Windows vs Linux On Security

e8johan writes "NewsFactor is running an article asking whether Linux really is more secure that Windows. I'd say that they miss to point out that Microsofts Office suite combined with VBA scripting makes Windows more insecure than anything I've ever seen, but they do make some good points, especially when discussing Open Source and security."

Comments

Security depends on many things.

[Anonymous MadCoe]

Which is more secure is such a hard question. UN*X is structurally more secure in many people's opinions. Windows also has the disadvantage that it has many clueless admins (even the certified ones). I think that's a big part here, any OS is as secure as the admin, a well managed Windows box can be more secure than a badly run Linux box... A propper comparison will be much more complicatec than this article.

Re:Security depends on many things.

[monadicIO]

Isn't it the job of a secure OS to prevent applications (however badly written) from royally screwing up things?

Re:Security depends on many things.

[tres]

With a properly designed and implemented system of groups, there's no need for ACLs.

Using SUDO beats giving ON or OFF Administrator privs to multiple people.

I'd say that gives UNIX a much finer granularity of control than NT.

NT 5 is catching-up with the "run as" command, but it's really only good for point-and-click administration.

more control == better security

Re:Security depends on many things.

[SerpentMage]

While that may be true, I think that is also what makes it more insecure. I have seen tons of documentation for programmers how to manage security. This means a programmer REALLY needs to know their stuff. In other words most programmers will not know their stuff. And as a result the apps are insecure. But the cause of the insecurity is not the app, but the OS because it is SO DAMM DIFFICULT.

While UNIX security may be simpler, it did not take me a huge effort to understand.

I use Windows and LINUX daily. My notebook is usually running XP and I have to say they screwed up security royally. The easy to use guides like "make available to shared users" actually opens your machine royally. The not shared locks everything done. But there is no middle. I had to go back to traditional NT security to twiddle how I wanted things.

Here is why I am gripping. I have a home network. And on this home network typically it is my wife and I. But sometimes I have friends come by with their notebooks. So they hook into my network. At that point I want per user security. Try to do that with the new "easy" to use XP security...

It all boils down to the same thing. NT has better security, but it is so DARN difficult that managing it effectivily is impossible.

Re:Security depends on many things.

[Asprin]

Isn't it the job of a secure OS to prevent applications (however badly written) from royally screwing up things?

Amen, I wish I had a mod point to give. Along similar lines, didn't CDC claim that BackOrifice uses the same standard API calls as MS's own SMS to provide remote access? On second thought, maybe and maybe not.

Either way, it seems to me that most of MS's security problems have less to do with the OS not doing it's job and more to do with the fact that MS has designed every one of their products to encapsulate (arbitrary) code inside their data files so their developers have easier ways to hammer out apps.

The problem is that the same scripting engine that lets Word (usefully) puke out mailmerged documents generated from a VB/Access app also gives virus authors a platform to attack. The fact that it's useful to combine code with data just means the platform is now ubiquitous, and therefore not going away because this is a fundamental design issue, folks. MS did this on purpose to make it easier to get computers to run code, and it can't be fixed by patching holes.

To really fix this, MS would have to renounce this entire experiment and replace every copy of Win/Office/IE with new software that is less 'capable.' Those of you who are paying attention probably now understand Mr. Valentine's comments of a few weeks ago, as well as Microsoft's interest in shoving Palladium down everyone's throats.

Re:Security depends on many things.

[Ed Avis]

The OS can compartmentalize resources so that if one app makes an illegal memory access, it doesn't crash the machine. The OS can limit access so that if one server is compromised, it can only screw up its own files and not the others on the box. NT does both these things (the latter with the ability to run a server as a particular user). However, no OS can do anything about deliberately stupid applications which choose to execute scripts stored in documents, for example.

Well, I suppose it would be possible to run Outlook under its own user account or with a reduced set of permissions, so that it could access only its own mail spool and not the rest of the user's files. But that would really get in the way of typical usage. Perhaps if there were some way to allow small extensions of permissions a la Java ('Outlook is trying to save a file c:\foo.doc. Do you wish to allow this?' and press Yes if it's something you asked for, No if it looks like a worm doing something nasty). But AFAIK no desktop OS has ever done anything like this; all desktop apps run with the uid of the current user and have full access to his files.

When developers make moronic decisions like auto-executing scripts in documents, it is not fair to blame the operating system. It is not so much Windows as the crap which festers around it (albeit coming from the same company). You don't hear about too many exploits in the Windows FTP server program (although surely there are some). Why not? Because FTP is a standard protocol and Microsoft haven't been able to set their monkeys loose on it and add insecure extensions.

Re:Security depends on many things.

[Karellen]

Compared to ACLs, the UNIX model of a single administrator with r00t access, and `everyone else', is simple. Very simple. The `setuid on execute' (with root as owner) for small, auditable programs (such as `passwd' and `su') that do simple things to allow people to do things requiring root capabilities (write passwd file, change to another user (including root)) couldn't be made more simple and straightforward unless you tried _really_, _really_ hard.

And some competent sysadmins still get it wrong on occasion. It's rare, but they can.

Stopping determined attackers cracking your system is hard, even if you have all the latest patches. The more complex your system gets, the more chances are that you'll miss something.

The complexity of ACLs? I've seen the API docs(*) for them. That's just nasty. It's _too_ complex IMO for an admin (even a good one) be certain of getting it right all the time. I'll take the simplicity of the UNIX way. I'm more confident of getting it right.

K.

*(Well, I've seen the MS ACL API docs, but MS have a habit of creating really shitty APIs, so there may be a better way)

Re:Security depends on many things.

[electroniceric]

Well, I think you hit the nail on the head with this:

It's just that the Windows User Interface and Windows applications are written under the assumption that users have complete control of the machine.

AFAICT, in terms of usability there is a profound unsolved problem here, which is twofold.

One is that many (most?) end users just want to do stuff on their computer, and as such they _sometimes_ need to be the administrator, without really understanding permissions or security. Remember Steve Gibson's rant about how XP by default has raw socket access for all users (b/c they are root). Microsoft has opted to make them administrators all the time to avoid explanation to a million disinterested and disgruntled XP users why they can't install the educational software their kids brought home from school.

A second, deeper problem affects both *nix and windows. The most serious threat in a compromised system is the loss of data, most of which lives in userland. But at least as far as I understand there's no clear way to determine what code and data to accept. Convenience dictates that stuff from outside the machine will need to find a home on your machine, while security dictates that it should at best be data only, and no code. As we move into a more networked world, this balance needs to be reexamined and retooled over and over. But I don't see *nix making great strides in that area, frankly.

Article Summary

[Sabalon]

Security problems exists - it may or may not be worse in Linux than windows...keep your systems updated regardless.

C'mon...this was nothing but flamebait - nothing news worthy there at all.

About the only telling thing is the top line about MS turning towards spending $$$ towards security - perhaps that includes buying blurbs like this saying Linux ain't perfect either.

There's three kinds of lies...

[Jack Wagner]

Lies, damned lies and statistics.

Windows applications will always be less secure than OSS because it's much more complex and used by millions more users. This is the fact that tends to get missed by people who blindly quote stats that they don't comprehend.

Actually this is yet more hardcore evidence that the FSF and open source proponents need to shift to a more modern Extreme Programming model of development and away from their legacy "hacker working alone in a basement" methodologies. I've done this using a modified P2P client for real-time distribution of code amongst a team of 3 other coders over high bandwidth connections and it works out very nicely-even though we were all in different states at the time. It's generally known that studies have shown that teams of four can develop code one order of magnitude faster than 4 coders working separately and my experience backs that up.

This hits at the very heart of the Achilles heel of open source as it tends to be rather unprofessional and willy-nilly in it's approach to development and project management which was fine back in the early 90's but suffers from severe limitations in todays modern and complex software development paradigm. Sure they make more secure software becasue it's easy to make an Xterm secure and not so easy to make an giant enterprise ERP package secure. Lets see these "experts" comapare apples to apples sometime.

Re:There's three kinds of lies...

[rseuhs]

IIS runs less than 25% of webservers, Apache about 2/3.

But, IIS has the far, far worse security track record.

Re:Nice spin on the article

[N3WBI3]

Beyond this. The article refers to slapper, and the like. Many of which will not hinder a Linux system of your average user. How many people run apache with openssl on their system really? and of those people how many do not keep the revs up to date.

My home box has Apache, but no ssl I really dont need secure transactions that much, if I did I would keep it up to date just like everything esle I use. Now lets look at Nimda, what % of people on windows use outlook/outlook express, and of these how many would not keep their system up to date.

Point is one is a server deamon exploit (used by a very small % of linux servers (say 10-20% tops), and one is a mail client exploit used by a mojority of windows users (so there will be many oure out of date versions per capita)

Bug Counting Again...

[theBraindonor]

Yet again, we find an article that points to the significant number of Linux bugs going through BugTrack. The turn-around time for the patch in Linux is usually quite fast. Commercial software makers are starting to sue individuals for disclosing security vulnerabilities.

How many bugs for Windows have been swept under the rug? How many software vendors out there have patch security holes, and requested that their customers download the latest 'maintenance' patch?

Just ask some of the truly gifted individuals in security what they think of security through obfuscation.

Re:I trust Linux's security implicitly

[Charlton Heston]

I doubt the veracity of your story. The NSA has worked on a secure Linux distribution. The big laboratories were also pioneers on the Internet. They've had a lot of experience with that type of software development and your rubber stamp story doesn't fit in with that.

Depends on administrator

[hatchet]

I think that most of linux's security risks are there because of administrators. They should only run services and modules that are essential, but nothing else.
Administrators should have physical access to machine, so they can disable anykind of remote shell access. Do not run ftpd as root.. and so on. I think that would minimize security risks.

Re:I trust Linux's security implicitly

[netphilter]

"Linux is not being considered until the development model is safe."
Translated this reads: "I only know Windows so stop threatening me, for job security reasons we can't use Linux." Anyone that claims that the development model is unsafe is showing their fundamental misunderstanding of said development model. That would be the same as saying that the pharmaceutic industrie's development model is unsafe. It's essentially the same model. OSS allows for peer review, which ALWAYS makes more secure software. Look at crypto algorithms for another example.

What timing!

[Pedrito]

Just last night, a buddy of mine did a security scan of the Linux box I use at home as a gateway for my other 4 computers. The only security problem found was with the version of wu-ftpd that I'm running.

No problem, I thought, I'll just upgrade it. So, my first step was to download it from wu-ftp's ftp site, only to realize I was going to have to figure out how to build it (that was simple, except I kept getting two or three errors in the compilation. I'm assuming my gcc is out of date) and then how to install and replace all the existing stuff (I have no idea how, and I don't have time to learn it).

So, I figure I'll go to RedHat, download the RPM and just install that. Which I do. Ran RPM to install it, no messages, try to FTP in, still running the old version. Shut-down and re-start, same thing.

Folks, I know most of you are Linux fanatics, but if a programmer with 23 years of programming experience can't manage to upgrade a simple application in under 30 minutes, Linux will never make it to the masses.

There's nothing I'd like more than to see Linux replace Windows on every desktop. When Linux is ready. Frankly, I don't think it is, and I think it's still got a long way to go. Sorry.

Re:What timing!

[smnolde]

You need FreeBSD to get you out of RPM hell. It takes far less effort to upgrade software on FreeBSD than it does with any RPM-based lunix distro.

Getting out of RPM hell was the main reason I chose FreeBSD over lunix.

Re:What timing!

[Cytlid]

Folks, I know most of you are Linux fanatics, but if a programmer with 23 years of programming experience can't manage to upgrade a simple application in under 30 minutes, Linux will never make it to the masses.

Ok, I was getting ready to flame you for this... but after reading all the other replies, I thought not. I think the biggest problem people have, either on the Windows or Linux side, is living in a paradigm. Like it or not, you're most likely living in a Windows paradigm. You like the way it works, it's "easy" for you, you program in it. You promote and spread the Windows paradigm. The Linux Paradigm doesn't fit you all to well... I'm probably the opposite. Yea, I've been using Windows for years, and I'm used to it, but I honestly think I fit better into the Linux paradigm. (Read: if I were adminning a Linux server, trust it better than if I were adminning a Windows server.) I *know* I should hone my skills in Windows administration, but without really good (free, available) documentation... it's not possible unless I spend all kinds of money. Only thing I can hope for is to pick up tips from people I know are Windows Admin gurus. I think this whole debate is a matter of realizing where you stand. The people who see clearly in both paradigms will be the ones ultimately winning.

Re:What timing!

[timster]

The problem here is that what you were doing was not "desktop use", but for some reason you extend your experience to desktop use. What you were doing was clearly server administration. I don't hear anybody telling me that Windows isn't a good desktop OS because the DHCP Manager isn't intuitive (which it's not, unless you understand DHCP). Server administration is always going to require skills, and whatever other skills you may have you have no skills in Linux server administration.

As for your experience, you made a number of mistakes that anyone who knew what they were doing (as a Linux sysadmin would) would never make. First problem was thinking you should go to the wu-ftpd website and try to compile the software yourself. Unless you have some tremendous reason to do this, you need to go to your distributor in all cases, since their installations are customized in numerous ways that you have probably come to expect. Second mistake was expecting an RPM to restart the service for you (RPM's don't really go for pre/post-install scripts, see Debian for that).

The third mistake was the worst, as it totally ignores the whole purpose of your distributor. Development groups (like the wu-ftpd group) generally attach security and bug fixes to new versions, since they usually prefer to work on one codebase. However, your distributor should never upgrade you to a new version that changes any functionality unless you change the version of the distribution, since a given version is supposed to be stable. So, as every Linux sysadmin in the world knows, Red Hat doesn't just toss the thing into an RPM and throw it out there. Rather, they take their existing codebase (which as I said, is usually patched in several ways) and apply the security fixes to _that_. And everyone knows this because it is _clearly_ _documented_. If you are running a server (ftpd is not a desktop app) then you need to follow the security updates for your distro, which will quite clearly explain what patch level fixes what holes.

My advice to you is to either: remove all the server programs from your system and use it as a desktop user; hire a competent sysadmin; or spend the time yourself to become a competent sysadmin. Don't play end-user-with-a-server or you'll get burned, no matter the OS.

It's the user

[photon317]

The user makes all the difference. What software you choose to run, and how you choose to configure and audit things. How much care you give to security issues and how much knowledge of basic security you have.

However, if you are competent and security-minded, it is quite easy to make a Linux box extremely secure against all but the most directed and knowledgeable attackers, which are quite rare. If you run Windows, no matter how hard you try you're still gonna be fairly hosed. Some things just can't be fixed reasonably on that platform.

A user's standpoint

[InodoroPereyra]

Even though I contribute code every once in a while, my background is not in CS and I am not an expert in Security by any means. What matters to me is not whether open source solutions are inherently a little more or less secure than open source solutions. What really matters to me is what can I do to secure my machine .

Security holes happen for any development model, shit happens. With open source, GNU/Linux in particular, I keep an eye on security updates to my distro and that's it. Almost no effort if you use a friendly distro. Well, that and I check not to run services I do not need, use a firewall, etc. I know that as fast as a hole is found a fix will appear and I'll download new packages in a couple days. If I am really concerned I can compile and install in the meantime. Here is where the freedom meaning of free software shines.

Oh, and the title should better be "Open source vs propietary security". Old same old ...

ActiveX is...

[Arker]

Microsoft has worked very hard to make ActiveX an integral 'part of the operating system' - it's a pain to get rid of it even on older systems, and I don't believe anyone has even worked out a way to properly disinfect it from XP to date (if I'm wrong give me a link, litepc.com is still working on it, it's a tough problem.) ActiveX is also the very exemplar of security hole from the ground up. Despite all the lip-service given recently to the concept of security by Microsoft, this particular policy, by far the biggest cause of security flaws, has been intensified over time, not backed off from. This makes Microsoft systems and security antonymical.

Now there are some smart folks at Microsoft, I can't credit the theory that no one there understands what they are doing. The alternative, of course, leads to what may be denigrated as 'conspiracy theory' but in this case it seems reasonable, for the reasons stated above. What does Microsoft gain by making their systems inherently insecure? A rationale for the 'necessity' of so-called security schemes (that really don't have anything to do with security, but rather with centralised control) such as DRM. Flood the net with insecure boxes and then cash in later by 'solving' the problem in a way that makes you the effective gatekeepers of the internet. Now there's a business model with some profit potential.

pick(nit);

[Black Parrot]

> I think that's a big part here, any OS is as secure as the admin...

I would have said "the admin sets an upper bound on system security". The OS could still undershoot that bound.

Re: pick(nit);

[Black Parrot]

> Actually, the OS would set the upper bound on system security.

Actually-actually, they both set upper bounds on the system security. The effective security is the minimum of the two bounds. You can't get better than your OS offers, and you can't get better than your sysadmin offers.

The question is not Who? but HOW?

[Nicolay77]

Who is better, bigger faster? That doesn't help any community very much either.

What is good is to ask how to make actual systems better, to catch up faster with patches an so on.

My try:

Besides disabling unneeded daemons, automatic updating should be a priority for almost all users, at least for every desktop (not hardcore) user. MS would have that right if they weren't pushing EULA changes with every update. And checksums of packages would start to be a serious thing, not something we saw but ignore in the same web page as the .rpms, .isos or .exes.

But this automatic updating should be entirely configurable, because hardcore users, admins and so on can't rely on third parts to check the compatibility of every patch with the endless configuration they have done. Auto-update could be enabled in any vanilla system, and disabled per package with dependencies with a CLI and GUI tool.

Ohhh, and making sure that this autoupdate doesn't have any bugs too! (as far as possible). May be SSH and server keys in the .isos to prevent man in the middle virus patch attacks.

Just a though.

Re:Ramen, Slapper, Scalper and Mighty ?

[unixmaster]

apache bugs : Application problems, not OS problems, big difference.

openssh bugs : Application problems, not OS problems, big difference.

xchat & other programs bug : Application problems, not OS problems, big difference.

Linux kernel symlink dos vulnerabilty ( 1 vulnerabilty about kernel I have ever seen in 1 year ) : os bug

See if you think like that Linux has only 1 bug....

Re:Nice spin on the article

[frankmanowar]

I thought the article didn't really stack the deck at all, in fact, it was very favorable to windows - it actually legitamized it (you motherless whore). when a security flaw is discovered in linux, a community of people work together to release a patch while a company that issues a distro/release works on their own patches. MS sits on known security issues for years without addressing them, doing damage to their customers and user base. Linux users don't pretend that their is no problem running X servers (or ttdbserver.rpc for you solaris people, holla *^_^*), they come up with solutions. MS has finally gotten around to releasing patches as they come out - but what about inherent flaws in the OS that are unpatchable - like the Windows Messaging system?

No, Windows STILL sucks.

-Frank

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Clueless admins vs. byzantine systems and bad d

[GigsVT]

Playing devil's advocate here but....

MS could have documentation that is just as good, and contextual like a squid conf file.

The problem is that people stop clicking the question mark cursor (contextual help) after doing it about 10 times and getting "This is a text box, you enter text into it" or "click the check box to toggle this option on or off".

So, IMO, it's not so much that they can't, it's that they don't.

Re:Geez

[Hayzeus]

Very likely the security reports mentioned about Linux also included any that were present on the applications that came with Linux, so how can you exclude security problems with pre-installed Microsoft applications. You can't have it both ways.

I'm not trying to have it both ways. I would no more include past problems with Bind, Apache or WU-FTPD when evaluating Linux security than I would MS-Office when discussing Windows security. Nowhere have I said that I feel windows is particularly more or less secure than Linux -- In fact, using BugTraq reports as a basis for comparison is a fairly clueless means of comparing OSs for relative security. Not to put too fine a a point on it, but comparing "Linux" to "Windows" is itself a meaningless exercise, since the two are not equivalent in any sense.

The bottom line is that (as mentioned elsewhere) the weakest link in any system from a security standpoint is the operator of the system, period. If you want to make any kind of meaningful comparison, compare Windows against a particular distibution of Linux with an emphasis on securability. How easy is it to secure the system? How effective are the means provided? Then you might have a study worth reading.

Microsoft Office

[tmark]

I'd say that they miss to point out that Microsofts Office suite combined with VBA scripting makes Windows more insecure than anything I've ever seen

That would be a good point if not for the fact that 1) Microsoft Office is not part of Windows, and 2) a lot more people would switch to Linux on their desktop if Microsoft Office (and not some pale imitation) were available on Linux. But it isn't, is it ?

Re:Nice spin on the article

[Blkdeath]

The thing is, cathedrals are inherently more secure than bazaars. This is in no small part due to the people that frequent each place.

Why, because they don't let anybody peek inside?

Because security through obscurity has worked out so well for Microsoft in recent years, hasn't it?

While there may be a significant number of vulnerabilities that have existed in Linux applications (a rare few in "Linux" itself, I might add), they're almost always fixed in a timely manner. More than can be said for our Cathedral competitor.

Moreover, the security model of even a relatively loosely secured Linux system helps prevent overall system damage and widespread deployment of such vulnerabilities. Consider the spread of CodeRed or Nimda compared to that of Slapper or Ramen. I'm no mathematician, but I do believe we're talking an order of magnitude in difference here. Before somebody reminds me for the umpteenth time that Microsoft is more widespread; let's concentrate on web server vulnerabilities. These guys disagree wholeheartedly.

Also to be considered is the sheer number of updates that appear on the WindowsUpdate site with no big uproar, and the potential number that are buried deep inside their service packs (104MB for XP, 106MB Win2k SP2 with a 17MB "security roll-up" and subsequent SP3, etc.). With atleast a quarter GB of updates to Win2k systems - that's a lot of fixes! The open source community is just a lot more ... open about the chinks in our armour, which gives statisticians a field day in coming up with reports and editorials about how bad off we are.

Of course, were I to deploy a mission-critical server installation running Linux, I still have the ability to audit the entire codebase (or hire somebody/a team of somebodies to do it for me). With Windows, that's apparently possible, in a small part, and at a very large price (I understand that enterprises can purchase large chunks of the Windows codebase for a few hundred thousand dollars, but don't quote me on it.) on top of the expense in hiring the programmers. This is not to mention the fleet of tens of thousands of eyes always staring at the code of larger projects day in, day out.

Of course I wouldn't install a GUI on my server - but does Win2k or WinXP give you that option? Of course not.`Microsoft's bread-and-butter is having that GUI shoved in your face at all times with the Internet Explorer icon emblazoned on the desktop and etched forever into the back of your retinas. The Windows Scripting Host and VBS support are all part and parcel with their Master Plan to have integrated desktops with unified interfaces (remember, Microsoft server administration is aimed at monkeys, not trained professionals. (Disclaimer: This isn't to say there aren't talented Microsoft administrators out there, only a comment on the target market of the Windows point-and-shoot interface for servers)).

Interesting to note, BTW, that Windows Professional and Server operating systems ship with RPC, Remote Registry Editing, Background Information Transfer Service (BITS), among other things enabled PER DEFAULT . Microsoft claims to be shifting their focus to security, but quite frankly, the default "Automatic" services list in Windows XP doesn't impress upon me a great feeling of security either.

Remember too that Windows (both the 9x and NT trees) were designed to be single user platforms (the NT tree coming from OS/2 - a single user platform) with multi-user support kludged into place. Only recently is there some form of organization as to where users store their individual documents and settings, but the de facto software installation course sees users installing things throughout the root of the filesystem still, because that's the way it's always been.

With a pretty basic set of hardening scripts (filesystem permissions, firewall rules, etc..) Linux can be made infinitely more secure than Windows, and I believe it will always be more secure if the administrator (behind both the Linux and Windows keyboards) are on the ball. Why? Because I believe OSS vulnerabilities will always be patched sooner, tested by a wider range of people, and applied sooner than the alternative closed-source Windows patches. Also, auditing a patch (diff) file is entirely do-able for one or two programmers in an afternoon - something that makes rapid mass-deployment of patches far more plausible, whereas in the Microsoft world the patch/update method is essentially "Test patch on several machines with similar configuration. If nothing breaks, apply it to the front-line servers."

Morality and security wise, I think I'll stick it out with Linux and let the statisticians throw around all the numbers they want. I'm comfortable right where I am, thankyouverymuch.

Re:Seeing Bugtraq postings about Linux...

[jandrese]

And sometimes only once, when the discoverer posts and then nothing from Microsoft. Heck, by this logic, the most secure system is the one where the vendor never ever acknowledges security problems, much less fixes them.

Re:Security?

[onion2k]

Most OSs can be made secure. Even windows. By a good sysadmin.

Unfortunately this doesn't say much for your dad.

The OS you know best will be the most secure.

[doodleboy]

I've used UNIX and Linux for close to ten years, and by now I have a pretty good idea how to do things in a secure and functional way. I've only had to admin an NT box once, and I migrated services off of it as quickly as I could.

Why? Not because I had any direct evidence of insecurity (this was before the real flood of NT vulnerabilities began), but because I knew I could do a better job with the tools I knew best.

But also:

- the NT machine tended to bluescreen every month or so for no apparent reason. The MCSE on staff was not overly troubled ("Oh I see the problem, it just needs a reboot"), but its flakiness did not fill me with confidence.

- the MS tactic of bundling the kitchen sink with the OS is just asking for trouble. Linux's modularity means you don't have to have a graphics layer on the server, for example, or any other unnecessary frills that provide opportunities for crackers.

- I believe the full-disclosure bug reporting model is orders of magnitude more responsive than what you get from proprietary vendors. Afaik, lots of reported linux bugs == lots of bugs get fixed because lots of people have access to the code.

- really excellent security tools are freely available: iptables, xinetd, snort, tripwire, nessus, nmap, chroot, etc. An interested beginner could make a linux server very hard to break into. I know {NT,W2K,XP} has more wizards and stuff, but is it easier (or even possible) to really see and control what's happening with the OS?

Several problems

[mfos.org]

1) The author cited as fact that the age of the operating system is directly related to its security, without any kind of proof. This makes sense at first glance, but it ultimatly glosses over the fact that both OSes are in constant development. New features are added every day. This might make sense if, after developing the system, all the time after that was spent patching and debugging, but this isn't the case.

2) The author has no concept of service vs. system. Most vulnerabilites are in sevices, not at the kernel level. All Linux is just a kernel. Packages are added to make a usable Linux distro.

3) The author cites number of bugtraq entries as a way of gauging relative security, without considering the severity. Also, bugs, like those reported to Security Focus aren't the only vectors of compromise

4) Open source software, by virtue of being free, allows an administrator to install much more security software for his dollar. Firewalls, IDSes, advanced cryptographic file systems, HIDS, and virus scanners can all be downloaded for free.

Re:Seeing Bugtraq postings about Linux...

[Blkdeath]

And sometimes only once, when the discoverer posts and then nothing from Microsoft.

I seem to recall a big uproar about Microsoft deciding not to further their efforts to release e-mail vulnerability/patch announcements, opting instead to have users frequent their websites to view the contents of the announcements.

I'm subscribed to just about every Security Focus mailing list that has anything to do with security, viruses, bugs, incidents, events, etc. and I really haven't even seen many (any?) "Visit this URL for details" posts from Microsoft. I'd have to say that they've gone quite mum in recent months.

Of course, when you stop announcing your vulnerabilities in an open forum, then threaten legal action against anybody else who tries to do it for you, that open forum will slowly start to tilt towards the other guys. Sure, Linux/UNIX application vulnerabilities (don't forget that Apache, Sendmail, and BIND still run on FreeBSD et al!) are more popular on the list - but that's because people aren't ALLOWED to publicize Microsoft vulnerabilities!

I know that recent MS EULAs forbid people from disclosing benchmarks relating to the ".NET" suite of applications without Microsoft's prior consent - is it feasible that they've buried something in there about vulnerability disclosure as well?

Windows vs. Linux security-wise

[fudgefactor7]

(Ok, so that subject isn't that great, sue me) ;)

I submitted this same story on the 11th and was amazed that it wasn't posted as it's an important debate, not to mention one that is extrememly volitile (which might be why it wasn't until now--get the Monday crowd, so to speak)..

At any rate, there have been tests done that disprove the OSS-is-more-secure model, basically stating that either style (OSS or Closed-Source) can be equally secure. We all know that. What I think is interesting is exactly how both camps go about the same thing (ie: security).

The OSS people find a bug, the author of the affected application is notified (probably by hundreds of affected people, or by bugtraq, or something like that, and he/she fixes the bug, releases a patch or new version and the world is more or less happy. (Some apps might not work, but then that's not the problem of the author.) Time from bug to "fix": about 2 weeks (at most).

Closed-Source people get a bug report, then they have to see where it is in the code, fix it (and here the similarities end) because there is (at least in the commercial business) a desire for backward compatibility and what MS likes to call "regression testing." Once that arduous process is done a patch is released. Time from bug to "fix": at least 2 weeks (unless your'e lucky.)

Really, the only thing I see different is the time involved, both bugs get fixed, but OSS doesn't have to test it with previous releases--the author only has to make sure it works on a "vanilla" install; whereas someone like MS has to make sure that it doesn't break anything going as far back as, say, Windows 98. (Which is pretty far back in computer time.)

I think the real way to describe it is that OSS is made secure faster than Closed-Source. Speed being the essence, that's the rub. If I want security I'd like it now, not later.

With the exception of OpenBSD

[flinxmeister]

Almost nothing is routinely secure "out of the box". And even OpenBSD has had its share of black eyes.

It's not a question of "How secure is it"...it's a question of how securABLE it is. IIS is securable, so is Apache. The problem with IIS is that it's usable by the low end of the technical spectrum who don't know or don't take the time to secure it. People who use *nix/*nux and Apache are almost techies by definition. They generally have the attitude to secure their boxes.
The irony is that with a flurry of points and clicks, IIS is easier to secure than Apache. However, nobody does it.

Re:Flamebait indeed

[jedidiah]

He knows well enough to be aware of what has actually been exploited. The article is infact a "Fear mongering" piece. It presents only the information that the author wishes you to see. It is clear the author has an axe to grind against Linux in particular.

The author ignores the common pedigree that Linux shares with Unix. The author ignores the underlying design issues that distinguish Unix versus Windows in theory and practice. The author plays a naieve numbers game with the bugtrack figures while conveniently ignoring the fact that Linux is more transparent.

He also makes the absurd assertion that more vendors == less secure.

If anything, competition and diversity should allow for vendors of varying quality and priorities.

The real vulnerability

[SatanicPuppy]

What everyone seems to be missing is the difference in scale between a windows exploit, and a linux exploit.

Linux, if you hack a mail client you can send spam to people on YOUR mailing lists.

Windows, if you hack a mail client you can send mail to people on THEIR mailing lists.

Most times linux exploits get you the very lowest level of security access. Yea, you got in, but you hardly got root priviledges out of it.

Windows on the other hand, has several known and documented exploits that not only get you in, but get you admin priviledges to go along with it.

Linux is very protective of it's hardware access (As anyone who's ever tried to run games will tell you. =P). Windows, on the other hand, goes out of its way to make hardware access easy and painless, both to the user and the abuser.

Exploits exist for both systems. But which ones would you rather have to deal with?

Re:Nice spin on the article

[archen]

Of course I wouldn't install a GUI on my server - but does Win2k or WinXP give you that option?

Simply put windows just doesn't have much functionality without a GUI, and many MS tools absolutely depend on it. Aside from that, strategically MS must to focus on their GUI. Why? Look at the functionality of cmd.exe vs bash . When you take things to a CLI level, UNIX is far superior. And lets face it, many in the MS world are just afraid of the command prompt.

The Admin is as good as the Documentation...

[vrypan]

he has access to.

My experience is that it is really hard to find *good* documentation for advanced topics in the Microsoft world. (especially when you need it). I guess that there are good books out there, but when I needed information I was not at the bookstore.

On the other hand, Linux/Unix is very well documented. And when you hit the wall, you can always look around in the source code.

Panayotis.

I beg to differ

[Jeppe Salvesen]

In fact, pushing all the responsibility down on the user is a very bad way of securing anything. Most poeple care more about functionality than security. We as developers need to pay more attention to finding ways of implementing non-intrusive security. It may include more lines of code, but it will certainly pay off in how many of your users end up screwed by an exploit in YOUR app.

I'm just waiting and hoping for automated code audit for security. That would possibly be the greatest contribution to computer security since encryption!

Quick Comments...

[tqbf]

• The article lacks credibility. Security is a complex issue. There are very few organizations qualified to present it authoritatively. Who is NewsFactor? Who is Masha Zager? What is the "Informations Systems Security Association"?
• Ignores the worm gene pool. Several of the Linux worms cited use the same (uncommon) vulnerabilities to gain access to computers. Putting a different payload on the same attack doesn't make the "different worms" uniquely different threats.
• Newer != Insecure. SunOS is old, and insecure. djbdns is brand new, and very secure. Secure programming, and (more importantly) secure design, are new disciplines.
• Linux != New. Linux is new in implementation, but evidences the classic Unix security model. The Unix model is flawed, but not impossible. Win32 has a "better" design, but does nothing to make that apparent (in the same sense as Darwin doesn't make apparent its microkernel design).
• Bug Counting? Most Linux bugs are in packages. There are thousands of available packages, virtually all with published source code. Third-party QA teams at ISS and Network Associates can go make a list of 100 CGI programs, read bad source code for a week, and generate 15-20 new advisories. Very, very few of them will affect real, deployed systems.
• Still More Bug Counting! Linux sees more bug reports. Linux has published source code. An independant QA person can spend a month looking for a remote attack on Win32, come up with one, and coast on it for a year --- that remote hole will probably affect 80% of all deployed systems. To get the same cred, you need to find tens of holes in popular Linux packages. It is both significantly easier and more useful (to the reporter) to find numerous Linux-related holes.

It doesn't matter which one is more secure...

[kakos]

...because they are both insecure enough to be a hazard in a real world situation. If I want to run a secure box, I'll run a BSD (probably OpenBSD). One remote exploit in six years is a bit better than a new one every month (a trend both Linux and Windows seem to share). The only way to keep a Linux or Windows box secure is to patch it almost constantly. To be honest, that is a task that sysadmins don't want to be doing all the time. There are much more important things to be doing.

Programmer of 23 years vs administrator of 2 years

[Skapare]

This is why we should not allow programmers to moonlight as system administrators. As a programmer, of course I expect you to never, ever, code up a buffer overflow exploit. But please leave system administration to professionals who know how to do the job. A system administrator of 2 years experience or less (usually way less) could do this with ease and correctly.

Re:Nice spin on the article

[Blkdeath]

Um... so they total up to it, but I thought every service pack contained all the fixes in the previous ones, so it doesn't really make sense to add them up.

Assuming a business has existing Win2k installations, they would have had to apply each of them as they were released in order to be up-to-date. The only people who don't have to worry about all of them are new installations, in which case they would only need to apply SP3 (if it works for them - I've heard a number of horror stories).

Not to mention it's a service pack for several Windows 2000 versions (though similar, I'm pretty sure a Win 2k Pro only would be smaller).

Regardless, the codebases are doubtless very similar (just different branches for the additional functionality offered in each version). Enterprises would still download the entire service pack to apply it to each of their machines rather than performing the "express install", which is only "express" for one or two Win2k machines. When you have a dozen servers and three hundred workstations, one 100MB download is preferable.

Anyone have any numbers on how much a No-SP Win2k install really need to be up to date? (express download)?

I remember when I installed a vanilla Win2k Pro not too long ago, it took (using the express download from windowsupdate.microsoft.com) somewhere to the tune of 150MB or thereabouts to get the OS up to date (including IE 6, Windows Media Player 7.1, all service packs, security roll-ups, and security/component updates released after the roll-up).