Is Linux as Secure as We'd Like to Think?

man_of_mr_e asks: "With all the recent brouhaha about Blaster and Sobig, there's been a lot of talk about how poor Windows security is, especially compared to the Linux we all know and love. But is this really true? The website defacement archive at Zone-h shows that Linux accounts for 61% of the defacements in the last 24 hours (note, this figure changes, so it might be different when you view it). An analysis of the last few weeks of their archive shows a similar percentage of exploited Linux systems. Note also that the 'Unknown' category is rather high, and certainly contains at least some Linux systems, further increasing the percentage. Why is this? Are we just deluding ourselves about our own security? Could there be a Linux 'Blaster' just waiting to happen?" While "defacements" don't necessarily mean "root level break-in", sometimes getting your foot in the door is enough. If this happens, wouldn't Linux then be just as exploitable as Windows? Are there other reasons why the likelihood of a "Sobig" or an "ILUVYOU" would be lower for Linux than Windows?

Comments

Psychology plays a role

[Brento]

First, the user base for Linux is inherently more systems-savvy and internet-knowledgable than the Windows user base: it comes back to the old Linux-on-the-desktop argument. As long as you've got less systems-savvy users on a particular operating system, it will be more vulnerable to attack. As a result, people with more tech knowledge tend to also run a more secure system - just like my lawyer friends know not to let the cops search your car.

Anti-establishment psychology also comes into play: for example, you don't see anti-business graffiti on your local coffee shop, you see it at Starbucks. When people want to make a statement about animal cruelty and food, they often picket at McDonald's - not the local Mom & Pop restaurant. Why? Because it's perceived as cool to go after the big business. Writing a Linux virus isn't nearly as cool as taking down Microsoft. The recent viruses attacked Windows Update for a reason: to make a statement. Calling Linux secure because people love DDOS'ing Microsoft is faulty logic.

Re:Psychology plays a role

[Anonymous Coward]

Maybe skilled users make the difference, but not in and of itself. Otherwise we would expect to see heaps of security problems/viruses with Mac OSX boxes.

Re:Psychology plays a role

[__aagmrb7289]

True, at this point. But isn't the point that Microsoft IS the biggie out there, and Linux isn't, but we all (well, there is an assumption here) would like to see that reversed? If that's true, then your arguement is effectively null and void.

Re:Psychology plays a role

[Brento]

But isn't the point that Microsoft IS the biggie out there, and Linux isn't, but we all (well, there is an assumption here) would like to see that reversed? If that's true, then your arguement is effectively null and void.

That's actually the point: there are a ton of anti-Microsoft people out there who would love to see Microsoft go down in flames, and Linux take its place. Those people are more technically inclined. While I would never go so far as to say that Linux people purposely write virii to take down Microsoft, I certainly wouldn't say that Microsoft users are the guys writing virii to take down Windows Update. You don't bite the hand that feeds you, and I've never met anybody who was smart enough to write a good virus and simultaneously preferred using Microsoft Windows as his/her desktop OS.

Re:Psychology plays a role

[Hassman]

How so? The roles would reverse there and Linux would be the target instead.

He's not null and void...he's dead on.

There are so many examples of people attacking one corperation and supporting another...then when the roles are reversed, the people's opinions reverse. No one likes to see someone as successful as Bill Gates or MS...

Re:Psychology plays a role

[511pf]

People don't go after big business because it's "cool." People go after big business because it's visible. It gets their message across to more people. Big business is also a target because any change in business practices has a wide effect. If McDonalds increases their food safety standards, the change has a real effect on national food safety because of McD's sheer mass. In addition, other fast food chains will follow suit to avoid bad publicity. Going after McDonalds isn't "cool." It's effective.

Re:Psychology plays a role

[imbaczek]

Yeah, potential buffer overruns sit in places no one would think about (hence all those bind/sendmail/iss/rpc holes...) Except that a buffer overrun in a well-configured unix system won't allow your normal cracker to do rm -rf /.

Re:Psychology plays a role

[Anonymous Coward]

Writing a Linux virus isn't nearly as cool as taking down Microsoft.

Writing a Linux virus isn't as easy to write, or more likely easy to distribute widely.
But if someone could, props to them. That would be very cool. Probably pretty funny too.

Re:Psychology plays a role

[Dog and Pony]

the user base for Linux is inherently more systems-savvy and internet-knowledgable than the Windows user base

Or so they would like to think...

I'm not so sure. There are lots of those savvy and knowledgable people on Windows, just as there are lots of "k3wl, I'm so 1337 d00d, because I run Linux and not M$ Winblows" amateurs out there.

I think you'll find the average Linux user to know a bit more about computers yes, but to make the assumption that Linux users are "inherently" more secure users is just begging for trouble.

And furthermore, lots and lots of Linux users are most likely too confident because they are so savvy and knowledgable. Hubris is dangerous on any platform.

Of course, since we all want to feel special and look down on some other group and be "better" than them, that is not what people want to hear around here.

Re:Psychology plays a role

[Anonymous Coward]

I'm concerned that your assertion that the average linux user is more "systems-savvy" than the average Windows user doesn't fully address the situation. While the statement itself is more than likely true at this point (given the wide dispairity between adoption of Linux vs Windows on the vast majority of consumer desktop systems), it doesn't necessarily follow that Linux systems are more secure due to the higher skill level of their users. Indeed, there may be reasons to believe that a Linux machine operated by a relatively unskilled user may be less secure than a Windows machine operated by another user with comprable familiarity with the Windows operating system.

Consider that the actual technical skill level between a Linux user and a Windows user is not necessarily that disparate. Easy-to-use installation assistants have lowered the bar, so to speak, for use of Linux. This is obviously a good thing if one is interested in propagation of Linux as a desktop operating system, but it can be dangerous if installation programs rely on [possibly uneducated] user choices for configuration of, say, sendmail. I have seen enough misconfigured Linux systems to know that many users, especially when first introduced to the OS, are unprepared to deal with the complexity of setting up and maintaining a [what may seem to be] dizzying array of network services & applications. While it is fairly easy for a person with little or no preexisting expertise or experience to run Linux on their home system, there is no guarantee that that person is running it well.

Combining inexperience with the open invitation to play around with the operating system's most intimate details is a recipie for headaches in any case, as most beginner Linux users no doubt discover. However, when misconfigured systems are connected to the Internet the potential for real problems rises dramatically. As adoption of Linux as a desktop alternative increases, you can be *sure* that the user bases are going to resemble each other more and more, and when your grandmother is asked whether she wants to run such-and-such service, can we rely on her (or the installation wizard) to make the right choice?

j

Re:Psychology plays a role

[Anonymous Coward]

Congratulations on pointing out the exception to the rule

Re:Psychology plays a role

[johnnyb]

I think that Linux _allows_ the user to be more knowledgeable. it doesn't try to hide things as much. It may try to give you a simple interface, but hiding is not something it generally does.

Re:Psychology plays a role

[dnoyeb]

I guess you don't meet many gamers.

Re:Psychology plays a role

[Anonymous Coward]

hahaha... "First, the user base for Linux is inherently more systems-savvy and internet-knowledgable than the Windows user base: it comes back to the old Linux-on-the-desktop argument."

Have you tried Lindows or Mandrake or Redhat lately? They have dumbed the basic linux install down to the windows level. All the core apps come installed and they boot to X, which the user can learn quickly. These distros also install 50 daemons... which the user doesn't understand what they do or how to turn them off. I know people who have never seen a linux machine before who download a Mandrake cd, install it, and instantly think they are invincible because they are running linux.

Few home users linux boxes ever get patched or updated because it is a pain and actually requires effort. I would say a lot, if not most, linux in the home systems do not get patched from the time they are installed til the time the user decides to upgrade to a new version. At least Microsoft has made it easy for the average user to patch their systems. Get real, not all linux users are tech savvy. That's like saying all windows users are idiots... which is only naive and makes you sound even less reputable.

-Traid (2 windows machines 2 linux boxes at home)

Re:Psychology plays a role

[Anonymous Coward]

> First, the user base for Linux is inherently more systems-savvy and internet-knowledgable than the Windows user base...

Of course! That's why they chose Linux!

Re:Psychology plays a role

[traid]

crap, I wasn't logged in, anyway, that was me if you wanna reply.

Re:Psychology plays a role

[KrispyKringle]

You make a good point; one of the explanations I've seen for statistics similar to those the article posting cites (61% of defaced machines being Linux) is that when an amateur wants to set up a personal website on his cable modem, he doesn't usually install IIS. He installs Linux and Apache. When he wants a really basic comment board or CMS, he uses PHP-Nuke. For his e-mail server, he uses Sendmail.

Yes, I've ran into hobbyists running IIS for fun--by which I mean I discovered his CodeRed infected box on my network--but the cost of a Windows Server license is prohibitive of amateur use, even if plenty of people just pirate it. So in the end, the inexperienced users with no time to spend securing their boxes turn to RedHat with Apache and Sendmail. Which isn't necessarily a bad thing. If I had to choose between Linux or Windows for which to leave alone without regular maintanance, the choice is pretty clear.

Re:Psychology plays a role

[I_redwolf]

Ugh.. this is so inherently based on faulty logic itself that it's beyond the scope of a comment to explain but I will try.

Unix and Unix like systems are based on a simple and easy concept when it comes to security. That is, if you don't have what is known as "root" you don't get to do any damage to system resource files.

Windows operates on an everyone is root notion, allowing anyone to make changes to system resource files. Not only that but because of the way Windows is designed where everything is mashed together, when one card falls so does the whole deck.

Unix and Unix-like systems operate on one tool for one job and with inventions like the pipe and IPC ta whole host of new functionality becomes capable just by passing output of one program to the next.

That's as simple as I can possibly explain it. I'm not saying Linux is the most secure thing since sliced bread, I'm simply stating the facts, and the fact is that Unix and Unix-Like systems tend to be more secure because they were DESIGNED that way. Windows was not designed with security in mind and the fact is that it is less secure.

All the other linux virus writing is less because windows is so prevelant hippy bullshit I'll save for PHB's. If you really believe that I've got an SCO license to sell you too.

Re:Psychology plays a role

[neura]

While Psychology might play a role, I think you're off on the wrong track about it.

The psychology of "hit the largest target, make the most amount of noise" is amplified by the simple fact that most windows boxes are configured almost identical as far as security/exploits go. *nix on the other hand, especially Linux boxes have a really wide range of configurations. Each distribution version has a new set of binaries with it, different distributions have sometimes largely varying tools, sometimes even tools unique to that one distribution.

So considering *nix as a target comparable to Windows is a mistake. You're really comparing lots of little targest to one huge target made of almost completely uniform installs (as far as most of the recent exploits go anyway).

Also, look at the number of windows developers in the world compared to the number of *nix developers for all distributions as a whole. I'd be willing to bet there are a considerable amount more Windows developers. So even if you just took a random sampling of developers and looked for ones willing/wanting to write virii, you'd probly hit more Windows developers. Which, I think the uniformity of "The Windows distribution" itself makes for a more attractive development platform to a lot of people. Write your software once, sell to a LOT more people. (instead of writing for say Solaris and porting to a bunch of other *nix platforms and possibly Windows)

It's all about the logistics.

Re:Psychology plays a role

[RedHat_Linux_Man]

But if MS and Linux are reversed, Linux will be harder to take down because:
1)It is not dependant on any one company or cash flow(or ANY cashflow at all)
2)It's open source, you find a bug, it's fixed in the blink of an eye because anyone can view the source
3)Linux was designed as a secure multi-user system-- unlike Windows

Re:Psychology plays a role

[Malc]

Rubbish. My employer bought a company that was deployed on RedHat 7.0. We are a MSFT only shop. Let me tell you, those RedHat servers were in worse condition than our Win2K boxes. The servers have been exploited as spam relays (very old formmail) amongst other things. It's pretty bad when a software engineer (me) has to come in and get a server running properly due to the incompetence of the IT staff. They had all kinds of stuff installed that should never have been there. They never cleaned things up. Based on that, I would say there are probably other Linux boxes out there administered by idiots.

Re:Psychology plays a role

[Shinobi]

Yes, Unix was so designed with security in focus that it had to be bolted on..... And don't forget that we have the Unix world to thank for worms in the first place.

Re:Psychology plays a role

[jedidiah]

Unix is simply designed and developed much more with security and securability in mind. The Linux kernel has had a network packet filter as a standard feature for at least 8 years. This provides a rather effective first line of defense against problems of the kind that Microsoft users have been suffering of late.

Should a particular service on Linux come to be a similar sort of problem, every neighborhood guru will be able to instantly provide "patches" that are an effective workaround.

Can the average WinDOS power user come up with a script to disable Win32 IPC off the cuff?

This is not something that Windows power users are expected or encouraged to do. Thus it becomes more difficult. Even slowing down a virus can help prevent propagation.

Windows does nothing to encourage tools or practices that can easily be deployed as roadblocks to malware.

Re:Psychology plays a role

[Anonymous Coward]

I guess you approve with Microsoft's action versus OpenGL too...

They quit the OpenGL group because gamers would love Linux as a gamers' platform.

Re:Psychology plays a role

[sloppydawg]

When opening up the psychology pandoras box you have to be careful. Using psychology in combination with statistics has to be one of most 2 edged sword when used in an deductive logic argument (as well as the most foolish).

Firtly, defacement with psychological influence will happen mostly based on the type of content the site is hosting rather than any bias torwards the OS running. Granted if OS 1 is less secure than OS 2 that many more people will succeed in breaking into said site. But you must also consider attempts. Say the internets top 1000 most likely to get defaced (based on content) web sites run 80% Linux and 10% Windows. What would the results show? No matter how you cut it if these factors were distrubed in this manner linux would come out as being more defaced than windows unless linux was 700% more secure than windows.

Now for those hackers that do use the OS the site is running as their primary motivation for target selection how do they psychologically decide which OS to target? Are they motivated by a challenge so hence pick a more difficult target. Are they motivated by animosity torwards the assoicated corporation of the OS and pick MS? Are they influenced by the OS they are running and hence pick the OS for which they have the most compatible tools at their disposal? You see playing the psychological card here leaves you with an empty hand since I doubt you've done all the needed statictical gathering to answers the questions posed above. You see psychology is indiviudual staticstics are collective they don't fit together into a cohesive argument easily. While the two can be used toghether if all the pertinent factors are assessed to thrown them toghether as you and this entire post has is simply foolish.

"There are lies, damn lies, and statistics." - Mark Twain

Re:Psychology plays a role

[Zemran]

Or could it be the fact that if you want to hit a web server it is more likely to be Linux and if you want to write a virus that will attack mail clients Outlook is the most common?

I speak as a Linux fan but I think that when Linux gets into the mainstream there will be more malicious attacks. Outlook is an easy target for the reasons we all know but if Evolution became the most common client you can be sure there would be virii written to exploit it.

Re:Psychology plays a role

[siphoncolder]

It's not that savvy Linux users are better or more secure than savvy Windows users.

It's that there are magnitudes more pitifully UN-savvy Windows users than there are pitifully un-savvy Linux users. This is a generalization that I'm sure will hold true despite the fact that your grandmother uses Linux at home no problem.

This is also probably a factor in the fact that Windows attacks tend to be so much more damaging than Linux attacks - larger, more corporate user base than the Linux crowd, therefore a giant target.

Re:Psychology plays a role

[Cloud K]

"there are lots of "k3wl, I'm so 1337 d00d, because I run Linux and not M$ Winblows" amateurs out there."

Indeed.

If anyone wants a good example, check out some of the comments over at my old haunt (still a haunt for amusement in a way): betanews.com

Re:Psychology plays a role

[Anonymous Coward]

Bolted on?? Care to explain?

Re:Psychology plays a role

[Anonymous Coward]

Yeah, most M$-H8ters aren't really MCSE flunkouts, and only stupid people like John Carmack run Windows.

Re:Psychology plays a role

[Anonymous Coward]

That's because there are more users of Windows than Linux. The fact that there ARE more Windows users automatically makes the group of un-savvy people larger because the group is larger. Linux users are a smaller group, therefore it is unfair to say you have more savvy users than Windows. Also you have to keep in mind that most people who run Linux or any operating system for that matter don't really understand OS architecture. Most people buy redhat at Comp USA install it and leave it alone.
They just want to be part of the in-crowd, their boxes get owned first. Linux users just need to face the fact that Linux sucks on the desktop. And no amount of "well you don't need that" or "you can do without this" is going to save you. Time to stop acting like children.

Re:Psychology plays a role

[Nathaniel]

"Based on that, I would say there are probably other Linux boxes out there administered by idiots."

Certainly, nobody should argue with that point, but there is no reason to think that your testimonial example is representative either. Additionally, companies that are being bought aren't usually a great place to look for good examples, they've often done a number of stupid things to get where they are.

There are idiots everywhere. It hardly matters if those idiots run unpatched RedHat 7.0 boxes or unpatched Windows 98 boxes, they will all be compromised, if they haven't already been.

Re:Psychology plays a role

[Anonymous Coward]

Right -- Unix was desgined to be secure the same way a 1981 Chevy was designed to be secure; Honest people needed a key, everyone else just pushed down the window and hotwired it.

Re:Psychology plays a role

[NetworkImpossible]

Well, of course psychology place a role... that's almost tautological.

But... if Joe Windowsuser clicks on the EatMe.pif virus, the innate single-user nature of Windows means that that virus executes with all the juju it needs to steal the system. Every time. Whether Joe is the IT guru or the latest gormless area associate in marketing doesn't matter, because either way he can't protect his machine, except by not clicking on the malware.

If Suzy Opensource executes a Linux email virus, if such an animal existed in the wild for her to execute, it executes with Suzy's privileges. This means it most likely stays in its sandbox and doesn't make much trouble. Much less rewarding for the vandals that write these things, which leads to fewer vandals on this platform in a continuous spiral. The vandals go where the least effort makes the greatest splash.

It's no longer 1987 when everybody on the net was a good guy and I did everything as root. But all Windows users are de facto root all day, every day. If you run as root unnecessarily, you risk getting 0Wn3d. QED.

Re:Psychology plays a role

[Nathaniel]

Contrast this with propriatary systems. I'm finding bugs in things like BEA's WebLogic Server all the time, and I can barely get them to acknowledge the bug, to say nothing of fixing it.

Re:Psychology plays a role

[Zeinfeld]

True, at this point. But isn't the point that Microsoft IS the biggie out there, and Linux isn't, but we all (well, there is an assumption here) would like to see that reversed? If that's true, then your arguement is effectively null and void.

I can't say that replacing a Microsoft monoploy with a Linux monopoly looks like any advance to me. Linux development is still way behind Windows in terms of features, in particular security features. Security does not only come from lack of bugs, it is also a matter of support for security features and tight integration of those security features.

Microsoft has in the past done baddly on the bugs side of things, but in the area of support for security featurs it has no peer. Windows 2000 has PKI and Kerberos security embedded deep into the core of the O/S. Sure you can get add ons for Linux to provide features like an encrypting file system, but you don't get deep intgration so you end up having to choose between the encrypting file system and the journaling file system. Same goes for Kerberos, you can add a Kerberos package onto Unix but you don't get the same tight integration you get on Windows 2000.

The virus issue is also rather more complex than some make it out see Phill H-B's security blog. The basic point here is that to propagate a virus needs to infect an average of more than one new host each time it spreads. So it is much harder for viruses to spread on a platform that represents only 9% of the population than 90%.

The problem with all the Linux boosterism on the security issue is that many of the 'facts' being asserted are nothing of the sort. If you ignore toy O/S that do not use protected memory such as the Mac before OS-x and the Windows-95 flavors Unix has historically been no better than comparabloe platforms. OK so there are few security vulnerabilities reported in the UNIX core, but that is the same for Windows. Most security bugs turn up in server code running at application level. Sendmail has been considerably worse over its life than IIS.

The problem with the complacency in the Linux camp is that Microsoft shows every sign that it has the security religion now. The recent spate of Microsoft patches are mostly for bugs Microsoft themselves discovered during their code reviews. Windows 2003 now loads the way a secure O/S should - in installments starting from a minimal core functionality.

Sure Linux can keep up, but only if developers respond to the challenge rather than sitting arround congratulating themselves on how much better they are. That seems to have been classic behavior of previous would be Microsoft challengers who lost.

Re:Psychology plays a role

[Enonu]

If a user can install Linux on their machine, it implies the following:

* Isn't afraid of computers
* Willing to use a command line
* Knows what a partition/hard drive is
* Comfortable with various GUIs

Now, imaging a world where everybody had at least this amount of technical knowledge. It should be quite easy to instruct them about the concept of security, even if it only meant being wary of untrusted binaries.

I still know a few people who have problems distinguishing left from right click, and have a hard time double clicking. Prime candidates for people who systems are easily infected.

Re:Psychology plays a role

[Zeinfeld]

Yeah, potential buffer overruns sit in places no one would think about (hence all those bind/sendmail/iss/rpc holes...) Except that a buffer overrun in a well-configured unix system won't allow your normal cracker to do rm -rf /.

This is one of my pet peves when folk start blathering about how insecure Windows is. The buffer overrun is essentially an invention of the C programming language. Before C nobody thought of writing language compilers without bounds checking on arrays.

The answer to buffer overruns is not to try more care. The answer is to switch to programming styles and languages that prevent buffer overruns.

This is not too difficult even in standard C if you do all string handling through macros that are thin wrappers to the bounds checking code that Dennis Richie left out. A much better answer is to switch to C# or Java where the problem is caught by the managed code environment.

Re:Psychology plays a role

[I_redwolf]

What do you mean by bolted on? Elaborate please, also if you can recall the last time Unix was attacked by a worm on the scale Microsoft is attacked; let me know. Obviously in comparison, every week there is a new worm out for some Microsoft product.

To put this in perspective, Microsoft worms attack desktop space apps by breaking the server. If you happen to replicate this functionality on a Unix server you aren't going to be doing much unless you have root. Why?, again, it's because the design is simple, there is no voodoo magic to it. If you aren't root you don't get any privileges and if this is what you are talking about that has never been bolted onto unix. Encrypted passwords, ACL's, Kerberos etc etc only makes the above concept stronger.

You can come to your own conclusions on why Microsoft is attacked more. I don't know, I do know Unix is more secure and has proven itself so over many years.

Re:Psychology plays a role

[Anonymous Coward]

If that's the case Windows was designed to be secure the same way a family home was designed to be secure; Honest people needed a key, everyone else just hopped through the windows.

Re:Psychology plays a role

[cshark]

I think it's safe to say that Linux is inherently more secure out of the box. But then again, I've locked down windows boxes pretty tight in the past.

The thing to remember is that a bad configuration is a bad configuration, and as much as I hate to admit it, I've seen some seriously bad linux configurations before. There was one a couple of years ago that had everything running as root. I think it actually did manage to catch a virus by the way (yes there are a couple of them out there).

But what I love about Linux is that I don't have to treat a Nimda attack every time I install the thing. Windows usually ends up coming down with something serious in under 30 minutes on a default install. Assuming you're dumb enough to hook it up to the network.

So I was dealing with this problem for a couple of years and it occured to me that almost every virus uses tftp as it's transport method of choice. So I deleted tftp.exe, and I haven't had a virus with Windows since. Well, not a worm virus anyway.

Re:Psychology plays a role

[The Terminator]

But there is one point:
Even a more than average skilled Windows User/Administrator has no chance to really track down the reason of a failure. And there is nobody really telling him. Outside M$ there is nobody who has chance to inspect the sources - and from inside M$ there is nobody willing to explain (obviously).
I left out the programmer intentionally because it can only be a M$ employee.

OTOH the GNU/LINUX or xxxBSD user/admin/programmer has no problem to find help in the community. And when a hole is identified it will be fixed in very short time and the fix is published to the whole community. You don't have to wait for an official fixpack which is approved by the marketing druids.

It's the most normal thing in the world that security is process and not a static thing. To keep a system secure no matter which OS you use, you have to check and recheck and reconsider and adjust the settings continously. It's finished when you dump the System. There is no program without a fault if it consists of more then two statements.

M$ claims in most cases that the problem is in OSI Layer 8 even when it's obvious that it's a windows problem. ;)

CU

Re:Psychology plays a role

[DrSkwid]

1)It is not dependant on any one company or cash flow(or ANY cashflow at all)

It is dependent on one person committing the changes, anything else just isn't Linux

2) fair comment, doesn't stop it being vulnerable

3) if this was true there would be no root

Re:Psychology plays a role

[spongman]

Windows operates on an everyone is root notion

I'm not quite sure where you've been for the last 10 years, but NT3.1 and every version of windows based on it (3.5, 3.51, 4.0, 2k, xp, 2k3) has a comprehensive user security model that pretty much blows UNIX's traditional 'uga/setuid' model out of the water.

Re:Psychology plays a role

[Anonymous Coward]

John Carmack codes on a Linux box you fucking idiot.

Re:Psychology plays a role

[I_redwolf]

Really? Do you have any of those versions of Windows connected to the internet? If so, would you like to give me your ip? From what I'm aware of after a little buffer overflow, or crashing of one of your server processes I'll be able to do what I want.

Also when you say comprehensive user security model can you elaborate? IE: ACL's, chroots, jails etc etc. I find it hard to believe that NT3.1 and every version of windows based on it has a such a model. I don't use windows in any serious manner so I wouldn't know but I'd like to read about the models 3.1 and up use for comprehensive user security.

Re:Psychology plays a role

[xenoandroid]

I think your underestimating the inteligence of some Mac users, sure there are some dimwits out there (they exist on many OSes), but they were at least smart enough to not use Windows for something they can do easily on another OS. From what I've seen, there is a lot less common sense in the Windows community than there is for other less widely distributed OSes. Many will download and run anything in their email no matter how many times they hear "Don't download strange attachments and run them".

Re:Psychology plays a role

[CableModemSniper]

* Isn't afraid of computers
ok...
* Willing to use a command line
Not neccessarily
* Knows what a partition/hard drive is
As above.
* Comfortable with various GUIs
You don't have to be comfortable.

You'd be suprised at the number of non-techie friend's computers I managed to sneak various distros onto. (Mostly Debian). But its definitely reaching the point where if you don't want to think about most things you can pop a Mandrake or redhat CD in and click next a couple of times.

Re:Psychology plays a role

[mslinux]

Right on man!!!

We have a 'Webmaster' who administers a Linux Web server that has been hacked several times. We even had a visit from the FBI once because the server was doing funky things to whitehouse.gov, etc.

Our 'Webmaster' is a Mac fanatic who's a college drop-out ( he was a sociology major with a .75 GPA). He hates anything from MS... that's why he *attempts* to run a Linux server. He is dangerous, very, very dangerous and will one day be fired.

It's people like this who don't *know* what the fuck they're doing that causes servers to be hacked (Windows or Linux or any platform).

Re:Psychology plays a role

[Anonymous Coward]

Sometimes, sure, but he says his primary is Visual C++/Windows.

Re:Psychology plays a role

[Anonymous Coward]

Congrats, you got the point. This whole argument is like midget wrestling. Both systems basically suck.

Re:Psychology plays a role

[Kenja]

This is true if, and only if, the service is running as administrator (aka root). The same is true on Unix if a service is being run as root. So please, explain the diference and why administrator is so much more vulnerable then root. Is it becuase root has fewer letters?

Bottom line is that if you put ANY system unprotected out on the internet you are hackable. Hell, I recall when for some reason Sun shipped SunOS with a cd player set to run as root so it could write play lists where ever it wanted. Easy enough to have it create a play list that removed the root password from a guest acount.

Re:Psychology plays a role

[gfody]

but the cost of a Windows Server license is prohibitive of amateur use

IIS comes with win2000 and XP, I think it was even installed by default on 2000.

Re:Psychology plays a role

[I_redwolf]

No, that is NOT true. The service can be running as any user on windows and you can still gain Administrator privileges; that is the problem. If you don't believe it, try it. Setup a windows box and then break into it.

I remember when SunOS shipped with a broken login but then I'm not speaking about any specific manufacturer I'm talking overall design.

Re:Psychology plays a role

[Anonymous Coward]

Right, just that Unix usually sucks less.

Re:Psychology plays a role

[0racle]

Exactly.

First, with any platform that's being used, the system is only as secure as the knowledge of the person administering it lets it be. With OpenBSD nothing is on, but that may not be what the user wants so they turn stuff on, windows, prior to 2003, (2003 has improved upon this leaning towards its not installed till you say it is) comes with just about everything turned on, so securing it is just a matter of looking at it differently and making intelligent decisions.

Linux is actually an interesting platform when you look at this. Linux use is growing but its probably growing the fastest, outside of business's among the kids who run it thinking that simply running Linux makes them 'know computers'.

The first distro of choice among most people is probably Red Hat, it's the most known. Red Hat, in my opinion, installs and runs much more then it needs to, by default, I believe that NFS, DHCP, Bind, Apache, Sendmail or some other mailer, and who knows what else, is installed and *RUNNING*, of course all running as root.

However, these users, being not as knowledgeable as the red hatted penguin would have them believe they are, do not know enough to do anything about these and are quite possibly unaware that these are running. This situation is no different then windows installing and running IIS for no apparent reason.
Quite frankly I have had this argument with several people, its nice to see I was right.

Re:Psychology plays a role

[SamBC]

I feel you are either miseducated in the matter, or a very good troll - I'll assume the former.

The issue of whether or not things are 'integrated into the core' is a good example of the key design philosophy difference between UNIX-type OSs, and MS OSs, although I was given the impression that MS OSs were going more towards UNIX in this regard. The UNIX design philosophy is to keep everything seperate, with well-defined means for different components to interract. This is especially well epitomised by the HURD MKA (micro-kernel architecture), but is also seen in every UNIX-derivative OS. Kerberos is a bolt-on, but then so is the mechanism for user logins, and email, and command interpretation (shells). It is up to whoever sets the system up, be they a sysadmin or a distro maintainer, to 'tightly integrate' them as much as desired, thus allowing a UNIX/linux box to use NIS/LDAP/Kerberos/whatever as a cetralised authentication system. Many linux distros give the option of using a Windows NT domain as an authorisation service, if the user so desires.

However, I will agree with you on complacency.

Sam

Re:Psychology plays a role

[master_p]

I don't think you are quite correct, although I respect your position. Windows is as secure as any Unix. The Blaster virus exploited a bug in the software, not the lack of security. For example, now that my system is patched, the Blaster virus can't penetrate my system.

And Windows WAS designed with security in mind. Evidence for this is that many Win32 calls accept a security descriptor as an argument. If security was not in the minds of Microsoft engineers, there either would be no security descriptor or a lot of functions would have been replaced with secure ones.

That the Windows security model is more complex than the Unix model is no secret. It may take a little more effort to secure a Windows box, because it as a more complex security model. I can't tell if it is the right security model, or if the Unix model is enough.

Windows is the preferrable target for macro virii because these virii are written in Visual Basic script, which runs only on MS Windows. If Mozilla gets the capability of running scripts with the touch of a link, then we will see lots of virii for Linux. But not as many as for Windows, because the guy is basically right: Windows users are less technologically informed about operating systems and software, and thus easier to trick.

Please don't forget the famous Unix worm that plagued the system around 1988. At that time, there was no Internet, but the worm succeeded in spreading because the software had bugs. Imagine what would have been said if the worm was released today. Would you call Unix less secure then ? I wouldn't, even if most servers were hit by it. Because it is not a problem of bad security or lack of it, it's just a software bug that was exploited.

Re:Psychology plays a role

[nadadogg]

(very old formmail)
That's your problem there. You can't expect something that is "very old" to be secure. Nothing is going to be released in a perfect form. That's what updates are for.
And yes, you are correct in saying that the IT staff was probably incompetant, and any non-updated system is going to have problems.

Re:Psychology plays a role

[Anonymous Coward]

Windows does nothing to encourage tools or practices that can easily be deployed as roadblocks to malware.

Yes they do. But slashbots bitch about that also.

Re:Psychology plays a role

[HoldmyCauls]

I'm not saying Linux is the most secure thing since sliced bread

With apologies to the writers of "Friends": Ah, sliced bread; a fine server OS.

Re:Psychology plays a role

[Anonymous Coward]

linux virus writing is less because windows is so prevelant hippy bullshit

If all the Linux systems in the world were, e.g. RedHat 7.2, it would be more rewarding for the virus authors (known binaries, known file locations, etc.). There's a lot less homogeneity in the Linux world than there is in the Windows world.

Re:Psychology plays a role

[johnnorthwood]

There are so many flavors of unix out there that it is hard to find a flaw that is exploitable accross all/majority of them(unlike the M$ software which is often based on the same code NT/2000/XP etc ). At the kernel level anyway.

Both approaches have pros and cons. It appears the unix approach is working for virus/worm attacks. Reminds me of natural selection. Unix has many different flavors and thus survives a virus. Microsoft does not, and thus a successful virus can wipe it out the entire species.

Re:Psychology plays a role

[Anonymous Coward]

since we all want to feel special and look down on some other group

Pretty revealing statement, there... obviously, you wanna look down on slashdotters! :)

Seriously, though... part of the reason that I am slowly (ohhh, so slowly) moving to Linux is because I have been blind-sided by Windows too many times! One of my favorites is the day I logged into my Small Business Server only to find an ad on the desktop! Who would have thought that a LAN messaging protocol was left listening on the Internet? Knowing that, however, I would have damned sure bet that enterprising spammers would eventually take advantage of it.

The MSBlaster attack is yet another example of this AND M$ blew the first round of changes! They shut off DCOM services out to the Internet but left the server listening on the same port and vulnerable to the buffer overflow attack that MSBlaster used.

Part of the reason I am moving slowly to Linux is because I am taking my time; learning how each service works, how to turn it OFF and ON, how to configure it and building the system from source. M$ has proven themselves to be incompetent in both the detection of and the fixing of vulnerabilties in their system; not just once but many, many times. I simply cannot leave my security in their hands!

What's that quote from Scotty on Star Trek? "Fool me once shame on you. Fool me twice, shame on me!"

Re:Psychology plays a role

[Anonymous Coward]

Go onto your local *nix machine. Find *every* process that is run as root (either services launched by the root user or apps that are setuid). One vulnerability in any of those processes and you can go from being a user to being root on a system.

Jeez, you're all over this thread, trolling to the choir and turning a blind eye to general security issues that prevail across all operating systems. You're a fucking useless zealot and a troll, you know that? Privelage elevation is something that *any* insecure machine is vulnerable to.

Re:Psychology plays a role

[HiThere]

Much of the security of Linux can be established on a conservative MSWindows system with a few simple steps. (I don't know about more recent versions...since I became aware of the EULA changes I refused to accept them.)

1) Disable IE. Replace it by Mozilla. Choose simple HTML. no JavaScript or Java in mail. No remote image loads.

2) Remove SMS capability. In fact disable anything that could cause a file to autolaunch. Including booting from a floppy or CD.

3) Only have one user per system.

4) Keep backups.

5) Use a hardware firewall.

Note the "Only have one user per system"? In Linux if you are so foolish as to launch an untrustworthy email, you can only wipe out the places you have write permission. I'm assuming that this is just your home directory. (If you browse as root, then you'd better follow rule 3-5 even on Linux. Thanks, Lindows! [Yuck!])

The main securities of Linux are:
1) files don't autolaunch themselves. (Until some distributions began using an automount daemon. Bad idea! Come up with some other way to make it easy to mount a CD.)
2) By default you can only destroy your home directory. Unless you're root.

These combine to mean 1) the damage you can do is limited, and 2) you need to take explicit action to put yourself in danger of damaging yourself.

Beyond this are the exploits, but both systems have those. It's reasonable to assert that the MSWind exploits are worse and longer lasting, but it ain't necessarily so. Some Linux users are just as careless or unknowing. And I presume that somewhere there are MSWind users as knowledgeable. This is less certain, because of the cloaks of secrecy within which MSWind is wrapped. So they may really NOT have anyone who is truly knowledgeable.

Re:Psychology plays a role

[agendi]

Oh please.

I've been biting my lip because I think windows vs linux rants are a waste of time but here is my contribution to the big dump.

When I was at Uni, we used unix (Solaris in fact). There may have been windows boxes somewhere in the faculty, but I don't think anyone touched them. Even in our first year we were writing trojans and hacks to try to steal each others passwords and write silly titled files in the system directories. It was sport. If someone annoyed me I'd know how to bring their machine down. In fact I brought one of the undergrad servers down - it's not special, it was stupid, but it happened regularly as we were all really learning about the system.

The point is that if a person is motivated to do something they will probably find a way to do it. Motivation is the key. Previous posts have mentioned the "cool" factor in bringing down MS, I think that is undeniable.

Before anyone says "But your Uni system wasn't secured properly" to that I say "exactly" - I am sick and tired of people talking as if security is something tangible that it's something you have or your don't - depending entirely on the OS. Security is a process, it's a matter of discipline and habit. A poorly admin'd box is a security risk no matter what OS runs it.

Another thing that I have witnessed in the business world is that you get the savvy Lunix Guru walking into a network or admin role and be "too good for it" and while they can tune a linux box to perfection, they don't give a rats arse about learning more about the windows boxes. Soon as there is something wrong with the windows box the reply is always "It's a microsoft product what do you expect?" to that my reply is "I expect you to do your job". I dispise the mentality that a IT person is allied to a platform and not to the best tool for the job. It cuts both ways, for every linux nut I meet that wears the penguin goggles there is an equally nutty windows pin head that will even try to deny the existance of linux.

If IT professionals start burying their head in the sand about other platforms, then what hope do Users have?

Re:Psychology plays a role

[Ro'que]

I've never met anybody who was smart enough to write a good virus and simultaneously preferred using Microsoft Windows as his/her desktop OS.

Looks like you need to get out more, then. That's a pretty broad and ignorant statement. Equally broad and ignorant statement: "I've never met someone who has been laid and simultaneously preferred using Linux as his/her desktop OS."

No, that's not how I feel. Yes, I do support Linux and the open source movement, but I don't believe in unreasonable and illogical statements against the opposing "camp" like claiming that not one of the millions of Windows-by-choice users are smart enough to write a good virus.

Re:Psychology plays a role

[Anonymous Coward]

Wow, look at that. I haven't even spent 15 minute since the previous post and I found that there are even more ways to gain elevated privelages.. Specifically, kernel bugs.

http://www.debian.org/security/2003/dsa-311

http://www.debian.org/security/2003/dsa-311

Here's a little quote:

CAN-2003-0127: The kernel module loader allows local users to gain root privileges by using ptrace to attach to a child process that is spawned by the kernel.

Now, will you get off your high horse and join the rest of us in the real world?

Re:Psychology plays a role

[I_redwolf]

I don't think you are quite correct, although I respect your position. Windows is as secure as any Unix. The Blaster virus exploited a bug in the software, not the lack of security. For example, now that my system is patched, the Blaster virus can't penetrate my system.

This is an illustration of my point, trust me when I say I understand where you're coming from. Also I wasn't speaking of the MSBlaster virus, Code Red, Nimda etc. However, I respectfully disagree with the above and it's a typical ideology that is used to refute my argument. The problem with it is simply, you had to patch your system to prevent it's abuse; that's a security issue. I didn't, your system wasn't designed for security or windows would not allow scripts and macro's to be run. Now, let us subtract the application software faults all together, lets say those don't matter. You haven't mentioned the large amount of compromising situations that can be caused with turning everything off!! You don't even begin to break the surface, this is why Microsoft themselves has started to approach security differently, albeit slowly. Personally, I don't know anything about MFC, C#, Windows programming and whatever those security descriptors or guidelines are they aren't being used.

Another point, Mozilla could never have the capability of running something via a script and even if it did, it would have to be made executable to run in the first place. Still for all that the damage would be less than that of a Windows system if the user wasn't running as root. IE: The script would have to be made executable by the website somehow, it would be automatically run and try to rm -rf / and get denied. The most it could do is take out the users home dir. It's a practice in futility.

As for the Internet Worm incident, it was a networked worm that exploited fingerd and some other utils. There was an internet back in 1988 if I recall correctly, I was only 9 but played around with it briefly via an IBM engineer on a vax machine. What's disheartining is the fact that maybe someone out there is running such an old copy of Unix that they still run whatever version of fingerd and the other util programs waiting to be exploited. It'd be like someone running Windows 286 still; it's possible but I haven't heard of the Internet Worm of 88 infecting many Unix systems. Should look into that maybe.

Also a software bug, that is exploited to gains means and privileges on a system you wouldn't originally have privileges on is a security issue. You can just call it a software bug if it makes you feel better.

Re:Psychology plays a role

[Tony-A]

the user base for Linux is inherently more systems-savvy and internet-knowledgable than the Windows user base

Probably, but methinks its more fundamental than that. The "magic" is that Linux users should be much less gullible than Windows users.

We're running an NT domain, Word, Outlook, Excel. Unpatched except for service packs ranging from 3 to 6a. Anti-virus only on new computers, where it has been disabled as soon as it gets in the way of anything. A user base nowhere near "systems-savvy". Very few hits, and those few come from the more "systems-savvy". I clean up ONE SoBig whatever and I (still) think it's funny. (I got some good help on that one. Bounce from a Linux machine that was kind enough to return the headers.) My system is extremely insecure but my users are not gullible. Next year they'll still be doing fine while "everybody else" is scrambling trying to play catch-up.

Re:Psychology plays a role

[icepick]

Sure if you don't mind the concurrent 5 connection limit.

Re:Psychology plays a role

[Zeinfeld]

I feel you are either miseducated in the matter, or a very good troll - I'll assume the former.

Lets see, I have worked with eight Turing award winners, I have designed operating systems, databases and security systems. I am the editor of several current standards. I have no need to troll. Sounds like your definition of 'miseducated' is 'holds a different idea to me'.

The issue of whether or not things are 'integrated into the core' is a good example of the key design philosophy difference between UNIX-type OSs, and MS OSs, although I was given the impression that MS OSs were going more towards UNIX in this regard.

I am probably better informed about the state of MS security system design than any other person who does not work for them and is not a contractor. You are wrong in this assertion on two counts, first the extreme modular nature of Unix has historically been considered a security weakness, second Microsoft is not moving towards Unix. Windows NT has always been a micro-kernel design.

The problem with the bolt on approach is that there is no consistency of use in the Unix framework. You can add Kerberos but you have to separately Kerberize every application. Same for integration to a domain server or any other infrastructure.

The problem is that Unix is not really a modular architecture, it is a patchwork quilt. In a true modular architecture there is one interface to the security subsystem and a sysytem installed there will affect every application. Unix simply does not support that type of interaction. The fact that it is composed of separate modules is irrelevant, all O/S are written as independent modules. The issue is whether those modules interact in a coherent manner or an incoherent one.

Unix regretably flunks that test, although propagandists will try to deny it.

Re:Psychology plays a role

[deputydink]

whoah dude, that first sentence was amazing. i just spit my miso soup all over my monitor.

"almost tautological" ... thats the most sensible thing i've read all thread.

You're making my fan list.

Re:Psychology plays a role

[Anonymous Brave Guy]

Unix is simply designed and developed much more with security and securability in mind.

And yet typical Linux installations from the major distros don't do much to, for example, stop you getting root once you've got some system access. The last machine I know was rooted was a shared Linux box, running Apache, that had a dodgy CGI script on it. And yes, it's run by people who have a clue what they're doing, and have since taken steps to fix that problem. But it was still rooted.

Can the average WinDOS power user come up with a script to disable Win32 IPC off the cuff?

The average Windows power user doesn't suffer from MSBlast etc. any more than the average Linux power user, because the system will be patched, running a personal firewall, etc.

Windows does nothing to encourage tools or practices that can easily be deployed as roadblocks to malware.

Oops, it seems I've been trolled. Sorry guys, my mistake.

Re:Psychology plays a role

[mindriot]

The other question was, "Are there other reasons why the likelihood of a 'Sobig' or an 'ILUVYOU' would be lower for Linux than Windows?"

They are a little lower, because:

• Holes that allow email attachments to executed automatically practically don't exist (no execute rights, hardly any scripting support in mail clients for potentially malicious programs).
• The trick "please open the attached file" will not work for the same reason, basically (no execute permission, need to save it first, chmod, then execute it)

So, most of those social-engineering kind of attacks will technically not work, unless somebody manages to convince you to do the whole save/chmod/execute procedure to start his worm. Which I think is rather unlikely. That leaves us with attacks through software vulnerabilities. As said, there hardly exist any in MUAs, which means that exploits for running services must be used. Given a higher popularity of Linux systems, new exploits are likely to be the cause of an attack much quicker, and we would of course see more malicious programs.

But would that be a problem? This concerns server systems which are at least a bit safer that Joe Schmoe desktop computers for their (hopefully) better maintenance. By the time a distro for true mass use of Linux appears and gets installed on, say, 25% of all home computers, we can at least expect a better patch availability for remote exploits, and probably a whole community of geeks working harder to avoid big holes. I would even expect that better default settings for services and firewall settings could be expected.

Of course, if some company puts out that Linux and ends up being very popular but very careless, this could be a problem and would most likely shed a bad light on Linux-based systems as a whole. That is clearly something to be avoided.

Re:Psychology plays a role

[Anonymous Coward]

Did you just count the amount of times you saw root and the actual processes running orrrr are you just trolling? Most of the processes running as root have to do with the filesystem and actually starting the system, flushing files on and on. Don't talk out of your ass it makes you look stupid.

Re:Psychology plays a role

[Anonymous Coward]

You fanboy fucknuts -- Carmack has stated, time and time again, that the development tools on Linux are sheeit, and that Visual Studio is his favourite. Keep your religious claptrap to yourself.

Re:Psychology plays a role

[mfchater]

Well said, I hate to even get involved in this never ending war, but you have a great point. I somtimes sit back and think what /. would be like without the daily ms vs. linux argument. just my 2 cents... again

Re:Psychology plays a role

[Anonymous Coward]

All trolls should be like you.. find an old kernel.. bitch about stuff that's long been fixed and wasn't even remote. Yeah, you made your point.

Re:Psychology plays a role

[Anonymous Coward]

A few corrections:

Windows does NOT operate on a everyone is a root notion unless you're running 3.1-ME version. Mac OS Classic does however, but manages to let people learn where they can muck around and still maintain itself as a secure OS because of the lack of shell.

Windows NT based variants lets most home users run as Administrator which is almost equivalent to root but not quite. The System is an 'account' of sorts that gives higher privs than Administrator....and it also the target of many worms/virii/trojans to make it a pain in the ass to remove because the virus has high privs than the admin does.

Re:Psychology plays a role

[SamBC]

The problem with the bolt on approach is that there is no consistency of use in the Unix framework. You can add Kerberos but you have to separately Kerberize every application. Same for integration to a domain server or any other infrastructure.

Unless, of course, you use PAM

Sam

Re:Psychology plays a role

[Geek of Tech]

Security wasn't to big of an issue with me. I decided to end my abusive relationship with Bill with the release of XP. I don't want to have to activate windows. I don't like the straight-jacket EULA. I also got really annoyed that they kept changing file formats for what I believed to be vendor lock in.

I didn't mind the way Windows was coded. I got tired of getting slapped in the face by Microsoft's lawyers. That's why I switched to Linux.

Re:Psychology plays a role

[AstroDrabb]

Tell me about it. I can't stand BEA Weblogic and the People Soft Portal we have running. It was the biggest mess to develop with. We are switching all of our other J2EE servers to Oracle 9iAS, and I hope that is much better. I have sent in bugs/complaints to PeopleSoft and I think it just goes to /dev/null

Re:Psychology plays a role

[Malc]

Formmail came from somewhere else. Somebody had had a clever idea about using it, and then forgot about it. At the time, none of our stuff even used it. Formmail has been plagued by security holes over the years. The version they used already had warnings all over it on the formmail web site for more than a year or two when they installed it. Those people should have known better. I really shouldn't be running up2date for these people, even though it wouldn't have fixed formmail either.

Re:Psychology plays a role

[Bingo Foo]

The Blaster virus exploited a bug in the software, not the lack of security.

And hence we see how informed and insightful this Windows apologist is....

Re:Psychology plays a role

[Anonymous Coward]

Except while John Carmack is rolling in the dough from being such a brilliant programmer, you are stuck making ad hominem attacks under anonymous coward.

Re:Psychology plays a role

[Tony-A]

Unix is simply designed and developed much more with security and securability in mind.

From an old fart, I gotta take exception to that.
The design is from Multics, which is arguably secure, down to something that is doable on a departmental minicomputer. The design doesn't preclude some degree of security but all the emphasis is on getting something useful done. That said, Unix probably does manage to get the most useable security out of the fewest bits theoretically possible. I suspect that Unix is as simple as it can be and have any pretense to security.

NT does have security "features". It has lots of them, and they take lots of bits. They are stuck in strange places. If I have a lot of files to manage, I will not be using those features. I do a DIR. I see date and time and file size. No security information whatever. Must not be important.

Unix, if I do just an ls, just gives back the file names. If I do an ls -l to see dates and file sizes, back comes a mess of x's and hyphens. Must be important. Further, these are in my face every time I'm looking at files.

Multics was designed to be secure.
Unix wasn't.
Windows was designed to be able to claim the most "features"

Copy a directory from one place to another, where you don't have permission to read some of the files or write some of the targets.
Windows will give a pop-up and die when it runs into trouble.
Unix will copy what it can and give you the error messages with it dying breath.
Windows security. Even a little bit can be too much.
Unix security. I haven't seen it get in the way, and I haven't really got into groups yet. (Big gripe. I can't have NT users and groups with the same name. Stupid.)

Re:Psychology plays a role

[13Echo]

Considering that Linux or UNIX runs almost 70% of web servers out there, then it depends on what you mean by "the biggie". Linux will not likely fall victim to things like Outlook Viruses, Word Macros, or IExplore holes because of the nature of its permissions systems. However, give someone an OS like Lindows, and then it's just as exploitable as Windows is.

In general, I'd say that Linux isn't likely to be effected by the same things as Windows, regardless of the userbase... Assuming the distrobutions keep its proper permissions systems intact. But there is always a chance of some DOS attack on some service that is running. Lots of Linux machines come with Apaache, ProFTP, or some other Internet daemon running out of the box. It's a good idea to shut these things off and firewall the machine. Desktop distributions, like Lycoris, don't have these things, and they still keep the root permissions systems intact (unlike Lindows). So, aside from Lindows, it could be assumed that most of the standard desktop systems are relatively safe if they don't run any server software.

With Linux, however, you don't have to wait for Microsoft to determine weather or not you need a fix. Every time something major has popped up, a fix has been had in a matter of hours, at best. I'm certainly not worried. No machine is unhackable, but I know which are more exploitable than others.

Re:Psychology plays a role

[Drooling Iguana]

Lets see, I have worked with eight Turing award winners, I have designed operating systems, databases and security systems. I am the editor of several current standards. I have no need to troll. Sounds like your definition of 'miseducated' is 'holds a different idea to me'.

You're a troll. Had you actually done any of those things you would have given some sort of specific detail for at least one of them.

Re:Psychology plays a role

[13Echo]

Number 3 is a really important aspect that Windows users don't seem to understand. Windows fans always use the "If Linux was more widely used" excuse, not knowing exactly how the multi-user Linux system works. It's obviously not 100% foolproof, but it does make an extreme difference.

NT is capable of locking down capabilities between users, but do most places run their machine that way? No. They've created a bunch of users that have grown used to having the ability to destroy an entire drive with one mouse click. With Linux, things aren't that way, but it does produce another layer for users that want to write to certain things (but normally only when software is installed, with very few exceptions.)

Most people never need root access for anything other than installing programs, and root should normally only be used for that. It's a model that users can learn, if (when) they migrate to a more traditional UNIX-like OS.

Re:Psychology plays a role

[Anonymous Coward]

Number 3 means that your browser can't install a potentially damaging virus...

Re:Psychology plays a role

[IM6100]

If Suzy Opensource executes a Linux email virus, if such an animal existed in the wild for her to execute, it executes with Suzy's privileges. This means it most likely stays in its sandbox and doesn't make much trouble.

It just, say, deletes everything in Suzy's home directory, and everything in every writable network drive that Suzy has write access to.

That's simply wonderful. We all know that everything should always be backed up, but do we want to rely on those backups regularly?

The only important data on a system is inherently the most vulnerable to the kind of trojan attack we're discussing here. IT people often don't 'get this' at all because, ummm, they're like a photocopier repair person: more concerned with keeping the copier running than what revenue-producing work is dependent on the copies it makes.

Re:Psychology plays a role

[Anonymous Coward]

I beg to differ with respect to the first paragraph: the user base for Linux may have been "inherently more systems-savvy" until about 95-96, but with the arrival of redhat (typical slash-potter's question: "where can I can an rpm for perl?") and suse and the like, this has long ceased to be the case.

Instead I'd suggest that the bulk of linux users nowadays consists of the same kind of fuck-wit who ten years ago would roam PC magazines in search of the latest 'kewl' Windows software and nowadays is pro-linux 'coz it still appears to have a whiff of avantgarde about it.

The issue of freedom and independence has been completeley lost, the sole advantage apparently being that linux costs less.

G'nite.

PS similar remarks about five years ago resulted in other /.readers calling me elitist.

Re:Psychology plays a role

[Anonymous Coward]

If you have a dodgy CGI script on an IIS server, may god have mercy on your soul. With Apache your chances are much better.

But this has nothing to do with the underlying operating system. Apache can run on windows, too.

> The average Windows power user doesn't suffer from MSBlast etc. any more than the average Linux power user, because the system will be patched, running a personal firewall, etc.

That is irrelevant. What the grandparent is saying is that an average Unix power user could potentially block a virus on his own, wheras with Windows this would be next to impossible.

> Oops, it seems I've been trolled. Sorry guys, my mistake.

Post a counterexample or STFU.

Re:Psychology plays a role

[aldousd666]

I beg to differ. I use AFS (kerberos -- actually following the standards ,unlike MS) everyday. Have you ever heard of PAM?

Re:Psychology plays a role

[reallocate]

You're both equating intelligence with knowledge of a specific computer system. That's completely bogus and more than a little techno-elitist. It's a bit like arguing that backyard mechanics are more intelligent than Linux geeks because they fix their own cars.

What someone does or does not know is not a sign of intelligence. It is simply a sign of what they know.

One would expect Linux users to be more system savvy than Windows or Mac users because a Linux distribution typically takes some study to configure and to put on the Net.

If/when Linux becomes a significant part of the shrinkwrapped desktop market, the need for self-study to make it usable will diminish (otherwise no one but geeks will use it).

Re:Psychology plays a role

[aldousd666]

that's what I said! people just don't know what's going on these days! PAM is exactly the thing that these past few comments have been claiming that linux doesn't have.

Re:Psychology plays a role

[DynamicBits]

Anti-establishment psychology also comes into play: for example, you don't see anti-business graffiti on your local coffee shop, you see it at Starbucks. When people want to make a statement about animal cruelty and food, they often picket at McDonald's - not the local Mom & Pop restaurant. Why? Because it's perceived as cool to go after the big business.

People picket Starbucks and McDonald's because it attracts attention. Be sure not to confuse "getting attention" with "getting actual results," however. If you look at the recent Pesticide problems with Coke and Pepsi, you will see that the underlying problem is not the fault of Coca-Cola/PepsiCo. The local water is the actual problem. Groups went after those two companies in order to attract attention. Look at the search results for "coke pesticide" to see how much attention it has gotten.

Coca-Cola and PepsiCo could drop that segment of the market with very little loss in direct profits. However, their image goes down. As a result of the attention, PepsiCo has announced they will use mineral water instead of tap water in all of their fountain drinks.

Problem solved, right? Wrong. The water in India is not getting any cleaner as a result of this attention. All that happened is that the two companies targeted cleaned up their act. Have you heard anything in the news about the dirty water in India that doesn't talk about Coke or Pepsi?

I originally misread the parent post. So this should pretty much support what was said now that I have realized my mistake. In closing, getting more attention than everyone else is perceived as cool by the script kiddies; that is why they target Windows.

Re:Psychology plays a role

[WatertonMan]

This is true. However Linux is considerably harder to setup and configure when you need to do anything out of the ordinary. As good as distros like Redhat are, you still often have to edit configuration files. Typically they are unnecessarily complex and easy to screwup, even with the purchase of an O'Reilly book for every service you configure. (Sendmail, Samba, etc.)

It is very easy to miss something and screw up security. I've seen this happen many times. The fact that things typically aren't straightforward in Linux means that many people think they are more secure than they are. Say what you will about Windows, but at least there people know it isn't secure unless they are careful. In Linux it is very easy to get a false sense of security. (And let's not even go into some of the horribly written CGI scripts that run in Linux - yeah poor administration, but easy to do)

Re:Psychology plays a role

[Anonymous Coward]

Part of the problem with Linux is it is easy to root unless you really know how to secure it. And that takes time. I have noted though, that the 2.6 kernal will have far more secure features, including NSA SE Linux style access control built in. This will make Linux inherently more secure, but only if people actually bother to use such features. These will nullify taking over a system by gaining root by compromising a service, but only if people can be taught how to use it properly. Along with SNORT, LIDs and other tools which I am sure most Linux users don't use. The tools are there and soon will be bult in, the problem is how to teach people to use them as they install to avoid Linux some day being a playground for script kiddies like Microsoft is now.

Re:Psychology plays a role

[Zeinfeld]

You're a troll. Had you actually done any of those things you would have given some sort of specific detail for at least one of them.

Like a specific detail that would tell you exactly who I am so you can pester me in person?

Err no thanks.

Re:Psychology plays a role

[xenoandroid]

I learned how to use a computer without anybody spoon feeding me instructions, intelligence can make all the difference for learning a specific computer system. I was simply given a mac in 4th grade and now i'm soon going to college and I don't know of a single student in my highschool who can outsmart me at Windows or Mac OS, and I only know one who knows a bit more about Linux than I do (to be expected since Linux isn't my main desktop OS). Intelligence has a lot to do with how well someone can get use to an interface as well as how much common sense they have about how to manage their OS. You don't have to know everything about an OS to not get hit by malicious code/hackers, all you need is a little incentive to protect yourself and basic knowledge of the web. I've known people who refuse to use google to learn some kind of language because they're just so fricken lazy or they lack the common sense to look up the information they need properly. For example, he wants 'help' for some program he wants to develop. So instead of searching for coding examples that he can combine to make his program, he searches the web for that program in perl already (so he doesn't have to do any work and he can just plagerize). I ask him how he expects to learn the language if he doesn't write a line of his own code, and of course he can't come up with any good answer and says, "I GIVE UP!" And he decides to give up perl. Then there are people who can't use search engines at all. They want to find something and they type in something like, "I want to program a perl bot" and get angry because google gives them no results. They just don't get the way most search engines are based off of keyword matching and not a person sitting at a computer reading people's inquiries to refer them to 100 or so sites. I fail to see how your 'backyard mechanics are more intelligent than Linux geeks because they fix their own cars' fits in with this. I was basically saying that some people just seem to lack any common sense and you see it everwhere. Computers, driving, credit cards, home improvement, pets/children (hot car anybody?), etc. Anybody who has the ability to learn and any bit of incentive to should be able to eventually figure out how to open and close ports in an OSes built in firewall. I tried helping some of my friends in other countries protect themselves from the blaster worm and they couldn't even turn on their own XP firewalls to delay the attack while they patch, and then they have the nerve to get angry at me for trying to explain something to them as best as I can, especially when I have to use web resources to help explain to them (I never owned and don't ever plan to own a WinXP machine). And forget about just fowarding the link to them, pictures seem to confuse them more!

Re:Psychology plays a role

[Anonymous Coward]

Original post was flawed. Should have read: look at every *service* run on your system. count the ones that are root.

Anyway.. my point holds. Privelage esclation is universal. Eat me. :)

Re:Psychology plays a role

[xenoandroid]

Oh and you can't forget those hotmail users who pass you their "Send this around or hotmail will close your account" fowards to your email address when your email address does NOT end in @hotmail.com or @msn.com. It's bad enough that they can't tell that it's a hoax

Re:Psychology plays a role

[Anonymous Coward]

So, you don't think VBScript comes into the equation at all? VBScript is overly powerful, and it's what a lot of viruses use. It also enables any script kiddie to put together something that will float around the 'net.

Microsoft is a good company, they got to the position they are in for a reason. However, they are not without their faults. To say they are entirely evil is wrong, but to say they are entirely without fault is wrong as well. They are simply a company playing the game, and playing it well.

Re:Psychology plays a role

[1lus10n]

you know im going to lay this straight out for every single virus writter/script kiddie out their. you think you can write a virus for linux thats effective, try it.

it *is* that simple, there is a reason that in the 30 year history of Unix there has NOT been anything even close to the kind of mass-moving virus's that windows suffers from. and i think that knocking out the backbone of the internet, or a bank is alot more enticing than somebodies PC.

i am so sick of you people claiming that Linux will have viruses when it gets "popular", it is popular, it has a very large share of the server market and is arguably the worlds 2nd most well known OS. yet we have no viruses .....

Unix is a much more secure system by design, Linus and the OSS community are much much better at getting things patched and rolling in hours, not days like microsoft. and equally important is the fact that the patch doesnt break things.

you know its funny you say that Linus is the only one who is allowed to commit changes to the kernel, but last i checked i could fork it if i wanted to, and it would be the same damn code, just called something different. try that with windows see how far you get. or try having a convorsation on the public development list for windows, with the main developers for windows. funny they dont have one of those. but im sure calling them on the phone and getting passed around , and ignored, maybe even called back and ignored is just as effective ...... right ?

Re:Psychology plays a role

[Anonymous Coward]

PoorPost Form v. 0.2

Your post has been moderated positively but that moderation must have been in jest or error. Your post sucks. Please review this form to understand the weaknesses in your post and how to produce higher quality posts in the future.

[ ] Your post was modded funny but is not really funny. This is because:

• ( ) You post simply used M$ instead of MS
• ( ) You went back to beating the Windows security dead horse
• ( ) You made a tired SCO joke
• ( ) You made a Jon Katz joke (who?)
• ( ) MS blowz, linux rules (or a variant)
• ( ) You made an unoriginal joke about Slashdotting (servers turning to powder, melting, etc.)
• ( ) Other (please comment here: )

[ ] Your post is modded insightful, informative, or interesting. In fact it is neither of the three. This is because:

• ( ) You stated the obvious
• ( ) You simply tossed out lots of five-dollar words
• ( ) It was in response to a poorly-written post or troll
• ( ) You copied text from a previous post that really might have been one of the three I's
• ( ) You simply criticized Microsoft without making it funny
• ( ) It is bloated with unnecessary technical claptrap
• ( ) All you did was pose questions (like a stoner)
• ( ) All you did was pose questions (like a lawyer)

[*] Your post may be rated too highly in general for the following reasons:

• (*) You are an asterisk who has, knowing the story's release time in advance, pounceposted to get first p0st and get modded up early
• ( ) You are one of the editors and are getting your ass kissed
• ( ) One of your fans has weighed in for you
• ( ) One of the editors has blessed it with an "underrated"

[ ] Additional comments:

Thanks for posting! Better luck next time! :) ( This form is currently in alpha and suggestions for its improvement are always welcome. )

Props to PoorPost troll for this form!

Re:Psychology plays a role

[arkane1234]

One of my favorites is the day I logged into my Small Business Server only to find an ad on the desktop! Who would have thought that a LAN messaging protocol was left listening on the Internet? Knowing that, however, I would have damned sure bet that enterprising spammers would eventually take advantage of it.

Wait.. you don't run a firewall between your Small Business Server and the 'Net?

Re:Psychology plays a role

[Mr. Arbusto]

> First, the user base for Linux is inherently more systems-savvy

I believe the words your looking for are Anal retentive

Re:Psychology plays a role

[autopr0n]

Windows does NOT operate on a everyone is a root notion unless you're running 3.1-ME version. Mac OS Classic does however, but manages to let people learn where they can muck around and still maintain itself as a secure OS because of the lack of shell.

Dude, you can install a shell.

Re:Psychology plays a role

[crapulent]

Windows operates on an everyone is root notion, allowing anyone to make changes to system resource files

This comment is full of misinformation it's not even funny. THe above is a non-issue these days. The majority of windows users now use XP which is perfectly capable of having an administrator account seperate from the day-to-day account, which has read/write access to only what it needs. Windows 2k and NT before it were also able to do this. By dragging that line that "everyone is root" you're simply taking assumptions about the WIn98 days and falsely applying them to the current situation. To say that windows is "designed that way" is simply wrong and misleading. The whole NT line was designed from day one with all the "proper" controls such as ACLs, privelege tokens, process controls, quotas, auditing, etc. In fact NT's ACLs are more sophistcated than the old POSIX "rwx" type. They have a much finer granularity.

Don't get me wrong, I'm not saying that a lot of Windows users aren't logging in as administrator, or as an account with admin priveleges. THey are. And that's dumb. But it's hardly windows' fault. If I setup my Linux box and always log in as root, is that somehow the distro's fault? No, that's user error.

Re:Psychology plays a role

[Transcendent]

I've never met anybody who was smart enough to write a good virus and simultaneously preferred using Microsoft Windows as his/her desktop OS.

And how many people of that do you know?

I knnow many acomplished programmers that could definately write some nasty things if they wanted to. Yes, they're smart enough, and yes they use Windows on their main computer.

Using Windows isn't about how smart you are, how computer literate you are, or any other characteristic that you may posses... it's just about what you wan't out of the OS.

Do I use windows? yes. Do I use linux? No. Can I use linux? Yes. What Unix variant do i use? BSD (open/free).

That has nothing to do with my intelligence, social status, political background, religion, skin-color, sexuality, health, whatever weird excuse you come up with... it's just using the right tool for the right job. Simple enough.

Re:Psychology plays a role

[Anonymous Coward]

Most computers come from a store where people buy them. If you buy a Dell it's automatically configured for you already, it's configured to be Administrator. If you install WinXP by itself, it uses an Administrator account. Actually reading your comment, you're the one with the misinformation.

Re:Psychology plays a role

[feronti]

Besides which, in windows you _can't_ turn off RPC... if you do, the system simply doesn't work. How do you think the abstraction layers in windows work? Many of the system calls are implemented solely as RPC calls, so without RPC, you have a nonfunctional system.

Re:Psychology plays a role

[Anonymous Coward]

NT does have security "features". It has lots of them, and they take lots of bits. They are stuck in strange places. If I have a lot of files to manage, I will not be using those features. I do a DIR. I see date and time and file size. No security information whatever. Must not be important.

It's not that it isn't important, it's that with ACL based security is kind of difficult to list who has what rights in a directory listing. When all you are showing is Read/Write/Execute rights assigned to User/Group/Everyone you can afford to list permissions in a directory.

Re:Psychology plays a role

[crapulent]

Oh please. The original comment was that it was not possible to run windows sanely with proper privilege separation, that windows does possess that capability. That is false to fact as it's had it since day 1 in the NT tree. If it comes installed unsecurely from Dell, it's Dell's fault, not an inherent fault of the operating system. If you install XP yourself and don't create a regular non-Administrator account to use, it's your fault. There is nothing inherent to XP/2k/NT that forces you to run as root all the time, that is the misinformation.

Re:Psychology plays a role

[Baggio]

Thank you for saying this. I was about to respond the same way when I read this AC posting. This is exactly the reason. However, to use the same logic as earlier; If I type ls and press enter, I get a list of all the files. I have to know to type "ls -al|less" or similar to get the security information on all those files. As a novice user I still don't know what it means, and it is hardly discoverable. How did I know that I could type ls -al? I looked up the man for it. Why would I even expect ls to list the files for me? That isn't an intuitive command for me...

Now, suppose that I'm using some GUI in X11 to view those same files. The meaning of all those x's might make more sense to me now, and maybe I can even relate some of those security attributes to what it means for another user. Windows makes this task just as easy.

ACLs while maybe more complicated, especially if you break inheritance, really can provide more flexibility and power than a Group permission. Then again, I don't expect most novice users to change either of these settings much.

The truth is, that neither system as they are currently implemented will make security "easy" for the novice computer user. This is where both Microsoft and Linux should invest some more time trying to make the task seem less daunting.

Re:Psychology plays a role

[Anonymous Coward]

Oh, you mean like posting grips about bugs that were patched a month before a worm came out that took advantage of it?

Re:Psychology plays a role

[Anonymous Coward]

Before C nobody thought of writing language compilers without bounds checking on arrays.
What about FORTRAN ?

Re:Psychology plays a role

[LadyLucky]

Windows operates on an everyone is root notion

Why do people keep saying this? It's not even vaguely true. Heck, on windows there isn't even a root user equivalent. There are things that no user can do, at all (ever tried killing a system process as an admin, you can't do it). Perhaps when you last used win95 and discovered you could click cancel on the login box security was a little less well thought out but it is quite different these days.

Next history lesson: Unix was not designed to be secure. It's quite old. Security has been added over time, in much the same way that it is happening with Windows. You see this in the flaws in the Unix security model (there are too many things you need to be root for, the poor implementation of groups, etc).

Re:Psychology plays a role

[Anonymous Coward]

I can't say that replacing a Microsoft monoploy with a Linux monopoly looks like any advance to me.

I can't say that replacing a Ford monopoly with a car monopoly looks like any advance to me. Just like there are multiple suppliers of cars, there are multiple suppliers of Linux. SuSE and RedHat being the two biggest.

Re:Psychology plays a role

[Anonymous Coward]

NT 3.51 may have been a micro-kernel design, but they have long since moved to an even more monolithic design than Linux. Come'on, even the graphics is running in-kernel now, with no documented way to bring up the system without graphics, even in case something goes wrong with the graphics subsystem. According to MS advertising, even IIS is going in-kernel from the next version, meaning that the next CodeRed is going directly into ring 0, even worse that LocalSystem.

Re:Psychology plays a role

[Anonymous Coward]

You're a fucking moron. You can quite easily use a loopback device with strong encryption and therefore use any fucking filesystem you want with encryption.

Re:Psychology plays a role

[Anonymous Coward]

Sorry, you don't understand PAM (or Kerberos).
PAM cannot give you kerberos authentication.

Just responding to a post incorrectly
modded up. Should be -3, misinformative.

Re:Psychology plays a role

[hamster foo]

Most of my friends that have bought Macs have bought them because of the pretty colors and the educational discounts. That's not to say they weren't intelligent people, but obviously their purchase decisions were based on flawed criteria.

"there is a lot less common sense in the Windows community than there is for other less widely distributed OSes"

Of course there is as a whole, when your user base dwarfs that of your competitor you've got so many more users that there are going to be more idiots using your systems. Hell, there are probably more idiots using Windows systems than the total number of Mac users. Of course, the same could be said for competent users also. If you don't talk in terms of per capita then you can say a lot of things just based on the sheer number of Windows users. I also doubt that most people would correllate common sense with being able to operate a computer. Anything that people train to do probably doesn't fit into the category of common sense.

"they were at least smart enough to not use Windows for something they can do easily on another OS"

You should have just said on a Mac. It's the only OS with a desktop environment that can even begin to claim the same level of usability as Windows. I'm not really sure that it can be considered inherently smart just choosing something other than Windows. Macs and Windows are both very good choices for people who want a user friendly desktop experience and/or just want things to work.

Re:Psychology plays a role

[Felinoid]

Very true quite a few users run Linux and say "I'm an expert".
They get told the same lie we are all told. The Linux is SOO hard you have to be a tech god to use it. If this were true I know two techno gods under the age of 10 and nither can write code.

So the avrage Linux newbie thinks he's great and thinks it's all easy to him. He can do anything.

Contrast this with an equally disterbing trend. Microsoft has people convenced that Windows is so user friendly you could even run a server and not be tech savy.

In contrast you have Linux hobbyists who think they are soo smart and brag vs Windows hobbyests who think they are tech dumbies and don't need to know anything.

The key here is that while the Linux newbie is most certanly not a tech god he dose know that there is much to learn. He made thousands of procedureal errors but he knows to learn and study and check and recheck.

As a result the avrage Windows newbie 6 years later will still know nothing.
The avrage Linux newbie will grow up quickly and remember back when he thought he was a god just becouse he could install Linux.. 6 months ago.

Re:Psychology plays a role

[bytesplit]

Your comments are logic faulty, it's rediculous. Knowing more about computers than someone else does not make you a "smarter" person. It just means that you have more of an interest in said area than that person does. My wife could care less about the internals of computers. Yeah, she agrees with me on stuff and likes to get me talking about technology and such, but she really doesn't give a rat's ass about how a computer works. She is poster child of someone who "just want it to work". Still, do I think she would make a brilliant computer scientist and put me to shame with how quickly she sees the big picture on certain topics and retains knowledge? Absolutely! I've tried, but no cigar. She is a nurse, loves being a nurse, and will always work in some capacity as a nurse. It doesn't make her less intelligent because she doesn't know a lot about how Windows or Linux (or Mac for that matter) works. Nor does your elitism and supposed intelligence over your pc peers qualify you to come in here and tell the world how it wouldn't turn if you didn't move your feet. Idiot.

Re:Psychology plays a role

[tankbob]

The user base for Linux is not necessarily more systems-savvy. With distributions like Redhat the so called "Windows muppet" could easily get a linux box up and running on the net. The problem then lies that these people then cannot workout how to keep the box up to date (or just believe the myth that linux is unbreakable). In my job I quite often find people who think they know what they are doing and then setup a linux box that is never updated and wide open to attack. It's not the bugs/flaws in the operating system that allow these virii/worms to spread - its sysadmins who cannot keep their systems up to date date and sensibly firewalled. Slammer came out 6 MONTHS after Microsoft released the patch, plenty of time to test the patch on your backup system and then bring it on line.

Re:Psychology plays a role

[Anonymous Coward]

From the Linux-PAM System Admin's Guide: "Linux-PAM (Pluggable Authentication Modules for Linux) is a suite of shared libraries that enable the local system administrator to choose how applications authenticate users. In other words, without (rewriting and) recompiling a PAM-aware application, it is possible to switch between the authentication mechanism(s) it uses. Indeed, one may entirely upgrade the local authentication system without touching the applications themselves."

So Linux doesn't have that kind of features embedded into the core of the system. Programs have to be written to be aware about such a system.

Re:Psychology plays a role

[Sique]

You should have just said on a Mac. It's the only OS with a desktop environment that can even begin to claim the same level of usability as Windows.

D'oh, thats somehow the reverse from what I always experienced... Windows now slowly grows into a desktop environment that compares in some parts with the usability of the long line of Mac OSses.

Re:Psychology plays a role

[Anonymous Coward]

its your own fault Zeinfeld - you criticised linux on slashdot. A witch, a witch! Burn him!

Nevertheless, I agree with what you said - anyone who has worked as a programmer for both sides knows the truth - that the systems have different approaches to working. NT is a microkernel architecture. that's good, but also provides a disadvantage when it comes to patches that update those dlls used by it - something Linux zealots pick up on all the time. Similarly, Linux is a monolithic kernel, meaning you don't get quite as much integration between services you do on NT.

OK, I'm making it a bit simplified there, but I hope you all get my point.

Re:Psychology plays a role

[Anonymous Coward]

Let's all switch to VISUAL BASIC. =)

Re:Psychology plays a role

[lars_stefan_axelsson]

I am probably better informed about the state of MS security system design than any other person who does not work for them and is not a contractor. You are wrong in this assertion on two counts, first the extreme modular nature of Unix has historically been considered a security weakness, second Microsoft is not moving towards Unix. Windows NT has always been a micro-kernel design.

Two points.

First, we're all getting a bit tired of the old "NT is a microkernel and UNIX isn't". When you look at the functionality that both kernels provide, both the traditional UNIX kernel and the NT kernel there is no difference worth mentioning. In fact, with the introduction of the GUI subsystem into the kernel by later NT versions, the scale is tipped in favour of UNIX. It handles more system tasks in user space than does NT.

It's unfortunate that the Mach people coined the term microkernel, since that seriously bloated the idea of what a microkernel is. If the term had been reserved for true microkernels (e.g. QNX, L3 or the like) than of course neither NT nor UNIX could have any realistic claim to the name, as it should be.

And second that the "extreme modular architecture has historically been considered a security weakness". I'm not sure I agree with much either. The one overarching security problem with the UNIX design (which was indeed identified in UNIX history) is the introduction of the super user (aka "root") and the poor division of responsibility/clout that came with it. Note that this is orthogonal to any notion of modularity.

Next you talk of the interfaces of the security subsystem in UNIX not being prepared for Kerberos and the like. Well, they weren't really prepared for networking either, as that wasn't really around when these interfaces were designed. A critisism a bit off the mark. As others have pointed out, when that weakness was identified the API was indeed made richer, with the introduction of PAM.

Re:Psychology plays a role

[mrob2002]

Even though firewalls and packet filtering play a big role, I believe in security in depth, and assume that someone wanting to break a server can get past the firewall. A key reason I feel safer with a *nix box as a server is that I can run netstat -a and be sure that only the ports I want listening are listening. And I can be sure that I have the latest version of each service on that port.

With Windows, I find it hard to be absolutely sure about what services are available over the network, and what patch version they are at, what with all the service packs, patches, patch roll-ups, etc, that I have to apply in the Microsoft way.

On the other hand, I also make sure that no users other than admins can log into the servers, because keeping track of all the vulnerabilites in the user level software is a lot of work on *nix too, probably just as hard as on Windows.

Re:Psychology plays a role

[lars_stefan_axelsson]

The buffer overrun is essentially an invention of the C programming language. Before C nobody thought of writing language compilers without bounds checking on arrays.

Wrong on both counts. The buffer overrun problem was identified (indeed exploited in a security context) well before the advent of both UNIX and C. Languages such as 'PL/1' and 'Algol 68' not to mention 'Fortran' that predate C by many years contained bounds checking on arrays. Indeed the hardware on which these languages ran (such as the Unisys A-series mainframes) contained bounds checking primitives.

Re:Psychology plays a role

[varjag]

The problem with the bolt on approach is that there is no consistency of use in the Unix framework. You can add Kerberos but you have to separately Kerberize every application. Same for integration to a domain server or any other infrastructure.

Frankly, I don't see how this problem fades away with Windows. When they introduced, say, DCOM, application writers interested in this feature had to add supporting code - it didn't just appeared magically.

What you are talking about is the administrative issue of enforicng and following the standard, which is always easier in a single-vendor environment such as Windows. It has nothing to do with system architecture.

Also, I don't see how monolithic archtecture is inherently more secure than modular. Could you please elaborate on that? (I am aware that NT was based on microkernel; however besides the kernel there is the registry, Internet Explorer down the guts, VBA scripting all around and all-encompassing SYSTEM user).

Another thing is that even if theoretically NT security model is sound, in practice it is plagued by malpractice of applications requiring to run with SYSTEM priveleges. Clearly a person with such an impressive background as yours should know that e.g. it is impossible to run IIS under restricted user, so I just don't get which aspect of practical NT superiority over Linux you imply.

Re:Psychology plays a role

[DrSkwid]

in the 30 year history of Unix
well someone already mentioned the Robert Morris Worm, it took down the backbone of the internet.

I seem to recall Apple being taken down by an email bouncing bug in something unixy, damn what was it.

i am so sick of you people claiming
I think you maybe replied to the wrong post, I didn't make any such claims. I was addressing the three specific claims for the non-appearance of a viruses / worms on Linux. They simply are not the reasons.

Unix is a much more secure system by design
Multi-user capabilites were added on to Unix *after* it's conception. It wasn't designed with system security in mind. Secure by design doesn't have setuid binaries, heck it shouldn't even have root.

This is a separate issue to the speed of patching. And, just for good measure, last time I checked, Linux wasn't Unix.

i could fork it if i wanted to, and it would be the same damn code, just called something different.
That's what *I* said : "anything else just isn't Linux"

try that with windows see how far you get
Why mention Windows? Do you have some sort of paranoia that everyone who challenges incorrect assumptions about Linux is therefore a Windows Weenie ?
Would a WW really say "root considered harmful" ?

Your exaggerated claims that "Linux will never have viruses or worms" are simply wrong.
The "Big Linux Worm" is waiting to happen and it will a doozie.

Linux' saving grace is that the kernel and userspace are quite well separated. This is not so true of Windows. Windows ships with services on by default and the firewall off by default.

Security is hard.

My prediction is that is will come in through Bonobo or similar.

Re:Psychology plays a role

[IamTheRealMike]

I am probably better informed about the state of MS security system design than any other person who does not work for them and is not a contractor.

Good grief, I hope that isn't true. No offence, but so far you've asserted that Windows NT is a microkernel which hasn't been true since NT4, and that Windows 9x doesn't use protected memory, which is equally incorrect.

The rest of your posts seem to be mostly a matter of "I say I've done this, this and this so you'd better believe I'm credible or else!" and vague handwaving about the relative coherancy of "UNIX" which hasn't existed as a system in any real world usage for years. Rather, everybody uses UNIX derivatives such as Linux, Solaris, AIX and so on, all of which are significantly different to the original UNIX releases.

Re:Psychology plays a role

[Crayon Kid]

As good as distros like Redhat are, you still often have to edit configuration files. Typically they are unnecessarily complex and easy to screwup, even with the purchase of an O'Reilly book for every service you configure.

So let's switch to XML config files and DTD's. The best of both worlds: machine- and human-editable with ease. Throw in a page of help for every option (or XML tag) like the kernel config has. Would make graphical administration interfaces a joy to work with. We could even have one and only admin tool for the entire /etc as long as some simple standards are followed.

Re:Psychology plays a role

[virtual_mps]

"I've never met someone who has been laid and simultaneously preferred using Linux as his/her desktop OS."

Ok, I think I know what's going on. See, if you're trying to get laid you shouldn't be thinking about your desktop OS. Instead, you should think about the person you are standing/lying near. Hope that clears things up. :)

Re:Psychology plays a role

[xenoandroid]

For your last response, no. You can easily have a linux box for basic computer usage that anybody can operate. Most common windows users could care less about how easy it is to start a webserver or how to get a new device to work with linux that isn't officially supported by your kernal yet, they just browse the web, check email, and use their word processor, all of which can be launched and operated by a monkey on Windows, Mac OS, or Linux (with X running of course). I must disagree however that Windows is not a good choice for people who just want things to work because may times things don't work, a system that can easily break itself isn't what I consider very functional even if it has the majority of users and software for it.

Re:Psychology plays a role

[Umbriel]

But a distro that install easily like SuSE 8.2 (easier than Mandrake in fact last time i tried it) also installs an automatic update, in this case an icon in KDE's systray that will turn red with a big ! that will tell the user to download the available patches for the system. Not like Windows Update that by default downloads first and asks later to install the already downloaded, great for modem users... And it's not like SuSE it's a toy distro, it's one of the certified ones along RedHat, but makes easy to try Linux for the amateurs too, taking care of unpatched systems.

Re:Psychology plays a role

[doug363]

You can turn off DCOM RPC (where the vulnerability is). Some services won't work, but if you're not running a server, then you won't notice. If you are running a server, you've got to reboot to patch anyway, so there's no big deal. System calls are NOT implemented with DCOM RPC. Some Shell, DirectX, and Windows Media calls (for example) are implemented using COM, but there is no remote vulnerability there, and disabling the DCOM service doesn't affect this.

If you want to know how, run "dcomcnfg" as an administrator, go to "Default Properties" (you have to choose "This computer" on WinXP first) and uncheck "enable DCOM on this computer". Press OK.

Re:Psychology plays a role

[1lus10n]

"Your exaggerated claims that "Linux will never have viruses or worms" are simply wrong. The "Big Linux Worm" is waiting to happen and it will a doozie."

still waiting, like i have been for years.

Linux is not unix. i know this, but it IS based on unix, the ideas behind unix etc ...

i dont forsee us having any issues with worms or virus's, and if we do it wont be me, i update major stuff daily and minor stuff weekly, and EVERY system i run is firewalled.

Security is not hard. good security is teduios but not hard.

Re:Psychology plays a role

[Viol8]

"Lets see, I have worked with eight Turing award winners"

That doesn't make you one of them. For all we know you could have been their lab assistent.

Re:Psychology plays a role

[julesh]

No offence, but so far you've asserted that Windows NT is a microkernel which hasn't been true since NT4, and that Windows 9x doesn't use protected memory, which is equally incorrect.

Actually, he is in a way correct.

By some definitions of microkernel, the Win2K kernel at least is one (the kernel itself has a very limited amount of functionality and relies on integrating external drivers in order to be able to do things like access hardware, filesystems, etc.). I can't speak for XP because I have very little experience of it.

Also, Windows 95 et al have a 1Gb area of memory space which is shared between all processes. Shared objects (eg dlls, memory mapped files and other such things) are loaded into this area, and can be accessed by any process. To say it doesn't use protected memory might be incorrect, but you could say it does use unprotected memory, which is a very subtle distinction.

Re:Psychology plays a role

[julesh]

Come'on, even the graphics is running in-kernel now, with no documented way to bring up the system without graphics, even in case something goes wrong with the graphics subsystem

What do you think the recovery console is?

Besides, the graphics code isn't actually part of the kernel, but rather runs at privelege level 0. In windows-speak this is a 'kernel mode driver', and fulfills a similar purpose to linux kernel modules. Only I believe the interface used is a much more modular one (message passing, I think, although I'm not certain of the precise details).

Re:Psychology plays a role

[hitmark]

well, personaly i no longer have to look at a command line when i want ot set up a network card or install something in mandrake, they have a very nice controlcenter tool going. and check out kde/gnome. sure hte geek will try to show of the backbox or commandline but most normal users of linux will go for kde or gnome (diffrence is more cosmetic then anything else in my book)...

Re:Psychology plays a role

[Viol8]

C was designed as a replacement for assembler in most (but not all) situations. Ergo they didn't put in any bounds checking because C is a
what-you-see-is-what-you-get language. Speed, flexibility and size were the considerations , not programmer hand holding.

"Before C nobody thought of writing language compilers without bounds checking on arrays."

Rubbish. Go read up on computer languages.

Re:Psychology plays a role

[IamTheRealMike]

Well, the Windows kernel also includes things like message dispatch/routing, registry access and various, GDI/user graphics/window handling and so on. So, I wouldn't say it's "micro" as such.

It's true about Windows 9x, but I'd note that sharing DSOs/DLLs is fairly common, as far as I know all major operating systems do that...

Re:Psychology plays a role

[Anonymous Coward]

He was the fluffer.

Re:Psychology plays a role

[aldousd666]

the programs have to be aware of PAM yes, but that means they will accept ALL kinds of PAM if they are. Like AFS or any other base. Get your creds from PAM, and it doesn't matter what kind of PAM it is.

Re:Psychology plays a role

[Michael_Jarvis]

I would venture to say that being "systems-savvy" isn't enough. You also have to be motivated. I've known plenty of so-called "systems-savvy" Linux users who were just lazy about keeping up with bug fixes and patches. The kind of people who, even today, are running RedHat 5.1 in a "production" environment.

I have 3 Linux boxes at home, but I also have to use Win2K at work. Since I understand the implications of security flaws, I regularly update my Win2K box at work by visiting Windows Update and downloading critical fixes, just as I keep my Linux boxes at home up-to-date with RedHat Network and Mandrake Update.

When the recent round of Windows worms started, I was fine because I was completely up-to-date on critical fixes. However, I was sadly in the minority, and so the folks in the IT Desktop Support group spent some long hours trying to track down and repair all the infected machines.

My point? A lot of so-called savvy users don't seem to see the value in keeping on top of updates, regardless of what operating systems they are running. They may have the technical knowledge, but are either lazy or think it "won't happen to them."

I think it would be a great feature if you could optionally configure ANY operating system (whether Linux, Windows, etc.) to automatically update itself.

Just my $2e-02. :)

Re:Psychology plays a role

[julesh]

Well, the Windows kernel also includes things like message dispatch/routing, registry access and various, GDI/user graphics/window handling and so on. So, I wouldn't say it's "micro" as such.

These aren't actually in the kernel, I believe. My understanding is that registry access is in ADVAPI32.DLL; GDI and other graphical stuff is in GDI32.DLL; window handling is in USER32.DLL.

The actual kernel, NTOSKRNL.EXE, contains relatively few functions, most of which seem to be related to threads and interprocess communication.

It's true about Windows 9x, but I'd note that sharing DSOs/DLLs is fairly common, as far as I know all major operating systems do that...

Most OSs only map a shared memory segment if you specifically request it, my understanding is that under Win9x you can access all processes shared memory, and screw around with the contents, if you know where in that address space it is.

Re:Psychology plays a role

[I_redwolf]

Why do people keep saying this? It's not even vaguely true.

If it's not true, get on a windows machine right now as a default user and try to get into C:\windows\system. Or install a program from the net that will install dll files into a system resource dir or add key entries into the registry.

If it wasn't true I wouldn't have said it. As for the poor implementation of groups; elaborate. All of you windows folk make complaints and don't back them up, at least i'd make an effort to fix the problem or address it. How is the implementation of groups poor? Which implementation or security controls are you speaking of? What flavor of Unix? Is it possible you can give a little detail rather than just saying poor implementation of groups, etc. That doesn't fly in a realworld discussion.

Re:Psychology plays a role

[reallocate]

>> learned how to use a computer without anybody spoon feeding me instructions, intelligence can make all the difference for learning a specific computer system.

Well, good for you. But you've simply proven you are intelligent enough to figure out how to use a Mac without supplementary study. That, I believe, is Apple's intention. So, you would appear to be an exemplary Apple customer.

I contend that all personal computers should be equally as easy to use.

What you have not proven -- because it can't be proven -- is the notion that choice of an operating system is an indicator of intelligence. This little bit of elitist nonsense appears with regularity around here, usually in posts from Linux fanatics who have invested a portion of their emotional identity in the OS. learned how to use a computer without anybody spoon feeding me instructions, intelligence can make all the difference for learning a specific computer system.

Re:Psychology plays a role

[John Harrison]

This world where everybody has "at least this amount of technical knowledge" will never happen. If you think that it will you need to lower your expectations for people and raise your expectations of Linux. People shouldn't have to worry about this sort of thing in order to use a computer. The system should be secure by default, and should be able to fix itself without breaking applications, in a way that is transparent to the user.

Your grandma thinks that a patch is something that you put on Levis and will never learn computer security. Why should we expect people of all profressions to adapt to flawed computers. Shouldn't the computers be adapted to meet the needs of people?

Re:Psychology plays a role

[I_redwolf]

Windows operates on an everyone is root notion, allowing anyone to make changes to system resource files. Not only that but because of the way Windows is designed where everything is mashed together, when one card falls so does the whole deck.

Not once did I say anything about windows not possessing the capability. That's not even the issue, the issue is that even with that everyone is still root and can make changes to system resource files. Also that because of the design and the inclusion of things like the web browser into the default desktop and other "vital" components to the operating system. When a flaw is found in an application process it can easily bring down the rest of windows. Nowadays it might be harder but clearly still capable as proven by the actual exploitation of these severe flaws.

How you misread it, I don't know. However, I stand by my statement and it's true until someone proves that without 3rd party programs Windows will not allow modification of any of it's system resource specification files, including that of the registry. Infact, I'm willing to setup a box for someone to prove it to me, if you're so inclined, put your money with your mouth is.

Re:Psychology plays a role

[Anonymous Coward]

I would have to disagree. I don't think it's necessarily a "Cool Factor" in choosing an MS exploit over a *nix one but the simple fact that Windows is THE SINGLE MOST DOMINANT desktop world wide.

With that in mind, look at some of the big viruses (virii?) out there recently; ILUVYOU, Melissa & SoBig are aimed at email. With Microsoft Outlook (and OE) dominating the market, it's fairly easy to write a vbscript addressing the API. A scripting language written by Microsoft, to access Microsoft methods on Microsoft applications.

Can a linux box be exploited and a site run on it be defaced? Sure it can. Does it happen often? Absolutely. Do many people see it? Not really, unless they happen to hit that particular site. BUT if a massive email virus hits the largest possible target audience, THEN we're talking fame, fortune and everything that goes with it (like those matching chrome bracelets and cozy 8 x 6 room).

It's called Marketing 101. Hold up a sign on a street corner and you'll have a view people see it. If that corner is Broadway and 42nd St in NYC, then you'll have millions of people see it (especially during the taping of TRL).

Re:Psychology plays a role

[arth1]

First, the user base for Linux is inherently more systems-savvy and internet-knowledgable than the Windows user base

You also have a large group of Linux users who *think* they are savvy, and represent a great danger to themselves and others. If they know how to set up ftpd, ircd and other services, but have no idea how to properly secure them, they shouldn't set them up either. But they do.

Just because you have a home box running Linux (or BSD) doesn't make you a sysadmin. Swallow that pride and ask for help when necessary.

Regards,
--
*Art

Re:Psychology plays a role

[spongman]

No, that is NOT true. The service can be running as any user on windows and you can still gain Administrator privileges

No, that is NOT true. The NT seccurity model does not allow you to do this (without correctly authenticating as a user that is a member of the Administrators group). You can only do that if you're exploiting a bug in the code. If you're exploiting bugs in code, then you're operating outside the design of the security model.

Sure, there are bugs in windows (as there are bugs in every OS) but that's outside the scope of this thread's discussion.

Re:Psychology plays a role

[faxafloi]

Anti-establishment psychology also comes into play: for example, you don't see anti-business graffiti on your local coffee shop, you see it at Starbucks.

No, but you will see gang graffiti on the local coffee shop. Gangs are not part of the anti-big business movement; they have their own reasons for doing what they do. So it is, I think, with the virus writer.

Calling Linux secure because people love DDOS'ing Microsoft is faulty logic.

Absolutely right. Might be wise to remind ourselves of rtm's 1988 worm.

Re:Psychology plays a role

[spongman]

there's no such thing as a system that can contain an arbitrary bug and still be secure.

think about that for a while, and then think about your whole argument.

Re:Psychology plays a role

[Anonymous Coward]

Lets count how many things are wrong with your post.


If a user can install Linux on their machine, it implies the following:

* Isn't afraid of computers Maybe
* Willing to use a command line Wrong
* Knows what a partition/hard drive is Not necessarily
* Comfortable with various GUIs or atleast the default

Hell, I work with some Comp Sci Grads that do programming on Linux (RH9) and have no clue how to use anything on command line. Hell, even my supervisor (interim-Sys Admin) can't do any simple user management unless the GUI is there. Drives me nuts.

Just because you and probably 3/4 of *nix users fit those four descriptions doesn't mean all will

Re:Psychology plays a role

[spongman]

yup, but the difference is that most self-respecting windows devs/admins probably have a linux/bsd box lying around to play/learn/use and they respect it for what it is and can have rational discussions about the differences between to two camps. The reverse is rarely true.

Re:Psychology plays a role

[IamTheRealMike]

Actually, ADVAPI et al relay through to NTDLL, which in turn interrupts down into the kernel. If you read the DDK, you can see kernel level registry APIs, as some drivers expose information through it etc.

Likewise GDI32, USER32 etc are the userland API equivalents, but they actually manipulate kernel-level objects. Obviously an API call to GDI32.DLL is far easier than performing a kernel system call.

Re:Psychology plays a role

[mikefocke]

While you assert: "... all O/S are written as independent modules. The issue is whether those modules interact in a coherent manner or an incoherent one. Unix regretably flunks that test, although propagandists will try to deny it."

You are lumping all UNIX or UNIX-like OSs together. There are UNIX API/ABI compatible OSs designed with security as the foremost consideration with formal provable security policies enforced over all object accesses. Written as multiple modules, yes. Designed and proven to interface correctly so as to permit correct user interface while preventing "illegal" ones, yes. Does it take a rigor unknown in most commercial OS shops Yes. But it can and has been done. See STOP.

Re:Psychology plays a role

[Anonymous Coward]

Sorry you are wrong. By your definition Linux would be a microkernel and so would freebsd. The "kernel" of Linux exists in one file (kernel/sched.c) and everything else is provided by separate modules and drivers each with their own set of unique interfaces.

Before the term got basterdized, a microkernel typically referred to an operating system where the kernel (scheduling and VM, or possibly just scheduling) would be the one and only priveleged process in the system. All other services are provided by separate lower priveleged processes that use a variety of forms of IPC to communicate with each other. One cost is obviously the increased amount of context switching.

Take a look at the online QNX documentation and see if you still think NT is a microkernel.

A while back there was a bug in NT that was corrected with one of the recent service packs. The bug caused the system to BSOD if a number of backspaces and tab characters were entered in a console window. Apparently there was some bounds overrun that caused CSRSS.EXE (one of the "nonkernel" processes) to crash. What is troubling is that this took down the whole system, that means that there are virtually no benefits from NT originally using a microkernel because the architecture has fallen apart.

Re:Psychology plays a role

[Anonymous Coward]

You stupid bastard. you missed the point completely. Re-read the post, and try again.

Re:Psychology plays a role

[aixguru1]

the user base for Linux is inherently more systems-savvy and internet-knowledgable

One thing you failed to mention is that many of the distributions are being released for users who are not "systems-savvy". Grab a camera, ask a newbie how to configure iptables/ipchains to secure some of their ports and have a kodak moment with that odd expression. Regardless of how savvy users are, there is a risk with most OS's. OpenBSD makes a point of trying to reduce that risk from an out of box install with their coding methodology. Un*x's in general have a more secure platform from an install because of the efforts engineers put into securing things. However, things with the free Un*x OS's are changing daily. Linux has a higher risk, in my opinion, of potential problems due to the vast number of programs and features being added constantly. Every new program added could have potential security holes. It is nice to see some developers making that a focus when they code, but that still does not reduce the risk. There could easily be a worm or virus created that does damage to systems and there have been worms released with those effects. Does anyone at all recall the "Ramen" internet worm which entered systems through ftp if I'm recalling correctly. The problem is issues with the code. A skilled programmer could look for a place to overrun the buffer on various server daemons and potentially create the same havoc. Keeping up to date, watching security advisories, and installing fixes as soon as holes are found is the one way to reduce the risk of these problems. Another thing that is important is to reduce the number of things that run as root or have root access. Run daemons as "nobody" instead of root. Educating yourself about security problems and their actual causes is important. I hate to seem like I am putting a message in for places to take classes, but there are a number of places to get security courses from.

Sans.org comes to mind first.

Educate yourselves to the real concerns and problems with security and join in the efforts to keep these attacks from being common place in the Un*x world.

Re:Psychology plays a role

[Anonymous Coward]

Well, I didn't then. I did shortly afterward, and now I don't run SBS at all.

Re:Psychology plays a role

[divisionbyzero]

That may be true, but if Linux is ever going to be successful as a desktop OS, then less knowledgeable people will have to be able to use it. When that happens, any underlying vulnerabilities or possible holes will become evident, and many folks will take glee in pointing out that Linux is not as secure as it could be. This supposed advantage of a knowledgeable user base will erode as Linux becomes more commercially successful.

Re:Psychology plays a role

[MadHakish]

I think we all know M$ is less secure due in part to the people who use it, however what no-one ever seems to mention is that the M$ Windows design is inherently insecure by default and can only get tighter from there? How many Windows admins do you know that comb through their internal security/group policies like some *nix guys do their firewall rules? very few if any.. I know guys who call themselves windows admins and don't even KNOW what the security policy settings are by default, or that they should change them. It's not a is linux secure question- yes it can be, given the proper factors. It's a why is m$ so insecure, and how does the methodolgy differ between windows and unix? Mutt will never execute arbitrary code and install backdoors because I viewed an e-mail laden w/ virii even if it were a linux virii.. The same cannot be said about 90% of outlook installations.

Re:Psychology plays a role

[julesh]

Yeech. What did they think they were doing? :-)

Re:Psychology plays a role

[divisionbyzero]

I think both of you may have a difference of opinion on what constitutes security. A highly integrated OS provides thick walls that will keep most attackers out, but once the attacker is in they have pretty much carte blanche. A modular OS provides slighlty less thick walls, but limits attackers as to what they can do once inside. It wouldn't be fair to say Windows embodies a pure implementation of the former and Unix the latter, but that seems to be the way they are biased. As in all engineering, there are trade-offs with either approach. Ergo, there is some security value in having a relatively heterogenous environment (i.e. don't run all your DNSs on one platform, etc...).

Re:Psychology plays a role

[frog51]

I have to take exception to this - in my fairly extensive experience running desktop and server security for major corporations I have found WIndows much more of a pain in the neck when trying to do anything non standard. And non standard includes securing anything.

(I will caveat that by saying that Windows 2003 actually looks pretty secure when configured correctly and it isn't as bad as earlier versions)

Under Linux you require pretty much the same effort to set up anything, whether it be normal or esoteric. And it works the same way every time so you can automate the process. I have not met a version of Windows which would be consistent. From one image, I can install on 5000 identical PCs using one script and get 15 or 20 different configs. WTF???

But it is all down to education. If Linux becomes the monopoly then all the grannies, computer illiterates and numptys will still do a default install and depend on whatever security is built in 'cos they won't know how to do anything else. Potentially we could be safer, as it should be easier to segregate users from machine space, but we need to enforce it.

I'm blethering - I'll stop now.

Re:Psychology plays a role

[poot_rootbeer]

Windows operates on an everyone is root notion, allowing anyone to make changes to system resource files.

BZZT

This is not true of NT-based Windows OSes, meaning pretty much all of the MS server solutions. In fact, NT has stronger access controls than a standard Unix-like system. ACLs anyone?

Re:Psychology plays a role

[mausmalone]

From what I've seen, there is a lot less common sense in the Windows community than there is for other less widely distributed OSes.

There's also a much higher percentage of 13 year old script kiddies and grandmas using AOL in the Windows community. Of course there's less common sense, and a lot of it comes from people being either too young to have experience or too old to bother learning, plus hundreds of other factors. An OS with an relatively high required skill level (linux) or one that appeals to a niche market (apple) is going to be devoid of a lot of the flotsam and jetsam of humanity.

Re:Psychology plays a role

[ro-boat]

As Linux distributions make installation easier more people who are not necessarily computer knowledgable will start using the OS. These users will not be so savvy because the installation did all of the configuration and the users did not need to find out about how their systems work.

Microsoft sells products aimed at the "Average Joe" who is not technical. This means that they have to hide many of the nuts and bolts and preconfigure much of the system. This would lead to a less secure system. As Linux moves into the mainstream it will face these same problems.

Re:Psychology plays a role

[jon3k]

FYI - you can run netstat -a on a windows machine as well. At least I can on this Windows 2000 machine. (yeah, yeah, they took my redhat9 box!)

Re:Psychology plays a role

[schon]

NT is capable of locking down capabilities between users, but do most places run their machine that way? No. They've created a bunch of users that have grown used to having the ability to destroy an entire drive

It's not just users, it's developers, too.

I can't count the number of apps I've seen that demand local administrator in order to run. Stuff like MusicMatch Jukebox.. I'm sorry, but why do you need admin privs to run a fscking MP3 player?!?!

Even MS has been bitten by this - the print spooler in Win2K had a bug when printing to network printers.. if the user didn't have admin priveledges, they could print, but the print spooler wouldn't have permission to delete the spool files.. so they'd accumulate until the drive overflowed (which was a real bitch if you'd upgraded from NT4, so your C: drive was limited in size.)

Although it's technically possible to restrict user privs under NT/2K, the mentatlity of developers frequently leaves the users with no option but to run with administrator rights.

Re:Psychology plays a role

[Anonymous Coward]

That doesn't make you one of them. For all we know you could have been their lab assistent.

I vote secretary.

I work with a bunch of sales guys - doesn't mean they know a damn thing about being a sysadmin.

Re:Psychology plays a role

[Anonymous Coward]

Linux is considerably harder to setup and configure when you need to do anything out of the ordinary.

Harder than what? It's been my experience that when you have to do something "out of the ordinary" in Windows, that it's typically impossible.

Example: I set up a webcam in our lobby, so that when the receptionist is away, that someone else doesn't have to leave their desk in order to see if someone comes in.

Under Linux, a simple CGI connected the webcam output to the web server.

Under Windows, it simply couldn't be done. Not possible. Our windows guys spent hours looking for software that would work with it, in any way..

Re:Psychology plays a role

[Anonymous Coward]

the extreme modular nature of Unix has historically been considered a security weakness

"historically considered" BY WHOM ?

Please cite references of actual, legitimate security researchers to back this statement up.

Re:Psychology plays a role

[I_redwolf]

No, that is NOT true. The NT seccurity model does not allow you to do this (without correctly authenticating as a user that is a member of the Administrators group). You can only do that if you're exploiting a bug in the code. If you're exploiting bugs in code, then you're operating outside the design of the security model.

This is the silliest thing I've heard. "You can only do that if you're exploiting a bug in the code". Hello? "If you're exploting bugs in code then you're operating outside the design of the security model"?!?! I'm archiving this post, primarily because it's the funniest thing I've seen all year.

Listen, i'm not here to make fun of people, but don't ever go to a job or into any other discussion saying what you've said above. I think maybe I should explain because it sounds as if you genuinely don't understand what security is.

If I give you a key, to your server room and you use that key to get in but everyone else can't because they don't have a key. Then you would feel you are secure, however; your server room has a window. So people without a key just enter through the window. Well, then it's operating outside the design of the security model according to you and that's just exploiting a bug in the way the server room was built, but then you have to wonder if this room was to be so secure why was there a window with no lock in the first place? Not only that but how secure are you when people can just come through the window and take the stuff out of the server room. Does your analogy above make sense? No, it doesn't, the room isn't secure and no matter how good you think the design model is (via the key) it's obviously, blantantly; insecure.

I said this like 4 times in this single thread but bugs in code that gain you priviliges rights or in the analogy made, access to the server room is a security issue. You can call them bugs in the code or exploiting a bug in the code if it makes you feel better. However, it'a security issue.

Re:Psychology plays a role

[mausmalone]

Unix security. I haven't seen it get in the way, and I haven't really got into groups yet. (Big gripe. I can't have NT users and groups with the same name. Stupid.)

Yes... we'll have a user Bob in group Bob! Seriously... users and groups with the same name are easily gotten around, especially since (in concept) a user is singular and a group is plural. Such as "Administrator" being a member of "Administrators." It makes sense if you go with the program.

I'm not a big fan of UNIX security. It's always been in my face, and more importantly, in my way. I can't do anything on my system with out being root, unless I do chmod 777 /usr. Also, the file permissions are so limited. I can set owner, group, and world priveleges... but what about another group's priveleges? In NTFS, I have (when need arises) created files and given R/W access to 2 groups (collaborating on the project) and R access to a 3rd group (observing the project). This is (AFAIK) impossible with your basic UNIX file permissions.

Also, the reason you don't get permissions in WinNT when you use DIR is because there's no way to format them correctly... it would be too clunky. It has nothing to do with importance. You'd have to put a "read" list and a "write" list... as well as "run" "print" etc... for each file. WinNT is, after all, based on the GUI. There's no need for a prompt at all, it's just there for backwards compatability. If you're browsing files that way, it gives me serious doubts on whether you're actually trying to use NT the way it's meant to be used.

Re:Psychology plays a role

[I_redwolf]

there's no such thing as a system that can contain an arbitrary bug and still be secure.

think about that for a while, and then think about your whole argument.

To make sure i'm not insane, or just hallucinating about this thread. I've invited others to read it. What you just said, has no relevance to the discussion or even the statements that I've made. If that's the way you feel then fine, but making statements about a system not being secure because of some "arbitrary bug" is moot; actually, it's not only moot it's pointless.

So while I think about that for a while, whilst thinking about my whole argument. How about instead of speculation. We take this argument out of the confines of slashdot and bring it into research. I've offered a machine which I can make available to whoever takes me up on the offer to participate in the "Windows doesn't operate on the everyone is root notion" contest.

Let me know if you're in I've asked several other people and would be willing to allow a group effort sort of thing. The box will be virgin WinXP and I'll allow whatever security additions to be added; fully updated, no 3rd party programs or utilities. You can have a full 2 days before I touch the machine then I will try for "Administrator".

Re:Psychology plays a role

[I_redwolf]

No, a good admin knows a systems weaknesses and strengths. There is no perfect system for all jobs, it just isn't rational thinking. However for someone to argue a weakness as a strength; that is highly irrational behavior. It's akin to the Iraqi Information Minister telling everyone that the war is going great.

A good admin knows when you need to secure something or you need die-hard stability. You don't go to windows and for good reason. In similiar fashion when you want a desktop for the little kid across the street to play video games you don't give the kid an OpenBSD or VAX machine.

If you're a devoted Windows admin that has a little unix-like box laying around more power to you, nothing wrong with that. If you think windows security is bar-none you're wrong and people including myself will point that out. If you feel i'm some unix bigot that won't respect Windows security you would be wrong. I love unix in all it's flavors minus SCO and DEC but I don't detest the latest versions of Windows, Windows 2000 is useful, NTFS I like alot, especially encryption on the fly. You see, I simply make rational choices when it comes to the best tool for the job. Windows for security is not the best tool for the job in comparison to Unix. That's a fact. If you're an admin and don't realize that, then you aren't as good of an administrator as you thought.

Re:Psychology plays a role

[mausmalone]

What your describing sounds more like fault tollerance, not security, and you're neglecting WinNT. NT-based systems have much more robust user premissions and policies. I can prevent any user from editing system files I want to... it's just not the default setting.

But when a comptuer system doesn't "fold like a house of cards," it means that it's stable and fault-tolerant, not secure. Secure would mean that nobody could attack it in the first place.

Re:Psychology plays a role

[mausmalone]

Also when you say comprehensive user security model can you elaborate? IE: ACL's, chroots, jails etc etc. I find it hard to believe that NT3.1 and every version of windows based on it has a such a model.

Actually, he can't elaborate on it... it's just there. It's not like you run a configurator to use it... you just open the permissions and change them. User policies have been in NT since 3.1 and have gotten more and more robust with each version. I've used them to actually increase users' permissions (i.e. Burning CD's requires admisinstrative access normally, but simple power users needed it too... so rather than elevate them, give them burner access). I've had little reason to edit user permissions and policies as the default groups usually get the job done. Windows has everything you need built in to allow you to very specifically decide what a user can and cannot do/access, but there's no real way to cite examples of such tools... they're just tabs on a dialog box.

Re:Psychology plays a role

[Anonymous Coward]

Yeah.. of course no one posted about bugs that were patched a month before a worm came out.

Re:Psychology plays a role

[mausmalone]

They had all kinds of stuff installed that should never have been there. They never cleaned things up. Based on that, I would say there are probably other Linux boxes out there administered by idiots.

Then call me idiot.

I just don't see why an OS needs to be "cleaned up" at all. Why install it if it's not supposed to be there? It's just that every time I use Linux I feel like I need to be psychic to avoid being an idiot. Say it's your first linux install... how do you know (a) that things have to be "cleaned up" at all, (b) what to clean up, (c) which things should not be touched at all? I have a hard enough time with the antequated incomprehensible file organization system (there are like 6 bin directories,... what's up with that?) without having to psychically guess what stuff needs to go.

With windows, if I'm a competent user, I install, answer a few simple questions, and run Windows Update, which cures my system's ails. There's nothing I need to remove, as most stuff is disabled by default.

All Register readers will know of the O'Really book cover Distributing Clue to Users. I just wish someone in Linux land would realize that that's what needs to be done. Instead of telling me that I'm an idiot for not knowing, tell me what I need to know. And don't look down on an IT staff that only uses Windows when they don't get Linux immediately. A Windows user has no need to how to administer Linux, just as a bunch of the Linux users in this thread have shown complete incompetence for the NTFS file system. It's out of your scope of expertise... you shouldn't need to know something that doesn't affect you.

Re:Psychology plays a role

[oobar]

No, everyone is not root and everyone cannot make changes to system resource files. At least, if setup properly. If you always login as Administrator then you might have the false impression that this is true. But on a system installed by an administrator that has a clue, it is certainly possible for users to not be able to read or write parts of the registry, files, etc. Just because you don't know how to do this doesn't mean it's not possible. Everyone is NOT root!

Re:Psychology plays a role

[xenoandroid]

The point was not that I learned how to use a mac (I was only stating it was my first platform) but that after starting with a platform that was fairly simple to use I was still able be put in front of a Windows machine and told to do something and even if I had never seen anybody use the start menu before I would figure out how to launch a program within minutes. The choice of OS has to be at least influenced by inteligence otherwise people would chose Windows ME to run a life support unit in a hospital, even if it's only knowledge influenced, how do you gain that knowledge. A computer needs specific instructions along with input data to make a decision, humans should be able to make a decision without direct instruction.

Re:Psychology plays a role

[Anonymous Brave Guy]

If you have a dodgy CGI script on an IIS server, may god have mercy on your soul. With Apache your chances are much better.

OK, your turn: post an example or STFU. How are your chances better with Apache, exactly?

But this has nothing to do with the underlying operating system. Apache can run on windows, too.

Indeed, but in the case of my example, it was a Linux box set up by geeks who were generally competent. They just missed something, and as a result once a cracker had some access, they got root. So much for Linux being inherently more secure, it's user-specific privilege model limiting the damage, yada yada.

That is irrelevant. What the grandparent is saying is that an average Unix power user could potentially block a virus on his own, wheras with Windows this would be next to impossible.

Again, post an example or STFU. I consider myself, amongst other things, a Windows power user. I have never, to my knowledge, had a virus on a system I run, nor been infected with the various worms, etc. Go figure.

And as for Windows not going anything... You do know what Windows Update is, right? Microsoft released a patch that would have stopped MSBlast dead a month before it came out. Smart users installed it, and we don't have MSBlast. Go figure some more.

Re:Psychology plays a role

[blankinthefill]

While that all might be true, what if the point of the virus is to ruin only Linux based systems? I know this sounds far out, but there are people who would like to strike back at these "systems-savvy" users that you describe. And hey, everyone knows that most "systems-savvy" people use Linux. What would be cooler than shutting down the established leaders of the tech world? And even then, the virus could be probing for data on systems, not just wreaking havoc on a world-wide scale. Those who would be the easiest to hit in a case like this might almost be those that are most secure in their security, because it would be unexpected. And from what I have seen/heard/read, most Linux users fall within that group.

Re:Psychology plays a role

[reallocate]

I think you're confusing a person's intelligence with what that person knows.

People choose what they learn, but they are born with a level of intelligence that they cannot change. To use your example, somone doesn't run Windows ME in a life support unit because they know that's the wrong option, not because their intelligence level is higher, or lower, than others.

Yes, intelligence influences what people learn. Some things are more difficult to understand than other things. (Otherwise, no one would remember Hawking, Einstein, Newton, etc.)

But, no, choice of an OS isn't an indicator of intelligence. Knowledge, yes, if someone bothers to learn what they want from an OS and what each OS offers.

Remember, too, that each personal computer OS is pretty much the same as the others. They all have to run on the same hardware, display on the same kind of screens, open the same kind of files, etc. At the interface level, there's hardly any real difference between X, the Mac, Windows: The user clicks on something, and something happens.

Re:Psychology plays a role

[xenoandroid]

I know that intelligence cannot change, but my point is that inteligence allows you to recognize patterns. If you sit in front of a monitor and click on the word 'file' you'll notice that a menu comes down, you click 'edit' you'll notice that another one comes down, so it's pretty safe to assume that all the words on that bar are menus with different functions. You seem to think that everyone has to be taught through a method they're already familiar with to learn how to use their OS. You still have to be intelligent to be able to make associations between your knowledge. Open up your favorite word processor and type this: Windows has a lot of viruses and is easy to exploit Linux is much harder to exploit but is more difficult to learn Mac OS X has few viruses, is about as hard to exploit as Linux, but is easy to use a the same time. However it requires different hardware. Save that file and see if your computer can recomend an OS for you based on that data. Can it? No because it doesn't have any form of intelligence to make use of that data. Sure you could program some kind of alogrithm that would give you a recomendation, but then again that's a human writing that code. My point is, that you have to have some inteligence to even use the knowledge anyway. Some people have all the information they need to make a logical choice right in front of them, but it ultimately boils down to "Windows has the most programs and according to tech guys who want my money, is the most compatable. Oh and my friend Fred said that macs are stupid even though the last mac he used was a Macintosh Plus. So I think I'll get Windows, I heard of Linux but most people say Windows and so I'm going to get it." Some of that is knowledge and some of that is illogical reasoning. Someone more intelligent would factor in what they want to do with their new computer and look at the hard, updated evidence. If you still don't get what I'm saying then I'm just going to give up trying.

Re:Psychology plays a role

[feronti]

D'oh! That's what I get for posting on something I barely know... I just know I disabled some kind of RPC and rebooted, and ended up with a paperweight. Anyhoo, thanks for clearing that up for me.

Re:Psychology plays a role

[jethroT]

With windows, if I'm a competent user, I install, answer a few simple questions, and run Windows Update, which cures my system's ails. There's nothing I need to remove, as most stuff is disabled by default

If that were the case, all those Outlook worms never would have happened. The first thing you have to do on a windows box is to turn off a lot of "features" in Explorer and Outlook.

I concur with the rest of your mail though, underneath the graphical interface Linux is far from user-friendly. Compare that with windows which is underneath just unusable.

Re:Psychology plays a role

[mrob2002]

Yeah, but that's my point, it throws up a list of many many open ports. My linux servers put up a list of 2 or 3. It's all the service interdependencies in Windows which makes it harder to close everything down.

Re:Psychology plays a role

[lars_stefan_axelsson]

You stupid bastard. you missed the point completely. Re-read the post, and try again.

No I didn't. I just limited my reply to was was factually incorrect. Now be a good little boy and sign your name to your next ad-hominem.

Re:Psychology plays a role

[Tony-A]

The biggest security hole is a false sense of security.

The "Big Linux Worm" is waiting to happen and it will a doozie.
Almost certainly true. The questions are:
1. How long before "under control"? How difficult?
2. How long before eradication? How difficult?
3. Should I be worried about it?

Considering that the response to Microsoft worms has been much quicker and better on the Unix side of the fence than by Microsoft at least from Melissa, I'm not particularly worried. However, long-term survival without useable backups is questionable.

Re:Psychology plays a role

[rossdav]

I can't say that replacing a Microsoft monoploy with a Linux monopoly looks like any advance to me. Linux development is still way behind Windows in terms of features, in particular security features. Security does not only come from lack of bugs, it is also a matter of support for security features and tight integration of those security features.

I've been a Unix admin for over 15 years and a Windows "admin" occasionally since Windows 3.1. This statement smacks of someone reading the NT kernel books without actually using these OS's in real life.

I agree that the services the NT kernel provides (such as Kerberos-like tickets and authentication token passing) are great in theory (although I could have a whole other discussion over whether the Access Control List idea is way more trouble than it's worth vs. the Unix approach), in the end the "Windows Operating Environment", as I like to call it, doesn't make use of this functionality. The applications that everyone uses on top of this rather sophisticated kernel ignore this functionality and turn the machine back into a "personal computer", giving you full access to wreak havok on the machine. Tight integration? Give me a break.

I remained unconvinced that the Windows way is better than the Unix way. The Unix security model is simple and effective. The multi-user history of Unix means it has a good handle on the problems that Windows is trying to retrofit.

I think we all agree that kernel bugs are rare (for either OS), and the entry point to any machine on the Internet are the services it makes available to the network. These are the concerns. I don't expect Unix or Windows to be better or worse at bug-free code for their services. Software sucks universally. However, I believe the Unix model lends itself to better isolation of problems with network services and preventing spread of things like viruses/worms. As I said however, it's certainly possible. I don't think anyone is denying Unix has been lucky because we're less interesting. (And sendmail? Come on - it was one of the first applications to be exploited - we all learned from that. Except maybe MS!)

And Windows code reviews? New security religion? I'm not holding my breath.

Re:Psychology plays a role

[Anonymous Coward]

more lies and bullshit from the windows zealot. you lie about working for MSFT, that is a FANTASY. You lie about what you do. Your code samples are all broken and lies. You have no open code that is even remotely significant available.

You are a dad man, Haken, a liar, a cheat and a fraud.

Keep up your stereotyping. You fucking loser. Windows kiddie zealot makes no money loser.

Re:Psychology plays a role

[Anonymous Coward]

In one word: http://bash.org/?4753

it's called MSBlaster, not Blaster.

[rokzy]

understand the reason and you'll answer your question.

Short answer No, Long answer Maybe

[Anonymous Coward]

Personally I have all my end-users sign on as root. So far so good

Re:Short answer No, Long answer Maybe

[deranged unix nut]

..sigh..

I wish this were so funny. The last two VARs that a business I know of has gotten accounting systems from have configured the systems so that all of the users did log in as root.

Re:Short answer No, Long answer Maybe

[EvilTwinSkippy]

That's OK. Someone was relating to me how a PHD thought turning the local system console off (physically) on a Sun server increased security.

Re:Short answer No, Long answer Maybe

[johnlcallaway]

Wanna hear something sad?? I have Unix developers who want root access because when they type 'find / malloc.c', it returns too many 'permission denied' messages. I tried to explain that if they tack on '2>/dev/null' onto the end, the errors messages would go away and they would still find their file.

Their response?? That's too much work.

It doesn't make any difference how tech-savy someone is. Secure systems by their nature prevent access to features. If the perception is that it takes longer to get something done because of the security, people want security turned off.

That's part of the reason why M$ so insecure, Bill Gate$ has made it too easy to use. My fiancee runs her XP laptop without any login, just turn it on and there you are. So much for security. I gave up trying to explain to her why she needs to login to use it. The standard answer is it takes too much time.

I guess getting to email and solitare quickly are more important than making sure all the personal data she has on it is safe.

Re:Short answer No, Long answer Maybe

[Electrum]

I have Unix developers who want root access because when they type 'find / malloc.c', it returns too many 'permission denied' messages. I tried to explain that if they tack on '2>/dev/null' onto the end, the errors messages would go away and they would still find their file.

Why didn't you teach them about locate?

Re:Short answer No, Long answer Maybe

[mkldev]

If that includes blocking access to the startup configuration, then it does increase data security. as any computer security person will tell you. It means you can't boot from a CD or an external drive and gain root access trivially. If the method of locking the console also locks the case closed, it also makes it much harder to rip the machine open and steal the drives.

Rule #1 of computer security:
If you don't have physical security, you don't have security.

Re:Short answer No, Long answer Maybe

[Qbertino]

Unix Developer: "If I'm supposed to fix this I want root access."

Admin:"Why that?"

Unix Developer: "When I try to 'find' stuff and such I get all those 'permission denieds' that me head so hazy and all and I can't see the real info I need, understand?"

*long pause, Admin making a faceless stare*
*Admin remains faceless, pulls out Deagle*

BLAM!BLAM!BLAM!BLAM!BLAM!BLAM!

"Yeah, shure. I see."

Re:Short answer No, Long answer Maybe

[dividius]

That's part of the reason why M$ so insecure, Bill Gate$ has made it too easy to use

While I agree with the general security-mindedness of this comment, it seems naive to blame 'Bill' for making the systems too easy to use. It begs the question: If he hadn't, wouldn't somebody else have? In other words, I think the issue is not so much msft, as the general user culture. Msft is a moderately responsive company, if users had requested greater security earlier, there would be better security today.

Re:Short answer No, Long answer Maybe

[frink_exp]

Secure systems by their nature prevent access to features.

I see. So by making the United States "more secure" with the USA PATRIOT Act, we've been prevented access to such features as civil liberties. Sorry for the off-topic post, but it's the first thing that came to mind when I read that.

Re:Short answer No, Long answer Maybe

[Anonymous Coward]

Hahaha, your life is so pathetic and powerless. Like all other administrators, you make up for a shortcoming in almost all areas of life by being a tyrant in the one tiny spec of the world where you actually matter.

Re:Short answer No, Long answer Maybe

[Anonymous Coward]

have Unix developers who want root access because ...

THis is your mistake. You don't have "unix developers." You have stupid ex-dotcommers who know a bit about Unix posing as Unix developers.

Perhaps you should hire experienced, degreed professionals instead of the cheapest help you can get!

Re:Short answer No, Long answer Maybe

[MrResistor]

locate is hardly a standard feature in the Unix world.

Re:Short answer No, Long answer Maybe

[kapok_tree]

I've had reasonably good luck explaijing to my users that not having a password, or having a simple password, is like not having a lock on the front door of their house. Usually they can grasp that analogy. Thank the gods I don't live in an area where people are trusting enough to not lock their doors....

Re:Short answer No, Long answer Maybe

[thaths]

I have Unix developers who want root access because when they type 'find / malloc.c', it returns too many 'permission denied' messages.

What are they doing trying to find malloc.c? Search and removing SCO's intellectual property?

Thaths

Re:Short answer No, Long answer Maybe

[lylum]

>My fiancee runs her XP laptop without any login, just turn it on and there you are. So much for security. I gave up trying to explain to her why she needs to login to use it. The standard answer is it takes too much time. Well... it doesn't really matter. Her personal data won't be safe because she uses a windows xp login, last I checked they didn't have the data encrypted.....

Re:Short answer No, Long answer Maybe

[Anonymous Coward]

Hah -- Unix oldtimers are the worst - born and bred in the oldtimey academic nosecurity culture that dominated the Unix world. Security is for the little people.

At least the dotcommers have heard about HaX in Counterstrike or whatever.

Re:Short answer No, Long answer Maybe

[squisher]

Their response?? That's too much work.

Your problem can be easily solved: Just replace the find binary with a shell scrpit that adds the error redirection and you have the desired effect without root access! They don't have anything to complain about and no extra work for them (even though an alias on the user configuration could of course do the same but then THEY would have to do it).
In Windows I don't think you can just change an option in the search dialog though... ;-) (or if there are, they are (a) more complicated and (b) would probably disappear and/or break after a new service pack)

~Squisher

Re:Short answer No, Long answer Maybe

[BrynM]

I have Unix developers who want root access

You have a different problem than the "I don't understand why" user. Inside, these developers are really saying "I'm not just some stupid user. You can trust me with root access. I know how the OS works at it's core." When I run into one of those, I just tell them "and that's why you won't get root either".

Re:Short answer No, Long answer Maybe

[Anonymous Coward]

Yeah, you're right.

just checked for you...

Re:Short answer No, Long answer Maybe

[Burning1]

Try: alias find='find 2>/dev/null', or locate(1).

Re:Short answer No, Long answer Maybe

[Zebbers]

writing this from a win2k lappitytop....as a person with 3 linux boxes in this room...

what the hell personal data does she need to protect, and who the hell wants it?

thats what i thought...

Re:Short answer No, Long answer Maybe

[Anonymous Coward]

find / -name malloc.c

As a clueless admin you're probably not very convincing to the developers on your machine. Know your stuff and maybe they'll repsect you more at your next job.

Re:Short answer No, Long answer Maybe

[Dr. Photo]

Their response?? That's too much work.

Time to start interviewing their replacements. >:-]

Re:Short answer No, Long answer Maybe

[MegaFur]

But if they keep ranting, surely it could be installed...

Or, perhaps you could make a shell script of `find' that takes their perameters, then runs the normal `find' with `2>/dev/null' on the end.

Those are just ideas that pop up. I'm sure you can find (no pun intended) some solution to the problem other than giving them root access.

On a related note: if they feel `2>/dev/null' is too much work, then they obviously haven't been indoctrinated into the Unix culture yet. It's important that you manage to somehow do this as quickly as possible. Until you do, they will find quibble after quibble to rant over: "vi doesn't work right--I can't copy/paste!!--windoze key don't work" etc, etc.

Re:Short answer No, Long answer Maybe

[EvilTwinSkippy]

Nope. This was simply turning the power off to the CRT.

Re:Short answer No, Long answer Maybe

[Anonymous Coward]

set up an alias like:
alias find="find $@ 2>/dev/null"

Or at least something like that.
I think that would solve your problem (at least for find)...

If they start whining, simply tell them they are too lazy to do it by themselves, and you did it for them.

Re:Short answer No, Long answer Maybe

[Anonymous Coward]

You mean does he get satisfaction from doing his job properly?

Re:Short answer No, Long answer Maybe

[peterpi]

If you wnat to shut up a particularly annoying luser, you could rename root to something else and then create a regular user called root. You'd be amazed at how effective it is!

Re:Short answer No, Long answer Maybe

[MrResistor]

But if they keep ranting, surely it could be installed...

Assuming it's been ported. (I honestly don't know, I don't use it.) That's a big reason why I decided to actually learn the standard tools like find and vi, rather than their more "user friendly" analogues.

Or, perhaps you could make a shell script of `find' that takes their perameters, then runs the normal `find' with `2>/dev/null' on the end.

Those are just ideas that pop up. I'm sure you can find (no pun intended) some solution to the problem other than giving them root access.

You could also make all your directories searchable. My solution would be to just say "No, you can't have root access. Sack up and learn to use your tools."

On a related note: if they feel `2>/dev/null' is too much work, then they obviously haven't been indoctrinated into the Unix culture yet. It's important that you manage to somehow do this as quickly as possible. Until you do, they will find quibble after quibble to rant over: "vi doesn't work right--I can't copy/paste!!--windoze key don't work" etc, etc.

You make an excellent point: I thought these guys were supposed to be Unix developers! They don't know it well enough to not have to base their finds at /?

I think its the apps

[tlacicer]

I think website defacement and Linux security are 2 different issues all together. From my own experience any website that I have had defaced on me was because I failed to update 3rd party OSS packages. This had nothing to do with the security of of the operating system or the web server for that matter. It was only a security hole in one php script. This security hole was identified and patched rather quickly but I failed to apply the patch in a timely matter. But the rest of my websites were fine along with the rest of the services running on that box.

My opinion is that there are a lot of free / cheap web hosts out there running OSS and a lot of people publishing web pages and message boards using scripts that someone else wrote and not updating them.

I would like to see a comparison on the types web pages that were defaced and what was actually done, I bet most of them had nothing to do with operating system the website was running on.

Re:I think its the apps

[sjwt]

ok,
but by the same logic runs for
MS too.

IE and Outlook are not the OS,
no matter how much MS winges
about IE being intergrated into the
OS :)

Re:I think its the apps

[deranged unix nut]

I disagree.

The point of security is to prevent people from doing things that they should not be able to do.
If they shouldn't be able to deface a website, and they do, then there is a security failure somewhere in the system.

Now, the security failure might be due to the Admin, the OS, the user, or the scripts...but it is still a security failure.

If it is due to the Admin, then maybe the OS is too complicated to properly secure.
If it is due to the OS, then it is definately an OS problem.
If it is due to the user, then maybe the OS is too complicated and/or time consuming to secure.
If it is due to the scripts, then perhaps the OS should include some security audited scripts.

Re:I think its the apps

[Anonymous Coward]

IE and Outlook are not the OS,
no matter how much MS winges
about IE being intergrated into the
OS :)

Care to enlighten us on how to remove IE from an XP system?

Re:I think its the apps

[tlacicer]

Well not exactly, remember those are Desktop applications that were written by M$ and included in the desktop.

I am speaking about web applications written by third parties. I am pretty sure that if Linux started writting PHP message boards they would be pretty darn secure :)

Just a side note .. I know this is off topic .. but have you ever tried to open an M$ Access DB over a network share from a machine with a FQDN? You get a security error. You have to go into IE and change security settings there for M$ Access to be able to use that share :) ..

Re:I think its the apps

[sphealey]

First, arrogance preceeds a fall, and that is as true of system security as anything else. So Linux users/admins should not become complancent/arrogant

IE and Outlook are not the OS,
no matter how much MS winges
about IE being intergrated into the
OS :)

Still, I have to disagree with you a bit here. Internet Explorer is very deeply embedded into the core OS. And other technologies are quite deep as well (ever try fully removing Windows Media Player from a W2K Server build and keeping it removed across service packs? Not a trivial task - but what the heck is WMP doing in a server build to begin with?).

This intertwing of core functions with much less secure access and presentation functions does IMHO make Microsoft products less secure by design. There is also the issue of Bill Gates deliberately creating a corporate culture where everything has to be reinvented from scratch. Well, sometimes the work done by other people was good work, or done for a resaon. People inside Microsoft seem to miss that thought a lot.

sPh

Re:I think its the apps

[tlacicer]

Dude .. if the OS is hacked due to admin failure then it is the admins fault not the OS, if its default install is weak then that is a different issue.

The operating system does place limits on what web applications can and can't due to the system, but it would be impossible for it to know when a peice of code was being mis used improperly, cause technically the code is doing exactly what it was supposed to do.

Re:I think its the apps

[BrynM]

I think website defacement and Linux security are 2 different issues all together.

Exactly! People tend to trust website "packages", like PHP-Nuke or site building applications a little too much. They tend to assume that someone has already fixed whatever security holes may be in it. When I installed PHP-Nuke (yes, I actually use it) I went through the PHP code with a fine toothed comb before I opened the site to the public. I found lots of potential SQL injection, external file call and global variable exploits that needed fixing. Since these sites usually end up being run on Linux and Apache, Linux and Apache get blamed when the site is defaced, when the actual weakness that led to the defacement was in the PHP/HTML pages themselves.

I don't expect everyone to know how to clean up security for a PHP site, but if they decide to use what they don't understand bad things will happen. If you know a novice that wants a site, start them out with some static HTML rather than let them use whatever code strikes their whim as "neat", "shiny" or "cool". Explain to them that they are learning how to eventually do the "shiny" stuff, but they need to learn how to use it safely first.

Re:I think its the apps

[Anonymous Coward]

It was only a security hole in one php script. This security hole was identified and patched rather quickly but I failed to apply the patch in a timely matter.

Imagine that. The flaw for Blaster was found and patched about a month before Blaster took hold, but many people failed to apply the patch in a timely matter.

The thing is, all the major viruses that hit Windows computers are exploting security flaws that have been fixed, and yet very few people update their systems, even now. And until a system is in place that people trust, viruses will run rampent.

Re:I think its the apps

[commodoresloat]

From my own experience any website that I have had defaced on me was because I failed to update 3rd party OSS packages. This had nothing to do with the security of of the operating system or the web server for that matter. It was only a security hole in one php script.

I think one could say the same about Windows, no? It has nothing to do with the security of the OS if hackers find vulnerabilities in a commonly used application (e.g. Outlook).

Re:I think its the apps

[tlacicer]

format /u c:

Re:I think its the apps

[PetWolverine]

Similarly, though, most MS worms and viruses exploit not holes in the operating system, but holes in various common programs that are Windows-specific. Blaster is an exception, but SoBig and Slammer are excellent examples--one exploits Outlook and the stupidity of many users, while the other exploits a small hole in Microsoft's SQL server. Neither, strictly speaking, exploit flaws in Windows itself. Even Blaster exploits a flaw in a network service that at least shouldn't be part of the OS, at least by the *nix OS-design paradigm.

When determining how secure an operating system is, it is essential to take into account the security of all the various programs people will run on it. Linux itself is very secure, but mostly because it doesn't do anything; all the potentially dangerous work is left to other programs, which often screw it up. Take a look at sendmail, for instance, and try to tell me it's more secure than a Microsoft product. Looking at security from this perspective, Linux isn't really an operating system, but rather the whole *nix category should be considered (in many ways) one OS.

When determining the security of a particular system, not only does the specific implementation of *nix become relevant, but the programs you run remain relevant--only now it really is the programs you run, not the programs that are available. Obviously the next root exploit in sendmail won't affect me if I'm running postfix. If I instead write my own mail server (just to keep the same example), it might be very secure through obscurity, but (since I'm a sysadmin, not a programmer) it won't be very fundamentally secure.

Basically, security is a lot more complicated than simply "Windows sux0r5." Bad programming and bad configuration can make any operating system insecure, and assessing the security of a particular system is quite a different thing from assessing the security of an OS in general.

Re:I think its the apps

[Gherald]

> Care to enlighten us on how to remove IE from an XP system?

www.google.com/search?q=uninstall+internet+explore r+6.0+xp

Re:I think its the apps

[Anonymous Coward]

Shouldn't that be:
format c: /u

Re:I think its the apps

[Master of Transhuman]

"it would be impossible for it to know when a peice of code was being mis used improperly, cause technically the code is doing exactly what it was supposed to do."

BWAHAHAHAHAHAHA!!!

Dude...

Re:I think its the apps

[B'Trey]

Yes, website defacement and Linux security are two different issues. We're definitely comparing oranges to penguins here.

Most of the comments about Windows insecurity were in the context of viruses and worms, not direct attack from a [(cr)h]acker. A group of people attacking web sites has a limited effect on the rest of the web. Even taking down, say, Google, wouldn't have that much of an effect on the 'net as a whole. Sobig.F has severely hampered email for everyone, even those who do not use Windows.

It might be possible to write an effective worm that attacks Linux machines, but doing so is likely orders of magnitude more difficult than doing so for Windows. And web site vulnerabilities, while somewhat troubling in their own right, don't change that fact at all.

Re:I think its the apps

[Deadplant]

no. you can't say the same thing for windows.
IIS is a major source of security holes. There have been many major worms that exploited vulnerabilities directly in the IIS server software.
Windows itself has a pretty bad track record too. one of the latest worms uses a windows RPC security hole to spread.

linux+apache is waaay more secure than windows+IIS

Re:I think its the apps

[Anonymous Coward]

It doesn't matter. Anything that runs under Linux is considered part of Linux by the less than computer savy Windows user. It is easy for a company to state their is a vulnerability in OSS software and characterize it in terms of Linux. This is done by analysts all the time when comparing Windows security to Linux.

For example Linux gets blamed for vulnerabilities in Bind 4/8 even though Bind 9 has been around for a while. Linux gets blamed for wsftp (yes, the Ramen worm got me) vulnerabilities even though there are several ftp server alternatives. None of them are Linux but are so closely bound with the Linux/OSS movement that they are perceived as the same.

And therein lies the problem, perception vs reality. The perception of the world is these are Linux vulnerabilities, the reality is they are application specific vulnerabilities.

Re:I think its the apps

[lorien420]

I think one could say the same about Windows, no?

Exactly, you can't say the same thing about Windows. When the Operating System bundles and prods the hell out of the user to use things like Outlook, it is immediately judged as a flaw in the OS.

Re:I think its the apps

[deranged unix nut]

Sure, and just because a Nuclear Reactor control room has the "Critical core temperature warning light" right next to the "Bathroom is out of toilet paper warning light" where the operators are likely to miss it also means that the meltdown is a human error!

Go read "Normal Accidents" and learn a little bit about usability before you blame all misconfigurations on the admin.

Re:I think its the apps

[jpsowin]

Right, like MSBLAST? RPC call is wide open. What about the MESSENGER service? Wide open for spammers. That's not third party stuff, that's built right in.

Now, I'm in agreement that it is sometimes the applications, but Outlook does come with the OS and is developed by good ol' MS themselves---that isn't a third party app.

Re:I think its the apps

[Anonymous Coward]

The flaw for Blaster was found and patched about a month before Blaster took hold, but many people failed to apply the patch in a timely matter.

You had about 3 days after it was announced before the hole was actively being exploited in the wild.

Re:I think its the apps

[Karl Cocknozzle]

I checked the MS article your Google search returned, but I think perhaps you're being a little disingenuous. Read this part (shoe-horned in at the very bottom of the page):

Internet Explorer 6 is preinstalled by default in all versions of Windows XP. To provide computer manufacturers greater flexibility in configuring desktop versions of Windows XP, Microsoft has made it possible for OEMs, administrators, and users to remove user access to Internet Explorer while leaving the Internet Explorer code intact and fully functional to ensure the functionality of programs and operating system functions that rely on it. For example, Windows XP supports an "IEAccess=off" switch in the Unattend.txt file, and Internet Explorer has been added to the Add/Remove Windows Components section of the Add/Remove Programs tool in Control Panel.

Since UNATTEND.TXT is the config file for an unattended installation of Windows, this is not really an uninstallation procedure so much as a way to keep a user from invoking Internet Explorer in a NEW Windows install. If you have a Windows XP machine that you bought pre-loaded with XP, the only way to take advantage of this is to re-install Windows. (And what do you want to bet MS has some language in their OEM deals that says any OEM actually using this switch will be sacrificed to satan.)

Not a very helpful feature for those of us who would like to be rid of it without starting from scratch.

Further, since the code is "Fully functional" you can assume any exploits in the IE code will also be "fully functional" whether you set this switch at setup or not.

Re:I think its the apps

[Gherald]

Perhaps, but at least no user will be using it to access insecure ActiveX sites, etc.

But you are right, the solution isn't very practical. Microsoft probably only implemented it part of a settlement with the justice department, or to satisfy the demands of certain large corporate clients.

Re:I think its the apps

[Politburo]

Part of the WMP thing is that there is very little difference between version of Windows 2000. For the most part, it will just let you use more RAM/CPUs. The different names are just marketing gimmicks, and perhaps therein lies a problem.

Re:I think its the apps

[deadcasuals]

I think one could say the same about Windows, no? It has nothing to do with the security of the OS if hackers find vulnerabilities in a commonly used application (e.g. Outlook).

Outlook is hardely a 3rd party package... :) In fact, Outlook security has a lot to do with the security of the underlying OS. Many of the security vulnerabilities for IE also affect Outlook because it's used for rendering HTML emails.

I think the Unix/Linux philosophy of separating funtionality goes a long way in improving overall system security. A vulnreability in one piece of software does not automatically lead to vulnerabilities in other packages.

I'd give my right arm to be ambidextrous.

Re:I think its the apps

[Anonymous Coward]

For one, the FS/OSS community shouldn't touch the reinvention of the wheel at all. Damn it, is there something you guys have not tried to re-invent? Your last reinvention was OSS-based FUD against MS & Co.

Re:I think its the apps

[PrImED73]

This had nothing to do with the security of of the operating system or the web server for that matter. It was only a security hole in one php script.

Agreed, there are many instances of people using existing/creating Perl and PHP scripts that end up being exploited, an example being redirect of output to overwrite existing content or write new content in the same directory. At the end of the day, if these scripts arent tested fully for these kind of flaws, the user on the server who puts the scripts up is their own security risk.

Re:I think its the apps

[Kenja]

Bingo. And lets not forget that if not for outlook we would have our PHB launching attachments named rootme.sh.

Re:I think its the apps

[perlchild]

package management and update/patch distribution do contribute a great deal to a secure system.

Microsoft just happened to flunk this particular aspect of "secure by design"(i.e. applying a patch that reinstalls a component that was removed for security is pretty bad), at least compared to debian, and several others. The Granularity aspect of microsoft's packages is especially lacking.
Think on how a single "package" provides a smtp server, a web server, an indexing/search engine,an nntp server, the admin for all the above and several other components, including a web api(front page) that needs to be reinstalled on every client site with EVERY upgrade...

A lot of those "design decisions" were based when marketing seemed to have overruled engineering... Otherwise, a better update/packaging system would:
1) have been provided by microsoft, not a partner supplying parts, while microsoft supplied another, and huge fees levied for developers to use it
2) have been ready by windows 98 or so
3) been more granular (i.e been less oriented towards "Oh this office 2010 is better than office 2009!" and more towards "We have improved the word component of Office 2009 and it's now Office 2009.2")

In this case, the low-marketability of security alone might explain why apple and linux are better at it than Microsoft. Microsoft could market refrigerators in Antarctica... Linux and Apple, have enjoyed no such successes, they however, have been more successful in putting together different "marketable units".

Re:I think its the apps

[Some Dumbass...]

From my own experience any website that I have had defaced on me was because I failed to update 3rd party OSS packages. This had nothing to do with the security of of the operating system or the web server for that matter. It was only a security hole in one php script.

I think one could say the same about Windows, no? It has nothing to do with the security of the OS if hackers find vulnerabilities in a commonly used application (e.g. Outlook).

To take this one step further, you could probably make the even more general argument that almost nothing really tells you which OS is more secure. Rather, break-ins involving a particular piece of code only tell you that the particular piece of code is insecure. You could argue that website defacements really measure the security of webservers, other web-related packages (PHP, shopping cart programs, and the like) and perhaps the security of other servers on the system, all depending on what exactly was used to break in to the system. Technically, even the security of other systems on the same network could play a factor (e.g. if someone roots the mail server and the root user has the same password on both the mail and web servers).

A big part of the difficulty here comes in splitting out applications from OS. Internet Explorer, Outlook and Media Player 9 are all technically applications, but I'm not sure that any of them can be properly "removed" from newer versions of Windows, at least not by your "average joe". Likewise in the Linux world, while it is rather clear that video games and the like are applications and thus separate (though some people insist on counting them in their Linux "vulnerability" lists anyway :) it gets harder when dealing with programs like SSH or LPD. SSH is third-party, but it's in such common use and is by far the preferred terminal server on Linux, so it seems as though it should count as part of the OS. Likewise, although LPD has sort of been replaced by CUPS, it's still in common enough use, and supplies a sufficiently basic function (printing), that many people count it as part of the OS. Yet I personally am not running either LPR or the SSH server and still have a perfectly functional Linux box, so they're hardly required parts of the OS.

Needless to say, comparing the security of OSes based on the number of times their applications are compromised is awfully hard to justify. If you include applications with the OS, then you beg the question: "which apps"? If you don't include applications with the OS, then in many cases one OS has much greater functionality and thus more opportunities to be compromised, so the comparison still seems unfair (having an always-on RPC server does provide functionality, you must admit).

Frankly, I'm starting to think that this argument should just go away. Nobody seems to agree on what constitutes Windows and Linux. Without even those basic ground rules, how in the world can we have an intelligent argument about the relative security of Windows and Linux (and MacOS, and *BSD, and...)?

Re:I think its the apps

[frodmann]

The operating system can't totally protect you from badly written applications. Remember the article is about web defacement and not root exploits.

If you have a web app that takes user input and displays it (for example a discussion board) and the application doesn't parse the input to strip out special html characters. This can lead to an exploit of the application and can be used for web defacement. This has nothing to do with bad security of the OS and everything to do with a badly coded application.

Re:I think its the apps

[BrynM]

As someone pointed out before,

Root access required for "rootme.sh".
Please enter the password for "rootme.sh":
_

There's a layer of security inherant to *nix that isn't in Windows. A trojan like that has a much harder time sneaking by.

Re:I think its the apps

[Zenki]

Oh wait, this sounds like Oracle and their per processor licensing scheme.

Or RedHat Enterprise AS Premium vs. ES Standard vs. Enterprise ES Basic vs Professional vs. Plain

Or SuSE Linux 10clt Openexchange Server vs. Enterprise Server vs. Professional

It is a marketing gimmick, but the best way to make money. And everyone does it, even Linux companies. You force people to pay for what they are willing to pay for said features.

The average user isn't running on a box with 8GB of ram (probably can't even afford said box). Why bother shipping him a feature that he can't use. Instead lower the price (to make it more attractive to the user) and charge lots of $$$ for users who need that feature (in fact, charge enough to subsidize the lower price of disabled builds) because they already spent a ton of bucks on hardware and the extra cost is probably like spitting into the ocean for them.

Re:I think its the apps

[OneArmedMan]

to remove IE from Windows LitePC

Re:I think its the apps

[kevinvee]

Well thats still made my Microsoft, so its still good enough for me!

Re:I think its the apps

[A Naughty Moose]

The flaw for Blaster was found and patched about a month before Blaster took hold, but many people failed to apply the patch in a timely matter.

You had about 3 days after it was announced before the hole was actively being exploited in the wild.

3 days, what fantasy world do you live in? Try more like 3 weeks:

Blaster takes advantage of the flaw MS acknowledge here (Bulletin MS03-026), which is dated July 16, 2003. Blaster itself made its appearance August 11th, 2003, nearly a month later.

Re:I think its the apps

[Anonymous Coward]

The average user isn't running on a box with 8GB of ram (probably can't even afford said box).

He couldn't afford the box cuz he'd have to have a 64 bit chip (for more than 4G of ram)... Good ol' 32 bit addressing baby, yeah!

Re:I think its the apps

[Anonymous Coward]

I consider VBScript to be a flaw in Micosoft Windows. It should not exist. It is an abhorrance.

Re:I think its the apps

[Foolhardy]

There are always Intel Process Extensions (PAE). They allow windowing of much more memory (I think that 64gb is the most any hardware supports) into a process.

Re:I think its the apps

[Foolhardy]

Shouldn't there be some audible alarms for Critical core temprature?

Re:I think its the apps

[sootman]

Are you kidding? First of all, Outlook is an MS product. (Note: I am over 14 and thus didn't say 'M$.') Secondly, it is bundled with the system, has an icon on the desktop, *and* is the default email handler for Windows. (Quick: launch IE on a fresh Win install. Go to a page and click a "mailto:" link. See what application launches itself and asks for your info.)

Secondly, the RPC stuff was a system-level Windows flaw, through and through.

Re:I think its the apps

[deranged unix nut]

Sure, that would be one way to create a good user interface...but several nuclear reactor "accidents" happened because the control rooms initially did not have good user interfaces. Afterall, the operators were expects, why did it need to be simple?

Re:I think its the apps

[Anonymous Coward]

XP has 5 ports open to the world. Not webservers either.

I don't get web defacements because I don't run a web server. XP home users got the worm last week.

Derek

Re:I think its the apps

[Anonymous Coward]

> Internet Explorer is very deeply embedded into the core OS.

I think it would be much more correct to say that IE is deeply integrated in the UI portion of the OS. That is one of the thing many Windows users don't even realize. The UI is not the OS.

Jorgie

Re:I think its the apps

[KingRamsis]

I think RH and SUSE offer more value than Oracle or Microsoft per dollar, RH EAS Premium is rock stable with a fine tuned kernel sure you can download and build an exact replica but look at their support and the RH Network, I didnt try SUSE but I think their Enterprise server has value also

Why bother shipping him a feature that he can't use. Instead lower the price (to make it more attractive to the user

The reason its not possible is that its difficult to disable or enable featuers in a fine grained way, especially if you are using Linux, because I can get the latest whizz-patch with zero cost, and IIRC the kernel supports 4Gb out of the box my guess is that the average user will not be using 4Gb either.

The bottom line is (and this more true for Linux) what you pay for is support and testing because we all agree that anyone can build his own enterprise-grade Linux distro (given time).

Re:I think its the apps

[Anonymous Coward]

but what the heck is WMP doing in a server build to begin with?

Simple. It's for the guy that feels like giving a big LAN party network admin a headache by running his own DHCP on his Quake 3 box. He needs to watch videos too.

Re:I think its the apps

[Anonymous Coward]

So you're saying it's the "GNU" in GNU/Linux?

Re:I think its the apps

[hackstraw]

Even Blaster exploits a flaw in a network service that at least shouldn't be part of the OS, at least by the *nix OS-design paradigm.

Err, Blaster exploits RPC which is a *nix thingy that Sun started about 20 years ago. It has been the source of various vendor's security problems ever since.

In my opinion, Linux has the most secure RPC implementation because the portmapper is controled by tcp wrappers.

weakest link

[macragge]

A system is only as secure as its most insecure user / service.

Re:weakest link

[Sir Haxalot]

Not if the most insecure user doesn't have root.

Better safe than sorry

[Anonymous Coward]

Better go ahead and migrate to OpenBSD.

Re:Better safe than sorry

[Anonymous Coward]

For webservers that is an excellent idea.

But are we talking about the same thing?...

[mrdlcastle]

I think we are correct in saying that Linux is more secure than Windows. When we are talking about just the operating system, then we can safely say that it is more secure.
Of course as we add applications to any system that system becomes more vunerable.

It's just that Windows starts off vunerable and gets worse as we add more apps (ie, Web server, ftp server, etc.).

Re:But are we talking about the same thing?...

[Anonymous Coward]

Why? Are you saying that protocols such as DNS, Telnet and FTP are inherently secure? What about Apache? Run that as root and watch the fun!

Linux is only secure when configured and patched properly as is Windows.

Re:But are we talking about the same thing?...

[mrdlcastle]

No that is what I am saying. That protocols are not inherently secure. Applications such as Apache are not inherently secure.

But an OS that when it comes right out of the box has all these applications and protocols closed is.

So when setting up a Linux or Mac the first thing you need to do is make it less secure than it comes by default. A Windows machine, on the other hand, you need to make more secure.
That's all I am saying.

Re:But are we talking about the same thing?...

[Anonymous Coward]

Linux more secure than Windows??? hahahahaha...

Linux just received the lowest government security certification score of any OS ever submitted for certification! People forget to realize that.

I receive a newsletter weekly that gives a list of the last week's Linux vulnerabilities. There's a consistent 10-15 new vulnerabilities a WEEK. Microsoft is up to 34 for all of 2003.

Re:But are we talking about the same thing?...

[Anonymous Coward]

Yes, today that's the case after many break-ins and mistakes. Remember that the first worms attacked unix machines in the 80s, and many distros shipped with all kinds of superflous services active by default.

There is something to be said for quick feedback and distributed knowledge about how the system works (which isn't the case with windows yet). But a secure system still is a properly configured system, reguardless of the os design.

certainly not.

[Anonymous Coward]

Linux is far from secure; just look at all the updates that are on bugtraq or redhat/debian's history. the fact is, all the script hiddies and l33t haxors run linux, and prefer to target microsoft.

linux is ONLY secure because it is free, and the bad guys attack the company that wants their money.

Re:certainly not.

[Anonymous Coward]

script kiddies, that is.

points still apply.

Re:certainly not.

[sloanster]

Nah, you don't know the difference between an advisory about some minor potential permissions issue and a worm which cripples millions of actual win doze pee cees.

If you can't see the difference in the severity of those two issues you have no business working in the computing or IT fields.

Viurs != security

[rsborg]

I think this article is way off base. Anyone can put an poorly secured box on the net. The big difference between Linux and Win32 is that Win32 is "broken as designed" and that won't change unless Microsoft changes it.

btw, if you want to secure your linux box against viruses, etc... you at least have the option to recompile the distro.

Re:Viurs != security

[deranged unix nut]

BTW, if your system is compromised, compiling may not help.

Reflections on Trusting Trust, Ken Thompson

Re:Viurs != security

[Gherald]

BTW, after your sofa is stolen, buying insurance may not help.

Re:Viurs != security

[Malc]

Why would I want to compile it? How much time do you think I have? What is acceptable to a hobbyist certainly doesn't fly in a business. Compiling only works if you know the code, and I don't have time to learn it.

Re:Viurs != security

[$0 31337]

roflmao

Point and match.

Re:Viurs != security

[gilesjuk]

True, the security model of Windows leaves a lot to be desired, not to mention the "feature rich" default state of Windows. It's also a bit tricky to remove large chunks of the OS that you simply don't need.

The one big security problem with Linux is having so much code out in the open. People can hack ftp servers and replace tar files with src code in them with trojaned versions. This did happen with OpenSSH, plus the GNU server was also owned for ages.

scewed results?

[iamkrinkle]

Does this take into account the # of linux servers vs. windows servers? If there are significantly less windows servers, then this isn't all that significant. If there are less windows servers, but just as many break ins as linux, then windows is still more insecure despite the fact that they have the same number. they have more per machine. i hope that made sense =)

Re:scewed results?

[K.B.Zod]

Makes sense to me. The fact that there are more Linux defacements may only be because there are way more Linux servers out there. It could be that a big percentage of the Windows servers were defaced while a small percentage of the Linux servers are; it's just that in absolute numbers you see more Linux defacements.

Another factor could be the popularity of the web sites. If popular sites run Linux, the higher numbers may just be an effect of that correlation. We need a statistician to help us out!

Re:scewed results?

[instantnoodles]

The vast majority of the bad worms (SoBig) have been Windows ones.

I know there are more Windows servers, but there isn't an overwhelming amount. The difference wouldn't be enough to compensate for being used on more servers.

Re:scewed results?

[DoctorFrog]

Note also that the 'Unknown' category is rather high, and certainly contains at least some Linux systems, further increasing the percentage.

Nitpick: If the percentage of Linux boxen within the 'unknown' category is smaller than the 'known' percentage, then correctly identifying the unknowns would lower the overall percentage.

Re:scewed results?

[Anonymous Coward]

So far there has been one moderately bad windows worm -- that was sobig. Even with all of the hubub about it, it did not effect the vast majority of the systems out there (infection estimates were under 1 million -- there are FAR more windows boxes out there). There have been other worms that I would classify as merely annoying (like code red).

However, I do recall a certain worm that targeted unix systems (sun in particular if I remember right) that exploited a hole in a mail server and effectively took down large blocks of the net for a few days several years back...

Re:scewed results?

[Reziac]

I had a similar thought, but pointed in the other direction: Per the last stats I saw, about 40% of internet servers run some species of linux. If 60% of break-ins happen on linux boxes, that indicates that linux is less secure than the other 60% of internet servers (that being about 40% Windows, and the other 20% or so being BSD, Solaris, and whatever else -- I don't have accurate figures in front of me, but you get the idea).

Would be interesting to chart numbers in operation for all the common servers, vs the number of break-ins for each platform. Of course, one might also want to distinguish between, frex, defaced websites and hacked FTP servers. (About 90% of hacked FTP servers that I've seen were running NT4. But what I've chanced to see may not be representative.)

The Only...

[strateego]

The only real way to secure a computer is to pull the power plug out of the wall. If you spent time mantaining your computer, keeping it up to date, and you know what you are doing their is little chance that you will have major problems. Anybody who puts a linux system on their network and doesn't update it is likly to have their system exploited.

Re:The Only...

[A Commentor]

Cool, all I have to do is pull the power plug out and my system is secure...

I'll just sit with my laptop (unplugged from the wall) and use 802.11b and know that my system is secure ;-) Thanks...

Re:The Only...

[Anonymous Coward]

So I shouldn't worry about the computer that the cops seized, since they unplugged it when they took it?

Cool!

Re:The Only...

[freeweed]

Anybody who puts a linux system on their network and doesn't update it is likly to have their system exploited.

Some day I'm going to take someone up on this challenge, and post my Linux box's IP address on Slashdot.

Have fun trying to exploit a machine with no open ports, and no listening services. Especially when IPtables blocks anything you send my way.

Oh yeah, that was the *default* install, by the way.

email viruses

[geeber]

Email viruses like Sobig are aimed at desktop users. Since most of the desktop users run Windows, it makes sense that most of the viruses would be targeted at them and not Linux users.

Re:email viruses

[Anonymous Coward]

Agreed. The reason that the vast majority of viruses are written for Windows is because the vast majority of computers are running it.

On planet Bizarro, where the roles are reversed and Linux is omnipresent while Windows is only used by geeks, people are decrying how insecure and buggy Linux is, and how perfect Windows is.

Which one are you?

[airrage]

SLASHDOT has various personalities, and I hope to be the first to document them all:

Project Manager - dude was an ex-coder (visual basic 3.0) and now is a low-level bottom-feeder working through slashdot so he has some vague ideo of the issues with technology.

Anonymous - dude is angry. Angry about something but not sure what. Against everything: hates all religions, colors, air.

Modder - points Nazi. God's irony incarnate. Why are those who have the least leadership skills always given a clipboard? Like getting a bathroom pass from the farting-kid.

Grandpa - dude is old. Waaaaayyy old. Like grandpa old. Runs a plain-text website. Talks about the early days of Usenet and punch cards. Senile.

The kid - 13 year old. Thinks coding full-time sounds like a wonderful career. Masturbates at Guiness Record Book pace.

The ranchero - Indian or Pakistani. Got his full-service corporate Internet access in Bombay or Kurachi and his call-center job. Has his PhD in math or science, feels he somehow part of the global village.

The survivalist - bro feels like if you dicuss something over and over somehow it will all be okay -- like Microsoft disappearing. Can't understand the cat is already out the bag and has humped everything in sight.

Her - d00d is a chick. A chick! Runs her blog, thinks she's a programmer.

The speller - d00d is seriously into grammer and spelling. On a site where the debate is around ideas, brother-man likes to make sure the semicolon is in the right place.

The Oz - australian d00d. "I come from the land down under, where women go and make thunder"

The napster - d00d is seriously into alternative-rock and the stealing thereof. Talks intelligently about music like one might discuss a Winslow Homer or the Illiad.

Lost in Translation - d00d cannot for the freaking life of anything find the home-row keys. o ,rsm jpe jstf od yjsy"

The scientist - d00d is seriously into fractals, 3-d Math, fluid dynamics, cutting-edge chaos theory -- allbeit from afar because basic physics and calculus escape him.

The microsoft - d00d is seriously against MS. Can't stand the cursor, the fonts, the windows, the design, the icons, the sounds. Uses it extensively to play games.

The thinker - writes long missives. Attempts at humor, sarcasim, wit, and pun are laudable; posts two-stories ago.

Ben Franklin - d00d loves chaos. Every judicial ruling is "another nail in the coffin of freedom". Has third-grade perspective of common law.

The formater - d00d loves to use *HTML* *TAGS* to *CREATE* posting that are *REALLY* *GHAY*

Heresy I tell you, heresy!!

[Anonymous Coward]

How DARE you criticize Linux? Don't you know that Linux allows me to live a life of smug superiority? If I weighed more and had a wife or girlfriend cheering me on, I'd kick your ass for posting such drivel.

Something to think about:

[Anonvmous Coward]

Species of Windows Programmer: Human
Species of Linux Programmer : Human

Chances of human error making it into the code: Equal

Doesn't matter if you're using Linux or Windows, you must be vigilant. You cannot completely secure against a creative human. Instead of debating this shit, how about learning from Microsoft's mistakes and making sure Linux grows from it?

Re:Something to think about:

[Anonymous Coward]

Doesn't matter if you're using Linux or Windows, you must be vigilant. You cannot completely secure against a creative human. Instead of debating this shit, how about learning from Microsoft's mistakes and making sure Linux grows from it?

What? No more Karma-Whoring statements and groupthink? The entire slashdot economy will go down the drain!?! Someone silence this man!

Re:Something to think about:

[FedeTXF]

Remember that millons on eyeballs catch more bugs than a few. Some parts of the linux code (not just the kernel) have been around for years and have been reviewed by huge amounts of different kinds people.
OTOH the windows code is only seen by the MS guys and they seem to rewrite big parts of it from time to time. Also they mix kernel stuff with windowsing stuff. I guess all that IIS and IE code inside win nt kernel hides some serious bugs.

Re:Something to think about:

[Sir Haxalot]

Species of Windows Programmer: Human
Uhh? I think you made a mistake somewhere...

Re:Something to think about:

[sterno]

There is a fundamental design difference though that amplifies the nature of windows problems. Linux is designed with hundreds of different components that are loosely connected. Windows, on the other hand, is all integrated. Every windows box has outlook and Internet Explorer, and windows file sharing, so you can use the integration of these things to make any small breach much bigger.

With Linux, it's a far more heterogenous environment. There are hundreds of different systems called "linux" made up of different applications. An attack that works against SuSE may not work against RedHat, or may only work when a certain other application is in use.

These loose connections are what make Linux slightly harder to use and more complex. As always, security is inversely proportional to convenience.

Re:Something to think about:

[arcanumas]

Indeed there are smart people doing coding on both sides of the camp. There is no "in the genes" kind of superiority to any platform.
The advantage to Linux (and *BSDs) is that they are of a different architecture that permits almost infinite customization, and that they are open.

The customization means that you can do pretty much whatever you can imagine with the machine because it's components do no make assumptions on the existence and configuration of other componetns (as in windows where you HAVE to have the registry, RPC , etc.. etc..). This means that a competent administrator on Linux can MAKE the machine more secure than a competent admin on Windows because it is more difficult on windows (and GUIs don't count here :).

As for the freely available source code. Well, i really don't need to repeat it, we all know it. If you think something should behave differently for the shake of security , you can modify it yourself. (Which is not even an option on windows or most of the applications on top of Windows)

Ofcourse none of this guarantees 100% safety (except pulling the network plug as we all know) , but it allows a consious and informed admin to make a system more secure.

Re:Something to think about:

[rokzy]

absolute nonsense.

it's not a case of "1 human vs. 1 human, therefore both are teh equal!!!1111"

it's a case of a closed source project being done by a relatively small group of people because they're being paid and have to meet deadlines.... vs.... an open source project being done in order to create a good program by a potentially huge number of contributers/checkers, usually without any deadlines and no need to release buggy code.

Re:Something to think about:

[brandonY]

Reason Windows programmers program: Pay
Reason Linux programmers program: Fun

Chance of love and thoughtfulness put into code: ERROR: DISCREPENCY DETECTED

Hey, you're right, there IS a difference!

Re:Something to think about:

[Anonvmous Coward]

I wish people would understand what I'm saying instead of feeling like Linux needs to be defended.

Linux may have a better foundation to work from in a security point of view, that does not in any way negate what I said. I had a Windows NT webserver that was up for 2 years without being exploited. I replaced it with a Redhat/Apache box thinking I'd be even more secure and within 2 weeks it was rooted.

This is not Linux's fault, it is entirely my own. I felt a false sense of security and didn't stay up to date with the machine. With Windows, since it was always under attack, I constantly checked it to make sure it was hardened. If I had been vigilant, like I recommended in my original post, I would not have been rooted.

Instead of cooking up an argument, think about what I just said. You're not secure. It is as simple as that.

Re:Something to think about:

[The Ape With No Name]

I have to disagree. The environment that a Windows programmer works in is not secure by design or by evolution, while a programmer working in a *nix-like environment has been thinking about security for a long time. Remember us Unix people woke up to worms and shite back in 1988 or so... Vigilant? Sure. But it is a hell of a lot easier when theo de raadt squeezes your nuts publicly for not checking a buffer.

Re:Something to think about:

[El]

Chances of human error being fixed sooner rather than later because "many eyes make all bugs shallow": much greater for Linux. Micro$oft does hire some of the smartest people out there; it makes their high defect rates hard to explain. Unrealistic schedules? Lack of peer revue? Lazy QA? Or perhaps there is a strong counter-incentive to shipping secure systems, when as it is now they can get anybody to immediately download any Orwellian privacy intrusion they can dream up by mumbling about a new worm or virus...

Re:Something to think about:

[Anonvmous Coward]

"it's not a case of "1 human vs. 1 human, therefore both are teh equal!!!1111""

You're absolutely right. It's not a case of both Linux and Windows security being equal. Just wish I had said that so you could feel good about being right.

Meanwhile, good job leaping over the section of my post that you should have paid attention to.

Re:Something to think about:

[Anonymous Coward]

It's now considered 'Flamebait' to ask for proof for unsubstantiated assertions?

Re:Something to think about:

[Anonvmous Coward]

That wasn't the point of my post. It doesn't matter what eviornment it is. Somebody will exploit Linux. It'll happen. There's 0 chance it won't happen. You still have to remain vigilant.

Re:Something to think about:

[feed_me_cereal]

Species of Hitler: Human
Species of Mother Theresa: Human

Chances of one of them stealing your lunch money: Equal?!?!

While all humans have faults, some humans have faults that are more severe, so it pays not to generalize. I'm not saying your conclusion is true or false, but it wouldn't be right to just assume that all programmers are created equal.

Re:Something to think about:

[NanoGator]

"Reason Windows programmers program: Pay
Reason Linux programmers program: Fun
Chance of love and thoughtfulness put into code: ERROR: DISCREPENCY DETECTED
Hey, you're right, there IS a difference! "

Um, the "programmers do it for fun" bit doesn't bother you?

Re:Something to think about:

[Anonymous Coward]

I think the NT developers would disagree with you.

Re:Something to think about:

[Anonymous Coward]

I agree that the human factor is a large contribution to the problem, however OS does play a role too. Windows is HARD to lock down, the admin is abstracted too much from the internals to do anything truely interesting withought going insane and gnawing their arm off in the process. In unix land it's quite a bit easier to protect against the unknown - which gives you a bit of lead time to install various patches, usualy.

Re:Something to think about:

[Anonymous Coward]

Species of Linux Programmer : Human

Shouldn't that be :
Species of Linux Programmer : SuperHuman
or Human^3

Re:Something to think about:

[Anonvmous Coward]

Argument rejected. Apples != Oranges.

Can you honestly tell me there is a human out there who has never errored?

Re:Something to think about:

[Mooncaller]

BS! Any programmer knows that the chance of making a mistake is related to the quality of the original code.

Re:Something to think about:

[np_bernstein]

Species of Windows Programmer: human
Species of OpenBSD Programmer: human


Chances of human error making it into openbsd code: far less

ps: decent troll.
--
Nick Bernstein
http://nicholasbernstein.com

Re:Something to think about:

[Anonvmous Coward]

"ps: decent troll."

Wish I was trolling. Nobody seems to be listening to the point I was making about securing against a creative human. Instead they feel the need to climb up the watertower with a bucket of paint to defend Linux's honor.

Re:Something to think about:

[UserGoogol]

1) No, different humans have different levels of error.

2) It's not a single human, but a network of humans. Different networks deal with errors differently. And the Open Source method is very different from the Microserf method.

3) But yeah, there's going to be error in both OSes, especially as error is an inherently random thing. (Two equally flawed programmers will not always create an equal amount of bugs, and two differently flawed programmers can sometimes create an equal amount of bugs.)

Re:Something to think about:

[EvanED]

I've been waiting to use this...

"Not only was this comparison easy to make, but it is apparent from the figure that apples and oranges are very similar."

Re:Something to think about:

[Anonvmous Coward]

Heh that's cute.

I can see Dogbert and Dilbert arguing about this.

Re:Something to think about:

[chocolatetrumpet]

Species of Shakespeare Authors: Monkey

Chances of monkey error making it into the complete works of Shakespeare: Zero

So, who wants to set enough monkeys and enough typewriters to the task of writing the Linux kernel?

Before you mod me as troll, notice that I spelled Shakespeare correctly!

Obviously I'm not your average /.er.

Re:Something to think about:

[Anonymous Coward]

I'm always impressed when something is reviewed by an amount of people. So you mean you put people in a blender, ground them up, and measured out a few cups?

The word you're looking for is "number"....

Re:Something to think about:

[The Ape With No Name]

Yes. NT is SUCH SECURE OS! They have SUCH a culture of security built into their coding practices. What has happened to the trolls on Slashdot? Don't they even try anymore?

Re:Something to think about:

[Anonvmous Coward]

"So, who wants to set enough monkeys and enough typewriters to the task of writing the Linux kernel?"

Again?

Re:Something to think about:

[Spoticus]

Species of Marketing VP's pushing Windows Programmer to get code out the door: Human

Species of Marketing VP's pushing Linux Programmer to get code out the door: NON EXISTANT

and I think _that_ is the biggest difference.

Re:Something to think about:

[rokzy]

you mean the really insightful "learn from mistakes" part, the defeatist "you can't beat a creative hacker" part, or the useful "let's not talk about this anyway" part?

Re:Something to think about:

[Anonvmous Coward]

"and I think _that_ is the biggest difference."

Yep, instead of cutting corners in security, they cut corners in UI design. Brilliant. It's more secure when you can't use it!

Re:Something to think about:

[juan2074]

No, he really meant amount. We just count up the kilograms. . .

Re:Something to think about:

[adyus]

Salary of Microsoft coder: present Salary of Linux coder: absent Linux coders do it for fun, while Microsoft coders do it for the money, so they're more prone to releasing bad code just to get their money. The Linux programmer receives a different kind of reward from his code.

Re:Something to think about:

[Anonvmous Coward]

So Linux programmers have no real motivation to do it right either?

Honestly, I think this explains why OSS software has a tendency towards horrid UIs. They'll just work on the fun parts.

Re:Something to think about:

[NanoGator]

"you mean the really insightful "learn from mistakes" part, the defeatist "you can't beat a creative hacker" part, or the useful "let's not talk about this anyway" part? "

You mean the points you didn't have an argument against, so you focused on one of them thinking you could put a dent in it?

You should be listening to AnonV instead of arguing with him. Agree or disagree, it's up to you, but you really should listen.

Re:Something to think about:

[NanoGator]

"Salary of Microsoft coder: present Salary of Linux coder: absent Linux coders do it for fun..."

This is a shift of resources, not an addition. Niether commercial nor OSS software is perfect, and the motivations you've described negatively affect either side.

You put far too much faith in developers doing it for 'fun'.

Re:Something to think about:

[BroncoInCalifornia]

There are Perl scripts with GUI wrappers to harden a Linux installation. These are available here: Bastille Linuxe

The srpipt will help to shut down uneeded daemons. It will configure things to minimize the attack surface presented by the computer.

Re:Something to think about:

[Tony-A]

Rain in the Sahara: possible.
Rain in Redmond: possible.
Must be dry in Redmond.

Re:Something to think about:

[Anonvmous Coward]

"Rain in the Sahara: possible.
Rain in Redmond: possible.
Must be dry in Redmond."

Nice try, but there's two problems with what you said:

1.) Nobody's ever won an argument with a metaphor or other illustrative response.

2.) Couldn't you even take a minute to make your response even remotely similar to what I said? I've had like 10 people try to use this type of response and nobody came close to scratching my comment. Honestly, is it that hard?

Funny thing is that part of my post was the most inconsequential, but people try to attack it anyway. Gee. Imagine taking on the points that are harder to argue.

Re:Something to think about:

[Tony-A]

There's one problem with yours.
Your middle is undistributed.

Re:Something to think about:

[Anonvmous Coward]

Right.

Re:Something to think about:

[Daengbo]

Which of the five or so allowed spellings do you consider correct?

Re:Something to think about:

[OeLeWaPpErKe]

Let's take an example here, some small freeware program

Number of windows programmers writing a program : 10
Number of programmers working on equivalent open source program : 10

exploit is found in both programs

Number of windows programmers fixing the flaw : 1 (if we were to fix the flaw and update people would think our program is insecure, so we'll do it in the next major upgrade, if a programmer feels like doing it)
Number of linux programmers fixing flaw in equiv program : 1+10+5 (1 = the original security researcher, ever notice how in apache vulnerability reports a patch is included + 10 of the original programmers, which are being pressured from a large set of emails, +5 others also responding to the emails because the original programmers aren't doing it fast enough, and afterwards these 5 tend to search the program for other security problem(s), because it might be their claim to fame)

Re:Something to think about:

[murphyslaw]

I would like to start by saying, Thank You. There is an understanding in the archaic world of BBS's, NT 4, and all the rest of the "out-dated" communication and networking software, that if a system can be accessed it can be hacked. Sys-Ops dealt with this as best they could by monitoring how their system was used personaly. Now, if it cannot be written into a script it does not happen. People who run high profile systems have been spoiled by the assumption that they can place the burden of security on an anti-virus prog. or late-breaking security update/patch. The burden of security is on the people who run and use the software.

Re:Something to think about:

[FedeTXF]

I was not disagreeing, just bringing up a point I thought was relevant. Of course you must be vigilant. In the low bandwidth era (arpanet?) UNIXes and BSD's and VAX's used to have well known bugs companies didn't patch until they had a critical mass for the update to be released, and even then sysadmins didn't update the systems for number of reasons. So human behavior is critical.

Re:Something to think about:

[Anonvmous Coward]

Gee, imagine picking an unusual example for Linux and using that to thwart me. Never mind that you completely skipped over my point.

Oh well. If you Linux dipshits want to run around thinking you're more secure than you really are, go right ahead. Go beg for your rooting.

Just give it time...

[krymsin01]

Wait until more people are using linux on the desktop, then you'll find out exactly how secure your system is.

Also, since Linux is open source, I would imagine that a coder looking for an exploit will have an easier go at it that they would on the windows system, where you are pretty much relying on decompiled binaries and assembly analysis.

Re:Just give it time...

[Anonymous Coward]

you have to take into account that most hacks/web page defacements aren't performed by someone looking through source code but rather someone who's downloaded the lastest exploit from their favorite "hacker" site.

Re:Just give it time...

[krymsin01]

I think the point is that there are more people out there who can look through a c/c++ source and find an exploit than there are people who are competant enough with assembly to do the same job. These are the people who are going to come up with more exploits, giving your script kiddies a larger toolbox.

*shrug* I could be wrong, though.

Re:Just give it time...

[sloanster]

We've heard this argument for ages, but it falls flat on it's face in reality. By your logic, the open source apache web server, which also happens to be the most popular web server on the net, should be afflicted with orders of magnitude worse security issues than the "secure by obscurity" iis web server - but in fact, iis is responsible for the _vast_ majority of web server security woes on the internet.

So much for yet another naive theory

Re:Just give it time...

[krymsin01]

I don't know. The way I look at it, there are a couple of reasons as to why IIS has more security woes than Apache.

1) Everyone loves to hate microsoft, myself included.
2) A good majority of IIS servers out there are on home computers where it's been installed and turned on by default.
3) Your typical microsoft user does not take the time to secure the whole thing down, making it a lot easier target.
4) The OSS comunity, right now, does a good job of patching their software.
5) Currently, those who use linux know how to secure their sites.

But, if you want Linux to spread, you are going to have to acknoledge the fact that people with no expertise in security are going to use it. These people won't care, as you've already seen, that a patch has been released. They are going to continue bopping along merrily until some worm deletes their partition table. And that's not even taking into account that if someone out there ever acutualy did write a flash worm, exploiting an unpublished hole in some OSS package, then no one will have time to patch any of their systems.

Get me right here, I'm not bashing Open Source. I use it, and believe that it offers a lot better product than the current options out there. I think that by giving people access to the source you will improve security because more people will discover the holes. But I also see that there are some bad assumptions here: The people who find the exploit will tell you about it, and that you'll have time to prepare yourself.

Patches!

[silicongodcom]

Most of these Windows problems are from people not patching their systems. Same thing would happen just as easily on any OS. More Linux users know how to patch, sure, but imagine if it had the desktops that MS had.

Ha - Ha! (Nelson voice)

[Outland Traveller]

Looks like some of that "defacement" is happening close to home.

view-source:http://www.zone-h.org/

DB connection failed ().

Re:Ha - Ha! (Nelson voice)

[cfallin]

DB connection failed ().

Um, that would be the Slashdot effect most likely...

Re:Ha - Ha! (Nelson voice)

[rune2]

Hmm I wonder if they're using Windows or Linux?

Re:Ha - Ha! (Nelson voice)

[onemorehour]

There's an easy solution--keep reloading. I'm sure you'll get it eventually ^_^

:: ducks ::

Re:Ha - Ha! (Nelson voice)

[Anonymous Coward]

looks like this:

Solaris 8 Apache/1.3.27 (Unix) PHP/4.1.2

it appears that there may be a linux in the mix there somehwere.

source: netcraft

Social-engineering != Virus

[RealityProphet]

Are there other reasons why the likelihood of a "Sobig" or an "ILUVYOU" would [be] lower for Linux than Windows?

Absolutely not! These are not viruses that exploit bugs in code. These are socially engineered programs designed to get the user to run them.

You can't make the argument that the "average intelligence of the linux user" is higher than joe-sixpack's because if we are talking about linux-in-the-mainstream, then the "average linux user" will be joe-sixpack! Also, you probably can't talk about the fact that it isn't as mind-numbingly easy to run a scipt in linux as it is in windows, since those arguments contribute to why linux isn't mainstream in the first place!

Re:Social-engineering != Virus

[brokencomputer]

its easy to run a script in linux. just not easy to run a script that will do damage to the whole system. Linux doesnt usually run in root and all programs are fine with that. They dont complain about permisisions like windows "limited user" does. That default root is a problem with windows and the people who make the programs available for it.

Re:Social-engineering != Virus

[Gherald]

> These are socially engineered programs designed to get the user to run them.

Re: Approved

Please log in as root to accept this offer...

Re:Social-engineering != Virus

[Master Bait]

The average joe sixpack linux user doesn't have root access, so how are these so-called equivalent scripts going to work?

Re:Social-engineering != Virus

[MsGeek]

Well, unless you are running the first version of Lindows that runs as root by default, a "click this attachment" social-engineering worm would only be able to screw up everything that the luser in question owns, not the entire system. You would lose your home dir, you would lose your settings, but it wouldn't be the end of the world. It would suck, true, but it wouldn't be the end of the world.

Another point: there are several mail clients used by Linux users. The worm-writer would have to specifically figure out which mail client they'd hit. Would the victim be Evolution? OK, all the people who run KMail, Faces, Mozilla Messenger, Balsa, Pine, Elm or whatever else would be spared.

There is a lot more diversity on Linux desktops than on Windows desktops. And if there were more diversity on the average Windows desktop (like, for example, use Mozilla, Eudora or TheBat instead of LookOut Excess) there would be less problems with worms in general.

Re:Social-engineering != Virus

[dirk]

its easy to run a script in linux. just not easy to run a script that will do damage to the whole system. Linux doesnt usually run in root and all programs are fine with that. They dont complain about permisisions like windows "limited user" does. That default root is a problem with windows and the people who make the programs available for it.

And how does this say that Windows is insecure? I have yet to have any MS application need root access (unless it is a server apps, which you would expect to need root). If Joe's program wants to be root, it doesn't matter what OS it is on, the program is at fault, not the OS. Saying that Joe programmed his app so that it wants to be root, so the OS is insecure is just silly.

And before someone says it, SoBig does not mean the OS is insecure either. Even if it was harder to run attachments, the users would have run them, because that is what they wanted to do. If the user wants to do something, they will, regardless of whether it is 1 step or 3. If SoBig targetted Linux (and assuming Joe Average used Linux and could even do this stuff), the user would have saved the attachement, marked it executable, and then ran it. That is what they wanted to do, adding steps wouldn't have changed that.

Re:Social-engineering != Virus

[Kevinv]

I've seen many apps for Windows that assumed they had full write privs to c:\, c:\windows, c:\windows\system32, and not just at install time. Don't ask me why a programmer decides this app HAS to put it's temporary files in c:\ instead of %TEMP%, but it certainly seems more common on Windows than linux.

And why would a server application need root access? The only reason on Linux is to bind to a network socket in the reserved range, most apps I use that need to do this drop root privs as soon as this is done (and I believe the security enhancements available from several sources do away with even this much.)

Microsoft's apps are less secure because Microsoft thinks it needs to do more for the user in stupid ways -- send me an .exe, why i'll just launch that sucker for you without even asking (or asking for every little thing so you get used to hitting Yes). I know of no Linux mail reader that automatically executes scripts or binaries that are sent to you, or even has the capability of doing this. All require saving the attachment manually, chmod'ing to give execute privs, then running it. Pretty long time to consider the folly of your actions.

Of course Microsoft's solution to this was a security patch that simply blocked all access to most executable content! Now you don't even have the option of saving to file first, you can't get to it at all. Again Microsoft assumes they are smarter than you.

Re:Social-engineering != Virus

[Telex4]

The idea that the virus problem is purely human is specious.

Come on, for a virus to do serious damage, it needs permission to change system files, access logs, open ports, etc. In Windows, there's little stopping the virus, whereas in GNU/Linux or *BSD, you have a whole lot of problems to get past. The virus needs to be run, to begin with, as opposed to many Windows viruses that just break into the PC or auto-run through Outlook, ICQ, or some-such program. They need to run as root, or gain root permissions, which is a big hurdle that doesn't exist (by default, nor on most installations) in Windows.

Of course you could still have a GNU/Linux user who still downloads the virus executable and runs it as root, but I doubt that'd happen all that much.

Re:Social-engineering != Virus

[IntlHarvester]

A unprivileged Unix user can parse an address book, delete MP3 files, and send mail. In most cases they can also run a proxy server on a high port. So, "root" isn't much protection against these viruses.

In fact, I'd argue that the whole timesharing SuperUser vs Peon security distinction is a fundamentally broken design for how most people use Personal Computers. It's a relic of minicomputing. On a modern PC, virtually every user needs some administrative rights, and almost everyone wants to run "untrusted" programs such as file sharing and so on.

It would be great if we could chuck the whole user-based system in favor of some sort of role or program-based model where programs have privileges based on what they are rather than who is running them. But since both Unix and Windows are heavily based on the user-centric model, that's going to be very difficult.

Re:Social-engineering != Virus

[cyril3]

There is a lot more diversity on Linux desktops than on Windows desktops

I have a theory that said diversity will diminish as Linux desktops become more popular. I am not convinced that there is an inherent reason why the Linux desktop will not eventually settle on a single desktop that is run by the vast majority of users. Especially if one version gets a good foothold in the corporate world.

It happens in every other sphere of activity (sort of a convergence on the mean) so why would the desktop be any different (unless of course you believe that MS became dominant only through evil means)

Re:Social-engineering != Virus

[CharlesEGrant]

They are going to work because there are numerous bugs floating around the UNIX world that allow garden variety users to run commands as root (do a google search on "unix privilege escalation" to see a sample of them). For a properly configured UNIX box, current on all its patches, this wouldn't be be much of a problem. Unfortunately, getting all the joe sixpacks to run properly configured and patched software of whatever flavor is an intractable problem.

Re:Social-engineering != Virus

[MsGeek]

A single desktop does not a monoculture make. Look at the multitude of mail clients used by Mac users. Some are still using Eudora, some are using mail.app, some are using MailSmith, some are using Musashi, some are even using Microsoft Entourage, which comes with Office 2001 and Office X, or Microsoft Mail and News which is the freebie that comes with MSIE.

If the "Mad Hatter" flavor of Gnome becomes the favored desktop of desktop Linux users, then yeah, Evolution will probably become a favored email client. But not everyone likes Gnome. Some of us like KDE. Linux people are very, very individualistic. I don't think that "One Desktop Environment To Rule Them All" is happening anytime soon.

Re:Social-engineering != Virus

[Anonymous Coward]

Well, that's also true in the Windows world. For every Exchange user, there's two Notes and Groupwise users somewhere. There's still millions of Netscape and Eudora users, and more people use webmail than any client software.

But still, even though Outlook is a very small part of the pie, sheer numbers make an exploit a huge problem. Put Linux on enough desktops and you'd see the same thing.

(Note that SoBig isn't mailer-specific at all.)

Re:Social-engineering != Virus

[IM6100]

For a virus to do serious damage on a computer/network that is used for serious business purposes, all the virus needs permission to do is have write access to the actual data that the computer system is configured and set up to manipulate. A useful computer has that sort of data on it and it's in user-level writable storage areas.

Some of us grow tired of the 'everything that's important on the computer can be streamed off the install CD' mentality. That's the mentality of a self-important IT staffer. Think in those terms at your peril if you work in the real world.

Re:Social-engineering != Virus

[Gherald]

Interesting... so on that theme:

From: [insert friend/colleague's address here]
Subject: Wicked Screensaver

Hey man, check this out! Blah, blah, yada, yada.

Note: You must be logged in as root to install this program.

Re:Social-engineering != Virus

[npietraniec]

Installing palm's hotsync utility under a user account in NT requires you to have administrative access under the user account that you wish to install it... Which means if user123 wants a palm, you've got to give them admin access, install it, and then take away admin access. You can't just install it under an admin account.

There's one example- but it's irrelevant. Viruses like the ILoveYou bug did plenty of damage to our network without having admin access. The real problem is Microsoft's complete lack of taking security into account when originally designing their programs (this web page wants to run that executable? ok!!) They're getting better, but things are still pretty fundamentally screwed up.

Also - Joe Average really wouldn't have any trouble running linux on a computer that came with it on it. They might not be familiar with it, and they might have to use different file extensions for some things to work perfectly, but after a few days they could use it for normal computing tasks (surfing web, email, typing documents, playing music, etc.)

Re:Social-engineering != Virus

[smallpaul]

It would be great if we could chuck the whole user-based system in favor of some sort of role or program-based model where programs have privileges based on what they are rather than who is running them.

In fact, that's a core concept of the capability security model: "There is no fundamental reason why a program that you write for me should be able to delete my bank transactions file just because I can. Yet those are the permission rules imposed by the current commercial OSes for personal systems."

More here.

Re:Social-engineering != Virus

[Aidtopia]

It would be great if we could chuck the whole user-based system in favor of some sort of role or program-based model where programs have privileges based on what they are rather than who is running them. But since both Unix and Windows are heavily based on the user-centric model, that's going to be very difficult.

Ah, you want VMS.

VMS had (has?) a user-centric model, but it also had an application-centric one. If you were the admin for a system, and you had a trusted app that required certain privileges, you could grant the privileges to the application rather than the users. For example, you could give your backup application READALL privilege so it could copy every file to tape regardless of the file protection, but that didn't confer READALL to the user in general. Thus your operators couldn't go snooping through user's files. The tapes were generally in a locked room that only the operators had access to, but if you had a public drive, then you could use an access control list or a group protection to limit access to the empowered copy of the backup application.

It wasn't a perfect system. If you found a flaw in a trusted app that let you crash out while it was actually using that privilege, then you're process would now have that privilege. But that was rare, the damage was relatively contained, and the holes were easy to patch.

Privileges were much finer grained than all-or-nothing Unix-style root/non-root. Privileges could be turned off and on as needed (if you had SETPRIV).

Back in the day, I recall that whenever the VMS-Unix debates hit the security topic, the Unix folks would just throw up their hands and claim Unix wasn't really designed for security.

Oh my, how a decade changes things. Now Unix is the secure OS and Windows NT--arguably a descendent of VMS--is like swiss cheese.

Re:Social-engineering != Virus

[Metroid72]

Hmmmm... I can see people falling for this.
Especially when the user is affraid to call tech support and be treated as an idiot. They might think.. well, let me log in as root so the support guy doesn't say that I didn't read the message.

It's only as secure as you make it.

[bartyboy]

Or your admin makes it.

I used to run an old distro (RH 5.1) for the longest time (it had everything I needed) and it was full of security holes after doing the install. But disable some services, update some packages and presto - you're ok to go.

It's the same thing with Windows - check out the services turned on by default after installing Win 2k. Half of them will never be used by a home user.

So patch your box, remove unnecessary services and you should be alright. If you know what you're doing, you'll be ok.

Re:It's only as secure as you make it.

[BagOBones]

Very good point. I think the thing most linux supporters forget is DISTROS!..

Why do windows systems get exploited? Admin mistakes and missing patches and too many services running.

Looked at Red Hat or Mandrake default installs?

How many default services are started? How many 3rd Party tools are running?

I would say that Linux is only a step away from some massive exploit but for the moment every one targets windows because the user base contains fewer skilled admins and users.

Re:It's only as secure as you make it.

[sterno]

check out the services turned on by default after installing Win 2k

That's the problem. Most people running Windows XP or Windows 2K wouldn't know a service if it bit them. That's why these worms wreak havoc. Linux has a smaller installed base and it's generally made up of more technical users. Thus, much of the problems that could show up under Linux are minimized because the people running it know what they are doing.

Re:It's only as secure as you make it.

[eenglish_ca]

The services themselves don't even really matter. Just set all the default policies in iptables to reject and only open up ports that need to be opened and have been secured. As long as the computer is not accepting connections, it cannot be hacked. Assuming of course that all internal connection handling done before rejecting the connections is secure.

Re:It's only as secure as you make it.

[EvanED]

OK then... that answers the story poster's question about whether Linux is inherantly more secure than Windows: no, because it's security depends on the people running it.

Re:It's only as secure as you make it.

[sterno]

Actually no it doesn't answer the question. It suggests that the question is currently beyond answer. The security of the system is a combination of at least three factors:

1) the environment it's in
2) the software it's running
3) the user operating it

So, unless #1 and #3 are the same, then measuring the differences in #2 is impossible.

Re:It's only as secure as you make it.

[Anonymous Coward]

Looked at Red Hat or Mandrake default installs? ... would say that Linux is only a step away from some massive exploit

One thing that most of you 500K UIDs don't know is that Linux has already been through all of this -- a few years ago, the security awareness in the Linux community was absolutely shite and the hackers made Linux users pay hard.

The default installs used to be beyond terrible (starting things like Gopher, not setting up non-root accounts). Rootkits were out there before the distro boxes hit the shelves. Some guy did a study and claimed that default install of RedHat 6.0 would be rooted within an average of 5 Minutes (!) of being connected to the net. No chance to even download the patches. "My other computer is your Linux box" used to be a popular tshirt among a certain crowd.

Fortunately, Linux people learned their lessson and tighened up everything. Now a few years have gone by and the 6 digit UID crowd is running around claiming that Linux has had the best security since 1964. When in fact it's only been 2-3 years.

The point is that Microsoft is doing the same thing and eventually will get through these waves and waves of hacks.

Re:It's only as secure as you make it.

[BrynM]

Most people running Windows XP or Windows 2K wouldn't know a service if it bit them.

The RPC service just bit them and bit them hard. Blood and flesh chunks and all that nasty just bitten stuff. I heard some novice office workers talking about RPC and what it does just the other day (they were trying to understand it). Experiencial learning strikes again!

Re:It's only as secure as you make it.

[sterno]

The funny thing is that if you get even the slightest hint at what RPC is, it just sounds insecure. I mean, letting another computer run commands on your computer? It's practically the definition of a security exploit.

Re:It's only as secure as you make it.

[toddestan]

The worst part about RPC is, you basically have to leave it running on Windows 2000 or XP all the time if you want the computer to function at all. Even if you never plan on using it to administer a computer remotely.

And that's just plain dumb.

Re:It's only as secure as you make it.

[freeweed]

Have a blast (pardon the pun) removing the RPC service from a Win2k box, and expecting it to run for any length of time.

Re:It's only as secure as you make it.

[BrynM]

XP/2K/NT tend to treat services as if they were on an external machine by default. This is yet another architecture problem. Just take a look at any install with Active Ports. You'll see a lot of stuff attached to 0.0.0.0 or 127.0.0.1 as well as your normal IP. One that always makes me scratch my head is "svchost.exe" (service host, which listens on 0.0.0.0). I admit that a lot of *nix software does this too. I'm a firm believer that, if your application isn't transmitting/receiving network data or listening for a real networking reason, then you shouldn't have a port open. Even if it's to localhost.

Anecdotally, "svchost.exe" is described here as

Svchost.exe is a generic host process name for services that are run from dynamic-link libraries (DLLs). The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. There can be multiple instances of Svchost.exe running at the same time. Each Svchost.exe session can contain a grouping of services, so that separate services can be run depending on how and where Svchost.exe is started. This allows for better control and debugging.

It's a wrapper for something else. That's why you see more than one running on a lot of occasions. You'd have to go into the registry and know where to look to see what services it's wrapping. If you look in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost, you'll see that "rpcss" or the RPC service is one of them.

Re:It's only as secure as you make it.

[Student_Tech]

Using that
# let connections on port 22 in
iptables -A INPUT -i $EXTINF -p tcp --syn --dport 22 -j ACCEPT
# let FTP servers get back
iptables -A INPUT -i $EXTINF -p tcp -m state --state RELATED --dport 1024:65535 -j ACCEPT
# refuse anything else connecting to me
iptables -A INPUT -i $EXTINF -p tcp --syn --dport 1:65535 -j REJECT (or DROP)
is nice too, because that way even if someone does get in and open a connection on a port somewhere, they can't get to it unless it takes over a port that has been allowed.
Yes, I had a machine get rooted, SSL and Apache had something up and they got in that way, noticed on a netstat they had something, deleted it, shutdown the SSL stuff and did stuff like that(yes I got rid of the stuff they put on. Person was using fstab for a program name listening on a SSH server on a high port, what an idiot), only pass a few ports now, 80,22,113, and a few ports for filesharing programs that get forwarded to internal machines so that the firewall can't utilize them for anything else.

Re:It's only as secure as you make it.

[Anonymous Coward]

One thing to understand is that RPC is as central to the design of Windows NT as terminal handling is to Unix.

The expectation is that user-level programs would communicate with the OS over RPC. That was considered the "modern" way to do it back in the early 90s ... Network is the Computer blah blah blah. Nobody with was thinking about the big bad Internet.

Meanwhile 9 out of 10 freshly minted MCSEs don't even know that you can just point the admin tools at any computer on the network.

my penis

[Anonymous Coward]

is SoBig

Updates on Linux

[rantenki]

I just install a vanilla Redhat on all my boxes. They get rooted within a few days, and the hax0rs take care of the security updates for me. Course, I can't log in as root anymore, but hey... that's a feature.

How I see it...

[rosewood]

When I say that Linux is more secure then windows, I see it on many levels.

For an end user its obvious since in windows you are always the admin (even in winxp where you can finally really change the power of the user, a lot of shit doesnt work right unless you are the admin). This basic security difference is HUGE.

Then there is the whole open source vs closed source security. I Truely beleive in that. It only makes sense that it is going to be more secure in the long term. This doesn't mean exploits don't exist - its just Im prone to beleive that there is someone using an unknown windows exploit as we speak to do something bad and it might be YEARS before that one is ever found (history backs me up on this one) but yet if there is something as blatent as the RPC exploit in OSS, we tend to see fixes for rather quickly (again history backs me up here).

Don't confuse the idea of inherint security with stupid users and sysadmins or even part time sys admins that aren't paid enough / don't work enough hours to keep a handful of servers updated across town.

Re:How I see it...

[DemoLiter2]

I would add : Linux is less monocultured, as there are quite many distros, and users run a wide variety of tools/programs, with rather often updated version numbers, which are in turn compiled using a variety of configurations and a few different compilers.

I believe this might be an additional factor which hinders creating exploits able to hit a majority of running Linux systems at once.

I don't think Linux, even if it would dominate usage share, will be subject to massive worm attacks, simply because no worm could be programmed flexible enough to support all this variety of systems it'll encounter.

Re:How I see it...

[mikolas]

"For an end user its obvious since in windows you are always the admin (even in winxp where you can finally really change the power of the user, a lot of shit doesnt work right unless you are the admin). This basic security difference is HUGE."

Well if you just for one second assume that a Windows user is as competent as a Linux user, this sentence just does not make any sense. I haven't been running as administrator on Windows since NT4. I know how to use "Run as a different user" just as well that I can write sudo in Linux so there really is no need ever to log in with too much privileges on Windows. And as a technologically advanced user you also know your policies and such so you can harden all the other accounts in the system just the same way you might do it using Unix-like operating systems. It's even easier to do fine grained security hardening on Windows given you know how to administer your box.

And, when it comes to the RPC exploit, you just don't remember what happened with OpenSSH some time ago? A fix was available for quite some time and even then a huge amount of computers got cracked. If Linux was as popular as Windows, there might easily have been about the same number of "infections" as there were with Blaster.

To assume one system is more secure than some other just because it's different is simply stupid. Security consists of many different aspects and the underlying OS is just one of them.

Re:How I see it...

[1ucius]

The other obvious difference is heterogenality. Who want's to hunt for exploits in a program 1000 people use?

Re:How I see it...

[lkturner]

but yet if there is something as blatent as the RPC exploit in OSS, we tend to see fixes for rather quickly (again history backs me up here)
What's your explanation for Sendmail? It brought us the very first worm back in 1988 and they're still finding major security problems in it 15 YEARS later.
Sendmail has a long history of security holes - Seen on Slashdot earlier today.

Re:How I see it...

[Anonymous Coward]

> For an end user its obvious since in windows you are always the admin (even in winxp where you can finally really change the power of the user, a lot of shit doesnt work right unless you are the admin). This basic security difference is HUGE.

Windows can be run without being an Admin. It just takes time and training/knowledge to set up. I think you'd agree that the proportion of Windows users who have security knowledge vs Linux users is much smaller. But as other posts have pointed out, this is related also to the target audience for Windows vs Linux. I've seen some posts where someone has suggested looking at code and looking for security holes before compiling/installing it. This is exactly why Linux _won't_ become a mainstream OS for the masses.

> This doesn't mean exploits don't exist - its just Im prone to beleive that there is someone using an unknown windows exploit as we speak to do something bad and it might be YEARS before that one is ever found (history backs me up on this one) but yet if there is something as blatent as the RPC exploit in OSS, we tend to see fixes for rather quickly (again history backs me up here).

Well, in the case of MSBlaster (and I think many other Windows exploits), Microsoft published details and a patch, and the worm/virus came between this time and the time it took for users to patch their own systems.

The same can and probably does apply for Linux/OSS patches fixes too - there may be a fix made available, but how many people have patched their Linux systems?

With an OSS, wouldn't you think that it would be easier for a virus writer to figure out how to exploit it since the code is already out there whereas they'd have to spend some time going through Win32 API calls to find a vulnerability.

Of course, you'll point out that it _seems_ that there has been many more Windows viruses/etc, but that I think that comes down to motivation. I don't think people would have the same level of motivation to write a virus to infect Linux machines out there - it doesn't seem like a "cool" anti-establishment thing to do...

Re:How I see it...

[julesh]

I know how to use "Run as a different user" just as well that I can write sudo in Linux so there really is no need ever to log in with too much privileges on Windows.

I'm curious - how do you use 'run as a different user' to perform your average system maintenance task. I'm running a Windows 2000 machine here and I'd like to, say, install a new printer driver. Obviously, this requires administrator priveleges, and I'm logged in as a non-admin user. How do I do it?

When managing files, I like using a GUI. Can I open a new explorer window that runs as administrator? Or am I restricted to the crippled command line that makes common tasks difficult? If I just try running explorer, I get a new explorer window running with the same user credentials as I originally logged in with, not administrator. Am I missing something, or does this just 'not work'?

Re:How I see it...

[mikolas]

Well,

How about starting Control Panel as a different user (from the command line): "runas /profile /env /user:XXXX\XXXX C:\WINNT\system32\control.exe"

Or you can also start Windows Explorer in the same manner, just replace the command line with path to your explorer.exe, usually it is in the SystemRoot so the correct path is "%SystemRoot%\explorer.exe".

This is essentially something you learn to do when you have bunch of services running on some very limited login accounts (no console login available at all even on the local console) so you can easily change the account setting by running some other user account that has login access and then running the processes under different credentials in order to change settings.

Re:How I see it...

[julesh]

How about starting Control Panel as a different user (from the command line): "runas /profile /env /user:XXXX\XXXX C:\WINNT\system32\control.exe"

When I run that command, a new copy of explorer (yes, explorer) opens, showing me the contents of the directory that was current when I ran it. Its hard to tell what user it is running as, but it tells me that I can't change security properties on explorer.exe so I guess it isn't administrator.

The problem is that explorer uses DDE to open new windows in the same process as it is currently running on. Control panel is just a special case of explorer, so you can't open it in a different user if some user is already running explorer.

This is essentially something you learn to do when you have bunch of services running on some very limited login accounts (no console login available at all even on the local console) so you can easily change the account setting by running some other user account that has login access and then running the processes under different credentials in order to change settings.

Yeah, I'm actually very aware of how to use run as. Its just Windows' stupid design prevents you from achieving anything useful with it, at least if what you're trying to do is mess around with Windows settings.

You could run registry editor and do various things with that, you can also run cmd.exe which is handy. But half of the GUI just refuses to work. And it happens to be the most important half.

Don't know what this is like under XP - could be much better for all I know. I've played around with 'fast user switching' and that's OK. Although I have to wonder why they call it fast. The Linux equivalent (i.e. running multiple virtual consoles) is *much* faster...! :-)

Re:How I see it...

[mikolas]

"When I run that command, a new copy of explorer (yes, explorer) opens, showing me the contents of the directory that was current when I ran it. Its hard to tell what user it is running as, but it tells me that I can't change security properties on explorer.exe so I guess it isn't administrator."

I have been successfully using this approach *but* I seem to have a small error in my previous post. The way you need to do this is to start a command prompt with different credentials and then executing a shortcut to the desired control panel functionality in the command prompt with desired credentials, for example "C:\Temp\Shortcut to Regional Options.lnk", "C:\Temp\Shortcut to Add Printer.lnk" and so forth. This way you can work around the Windows GUI limitations, should have checked out the bat files before posting :-)

And what comes to fast user switching in Windows XP, it's pretty much useless in corporate world as you can not use it when the workstation is part of a domain. That is of course very, very, stupid limitation.

Security through obscurity

[defile]

Are there other reasons why the likelihood of a "Sobig" or an "ILUVYOU" would lower for Linux than Windows?

Anyone can write a worm that leverages a security hole in a default service of a default Red Hat Linux install. Or Windows XP Home Edition.

However, it takes considerably more skill to be able to write a worm that can target vulnerable services across multiple distributions of Linux, multiple versions of each distribution, etc.

As long as Linux evilware continues to exploit C program unchecked boundaries, a single universal worm that can effective exploit every potentially vulnerable Linux system remains highly unlikely.

Re:Security through obscurity

[freeweed]

Anyone can write a worm that leverages a security hole in a default service of a default Red Hat Linux install. Or Windows XP Home Edition.

Except that a default Red Hat install runs pretty much no services, nor leaves any ports listening (no services generally means no ports, but just in case people can't keep up :). XP, on the other hand, has a good half dozen ports open, some of which are almost impossible to close.

I think the issue of 'likelihood' is answered quite sufficiently by that fact alone.

Well...

[RancidBeef]

60 something percent is running Linux (and I assume Apache). Who the hell is still going to be running Windows with IIS???

Re:Well...

[Anonymous Coward]

Peopl who don't use OSS?

No...

[Anonymous Coward]

Somehow I'm willing to bet the poster is Carl McBride, trying to throw more Linux FUD around.

man_of_mr_e - Carl McBride.

Coincidence? I think not...

Lots of room to grow; OpenBSD is 1 good example

[Anonymous Coward]

If you want a free, open source Unix like operating system that focuses on security, you can't get much better than OpenBSD (http://www.openbsd.org).

If you really want to stick with Linux, distros such as OWL (www.openwall.com) and Trusteddebian (which uses GRSEC and PaX) are OK too.

Popular distros have only very recently turned their attentions to security - just like M$; and as such they have a long ways to go. Projects like OpenBSD really serve as a model of what can be accomplished over a longer period of time with such a focus, yielding a thoroughly audited code base, many default security settings, and they're still usable from the get go (e.g. not all services are turned off, making it a completely useless piece, though perhaps still more constrained than some are used to).

Outside of some of OpenBSD & security conscious linux distros and OSS security minded projects - I think that the open source community as a whole has a lot of room to grow wrt to security, and really isn't all that different from everyone else be they MS or Oracle.

at the end of the day...

[zeruch]

...one can rely on two truisms: 1. *nix was inherently designed better from a security model perspective 2. most users heads are not

How about this?

[wadeb]

Linux is less vulnerable because there are fewer identically configured machines on the internet.

One of the things about Windows is that there are so many copies out there that are all configured the exact same way, if a flaw is found in anything you have an instant worm possibility.

With Linux there are so many distributions, each with their own initial configurations and setup types that a worm would be hard pressed to find a common exploit.

Not that the internet hasn't been shut down by a UNIX worm in the past, that is... :)

Re:How about this?

[Anonymous Coward]

Yes well, that exploited sendmail. Most people uses Postfix nowadays anyways.

And if they don't, shame on them. Sheesh, its been almost 5 years since IBM's "Christmas present."

Re:How about this?

[redjeremy]

Does this undermine the standardisation efforts going into Linux? (think UL, LSB).

In biological terms, a diverse gene pool is required to prevent a single, effective threat from having adverse effects on an entire population. By standardising Linux, are we removing this diversity?

Not to say that I'm at all against standardisation, just a thought.

It's easy

[brooks_talley]

Windows web defacements are the fault of a crappy, inherently insecure operating system from a criminal monopoly.

Linux defacements are the fault of stupid admins who can't be bothered to install the latest patches, or who are too incompetent to install the OS and configure it for security.

I thought everyone knew that.

Cheers
-b

Re:It's easy

[glenebob]

Somebody mod this crap DOWN. Web defacements are due to the same thing on both systems: buggy web servers and failure to patch. Period. It has nothing whatsoever to do with the underlying systems.

>> I thought everyone knew that.

Good point... this IS slashdot afterall...

Re:It's easy

[Anonymous Coward]

Web defacements *CAN* be the result of crappy OS, crappy system admins, crappy webserver configurations, but speaking as an owner/operator of a web hosting company teh number one reason is crappy scripts. CGI and PHP applications that are not designed with security in mind are by far the larger cause of defacements and unauthorized access. People who don't know scripting think its great that all these scrits are free, but they do not understand that the software was written to scrath an itch usually, and that security usually was not the itch that needed scratching.

Re:It's easy

[Anonymous Coward]

>Windows web defacements are the fault of a crappy, inherently insecure operating system from a criminal monopoly.

>Linux defacements are the fault of stupid admins who can't be bothered to install the latest patches, or who are too incompetent to install the OS and configure it for security.

Hey! Be careful! Your not allowed to post the /. creedo where just anyone can read it!

Re:It's easy

[brooks_talley]

It was a joke, son.

-b

The real reason why...

[Programmer_In_Traini]

The real reason why windows gets so many attacks is because most of them comes from

1. wanna-be script kiddies running in windows and practicing some new skills to show off

2. Hardcore hackers/programmers running linus that do it only for the heck of finding, yet, a new hole in windows.

Even if im running windows, I find it amusing to see just how much the linux "society" is determined to prove itself right againt the $oftware giant.

Was there ever a virus exclusively for linux ? Like the article says, I believe linux users just like to believe they're safe, when in reality, no matter its quality, linux is a product made by human, thus flawed, thus opened to attacks.

Re:The real reason why...

[mlk]

> Was there ever a virus exclusively for linux ?

Yes, it went about patching Linux systems.

It had a story on /., but "linux virus patch" is returning way to many results.

Re:The real reason why...

[wirelessbuzzers]

Was there ever a virus exclusively for linux?

Yeah, the Linux Slapper Worm. It used a remote root hole in Apache (IIRC) to cause havoc.

Just my 2c...

[dark-br]

I've seen people on Windows machines probed and hacked while they were online on IRC, in real time. Any passably competent cracker should be able to take control of a Windows box in short order. And Microsoft is well known for being slack on security matters. Always has been. And VB and the other tripe they've grafted on to their products multiplies the possibility for hacks by an order of magnitude.

Yes, there are Linux hacks, though far fewer than Windows hacks. And I see the buffer overflow vulnerabilities and such that come out weekly for Linux software. Many of those vulnerabilities are theoretical, found by a perusal of source code and never actually taken advantage of. And the Open Source community fixes these _far_ faster than Microsoft will ever fix theirs.

Oddly, some of the foremost security guys (Bruce Schneier, for example) state very explicitly that Open Source software is far better security-wise than any closed source software (read Windows). And they explain the reasons in great detail. And there are several people on this list who deal with both OSes on security matters on a day to day basis, and I'm pretty sure they'll attest that Linux security is much stronger than Windows.

If nothing else, a Linux user can determine and control open ports, running services, and create firewalling rules. Windows users think a port is something a ship pulls into, and a firewall is something in their cars.

Re:Just my 2c...

[Dr. Bent]

Oddly, some of the foremost security guys (Bruce Schneier, for example) state very explicitly that Open Source software is far better security-wise than any closed source software (read Windows).

Why would that be odd? Makes perfect sense to me...

Re:Just my 2c...

[Dog and Pony]

If nothing else, a Linux user can determine and control open ports, running services, and create firewalling rules. Windows users think a port is something a ship pulls into, and a firewall is something in their cars.

So, by installing Linux I somehow automatically learn how to do this? What a strange idea.

Either you are interested and learn how to do something, or you aren't and you don't - on any platform.

Re:Just my 2c...

[BrynM]

.And I see the buffer overflow vulnerabilities and such that come out weekly for Linux software. Many of those vulnerabilities are theoretical, found by a perusal of source code and never actually taken advantage of.

You bring up an interesting point. I bet we'll never see Microsoft patch a theoretical exploit. They seem to see patching as a reactionary process rather than as bug tracking. "If it aint bad PR, then don't fix it." - Too bad that attitude still leaves it "broke".

Re:Just my 2c...

[Gherald]

Security types love OSS. It makes finding vulnerabilities that much easier.

Re:Just my 2c...

[StarCat76]

Any passably competent cracker should be able to take control of a Windows box in short order.
How the heck do you figure that? Just because there's been one exploit in the last week or so (No, if the user consents to it, it's not an exploit) doesn't mean that every Windows box can be cracked. Sure, I bet if you got a very skilled hacker he could probably control the box in a couple days, assuming the person administering the machine wasn't very skillful. But, short of a recently-dsicovered, not-yet-patched exploit being found, if the machine is well patched and had minimal services running, what is said cracker going to do, Will it to send him the password by just his sense of superiority?
I mean, I realize that there are exploits that get discovered every so often, but a Sysadmin who patches the boxes on a regular basis shouldn't have much trouble.

Re:Just my 2c...

[Anonymous Coward]

Your speculation is incorrect.

I was an engineer on the Windows OS during the "security push" last year. There were numerous fixes made for "theoretical" security defects. The top priority was to get these fixes into Windows Server 2003, and then backport fixes for the most serious issues to Windows XP SP1 and Windows 2000 SP4. Because there were no known exploits for these theoretical vulnerabilities, Microsoft did not make the fixes public. You are not going to hear Microsoft say "hey! we fixed 315 previously undiscovered security vulnerabilities in the codebase."

Re:Just my 2c...

[Anonymous Coward]

Exactly. Take IIS off, hell keep it on and patched. Run a competent up to date virus scanner and don't click on everything you see. I'd love see mr anonymous hack in my machine while talking to me on IRC.

Let's see, don't autoreceive and run files. Don't accept dcc chats. It doesn't take a rocket scientist to secure your box, but most people are too lazy to do so.

Re:Just my 2c...

[BrynM]

That's cool. I wish there was some way to find out what the fixes are though.

Re:Just my 2c...

[Anonymous Coward]

Did you actually count them?

Vulnerabilities for 2003 (as of August 25th):

Microsoft Technet - 33 Vulnerabilities
Debian Security - 153 Vulnerabilities

In both cases the vast majority of the problems are buffer overflows. In both cases the issues involve products that are not the core OS, many being either not installed by default or completely separate products.

Re:Just my 2c...

[JeanBaptiste]

> I bet we'll never see Microsoft patch a theoretical exploit.
I bet they do it all the time and just dont publicize it.

Re:Just my 2c...

[angulion]

I believe Open Source has another security boosting factor as well - so much of Open Source software is coded with devotion and "the want to do a fine job".
Even if this would be true for some programmers in a company, companies have a high priority on "time = money", and thus deadlines come quicker than they should and some shortcuts may be taken.

Um... no, you're wrong.

[Anonymous Coward]

"While "defacements" don't necessarily mean "root level break-in", sometimes getting your foot in the door is enough."

With Windows, you can get your foot in the door and shut down the system by doing something stupid. You already see what MSBLASTER and SOBIG can do without Administrator access.

You can't do those things on Linux with "foot in the door" attacks. You can't fck up services like BLASTER did or restart the computer. (Remember that the MS kbase article said that BLASTER could cause system shutdown because a RPC failure is configured to automatically restart the system in an attempt to get the service back up again. I know this is true; it happened on my sister's machine.)

Getting your foot in the door is certainly NOT enough to take down services or even the system on Linux.

Well...

[Sir Haxalot]

I'm almost certain that (evem as I'm loath to say it), Windows Server 2003 is more secure than most versions of Linux, but of course it isn't free :)

We *are* in the same boat as Windows, in a way...

[Anonymous Coward]

Even if it turns out only old copies of Linux or Apache are being exploited, we still face the
exact same problem as Windows does: how do we
make sure that sysadmins update their systems
when security patches are released?

Social Engineering

[Ieshan]

Modern viruses work by two major routes:

A) Exploits
B) Social Engineering

Exploits are hard to stop without patches. Get enough unpatched systems, and your virus spreads. There are a lot of guilty linux users here, I'm sure: people download software all the time without checking it's security. People run software daily without bothering to check for updates. It happens.

Social engineering, however, is by far the most widely used virus tactic. It's easier to fool a user than to fool a well-secured computer, says this adage. The basic premise fails under linux: it's really, really hard to get someone to run malicious code that you want them to run. Most linux users are above-average on the computer-tech-savvy curve - I would say that the mean computing knowledge for an average linux-desktop user is above the 90% mark on a curve of all computer users.

This means linux users don't do stupid things as readily. The subject line RE: DOWNLOAD MY NEW SCREENSAVER with the attached .tar.gz isn't likely to fool many people. I have a hard time believing that most SoBig victims are those who know what Bayesian filtering is; actually, I have a hard time believing that most SoBig victims know what Inbox means.

Furthermore, it's tough to write code that will run without a hitch on everyone's system, as there's so few distro standards. Also, as email virii work, with linux being a small desktop percentage, it's tough to get emails into the boxes of most Linux users.

Last but not least: There are few people who want to see Linux die. The rivalry doesn't work in both directions. There are thousands of anti-MS'ers, but a sad few anti-Linux'ers (SCO not included. =P). What would the protests be? "Hey, assholes! Keep your free operating systems off of our clean hardware! You're ruining good pentium chips by corrupting them with something non-proprietary!" etc.

Just a few points. I'm sure there are better ones.

Re:Social Engineering

[Anonymous Coward]

Actually, there are more anti-Linux'ers than anti-MS'ers. That's one of the inherent problems with minorities -- they always tend to be the loudest in a crowd. Linux still hasn't garnered more than 5% of the market. That's a minority no matter how you slice it.

The majority of Linux'ers hit these boards. Count slowly and you'll see the full number of Linux users.

Re:Social Engineering

[Anonymous Coward]

This means linux users don't do stupid things as readily. The subject line RE: DOWNLOAD MY NEW SCREENSAVER with the attached .tar.gz isn't likely to fool many people.

You just wait until there is more widespread use of Linux on the desktop. With a consistent architecture (x86) it won't be too much of a stretch to imagine a binary being emailed around and I guarantee you your typical end user will execute code that has been sent to them via email without blinking an eye. Sure, it may require an extra step of chmod +x - but it will happen.

Now, before anyone goes "hurr hurr at least you can't hurt anyone else" I can guarantee you that an end user is not going to be any less happy with their home directory being nuked not to mention lost productivity if they are in a business environment.

Re:Social Engineering

[Anonymous Coward]

Not necessarily, 90% of the people running windows don't know what linux is, and would hardly be hostile to a superior operating system ;)

Re:Social Engineering

[Anonymous Coward]

Furthermore, it's tough to write code that will run without a hitch on everyone's system, as there's so few distro standards.

which is why Linux will never become mainstream.

From considerable experience lately,

[Sevn]

I do contract work. A HUGE bulk of it lately has been doing security audits on companys running old redhat, old plesk, or both that have been hacked by shit brazilian hacker groups like "Hidden Wrestle" and "Securinos". They hang out on irc.brasnet.org all day looking for webhosts using old plesk and old redhat. It's an awesome excuse to migrate people to FreeBSD and webmin. I've done quite a lot of that lately. They freak when they see the cost of the latest plesk and enterprise redhat. It makes selling them on FreeBSD and webmin/horde/squirrelmail/usermin/virtualmin/etc. very easy. So as long as people insist on installing 2 year old redhat and plesk 2.5 and never updating it, I'll have plenty of work removing eggdrop and psybnc from machines, and migrating people to FreeBSD. I'm starting to look at BMW's again.

Re:From considerable experience lately,

[Anonymous Coward]

Yeah. I'm a brazilian, but you are totaly right. Those script kids are a bunch of idiots, they stay on channels like #silverlords, and the worst, the media put then as hackers. Yeah, ass hackers.

Re:From considerable experience lately,

[Krach42]

"Setec Astronomy, Too Many Secrets, Comatose Sentry, Taco Semen Story"

OOo... "I want World Peace" "What? We're the US Government, we don't do that!"

Of course, the best one, was "I want her number." "You can have anything in the world, and you want my number?"

I gotta buy that movie... it's great.

Re:From considerable experience lately,

[Anonymous Coward]

The movie is Sneakers for those of you that don't know what's being talked about.

http://www.imdb.com/Title?0105435

Re:From considerable experience lately,

[IamTheRealMike]

If they didn't update red hat, what makes you think they will for FreeBSD?

It sounds like a process/staffing problem rather than anything to do with what software is used, to be honest. Yeah, the latest red hats are expensive if you don't want to upgrade every year, but if you're happy with upgrading once a year it's still free.

Re:From considerable experience lately,

[Sevn]

If they didn't update red hat, what makes you think they will for FreeBSD?

They won't for FreeBSD. *I* will. That's part of the lovin' they get from me. For a fee much smaller than they'd pay to re-redhat their entire network and the fortune they'd pay to keep plesk updated, I move everything to something that is not only more stable and completely free as in beer, but easy as hell to keep updated. Have you ever had to admin FreeBSD? Handling the security end of things is so easy that I charge next to nothing (reletively speaking) to monitor their FreeBSD machines that I install and keep them patched and updated. I haven't had one hacked in 3 years. They get a managed solution for less money and heartache. I write elegant scripts to automatically update 300+ machines remotely when there is a security issue. :) It's neat how you can put the same webhosting customers back on the same hardware with FreeBSD instead of redhat and plesk and then another 30 percent more.

Zone-h now defaced

[teyu]

Not sure if they're running linux, but it looks like their defacement archive just got defaced.

DB connection failed ().

Questions.Question->Answer

Re:Zone-h now defaced

[WindBourne]

An even more real possibility is that the site was hacked to make it show 61% on Linux.
BTW, according to netcraft, they are running apache on solaris.

Missing the point entirely

[Anonymous Coward]

A careless admin running Linux is just as insecure as a careless admin running windows. I've seen the practices put in place by many hosting companies running Linux, and if they could be doing one thing better, it's security. For a careless admin, the only real advantage of using Linux and other OSS is price, and the fact that the openness gives them an edge over closed source software in bug hunting/vuln finding. Also, the Linux defacement number could be inflated, as a higher percentage of hosting companies may be running Linux, and attackers may target Linux over windows.

Defacement != Hack

[RT Alec]

At least, not always

IMHO, the single greatest threat to having a site defaced is the use of insecure protocols for publishing. Let me be more specific: FTP. Most web development tools use FTP for their "publish" feature (e.g. Dreamweaver, just to pick on them). Securing FTP is a nightmare, with all the ports randomly popping up and so forth. You have to dumb down a firewall quite a bit, and having it tunnel over SSH only partialy secures it (and you still have to deal with the firewall woes).

So, an employee goes home at night, and updates his company's web site over her cable modem connection, and the 12 year old down the block running a sniffer captures the user ID and password. She then passes this information on in a chat room, and viola! The site is defaced shortly thereafter. It does not matter what OS the site is on.

Having said that, some systems are more prone to social engineering. If the server goes down due to numerous patches being applied (and the requisite reboots), a web developer might get used to the IS department resetting her password and thus more suceptable to that phone call asking for the login info. But my point is, web site defacements do not necessarily indicate the security of the OS. It is a combination of protocols used (how about only allowing SFTP?), policies, and implementation by knowledgeable admins. Unix (Linux, BSD, etc.) admins tend to be better at implementation and policy development then their Windows brethren, perhaps that is the causal connection.

Re:Defacement != Hack

[Arandir]

So what do you do about hosters that won't let you update your site except via ftp? I have to use ftp for my site. Supposedly, rsync is available, but they haven't bothered setting it up for me.

Re:Defacement != Hack

[RT Alec]

Well, you could move to a hosting company that cares about security, instead of talking the talk. Otherwise, prepare to have your site defaced at some point. Sorry. It's kind of like people who complain about their house getting flooded all the time, but they live near a river. Move.

Re:Defacement != Hack

[Anonymous Coward]

Or people who live in DC complaining about not having a vote...

Re:Defacement != Hack

[Arandir]

I understand the risk I face. It's the price I pay for really good uptime, service and price. At least I've got them researching ssh and sftp.

But the real point is, how many people have a hoster that actually offers a secure solution? Certainly the big three don't. Some smaller guys might, but good luck finding them at a reasonable price. These GUI publishing tools all use ftp, because that's all anyone ever provides in the consumer webhosting market.

Re:Defacement != Hack

[Just Some Guy]

Furthermore, the defacement may have nothing to do at all with the underlying strength or weakness of the host OS's security model, but may fall squarely on the gaping security holes in content management applications.

One of my sites was defaced recently. During my morning "hosting stroll" I was greeted with a giant "Y00'VE B33N 0WN3D!!!1!11!!". I would've felt pretty dumb if the site wasn't a Wiki.

Garbage in Garbage out

[Brahmastra]

The OS is only as secure as the user. If a lame Linux user does everything as root, he's going to be more vulnerable than someone using Windows 2000 with a firewall. If a lame Windows administrator doesn't have a decent firewall and keeps all kinds of ports open, he's going to get hit too. It's about users knowing what they are using. But I have to say that a default Windows installation does appear to be less secure than most default Linux installations.

It's more complicated than all that.

[dwheeler]

The arguments are all far more complicated.

An unmaintained system is almost always more vulnerable than a maintained system, no matter what they are. Also, I don't know how secure you'd like to think GNU/Linux distributions are - they're made by humans who make mistakes.

But the recent attacks certainly give evidence for th e Linux crowd. XP comes with multiple open ports by default, by default doesn't enable a firewall, and its mail reader by default runs arbitrary programs sent by attackers when clicked. Typical Linux distributions have no open ports by default, use a firewall, and don't stupidly trust attackers to send them "nice" programs when clicked.

The notion that Linux systems are immune is fundamentally wrong. Linux systems do make design choices that make them rather resistant. But it's all more complicated than "X is always more secure".

Re:It's more complicated than all that.

[shird]

An unmaintained system is almost always more vulnerable than a maintained system

Thats exactly right. So what it comes down to is which operating system is easier to maintain (easy to maintain = easy to secure). Personally I think that is windows, just download a couple service packs and your done. On Linux, due to the number of different configurations and heterogenous components it is a lot more difficult to keep it up to date. my 2c.

Re:It's more complicated than all that.

[stevens]

Typical Linux distributions have no open ports by default, use a firewall [...]

Which distributions are these? No open ports? An already-configured site-specific iptables setup?

I think you're on crack. The first thing I do with any new install is to comment the hell out of inetd.conf, clear other unnecessary crap out of rc[2-5].d, and make up some iptables rules.

I like creating bare systems from debian or openbsd because they have only a small amount of other crap running.

Re:It's more complicated than all that.

[patman600]

But it's all more complicated than "X is always more secure"


no its not, OS X is always more secure because it is made by apple.

Re:It's more complicated than all that.

[pantherace]

I am going to have to disagree with that.

1) Microsoft typically has patches out only after exploits (or detailed description) is posted.

2) The automated downloading of patches can be done by just about any linux disto (excuse my ignorance, but the only 'major' (redhat, suse, mandrake, debian, gentoo, slack) distro that I am not sure about is slack (due to my lack of experence with it). apt-get, emerge, up2date, etc can be scheduled in crontab (and have been able to be for many years before a decent 'windowsupdate')

3) Windowsupdate ONLY DOES MICROSOFT PRODUCTS (and a very few other things, such as drivers) Using Corel WP? Lotus 123? etc? You have to find some way to update them (admittedly they either aren't as buggy or no one cares about them)

4) REMOTE installs... with ssh + the a linux package management system (apt, emerge, up2date, etc) all computers can be updated remotely with all of their packages. You can do this in windows but only for critical updates via SUS.

I can't stress #4 enough, and I have been looking for something that will do many of them, but the best solution someone has come up with, aside from write your own, is to repackage installed programs.

Where are the windows admins who admin 100s of windows clients? Bring out your package management tools! (even the expensive ones!)

Re:It's more complicated than all that.

[shird]

2) The automated downloading of patches can be done by just about any linux disto (excuse my ignorance, but the only 'major' (redhat, suse, mandrake, debian, gentoo, slack) distro that I am not sure about is slack (due to my lack of experence with it). apt-get, emerge, up2date, etc can be scheduled in crontab (and have been able to be for many years before a decent 'windowsupdate')

But will it update your custom compile of Apache with a module you downloaded from hacker joe which makes use of the latest Perl tarball you nabbed from CVS? You see what I'm saying?

sure Microsoft has a monopoly and supplies all these components themselves, but it gives you a single place to get well tested updates from. You dont have to subscribe to a hundred different mailing lists and read every mail to make sure you dont miss an update to some obscure kernel module you have to patch in manually....

Re:It's more complicated than all that.

[pantherace]

But will it update your custom compile of Apache with a module you downloaded from hacker joe which makes use of the latest Perl tarball you nabbed from CVS? You see what I'm saying?

If you are using CVS, etc, on a server you had better know what the heck you are doing, or you shouldn't be using it. Also why custom compile it (if not using gentoo)?

I have done something similar, and all it took was a shell script to fetch the (samba) source rpm, a sed script to add the configure option (--with-ldapsam) and then to rebuild it and install it. Not hard to do, and if I wanted to it could have been completely automated (admittedly it wasn't automated)

sure Microsoft has a monopoly and supplies all these components themselves, but it gives you a single place to get well tested updates from. You dont have to subscribe to a hundred different mailing lists and read every mail to make sure you dont miss an update to some obscure kernel module you have to patch in manually.... Why the heck would you be using obscure kernel modules if you don't have a good background on them in the first place? The distros all have their kernels (so can use nice package management) patched up. If you are compiling the kernel from source, again, you should know what the heck you are doing.

I realize that I am talking about people knowing what they are doing, but lets face it, if one runs a windows server they had better go in and clean up all the mess, and frankly if you stick to the updates, Linux will do much better, than windows, especially from the point of the whole OS (and installed apps-as mentioned in my post above-you can update all the software, not just the microsoft software).

I recently had this discussion

[Lane.exe]

With several friends of mine. One of them, despite his better knowledge, is a big Windows fan "because it does what I need it to do, it's secure if you patch it, and I can run my BF1492 server off of it."

The rest of us are OSS fans, and had a hard time convincing him that while he could use gobs of 3rd party software and his own knowledge to secure a Windows box as well as any of us could secure our machines, Windows was not "just as safe" because it has security holes you have to patch when you buy it. There are at least 5 processes that leave ports open in the background on any XP box when you install it. You don't get that with something like Linux.

He did make a good point that it's easy for typical users to secure Windows by buying a firewall, shutting off Messenger and running virus scans, but in order to make something really secure, you need a good, secure OS. It's hard to do anything that harmful in *nix without root access, and that requires things like password sniffers and keyloggers... things an educated computer user should be able to avoid.

It goes back to the fact that *nix is more secure for mainly two reasons -- design and the knowledge of its typical user.

Website defacements

[FrostedWheat]

I'd say the majority of those defacements are because of mistakes or bad design by the websites developer. I've made a few of those mistakes myself, but caught them before anyone else did.

If it was a vulnerability caused by Apache or the Linux kernel, you'd soon hear about it!

2x Linux servers

[Anonymous Coward]

That's because there are twice as many Linux (apache) servers as Microsoft. How long did it take you to come up with this anti-linux angle?

Numbers!

[Quasar1999]

Hey, if I told you that one in every two Ferrari F-40's explode for no reason, but only 1 in every 1000 Honda Civics explode for no reason, which explosions are going to be more noticed?Obviously Honda, as there are more of them on the road... so...

Linux may or may not be as bad for security, but when Windows gets exploited, it's felt... and it's felt HUGE!

Re:Numbers!

[Brento]

Hey, if I told you that one in every two Ferrari F-40's explode for no reason, but only 1 in every 1000 Honda Civics explode for no reason, which explosions are going to be more noticed?

The Ferraris, because nobody important drives a Civic.

Knock off balding middle-aged, filthy rich tycoon, and that'll get more press than offing a bunch of morons who put rear spoilers on front-wheel-drive cars.

But I digress...

Re:Numbers!

[Anonymous Coward]

congratulations on your CRAPPY LOGIC moron

what kind of pipe smoking mod who never took a logic class modded this sad post up?

Re:Numbers!

[Anonymous Coward]

Your the one with screwed up logic.

Re:Numbers!

[narcolepticjim]

Your analogy has one giant failure. When Windows has a gaping flaw, we don't see one machine in 1000 exposed -- probably more like 750 in 1000 getting hammered, just like with the Blaster worm or Code Red. Further, these exploits almost ALWAYS give the virus/worm administrative privileges that would be MUCH harder to wrest from a *nix machine.

Re:Numbers!

[Anonymous Coward]

Knock off balding middle-aged, filthy rich tycoon, and that'll get more press than offing a bunch of morons who put rear spoilers on front-wheel-drive cars.

There is a lot more truth to that than many realize. Back in 1981, I was working at CDC as a lab assistant. The CDC approached Reagan for a couple of million dollars to chase down those that had a new infection. Apparently, though, it was only striking gays. When they asked for the money, reagan's staff and particularly reagan refused. In fact, they blocked as much as possible, while preaching about the horrors of Herpes. But shortly after Lymes disease poped up. WOW, did that get funding. It was amazing. Same for leageneers(sp) disease.

Re:Numbers!

[csimicah]

more press than offing a bunch of morons who put rear spoilers on front-wheel-drive cars.

Side note, and this is only tangentially related to the current thread.

Rear spoilers are not there to improve tractive acceleration. No production car in the world has a problem with tractive acceleration at speeds where a spoiler is useful. Spoilers are there to keep weight on the rear wheels for lateral acceleration, which is required no matter what the drive wheels are.

In fact, most FWD cars are lighter in the rear than RWD cars so you could argue that they need more downforce to keep the rears in line in hard cornering. Of course in reality, no street sized spoiler is effective at speeds below ~100mph, but to imply that it's somehow stupider for FWD doesn't make sense.

/rant

Re:Numbers!

[Brento]

Back in 1981, I was working at CDC as a lab assistant....Same for leageneers(sp) disease.

I bet I know why you lost your job.

... Suitability and purpose ...?

[plasmaroo]

I think that the important thing here is the suitability of the application: If you set up a web server and want it to be secure [and are a savvy user] people would often go for secure/stable distros [e.g. Debian] because they are usually stabler to start with and the level of exploits from nothingness-level is very low. However, most people use the standard distro which is quicker for them: remember, [most] ISPs care about making $$$ first, and their security second unless they need security to keep the first [$$$].

However, the OS is often not the case: If you have the most stable OS ever , and you are running something as setuid or a stray *inetd service is running loose with root access, you have every right to be screwed: a stable system with stable software but a big gaping hole is going nowhere other than getting penetrated unless it is patched in time before somebody comes along and kills it.

So why does this happen with the M-company more? Well, this is because of the design [the code is just layered and layered and layered from old buggy versions: it gets less stable unless you add more code to stabilize it and of course, gets less secure and more prone to buffer overflows and the likes]. However, the user is also to blame: Users often install innocent software [which is designed by developers who write for an 'innocent' operating system...]... And the loop goes on. And when one thing falls out, the rest do. Like that stacking and pull a thing out game, whatever it's called.

Its in the code....

[ItaliaMatt]

I would like to think that linux is as secure.... the difference between Microsoft and Linux is the peer review of code in Linux. Microsoft can continually ship beta code and wait for their customers to test it for them. Linux has a more robust peer review of code that has many programmers with different takes on coding look at the code to see if it can be cleaned up/more secure. Microsoft is unwilling to stand up to such a review. Simple as that.

Kernel security is key

[Anonymous Coward]

Most service vulnerabilities can be worked around... if anything, by replacing the software that provides the service. Not so with kernel holes. I for one run a couple of firewalls that I'd love to 'freeze' and switch over to CD booting and RAM disks. Unfortunately, I'm not confident enough in the invulnerability of the stable kernel. So I just upgraded both to 2.4.22 this morning, and will have to keep doing so until someone convinces me otherwise, even though I don't need any new features.

Server vs OS?

[dj961]

Comparing Linux server defacements and Window's viruses is like comparing apples and oranges. In one case we are talking about exploiting applications that run on top of Linux ie. a web server, in the other faults within the actual operating system that can potentially be devastating to the end user. Either way no piece of software is secure as long as someone decides to use it.

popularity

[bongholio]

I think that the most popular OS, whatever it may be, will always have the most visible and damaging virii, worms, cracks... Not only will the media be more interested in problems that affect many people, but those who cause the problems are also more interested in affecting the most systems/people as possible. That doesn't mean that the other OSes are better or more secure, just less interesting to the troublemakers.

You have the right to choose

[Smartcowboy]

Any OS maybe secure but are often not secure by default (ala OpenBSD). The most popular distro (RedHat, Suse, Mandrake, ect) want to be user friendly but there is always a tradeoff between security and usability.

It's up to the sysadmin to make sure his server is secure. If his Windows or Linux or BSD server is defaced he can't blame anyone but himself because he is the one who made the choice to use Windows or Linux or BSD and he is the one who made the configuration.

Some links to learn how to increase the security on your linux box:

Linux Security HOWTO

Security Quick-Start HOWTO for Linux

Security Quick-Start HOWTO for Red Hat Linux

Computers > Software > Operating Systems > Linux > Security

Website defacement is not a good measure

[sterno]

Linux is a kernel, upon which you can run a number of applications. To say that Linux is insecure because somebody runs a buggy web application is ridiculous. If the defacement happens because of a exploit against the OS itself, fine, but that number doesn't reflect that.

A better measure would be to calculate the approximate economic damage created by a given security breach, and then adjust the figure to acommodate for the installed base. That is, if a Linux hack costs $1,000,000 and there are 20 times as many Windows boxes, then it's equivalent to a $20,000,000 hit in Windows terms.

Isn't it obvious...

[pyrrhonist]

...BSD^H^H^HLinux is dying!

Windows comparisons are silly..

[Anonymous Coward]

No good will come from comparing Linux security to Windows. We should be comparing it to OpenBSD. That gives us something to strive for, and will lead to improved Linux security. We will always be able to just sit smugly on our laurels if we make comparisions to Windows -- it just isn't much of a standard.

Number of deployed systems

[motha_chucker]

I think the answer lies in the number of installed systems running linux at home. Most viruses/worms today seem to recruit zombie machines to carry out larger attacks. The easiest machines to compromise are those installed at the home without firewalls. Nearly all of those machines are Windows based. That being the case, those who are taking advantage of security holes to carry out attacks focus on creating windows based worms/viruses since machines running windows are more numerous and accessible.

I also believe that if the majority of unfirewalled machines were Linux based, we would see more linux security holes exploited via worm/virus. I believe there is evidence to backup this claim in that there is a higher percentage of viruses/worms per security hole on average, written to exploit windows.

Hello, son

[Anonymous Coward]

It has come to our attention that not only are you wasting your time posting to slashdot when you should be looking for a job, but you are also a moron. The W32.Blaster worm goes by many names, something you as a geek should know.

Please move out of our basement and take all your Hentai DVDs with you.

Love,

Mum and Dad.

Re:Hello, son

[rokzy]

I don't have a mum you insensitive clod!

Re:Hello, son

[Anonymous Coward]

I don't have a mum you insensitive clod!
That allright. Jesus was born in an immaculate conception, so he did not have a dad and the original a.c. most likely did not know who is daddy was, but only that his mum barked.

Linux worms

[ZorbaTHut]

I've actually gotten irritated enough with "Linux is more secure than anything!" zealots that I've considered writing a Linux worm. I seriously doubt it would be hard. Go find some old security advisories for Apache, SSL, and anything else you want. Hook together a Linux-killer worm that tries all of the exploits, installs a rootkit on the compromised system, and sets that one up to probe. If you wanted to be really evil, you could code it to start doing subtle damage after a week - wiping random passwords, deleting random files in user's directories, and so forth. After a few months it could start causing kernel panics if you wanted.

Would it work? Of course it would work. For all the "Linux is secure!" talk going on, what they really mean is "Linux is secure if it's patched up to the most recent versions" (curiously enough, this is the same as Windows). I'll bet you cold hard cash that there are plenty of old unmodified Redhat 5.0 systems out there. How many root exploits have been found in the last few years? How many holes have there been in Apache, SSL, Samba, any other program that's installed by default?

Nobody's done it yet - but that doesn't mean it's not possible.

The only reason I haven't written the worm is because, in the end, I'd cause a whole lot of financial problems and headaches for a lot of people who didn't deserve it. I'd love to prove Linux doesn't have intrinsic perfect security, but I don't want to actually do damage to prove it.

But just wait - someone's going to do this someday. In fact, for all you know, somebody already *has* - they've just programmed it to be unbelievably stealthy and only target systems that the admin hasn't logged onto in months.

Go on - prove it's impossible. I dare you.

Re:Linux worms

[Anonymous Coward]

"installs a rootkit on the compromised system"

Just how are you going to put a rootkit on a machine that runs its processes under user accounts? How are you going to put a rootkit on a machine that has root mounted off of a CD? Your worm would be lucky if it rooted 3/4ths of the children in school's boxes, but it's never going to touch one run by an adult.

Re:Linux worms

[thebatlab]

Isn't it mathematically impossible to prove something can't be done? Your last comment just made that come to my mind. Sort of like it's impossible to prove that a piece of software is completely bug free?? Maybe I'm just on crack....

Re:Linux worms

[habig]

> How many holes have there been in Apache, SSL,
> Samba, any other program that's installed by default?

That's part of the point, though. Even if those programs you mention are installed by default (they are on RH "server" installs, but not otherwise), they aren't enabled by default. Even on something as old as RH 5.

People who feel the need to go out of their way to enable those things are also more likely to feel the need to update them. Although there are always bozos included in any sweeping generality :)

Re:Linux worms

[ZorbaTHut]

As for your first comment, that's what root exploits are for. Yes, they exist. Not many, but enough.

However, I personally have never seen a Linux box in use that was mounted off a CD. I know they exist, and yes, they'd be pretty secure - but I have never once seen one. Statistically insignificant.

Re:Linux worms

[uid8472]

Isn't it mathematically impossible to prove something can't be done?

If you believe that, then find me integers p and q such that (p/q)^2 = 2.

There's a well-known and rather old mathematical proof that that's impossible (and thus that the square root of 2 is an irrational number), but feel free to try...

Re:Linux worms

[cyril3]

It is 'scientifically' impossible to 'prove' that something isn't true because you cannot test every possible occurance. Statistically you can feel comfortable that a prediction will prove correct but you cannot be assured 100%.

Matmatically you can prove a theory. Or prove that something cannot be done. Godels incompleteness theory springs to mind. But notice that it's called a theory as well.

The fact that you are on crack does not change this though it makes it less likely that you give a shit.

Re:Linux worms

[adam arndt]

Hm. Why then, does someone not write a benign Linux worm? Or a cheese worm? It could propograte around (to some maximum reproductions), report back somewhere and then delete itself. It would report back how many systems there are with common exploits. I can't believe this doesn't happen. If it were another cheese worm, it'd patch the systems as well.

Re:Linux worms

[Znork]

Unmodified Redhat 5.0 systems? Now, that's a hoot. Trust me, there are no unmodified Redhat 5.0 systems out there. Any unmodified Redhat 5.0 system would have been so haxxored so many years ago that the l33t haxxors would have upgraded it by now.

There are plenty of linux exploits and even several worms. If you have an unshielded unpatched box on the net you're most definitely going to have it cracked. Probably within hours of installing.

The only advantage that Linux has is really the slightly more secure default install these days, and the slightly higher chance of reasonably competent admins.

But its hardly unbreakable. You have nothing to prove, any halfway decent admin already knows there are such worms and that more could be written. The rest you arent going to convince anyway.

Re:Linux worms

[poot_rootbeer]

I've actually gotten irritated enough with "Linux is more secure than anything!" zealots that I've considered writing a Linux worm. I seriously doubt it would be hard.

Robert T. Morris already did this (or would have, had Linux existed 20 years ago)...

Re:Linux worms

[Darby]

Godels incompleteness theory springs to mind. But notice that it's called a theory as well.

I think you mean "incompleteness theorem".
A theorem, once proved, is absolutley proved without a shadow of a doubt (within the parameters of your system).

So, no it is not ever called a theory by somebody who knows what they are talking about.

Re:Linux worms

[cyril3]

Shit, he proved it. I really am behind in my reading aren't I.

Re:Linux worms

[benzapp]

It is only impossible to prove an unrestricted negative. Once could say God doesn't exist in my room right now, but one cannot say God doesn't exist. This is a common topic in theist/atheist debates.

If anything, things like the quantum mechanics seem to indicate anything is possible. There is a measurable chance that you will instantly appear right next to me when you read this post. There is also a chance a perfectly secure linux box will appear as well... It may be extraordinarily improbable, but it is still possible...

Linux Security

[FsG]

Linux isn't secure; it's securable, and if you simply throw a default RedHat install onto the web, then you're missing the whole point and effectively negating all of the security potential that Linux has to offer.

Both Linux and Windows must first be properly patched and locked down; the differences between the two are:
1. Linux's security model, when properly used, makes it harder for an intruder to go from "foot in the door" to "root access."
2. In the case of Linux, you won't have a whole new set of remote root exploits that need patching 6 hours later.

Re:Linux Security

[Anonymous Coward]

Well, yes. Since my DSL web server got hacked about a month after it was up with a vanilla RedHat 7.1, I've appreciated that a secure RedHat bears about as much resemblance to a vanilla install as a secure Windows machine bears to a vanilla install.

Nonetheless, I think it has to be stated that Microsoft has gained huge percentage share in small business implying that companies can send the accounts manager to a weekend course and "voila!", she's a sysadmin. And that is cleverly slimey because when the predictable chaos ensues, there are all sorts of other directions to point fingers rather than the initial sloppiness. So what's the moral if managers keep buying into that line?

Re:Linux Security

[Anonymous Coward]

Believe it or not, Windows NT's security model, when properly used, makes it even harder for an intruder to go from "foot in the door" to "root access"! No, seriously -- spend some time researching exactly what the NT series provides. It's quite comprehensive and extremely flexible. The number one issue by far is that nobody pays attention to it, and everyone expects everything to work without the least bit of hassle. Security features that aren't used don't help much, do they?

Webmasters are not security geeks.

[symbolset]

Most of the people who run websites think html formatting is "programming". It should surprise noone that given a pistol they make holes in their feet.

OTOH, IIS servers are insecure by design, as a quick glance at your logs will tell you. Where else would all those requests for /c/windows/cmd.exe? come from?

Let's face it. The web is always going to be the Wild Wild West.

Email Virii are different..

[mrmud]

Email virii usually rely on stupid, sleepy, or _____ people to click on the attachment. Since most of these people are usually on desktops, which means windows, they get propigated out quickly.

Of course, security wise, there will always be buffer overflows as long as coders are allowed to decide what kind of data to put in their own buckets. Right now, windows is the OS that people love to hate and has most of the desktop share, and a good chunk of server, so naturally there is more attention paid to it then with Linux. I imagine as Linux becomes ever more popular, there will be more exploits out for it and it's applications. (See: current Sendmail exploit.)

Just because you don't see many exploits out for CP/M doesn't mean it's the most securely coded OS.

The answer is simple.

[miffo.swe]

The linux distributors is the ones that should adress security in linux. Developers also have a big part but for the user it more important that the dist he is using is secure out of the box. No unwarranted ports or services should run from scratch. If nothing vulnarable is running not much can be broken into right?

Developers need to make it easier to secure the systems. Often people tend to open up every port and setting things too loose when they try to get things working. Better documentation and better configuration systems should help a great deal in those cases. Many times its not linux that is insecure but the admins dont know how to secure their systems. With more and more MCSE's using linux it need to be simpler to secure.

User level privilages

[miketang16]

Personally, I think Linux will always be more secure as long as Windows doesn't implement users and groups correctly. In XP, the default login is Administrator, which allows for access to EVERY single file on the system. The installation doesn't tell you this either, it just uses it if you setup only one account. With Linux, even if someone were to break your user password, or exploit their way into a user account, they can't do nearly as much damage as in Windows. Of course if they get the root password, you're just as screwed, but at least there's a barrier of protection between levels.

Linux/Windows Security

[Anonymous Coward]

I always find this a laughable subject.

1. NT and it's descendants are SUPPOSED to have granular security model. However, it does no good at all to have a granular security model if you don't use it. Most every application I see either runs as Administrator OR must be installed as Administrator.

2. Linux may not have a granular security model, but in many ways this has been not as big an exposure since most admins have finally wised up and stopped running applications as root. As soon as a granular security model is globally available, I imagine pushback will quickly occur on application vendors to vanquish root access requirements (or at least they SHOULD stop requiring ROOT access).

Frankly, if end users and administrators had been demanding this early on, the exposures today would have been reduced many times. The easy road is not neccesarily the best road.

There are coming POSIX standards and other security measures that will make Linux a very ROBUST solution and the easy equal of NT's security model. If vendors will just support those models, then we will all be better off.

One example would be MAC (Mandatory Access Controls).

I would just be happy once the ability to assign privilaged operations to specific users/groups is widely available. I should never require a "root" account with all access abilities. More so, I should be able to have an account called "root" that by default has all access, and remove or re-assign them as needed.

Re:Linux/Windows Security

[Anonymous Coward]

http://acl.bestbits.at/ - Extended Attributes and access control lists for Linux

http://www.cs.duke.edu/csl/faqs/solaris-acls.php - Solaris ACLS, Solaris also has there own DNS like system which you can wrap into this. Including Network ACLS

http://www.freebsd.org/doc/en_US.ISO8859-1/books /h andbook/mac.html
Then you have FreeBSD etc etc that have MAC. It's not new contrary to popular belief. The only system that doesn't have it that I'm aware of is OpenBSD and thats more political than anything else.

I could go on with the same OS's and diff refined control mechanisms but i've already made my point. So you should of been happy a while ago. It's just another one of those things alot of NT admins think doesn't exist in unix.

Only As Secure As The Person Running It

[nuintari]

Linux itself, and any OS can be very secure, in the hands of a competant admin. Its when you get a moron in command that the integrity of the system goes down the pooper. Even OpenBSD can get owned if a moron is running the show.

And remember: Website defacements are often a level above owning the actual server, PHP Nuke has an awful track record, with new holes found all the time, and other site management software is vulnerable as well. Crois site scriptingm, cgi exploits may allow a level fo access to a site, or even compromise a user level account, but in the hands of a skilled admin, this is nothing compared to a fully suvccessful root exploit, and can eb dealt with.

And fo course, no matter how good you arem, if you allow remote root ssh conenctions, and your password is "demiguru" for every account you have anywhere, well then, your just a dumbass. Yeah Nick, I am talking about you.

Re:Only As Secure As The Person Running It

[nuintari]

My god, mod me back down, I didn't realize how much caffiene I had before I typed that. I'm a bad typist normally, but jesus.

Re:Only As Secure As The Person Running It

[Anonymous Coward]

My god, mod me back down, I didn't realize how much caffiene I had before I typed that. I'm a bad typist normally, but jesus.


Too late. As at 06:30AM half of my accounts everywhere have been hacked.

Don't die before I get to you, Nu.

--Nick

Email viruses

[MyDixieWrecked]

Welp, most of these Windows-only (or M$ only) viruses that have been ripping everyone's asses open have been the result of M$ trying to implement end-user programming into every application; only they're doing it the most stupid way possible. Auto-running code is one of the worst features I can think of. When I put a CD in to my computer, I don't want some whacko, crazy welcome screen popping up. I wanna just run the damn installer and get everything done.

I don't want to be able to have VBscript code running when I get an email, and I don't want the script to have access to my address book or to my whole harddrive. I don't want my default OS install to have every possible internet service enabled; even if I'm gonna use it as a dedicated server.

Regarding website defacements, it's got nothing to do with the OS that the server is running. It doesn't matter how secure your OS is or how savvy the techie running the site is, if someone's using an insecure password or uses it insecurely (saying it outloud to someone only to be overheard or writing or whatever), the site could be breached. Also, many services (ftp, htaccess, not ssh or telnet) don't protect against brute force attacks on the passwords, so there's a security problem, there.

Another problem is that some ISPs have a habbit of dispensing cookie cutter passwords (initial of first name followed by street adress for instance) to new users which, generally won't change the password to something they can call there own which could lead to further break-ins.

I agree with what one poster said earlier though, the more people who are running a given platform who don't know anything, the more likely a break-in will happen.

That's all I've got to say.

Today's attacks...

[sorrodos]

Hmmm for today's defacements, I see there have been 16. I also see that they have all taken place on Win2000 servers. Also, while viewing these stats, I saw a banner-ad at the top of the page for Zone-H that says Windows is the most insecure OS and that 51% of defacements are performed on Windows servers.

Insecure Users

[Anonymous Coward]

While the problem may reside in software, i.e. not patching, updating, plain insecure code, I think many times it is also as a result of the users not choosing secure passwords. Just thought I would toss that out there.

I'd say yes

[FooBarWidget]

I say Linux is *overall* more secure than Windows. Not because of the of then number of exploits, but the *attitude*.

Let's face it: nothing is 100% secure. As long as software is made by humans, there *will* be security vulnerabilities.
So, what matters is how you deal with bugs and vulnerability. The open source community is much better at this than Microsoft. Security patches are often released in a few days *and* peer reviewed. Those patches break a lot less things than MS patches because they're peer reviewed.

Also, no Linux email client supports automatic execution of executable code. This already eliminates most of the viruses today that are made by script kiddies. And you have to manually save the attachment to disk and add the execute bit. This is a lot of work for Joe Average.
Of course it's still possible to get a virus, but the point is that the overall chance is lower.

So yes, I'd say Linux and open source is overall more secure than Microsoft. Security is not measured by the number of exploits alone!

Re:I'd say yes

[rockhome]

Also, no Linux email client supports automatic execution of executable code.

What about defining a MIME-type for specific type of data?
If you had a predefined type for PostScript data that told your mail client to open up ghostscript or something simialar, could I not put malicious code into the postscript code?

I believe this would be automatic execution of code, no?

Re:I'd say yes

[FooBarWidget]

Well no. By default, GhostScript disables all potentially harmful functions (like functions that can delete files). Heck, I don't even know how to turn those functions *on*.

the biggest difference...

[spir0]

I think that the biggest difference is that there are lot of people installing default redhat boxen for webservers. they don't have the knowledge to secure them.

of course, that happens in the windows world to, but the problem with windows is that it has so many hooks to allow apps to talk to the core OS with standard user permissions that it is that much more exploitable.

it's easier to take advantages of windows flaws so most people do.

.. just about 30% relevance

[gl4ss]

maybe that's because 60% of websites run apache/linux?

not to mention that i would think most defaces to be because of poor security thinking in scripting and other user made holes(or not properly being prepared for such, or using some poorly written apps with them) rather than holes and poor security thinking in the actual operating system the application runs on. obviously people don't write better php or whatever just because they're serving it from a computer running linux, nor do the blogs 'made with features only on mind with security as second' magically turn into secure applications, you shouldn't run any crap on your server you know no matter what the base system is. while the attacks on iis are rather generic and scanned in fashion and targeted at the serving system itself(as anyone who runs a webserver will know from their logs).

and sobig&others largely rely on user ignorance combined with poor security isolation(and far too easy execution of code you shouldn't run, and yes it shouldn't be that easy, if you can't be bothered to do it little harder you probably don't bother thinking if it's worth it), msblaster relied just on one hole that was on a service that wouldn't need to be on most of the time(or not even recommended to be on hostile environments yet is enabled).

anyways, what would be more intresting would be seeing numbers on defaces because of some very common php&other language mistakes(or some commonly used web apps that are full of holes) so that avoiding them would be easier.

Never unestimate stupid people.

[jellomizer]

Linux is usually more secure then windows mainly in the fact that most services don't run as root or administrator like Windows does. Also most Linux Distros have pretty good security defaults compared to windows. But it is really easy to find and configure a Linux Distro to be a security nightmare which is far worse then any windows distribution can ever be. It is actually a lot easier to make a Linux Disto very insecure compared to a windows system. Just because you are using Linux or OpenBSD or whatever else you cannot assume that you vulnerable against security issues. To protect yourself from these security issues you need proper planning and knowledge on how to continue this plan. Although I know how much many slashdot people hate consultants. But if you feel that their might be something that may be a security issue or you have already had one I would strongly suggest that you swallow your pride and higher an independent consultant who can run a security audit on your network and help make and help implement a plan to help secure your network properly.

What is Linux?

[spankers]

Kernel? Applications?

All operating systems are insecure by nature. Windows, Linux, Unix... ad nauseum. What makes Linux appear to be a more secure OS is that there are not nearly as many Linux hosts as Windows on the net and the technical abilities of Linux users are remarkably higher than your average Windows user and AOL subscriber.

Does anyone remember Redhat 6? How many people got rooted via SunRPC?

I really like linux... I run Debian unstable with:
hermes:~$ uname -a
Linux hermes 2.6.0-test4 #0 Mon Aug 25 15:25:10 CDT 2003 i686 GNU/Linux

File permissions don't mean a damn when you've got root.

Re:What is Linux?

[Anonymous Coward]

File permissions don't mean a damn when you've got root.

Yep, as multiple people have stated, computers are as secure as the admin makes them.

Law of averages

[Schnapple]

Are there other reasons why the likelihood of a "Sobig" or an "ILUVYOU" would be lower for Linux than Windows?

Because there's fewer of you (not myself a Linux user) and as a result the law of averages says it's less likely that it will happen. And let's be honest - smarter people run Linux. They're not smart because of Linux per se, but people who run Linux know what they're doing, usually. Lots of Windows users don't know what they're doing (think parents and grandparent types).

But if Dell shipped 95% Red Hat boxen, you'd see a lot more Linux worms show up. Maybe not as many as Windows, but still...

Re:Law of averages

[bsmithsweeney]

This is the case now, but it is changing as many linux distros are making themselves more accessible to the end-user and/or more desktop-friendly. Heck, you can download a fully-functional Linux distro like Knoppix or any of the many others, all of which work very well as desktop environments and many of which would be comfortable to M$ users. Indeed, working at a University as I do, I already see more and more students using Linux on the desktop, and that's encouraging. University environments can sometimes portend future technology trends and I'm hoping this will hold true here. However, this means that more and more the "average" user may be getting put onto Linux. And it won't be long, then, before I think we do start seeing Sobig-like fun in Linux. This will be furthered as well when, as was stated somewhere in this thread, Linux gets used more and is therefore a useful platform for making a "big splash" via mass-infection.

Re:Law of averages

[Anonymous Coward]

But if Dell shipped 95% Red Hat boxen, you'd see a lot more Linux worms show up. Maybe not as many as Windows, but still...

Malware writers don't target Windows because it's popular. While it is a plus when you are writing malware, it's not the main reason. The main reason is because Windows is an easy target. Uneducated users, poorly designed operatign system, poorly coded opearting system, Windows is an easy target.

Why try to kill the Colonial when you have soldiers all around you?

Re:Law of averages

[Some Dumbass...]

Are there other reasons why the likelihood of a "Sobig" or an "ILUVYOU" would be lower for Linux than Windows?

Because there's fewer of you (not myself a Linux user) and as a result the law of averages says it's less likely that it will happen.

I've argued against this several times on Slashdot and elsewhere. Frankly, I'm getting sick of arguing it, but oh well. What do you think about this counter-argument:

1) When appropriate vulnerabilities in Linux show up, so do worms (e.g. ssh circa 2001, the RedHat lpd vulnerability).

2) Worms do not always target common boxes. Example, the MS SQL worm, whose "target audience" was very small. Note that this worm did massive damage, albiet indirectly, by causing enough faulty DNS lookups to bring down several root DNS servers.

3) Both of these examples show that worms sometimes target uncommon OS configurations. Furthermore, as the latter example points out, massive damage can be done in such cases.

4) Therefore, I would argue that worm writers do not target the most common systems, but rather those for which vulnerabilities are available. Even a worm which affects a small number of systems can cause massive damage, and I believe that this is the worm-writer's goal. Thus Windows worms are common not because Windows is so commonly used, but rather because it has more vulnerabilities of the appropriate type (remote execution of arbitrary code) than does Linux.

Any comments?

Re:Law of averages

[Anonymous Coward]

> Malware writers don't target Windows because it's popular.

Bullshit. Read anything about virus writers -- the number one reason is "to see how far it spreads".

Or how about SoBig -- written by spammers so they could have a massive unstoppable proxy network. It has everything to do with hitting the biggest target

Linux is more secure

[Anonymous Coward]

Since Linux is Open Source, it is MORE secure. I think that it's pretty much like writing an english paper... more people proof-reading means more errors will be detected.

Many people would like to see Microsoft's code more secure, more stable... unfortunately, Microsucks is too short-sighted to release their code.

if it were a desktop thing, yes

[Anonymous Coward]

linux is predominately not on the desktop .. if it
were rife with all the easy-use functions that win
users have (executable attachments, etc) i expect
it would be even more insecure, as coding for linux
is a lot easier than writing for windows .. however,
because linux systems tend to differ widely (in
contrast to windows systems, which are almost all
alike in the way they do things) i don't think a
single bit of code would be as widely successful

It's all numbers

[puck71]

The way I see it, the reason you see more Windows exploits is because:

a) There are more people working to find exploits in Windows.
b) There are more people to affect by finding a Windows exploit.

What would be the point of distributing a worm that used a Linux exploit? Relative to Windows, Linux has basically no userbase, so you wouldn't have the "strength in numbers" to cause any widespread damage. Bottom line - if you want to wreak havoc, you need to do it on Windows, just by the numbers alone.

it's a lot of factors...

[pavel_pod]

It really is the COMBINATION of factors:
* number one reason is probably that most user desktops are windows;
* an average linux user is a lot more technically savvy than an average windows user, and is much more likely to understand the importance of applying patches [my non-technically oriented friends ALWAYS IGNORE those "updates are ready for installation" messages];
* as a lot of posters have mentioned, Linux systems can be made more secure (open source, security-minded design, ...) -- if you know how;
* I'd guess people who create these things might use MS hatred as an excuse;
* there is greater diversity among linux software, whereas most people use outlook/msie on windows; (maybe to a lesser extent,) same is true for OS versions; this makes it easier to target MS.
* (Probably more that can be added here.)

How many of these defacements were due to Linux?

[Anonymous Coward]

So we have N sites hosted on Linux defaced. How many of these were because of people who ran an old sendmail on their webserver? How many of these were because of someone logging in via FTP or Telnet without encryption? How many of these were because of people with username "web" password "web"? How many of these were because Joe User set up some blog software without reading the documentation? (I suspect that this last segment, incorrectly configured web generator software, would count for a lot.

The fact is, a default configuration (of most major distributions of) Linux box is more secure than a default configuration windows box. The Windows box will have the RPC port publicly available and exploitable whether it's a home system or a server. The Linux box typically has inetd with chargen, discard, daytime, time, and echo (and most current distributions disable most of these).

Then you start throw the server on: Apache on Linux, Apache on Windows. I'd use IIS except that everyone uses Apache on Windows. Here, its a draw.

Then you put up your webpage: Buggy PHP code on Linux, Buggy PHP code on Windows. Again, a draw.

So, we can see that everything else being equal and all parties equally incompetent and/or lazy, doing the absolute minimum work, Linux comes out ahead due to the remote exploits inherent in Windows. Joe Linux runs apt-get upgrade or up2date or whatever, and gets the latest fixes made available by their distribution. Joe Windows runs Windows Update and might get that critical patch, if Windows realizes that it hasn't gotten it yet. Or Joe Windows may have disabled windows update after getting the same patch 5 reboots in a row. Linux stays ahead.

So, where did it go wrong? Probably from Joe User deciding that it was too hard to use an encrypted ftp service or ssh2's sftp to transfer is website, and logging in over ftp over a cable modem. Or from Joe User thinking "I'm a badass admin and all because I've got every server available installed and open to the world, and what the hell is this snmpd? oh well I'll run it anyway!"

asking the wrong question...

[dwgranth]

Remember this one thing about security: Your security on your boxes is proportional to your sysadmin's intelligence/paranoia levels. Ok... now, if we factor out human error... The question that remains is: Which OS is more securable: from my experience it is BSD... (pain in the ass.. but worth it in the end if you are super paranoid).. but not all apps will run in BSD... so for most people, Linux is their best bet.. yes.. people will be stupid and not patch their systems.. but that is the admin's fault (same w/ MS admins) but at least you know whats going on with your system, what services are running, and you can patch without restarting (big plus) .. while on MS systems you are at the mercy of your system... especially when things start going awry.. most of the time the solution for MS server admins (as far as ive seen) when their server is bombing... is to reimage the server :P ... so too bad if its a production server

assumptions

[Anonymous Coward]

I'm concerned that your assertion that the average linux user is more "systems-savvy" than the average Windows user doesn't fully address the situation. While the statement itself is more than likely true at this point (given the wide dispairity between adoption of Linux vs Windows on the vast majority of consumer desktop systems), it doesn't necessarily follow that Linux systems are more secure due to the higher skill level of their users. Indeed, there may be reasons to believe that a Linux machine operated by a relatively unskilled user may be less secure than a Windows machine operated by another user with comprable familiarity with the Windows operating system.

Consider that the actual technical skill level between a Linux user and a Windows user is not necessarily that disparate. Easy-to-use installation assistants have lowered the bar, so to speak, for use of Linux. This is obviously a good thing if one is interested in propagation of Linux as a desktop operating system, but it can be dangerous if installation programs rely on [possibly uneducated] user choices for configuration of, say, sendmail. I have seen enough misconfigured Linux systems to know that many users, especially when first introduced to the OS, are unprepared to deal with the complexity of setting up and maintaining a [what may seem to be] dizzying array of network services & applications. While it is fairly easy for a person with little or no preexisting expertise or experience to run Linux on their home system, there is no guarantee that that person is running it well.

Combining inexperience with the open invitation to play around with the operating system's most intimate details is a recipie for headaches in any case, as most beginner Linux users no doubt discover. However, when misconfigured systems are connected to the Internet the potential for real problems rises dramatically. As adoption of Linux as a desktop alternative increases, you can be *sure* that the user bases are going to resemble each other more and more, and when your grandmother is asked whether she wants to run such-and-such service, can we rely on her (or the installation wizard) to make the right choice?

Umm

[evil9000]

I see 100% windows 2000 defacements on the page. Does that mean we are no longer using Linux - and nobody told me!

I was just thinking about this today

[selan]

...and I decided that it's really only a matter of time. Okay, so it's unlikely that Linux user will run a strange attachment from an email, but we routinely download and install strange software from the net without thinking twice--after all, freely distributable software is the cornerstone of our culture. Besides, what kind of virus is going to ./configure, make, make install itself ;)?

Here's my rant on human stupidity...

[Art Tatum]

I think it's a little more than just being savvy. One problem is that an awful lot of Windows users have very screwed up ideas of how their computers are supposed to function.

For instance, they don't think having to type in a password to run Setup.exe is even remotely reasonable. Their view of the computer is: "if I want to do something with my machine, I should be able to just do it. Don't put anything in my way." And if they were forced to take precautions, their password would end up being something like 'a'. And a regular schedule of changing passwords? Forget it.

Another example, a little more relevant to this case: people want their email for sending dirty pictures, HTML joke pages, funny Flash or Shockwave animations, Active X games, etc. They'd be bored to tears if they had secure email. And they'd be pissed off at anybody who was responsible for it. Have any of you guys ever taken heat for banning popular but incredibly insecure software at your site? Or spyware.

And it's astounding how many supposedly intelligent people (programmers) who have you in their address books end up sending you virii because they were stupid enough to continue clicking on emails about 'Hot pics' or those 'Snow White and the Seven Dwarves' emails. Sheesh.

All this is not to say that Microsoft doesn't have some basic architectural issues--they do. But the unreasonable demands and silly behavior of many users more or less prevents them from changing any of it. And when they do change it, people ignore it for the sake of convenience. It's been possible to run as an unpriveliged user for a long time with Windows. And it's not difficult to do. But guess how many people actually do that.

Re:Here's my rant on human stupidity...

[DunbarTheInept]

All this is not to say that Microsoft doesn't have some basic architectural issues--they do. But the unreasonable demands and silly behavior of many users more or less prevents them from changing any of it.

I don't think those two are seperable. The reason users make those unreasonable demands is precisely because they've been sold on the white elephant of similtaneous security and ease-of-use by Microsoft's practices. They don't realize they've been lied to. Good secuirity requires extra steps on the part of the user. Microsoft is trying to convince people it doesn't, and those who believe it are the ones propigating these virii.

Re:Here's my rant on human stupidity...

[Politburo]

Oh blah blah blah. This is the same old tired shit of "Windows user = stupid, Linux user = smrt". The reason Windows users have these misperceptions (yes, that's what they are) is because that is simply what they are used to. In Win9x, 3.1, and DOS, there were pretty much no passwords. To suddenly think that millions of people will overnight realize that passwords need to be commonplace for security is asking way too much. We are currently in a growing period in computers, and the worms around now are the growing pains. If people that are knowledgeable about computers acted nicer towards Joe User and explained the rationale behind passwords, and not running as root/admin, instead of being l33t and condescending, you might see a little more positive response.

Re:Here's my rant on human stupidity...

[Zocalo]

Looking at those first two paragraphs you describe the stereotypical *NIX user's view of a Windows user very well. Yet if you replace "Windows" with "Macintosh", then you get the stereotypical Windows user's view of a MacOS user instead.

Linux and MacOS have a similar market share I believe, yet when was the last time you saw an artical about a MacOS exploit in the tabloids and on primetime TV news? I don't think it's fair to blame user expectations for the focus of worms on the Windows platform. It's entirely down to the maximum impact gained by the combination of a massive installed user base combined with "insecure by design" code. I'm fairly sure the proportions of gurus, hackers, users and lusers is pretty much the same on any OS, it's just that Windows numerically has *far* more lusers. Add monumentally insecure applications like Outlook Express and IE installed as standard and you have a recipe for disaster.

Re:Here's my rant on human stupidity...

[dzym]

So true.

I changed my local XP account type from "Power User" to "Restricted User" a while back.

Haven't been inconvenienced in any serious way other than a "Run As ..." every now and then.

Re:Here's my rant on human stupidity...

[kudos200]

I think I disagree a little. Some users might have a problem ever typing a password or something, but I think most people are pretty reasonable. I know that when I started using a Linux desktop this summer, I didn't mind typing in the root password to change stuff around that would affect everyone. In fact, I kind of liked it since I knew I could play around as much as I wanted: if I didn't type in the root password, I couldn't affect anyone else.

On the other hand, I'm at this site, so I'm probably not your average computer user. And, Linux does have some stuff wrong (in my opinion). Changing screen resolution . . . adding printers . . . some of that stuff I'd kinda like to do without a password. But gnome has that nice little key thingy that stays around; you can play around for a while, and remove it when you're done. MUCH better than logging on as a regular user, and having to logoff/logon as administrator to install a program or whatnot.

I don't know. Maybe some users would get pissed off with one additional password request. But anything you do is going to make *someone* mad; you can't cater to either extreme. I think there's some middle ground Microsoft could find. Hopefully they will.

Re:Here's my rant on human stupidity...

[kberg108]

"Linux and MacOS have a similar market share I believe" I hope you mean similar in size not shared market share and ethier way your wrong. And I think the key to your point is monumentally insecure applications like Outlook Express and IE installed and don't forget Exchange that's the piece of crap resposible for spreading most of these damn worms.

Re:Here's my rant on human stupidity...

[Anonymous Coward]

Hey- since you are just making up words (virii), why stop at 2 i's? Why not 3 or 4, as in viriiii? That looks cooler.

Re:Here's my rant on human stupidity...

[Anonymous Coward]

For instance, they don't think having to type in a password to run Setup.exe is even remotely reasonable. Their view of the computer is: "if I want to do something with my machine, I should be able to just do it. Don't put anything in my way." And if they were forced to take precautions, their password would end up being something like 'a'. And a regular schedule of changing passwords? Forget it.

I am offended!

My password would be 'asdf.'

Re:Here's my rant on human stupidity...

[Grishnakh]

That doesn't work. If you explain it to them nicely, they just don't get it and get pissed off that they can't do what they want on their computer without security precautions getting in their way. The only way they'll learn is the hard way. This phenomenon isn't confined to computers, either. Nontechnical people always seem to get pissed off when a technical person explains, however nicely, why they can't do something. Either that, or they just ignore the explanation.

Re:Here's my rant on human stupidity...

[Anonymous Coward]

Right. Telling a windows end user about security is like trying to convince a smoker to quit smoking or to convince a dangerous driver to wear his seatbelt and obey the traffic signs. You can explain away all day but they just do not want to listen...

Re:Here's my rant on human stupidity...

[Lemmy Caution]

As a technical person who communicates well with non-technical people, I have to say that the failure of communication is almost always with the technical person.

Being more concerned with being seen as smart and informed than actually providing coherent information, spending too much time on irrelevant details instead of providing step-by-step instructions on what has to be done, geek inferiority complexes leading to arch, grating deliveries, a failure to listen and understand the end-users needs - I've seen it all. And I've almost never met an end-user type whose technical behaviour I wasn't able to amend for the better.

Re:Here's my rant on human stupidity...

[shaitand]

By default all these things stupid users want should not be turned on. That is a prime example of the mindset which is responsible for 90% of the architectural issues with windows.

These things shouldn't be difficult to turn on... if you know how. The users should have to learn at least enough about what they are doing that they couldn't blame anyone but themselves if something goes wrong after turning them on.

Users should have to go out of their way to run on a priveliged user, and the default should be unpriveliged.

Re:Here's my rant on human stupidity...

[Politburo]

See other reply, he said it better than I can.

Re:Here's my rant on human stupidity...

[Anonymous Coward]

Ummmmmmm .... yes! What else is an appliance supposed to do --- but just work. A computer is an appliance, byteboyz, like a dildo. Do I want to factor 19,000 digit hex to brush my teeth ?

Re:Here's my rant on human stupidity...

[antiMStroll]

Nice try. It ignores the fact that about 95% of today's Linux users once used DOS and 3.1. Linux wasn't around back then, the other 5% we can grant to Apple and other. We learned to use passwords. That still isn't to say Windows users are stupid, but the argument 'they're not accustomed to security' doesn't wash. Neither were we, and we learned.

And blaming Linux users for the current state of security in MS userland? High comedy or pure BS, but total fabrication either way.

Re:Here's my rant on human stupidity...

[Anonymous Coward]

Linux was around during the DOS(well late DOS) and 3.1 days. It wasn't anything spectacular but it was there.

Re: Here's my rant on human stupidity...

[gidds]

For instance, they don't think having to type in a password to run Setup.exe is even remotely reasonable.

I don't think users are as resistant to security as that, provided it's done right. A case in point (and I mention this only as a relevant example, not because I'm a raving zealot, honest) is Mac OS X, which pretty much enforces a reasonable level of security. When you set it up, you create a user which has admin privileges but not root privileges -- and even that user must re-enter their password every time they install or change something at a system level. But although people do find Mac OS X features to complain about, the security is rarely one of them. Most people seem to accept it as a necessary evil in today's networked world.

Re:Here's my rant on human stupidity...

[SonOfThor]

As a technical person who communicates well with non-technical people, I have to say that the failure of communication is almost always with the technical person.

Being more concerned with being seen as smart and informed than actually providing coherent information, spending too much time on irrelevant details instead of providing step-by-step instructions on what has to be done, geek inferiority complexes leading to arch, grating deliveries, a failure to listen and understand the end-users needs - I've seen it all. And I've almost never met an end-user type whose technical behaviour I wasn't able to amend for the better.

People like you are rare treasures and should be put to use in the best possible way: HELP DESK!!!

BUBHAHAHAHAAHAHAHAHAHAHAHAHAHAAAAA!

Kinda makes me glad that I'm not as gifted as you are.. I might be a little saddened to realize that my best fit is a job at a help desk.

Toodles.

Re:Here's my rant on human stupidity...

[Dr. Photo]

Oh blah blah blah. This is the same old tired shit of "Windows user = stupid, Linux user = smrt".

Smrt? Is that just a synonym for "intelllejint"?

I bow before your Windows-using jeenious! ;-)

Re:Here's my rant on human stupidity...

[Politburo]

Yes. You learned. You also took the plunge into an OS which requires a much higher amount of technical skill to run. In short: you don't count. The problem isn't getting tech people to use passwords, it's getting Joe User to use passwords. Joe User didn't ever switch to Linux.

Show me where I blamed Linux users, and I'll show you where you mis-read me. You could say I blamed technical people in general, but in a sense that's true. Technical people do need to take the burden upon themselves to develop and implement a way to educate Joe User in the ways of secure computing.

Re:Here's my rant on human stupidity...

[Politburo]

Dunno if IHBT or what, but smrt is a simpsons reference :)

Re:Here's my rant on human stupidity...

[Politburo]

Okay yes i used the phrase "l33t and condescending" from the famous Jeff K cartoon. The link to Linux, however, was not what I was going for. The l33t and condescending part was. This happens with Linux, Mac, BSD, and Windows power users, and I myself have been guilty of it at times.

Re:Here's my rant on human stupidity...

[Dr. Photo]

Dunno if IHBT or what, but smrt is a simpsons reference :)

Yeah, I immediately pictured the burning diploma when I saw it. While nitpicking about spelling in general is lame, misspellings of "smart" always amuse me.

(How many times have you seen someone write "I am a very intelegent person"? One might as well write "I am an expert speler." :-D )

Re:Here's my rant on human stupidity...

[The Revolutionary]

This just isn't so as often as you suggest.

In cases where there is no compromise available, where it is, "Either I prevent them from running this little app, and doing this or that, or our systems and information can not be as secure as they should be," some users, especially users who know "just enough to be dangerous", will not understand.

They will call you a "nazi". There is nothing you can do short of spending time which you do not have to educate them, or to point out that they do not in fact know what they believe they do, because as far as these users are concerned, they already know more than you do, and it is you who are incompetent.

Re:Here's my rant on human stupidity...

[Lemmy Caution]

Of course, I would be a good help desk. Also, I'd be a decent cook, an OK guitar teacher, a pretty good tour guide, and a fairly acceptable gardener.

Fortunately, none of these skills are my most well-renumerated, so they tend to go in the back burner.

Re:Here's my rant on human stupidity...

[Anonymous Coward]

There are a lot of people here on Slashdot that some how think that they are the intellectual elite just because they use a different OS from the masses or studied in the field of CS/CompEng/EE. They rant about how dumb the average users are, just because these people don't know about some obscure command line or how to compile source code and install patches on their own. Let me break the news to you, they DON'T care about how a computer works. By your logic, a car mechanics could claim that he is intellectually superior to you just because he knows how a car works inside out and drive a car he modified himself. And they should tell the customers to RTFM to fix any problems. Computer is just another tool, like car. People who use these tools don't care about how it works and they shouldn't have to, otherwise there is no reason why we should get paid so well, just as really good car mechanics.

I'm an undergrad in CompEng and have worked on system software development in the industry. I consider myself at least informed about the working of a computer system from both a software and hardware perspectives. But that is just my profession. How many of the IT folks here wrote compiler or OS from ground up, and designed and implemented microprocessor and controller? Just because I did all these does not imply anything about my intelligence compared to someone who studied non-computer related subjects.

My dad has a PhD degree in Chemistry and is doing cutting edge research in treatment for cancer. But he still asks for my help sometimes for simple computer problems. Does that mean he is dumb and unable to think on his own? NO! People use tools to get their work done, the tools should be simple and easy to use that does not cost their valuable time from doing their real job. To me, computer is a passion, to someone else, it is just another tool. If the tools that I designed requires hours of wasted time on the user side, I would consider myself to be the dumbass, instead of the end users.

If you are one of the folks who need to elevate yourself above others, by oh say "I use a Mac" or "I use Linux" or whatever that get you high, get a life!

Re:Here's my rant on human stupidity...

[deinol]

And it's astounding how many supposedly intelligent people (programmers) who have you in their address books end up sending you virii because they were stupid enough to continue clicking on emails about 'Hot pics' or those 'Snow White and the Seven Dwarves' emails. Sheesh.

Hey, don't blame me if the idiot that is hit by the virus has both of us in their address book, and the virus spoofs my name as the from line. I keep getting bounced messages saying 'your e-mail was rejected because it has a virus.' When I never sent the e-mail, and I'm pretty certain neither my linux mail server nor evolution was infected by a windows virus.

The modern virus lies about it's origin when it sends itself out.

Re:Here's my rant on human stupidity...

[Art Tatum]

I'm not being condescending here. I never said 'Windows user = stupid, Linux user = smrt'. When I first got my hands on a UNIX box, I ran as root 24/7. I then learned my lesson when I promptly trashed /lib. :-) We were all newbies once. If Linux ever succeeds on the desktop, it's going to face the exact same issues (with a more reasonable architecture, to be sure).

My statement was rather an observation about the way a lot of people using computers behave and that their miseducation is part of the reason we have such trouble with worms. People have come to expect that using a computer involves a certain level of effort and people by nature don't like to put in more effort than necessary to acomplish a reasonable result. It's human nature and I make no apology for it. But I can certainly see and analyze its effect.

Re:Here's my rant on human stupidity...

[Art Tatum]

Yes, that's true too and is part of the 'cycle of violence', to borrow a phrase. I'm not a violent MS hater. In fact, I believe most of this came about rather by accident than by plan. But it's gotten to the point now where Microsoft has great difficulty getting itself out of jams because of the large burdens of backward compatibility and already-present end user expectations. I'm not sure there's a whole lot they can do without losing customers.

Re:Here's my rant on human stupidity...

[Art Tatum]

Your analysis is pretty much correct. I should note here that, although my little 'rant' may have come out a bit harsh, I'm not really blaming users per se. There's plenty of blame to go around and, really, I'm not sure it's fair to use the word blame. I doubt anybody at Microsoft sits around thinking about how they can create insecure software that will bring the world to its knees. And users are just doing what they've become accustomed to.

Re:Here's my rant on human stupidity...

[Art Tatum]

Yes, I was generalizing a bit and there are a great many users who are just trying to get their jobs done and are being reasonable. But with pervasive networking and featureful applications, it doesn't even take a majority of complete idiots to screw things up badly. It only takes a moderate number of moderately informed people with a few bad habits. And I really don't see how we can completely fix it.

Re: Here's my rant on human stupidity...

[Art Tatum]

Ah, a subject close to my heart. Yes, the Mac OS X way of doing things is pretty good. However, since I am a raving zealot <grin>, I must point out that this was the default behavior with OS X's predecessor NeXTSTEP/OPENSTEP. So this very enlightened way of doing things has been around for many many years.

You know I can't let you Mac people get away with thinking OS X is really an Apple product. :-)

Re: Here's my rant on human stupidity...

[gidds]

Well, AIUI it's as much Apple's as it is NeXT's, really. Which may or may not be less than it is Ritchie and Thompson's. NeXT did some great work, which should have been more appreciated, of course, but Apple have done a lot before and since then, as have many other people. Let's end on a note of agreement and say that, whoever made greater or lesser contributions, it's a great system :) And one that shows security doesn't need to be a handicap, nor something that users will reject.

Re:Here's my rant on human stupidity...

[IamTheRealMike]

For instance, they don't think having to type in a password to run Setup.exe is even remotely reasonable

Er, because it's not? Having to type in a password to do pretty much anything on Linux is a total pain in the ass and gives no extra security on a single user desktop system.

Think about it. There are about a hundred different ways to get a Linux computer to do malicious things without root access. Here are some examples. Let's assume all the user has to do is run a program, as SoBig.F has shown that people are still willing to do this in large numbers. What can we do?

We can:

• Pop up a fake "please enter your root password" dialog and snarf the root password, if we so desire. Probably if the person was willing to run an attachment they won't think twice about this, after all they are asked for their root password at seemingly random intervals whenever they wish to change their configuration, or run some installer, or even run some other programs which for various obscure reasons need root access (did you know that "beep" needs to be setuid root?).

• Run a copy in the background emailing the virus to lots of other people. You can try and snarf the address book directly, or just do what SoBig.F does and perform a regex on the entire system. Hey, we even provide tools to make it easy ;)

• Install some XBL and user-stylesheet CSS into the Mozilla/Gecko configuration directory. That lets you dynamically rewrite websites as they are downloaded and displayed. You could have all kinds of fun with this one. What about slurping form submissions?

• Wipe the users data. Most viruses aren't that malicious, but user vs root doesn't help you here. The users data is of course the most valuable thing on the system, but absurdly it's also the most vulnerable and unprotected.

• Install basically any software you like. What you say? The home directory is mounted noexec? Very clever. Try typing this at the prompt:

  $ sudo chmod -x /usr/sbin/lsof (for example)
  $ /usr/sbin/lsof
  bash: /usr/sbin/lsof: Permission denied
  $ /lib/ld-linux.so.2 /usr/sbin/lsof
  ........
  

  You see how feeble UNIX security really is now?

Basically, the idea that Linux is inherantly more secure than Windows is so massively flawed I don't even know where to begin. If Linux is going to be stronger than Windows, it must be through the power of a caring community to look out for users best interests, while letting them get on with their work and play.

I think I'll keep ranting about this until somebody does it, but what we need is a community anti-malware project. Think of it as a cross between Debian and Sophos - with a strong founding moral code, a community that features wargaming and debates upon how to make the system more secure, as well as one that builds an infrastructure which can seek out and eliminate malicious software on users systems after infection has occurred.

After all, simply having walls is not good enough. You have to be able to deal with breaches in those walls too. The only thing we've got like this now are the distro backporting teams, which is good for servers, not so useful for home users.

Re:Here's my rant on human stupidity...

[Anonymous Coward]

Blah blah blah blah, blah blah blah blah virii *PLONK*

Re:Here's my rant on human stupidity...

[Crayon Kid]

There are about a hundred different ways to get a Linux computer to do malicious things without root access.

While the idea in itself stands, your examples are not the best choice in the matter. Your are not taking into account the vast variety of Linux system configurations possible and many aspects of the Linux/UNIX specific security model.

Let's assume all the user has to do is run a program [...]

See, the very premise you're starting from is far from a given. You can't compile a piece of code and expect it to simply run on any Linux machine. It may run on many but nowhere near the 100% you can reach with Windows.

Pop up a fake "please enter your root password" dialog and snarf the root password, if we so desire.

You're assuming there's X running, that the X version is compatible with your program, that X runs locally and not remotely. What widget set will the password prompt use? Xlib? Won't it look different enough from the usual dialogs to make the user suspicious? There's a good reason why most Linux exploits are command-line rootkits; expecting more than a shell to rely on is already unreasonable.

if the person was willing to run an attachment they won't think twice about this

The concept of "running an attachment" is close to non-existent in Linux environments. I can't name any MUA that runs attachements off the top of my head, and there's a damn good reason they don't. Ah, they may call some application that processes an attachement for display. Good luck on exploiting this: you have no idea what application, whether it's standalone or a plugin, what crashing or tricking it will do and so on.

did you know that "beep" needs to be setuid root?

No it doesn't. It's a device access issue here and you can solve it nicely with proper rights and ownership to the relevant /dev file (I forget which one right now).

You can try and snarf the address book directly

Which adress book would that be? The sheer MUA diversity makes it a very complicated task to find and read the address book one user is using.

You see how feeble UNIX security really is now?

All I see are some bad examples. Some of them were OK because they touched real issues: (1) once you get code executed on a system you can do bad stuff (but don't think getting that code executed is such a trivial task); (2) a good security model is useless in the hands of ignorant users.

Re:Here's my rant on human stupidity...

[Politburo]

For instance, they don't think having to type in a password to run Setup.exe is even remotely reasonable. Their view of the computer is: "if I want to do something with my machine, I should be able to just do it. Don't put anything in my way." And if they were forced to take precautions, their password would end up being something like 'a'. And a regular schedule of changing passwords? Forget it.

While your statement is an fairly accurate observation about the way most people use computers, it's your wording and your assumptions. I'm saying that many of those practices come from a simple lack of education, like choosing smart passwords that aren't 'a'. If you just assume that Joe User can't handle smart passwords, then you probably aren't going to bother educating him about that and other secure practices, and that is a big part of the problem.

Re:Here's my rant on human stupidity...

[IamTheRealMike]

You're assuming there's X running, that the X version is compatible with your program, that X runs locally and not remotely. What widget set will the password prompt use? Xlib?

Well, I'm assuming a desktop scenario here, ie the sort of typical Windows install that is currently blasting me with SoBig.F - in this case having some version of GTK installed is almost a given, ditto for having X running.

See, the very premise you're starting from is far from a given. You can't compile a piece of code and expect it to simply run on any Linux machine. It may run on many but nowhere near the 100% you can reach with Windows.

Why not? In fact you can do exactly that. If you assume, as I am, that the majority of Linux desktops in the future will vaguely resemble Red Hat, SuSE or Mandrake today, then it's certainly possible to write a piece of code that will execute on pretty much any desktop. Linux is more binary compatible than people tend to think.

The concept of "running an attachment" is close to non-existent in Linux environments

It's pretty easy to run programs. "Hi, I have this wicked screensaver, just save it to your home directory and type 'sh cool_screensaver'". I can see people falling for that as easily as they fall for viruses tricks today.

Which adress book would that be? The sheer MUA diversity makes it a very complicated task to find and read the address book one user is using.

Exactly, my point was that it doesn't matter, SoBig just slurps any email addresses it finds using a builtin regex engine.

All I see are some bad examples. Some of them were OK because they touched real issues: (1) once you get code executed on a system you can do bad stuff (but don't think getting that code executed is such a trivial task); (2) a good security model is useless in the hands of ignorant users.

If users are ignorant then getting code executed is pretty easy.

Re:Here's my rant on human stupidity...

[Minna Kirai]

See, the very premise you're starting from is far from a given. You can't compile a piece of code and expect it to simply run on any Linux machine. It may run on many but nowhere near the 100% you can reach with Windows.

That, and most other counter-arguments you give, are security through obscurity. Claiming that systems are resistant to exploitation because they're nonstandardized is a weak, shortsighted defense. (And carries a pessimistic assumption that Linux will not become a dominant computing platform and acquire 'monoculture' characteristics)

(1) once you get code executed on a system you can do bad stuff (but don't think getting that code executed is such a trivial task); (2) a good security model is useless in the hands of ignorant users.

It's not a good security model. Allowing a system to contain privilege-escalation exploits is a design flaw, even if those exploits rely on watching a normal user until he says the magic word to update his priviledges. A good multiuser OS will allow only a small number of tightly-controlled and un-spoofable paths to reaching root access. One should never be allowed to "su" from an insecure environment (one that potentially has been tainted by untrusted code).

It should be possible to train users that there is just one way to change to a higher priviledge mode, so they can be certain any other prompt requesting the root password is an attack. The approved way to escalate priviledges should be protected by the OS so that no user-application is able to emulate or intercept it. Unix does not meet this criteria. The "su" command certainly isn't safe, nor are remote-root logins. Only Ctrl-Alt-F1 comes close, but even that has weaknesses.

This is what is alluded to by section 3.2.2.1.1 of the DoD Trusted Computer Criteria, which is the requirement that lead to Microsoft's use of Ctrl-Alt-Delete for a login box. (A feature they haven't always implemented correctly or even completely, but at least someone was trying. They seem to be backing away from this approach in XP, but have other, funny ideas to face this problem.)

Re:Here's my rant on human stupidity...

[mausmalone]

I think it's a little more than just being savvy. One problem is that an awful lot of Windows users have very screwed up ideas of how their computers are supposed to function.

For instance, they don't think having to type in a password to run Setup.exe is even remotely reasonable. Their view of the computer is: "if I want to do something with my machine, I should be able to just do it. Don't put anything in my way." And if they were forced to take precautions, their password would end up being something like 'a'. And a regular schedule of changing passwords? Forget it.

I don't see what's so wrong with wanting your computer to do what you tell it to do. Granted, you sound like you're an IT manager with a lot of stupid users using work comptuers for stupid means. You have every right to be angry for them mis-using company property and mis-treating computer systems you work so hard to maintain. They're spitting on your work, and that's not right.

But on my home computer, it better damn well do exactly what I tell it to right after I tell it to. Now, I'm not a retard, I have reasonably secure passwords on my PC (myself and some trusted pals know them), but I gave myself Administative abilities. When I say "install this spyware" I want my computer to say "where?" not "you're not authorized!" I don't want to have to confirm my identity past my initial log in. I don't need a rotating password... if someone gets in, then my password isn't gonna rotate in time to stop them from doing whatever maliscious thing they're planning to do.

Using OS X at work, it annoys me that it asks for a password (after logged in) to install a security patch. It's for the good of the system and you already know my identity! Just do it already!

Re: Here's my rant on human stupidity...

[Art Tatum]

Yeah, I was just kidding around with ya.

Re:Here's my rant on human stupidity...

[Art Tatum]

Lack of education is part of the problem. For many users, however, it's not a lack of information but rather a lack of desire. In a way, Microsoft is simply giving customers what they want. Of course, Microsoft has fostered these desires to some degree as well, since DOS and Windows were single-user for such a long time and they've been shoving a high volume of poorly secured features into Outlook at an astonishing rate.

So what we're dealing with here is Free Market forces (which I'm generally in favor of). But I'm certainly not against educating users either.

GAH! Missing the point!

[neura]

Do any of you stop to think about what % of those webservers are running linux vs some other operating system? The ratio of defaced web servers running linux is probably proportional to the number of web servers running linux, if not lower in proportion (just a guess).

"61% of the defaced servers run linux" as a stat by itself means precisely jack. You need some context.

Yet everybody is quick to start a massive argument about the security of windows vs linux, when really, this isn't even about platform security, it's about web site defacement, which doesn't even directly corelate to platform security.

heh....

or the web application most likely

[rebelcool]

I develop alot of backend web apps and its surprisingly easy for an enterprising individual to pass bad data through forms, and if the app doesn't check the incoming data properly, and simply assumes its coming from a legit source, you're going to have bad behaviors.

There was a story on kuro5hin a few months ago about this, where a guy figured out a way to enter his own price for a product on an electronics website and was ordering hardware for less than what the page said it cost. And got away with it. This kind of hole is scarily prevalent i've found, as alot of backend developers are very lazy and inexperienced people.

I think this is whats meant by 'applications' security. The box itself may be locked down well, but its taking advantage of the open services in ways the developers never intended.

Re:or the web application most likely

[hackstraw]

surprisingly easy for an enterprising individual to pass bad data through forms, and if the app doesn't check the incoming data properly, and simply assumes its coming from a legit source, you're going to have bad behaviors.

WTF! Repeat after me.

Thou shall never trust input from an external source.

Be it a textfile or variables passed over the web or communication over a socket.

Every input will be checked for reasonable data before it is evaluated or used in any way. I had to correct a "Senior level" developer with this simple fact not too long before I quit that job.

Things to do are:

- make sure numbers are numbers
- quote strings
- do simple text subtitutions for unwanted characters
- make sure strings are in normal lengths
- etc

whatever, its common sense, programming 101.

Re:or the web application most likely

[Technonotice_Dom]

I work for a small electronics/computer retailer just about to move into the online ordering world. I've been working with PCs myself for years and I've been programming for most of them in one form or another.

Since I don't have the time to write the site myself, we got a local web designer in to do the job for us. He showed us the sample site this week with some sample custom PC ordering scripts... looked ok at first.

It wasn't until I looked at the HTML source (horribly written in a mixture of Frontpage and Dreamweaver with about 98% bloat) that I realised what the idiot had done... all the prices for the components were submitted by the form. To be precise, the last six characters of the form data sent to the server were assumed to be the price - this was then added up and quoted as the total for the customer to pay...

I then looked at the site code and it just got progressively worse... the <b>MS Access</b> database was stored in the root directory of the server with tables such as "orders". Thankfully he's only started the site and hasn't had chance to utilise his "programming" skills to the max ;-)

Now I've got to break it to my boss...!

Other data don't support this claim.

[dwheeler]

I can't seem to access the data noted in the Slashdot article. But other sources of data don't support this claim. See http://www.dwheeler.com/oss_fs_why.html#security - Attrition.org and alldas.de data suggests that, in the time they collected data, Windows was less secure.

Too homogenous systems are dangerous

[pere]

"I love you" and "soBig" both happened because too many people are using Windows, not because Windows in itself are insecure.

Any homogenous system will always be voulnerable to these kind of attacks.

The problem with any homogenous system (ecological, social or digital) - even if it might be very effective and streamlined when it works - when one of the units fails: all fails.

The key to building resistant systems, is making them heterogenous. Nature has figured that out millions of years ago. The key to securing a species survival is variance.

The same goes for computer systems. When 90 % of the computers are running Windows, Office, Outlook, viruses like ILoveYou and soBig have disastrous effects. (The fact that there are several versions of Windows, with different SPs installed, is making it a lot harder to write effective viruses).

My biggest fear is that Microsoft will end up with a susbscription system, and automatical updates. This could lead to a totally homogenous computer park... it is bound to be disastrous..

uh oh DB connection error

[lcde]

(note, this figure changes, so it might be different when you view it)

If you don't agree with the data, make sure the data doesn't exist. :)

Defaced percent vs. installed base

[Jeremiah Blatz]

You say 61% of defaced sites run linux? Well, 64% of web sites are running Apache, according to netcraft. I will now wave my hands wildly and assert that those are all running on linux. Well, maybe not, but I suspect that a big chunk of that 15% "other" is linux. So, from stats (and hand-waving) alone, once should deduce that Linux is more secure than Windows.

More installed windowsens...

[soccerisgod]

...thus more media attention for a wormy. Pretty easy concept, innit?

RTFP

[overshoot]

According to the given link, 17 out of 17 defacements are Win2K.
How does this reflect badly on Linux?

Linux is as secure as you make it

[Anonymous Coward]

Linux is only as secure as you make it. You can install Linux, with Apache, don't install the patches, don't update PHP, don't bother with shutting down unused ports, and your system will get defaced or cracked.

Also, defacing a website can depend on the applications running on that server...it won't matter what the server runs, if the cgi is insecure, it can lead to cracks. If you had 60% of servers running linux, 40% running windows, and all were running insecure cgi apps, you'd have a 60% linux defacement count, and a 40% windows defacement count - even though it's got nothing to do with windows or linux.

full-time Linux users are more savvy

[SHEENmaster]

It's those communist dual-booters that we have to worry about.

Re:full-time Linux users are more savvy

[RedHat_Linux_Man]

It's those communist dual-booters that we have to worry about.
Or schizophrenic dual-booters...

Re:full-time Linux users are more savvy

[Dr. Smeegee]

Or those Bootsiephonic Schiz-Deullers...

Re:full-time Linux users are more savvy

[Anonymous Brave Guy]

s/communist/common sense/

:-)

Re:full-time Linux users are more savvy

[Anonymous Coward]

De-groovy.

The answer is unknowable...

[jd]

...unless IBM is willing to spend a great deal more than a few tens of thousands of dollars...

The only way to know how many exploits and holes there are in Linux is to find them and fix them. (Fixing is important, as code changes at point X can impact the code at point Y. Thus, as one hole is closed, another could potentially be opened.)

To do this with every single hole in every component in a standard Linux install - in short, to produce an A1-compliant desktop OS, with all the capabilities you'd typically want - would be a financial and logistical nightmare. I did a quick back-of-the-envelope calculation on what you'd need in manpower, just to keep up with the rapid development of the software.

You're looking at a few million coders, and about the same number of Higher-Order Logic mathematicians. This translates to a cost of about a hundred billion dollars a year.

Now, you can argue that this is to get an exact evaluation of Linux, and to produce a completely secure implementation. To get a rough estimate only (no actual improvements, just the figures), you are still probably looking at ten to a hundred times the amount IBM spent on their certification.

Any estimates that anyone can reasonably afford are going to be impossibly inaccurate, and swayed by the mood of the day.

absolutely right

[kaan]

The above poster is absolutely right. For instance, when comparing applications on one system to apps on another, that's an entirely different discussion from the user model of Windows vs. Unix/Linux. The Windows user model is pretty retarded and very insecure, allowing all kinds of bad things to effectively run as "root", something that doesn't happen on Unix without some level of user intervention. Another major problem is the level of component integration within Windows. Why on earth does an instant messenger client need system level access, like it has (or possibly used to have, if they've changed things, although this isn't likely) with MSN?

If somebody discovers a buffer overrun error on Unix, as has happened from time to time (like the ftp buffer problem discovered many years ago), it takes a lot of machine and architecture-specific information to do anything invasive. But on just about any Windows machine, you need to know much less in order to successfully exploit a buffer overrun.

I don't consider the security of Windows to be anywhere near that of Unix, and I think anyone who seriously tries to argue that (or even question whether they're possibly equivalent) has a lot to learn about operating systems.

Re:absolutely right

[Anonymous Coward]

Anyone who would argue Unix is inherently secure has a lot to learn about security.

Re:absolutely right

[Anonymous Coward]

how about "anyone who twists someone else's words around is a punk ass chump"?

the above poster wrote:

"I don't consider the security of Windows to be anywhere near that of Unix [...]"

that is not the same thing as saying "unix is inherently secure". i read it as: unix has some level of security, windows has some level of security, and the security (whatever it may be) of windows is not as good as the security (whatever it may be) of unix.

Statistics can be deceiving

[Daverd]

The website defacement archive at Zone-h shows that Linux accounts for 61% of the defacements in the last 24 hours

Well, what percentage of all websites are run on Linux? Do people who run webservers on Linux tend to put up more attractive targets for some reason? Maybe it's just more fun to break into a Linux system than a Windows one.

It's easy to see "61%" and jump to conclusions, but statistics can be manipulated so easily, you can't really trust them.

Nothing is as secure as we'd like to think

[kfg]

So the first step is to get used to that idea.

Beyond that is an optimally configured Linux system more secure than an optimally secured Windows system?

Yes, I think so, that's one of the reasons I use Linux. But let me ask you this, how many optimally configured systems do you think there really are? For that matter how sure are you that your system is optimally configured? If you have to spend even a couple seconds thinking about that question think about average bloke.

There's a social flaw in the system as well, which thus effects all systems no matter what operating system they're running.

To secure your home you call in an expert. A locksmith, perhaps an alarm systems expert as well. Virtually everybody does this. It's so ingrained that it's considered a no brainer. You'd have to be an idiot not to have proper locks on your doors and windows, right? If your security is ever breached ( say someone steals your keys) you can't get to the phone fast enough to have the locksmith come over and change all the locks.

How often have you had a pro come over and check the "locks" on your OS? Do you even know anyone who can do this? Can you look one up in the Yellow Pages?

Why not?

If you are such an expert yourself how many systems have you, outside of your "job" bothered to secure for people? Are you too snippy and think that "lusers" just shouldn't be allowed to operate computers? Maybe you're a part of the problem. Help be the cure.

I've just given you an entreprenurial niche on a silver platter. Why not take a nibble?

KFG

Good question, however...

[winstarman]

I personally would prefer to use an OS that has been refined over and over... and over.

It is very comforting to think that the OS I'm using has been improved by hundreds of thousands of people. Some of them have security in mind, some have performance in mind. I can hardly think that Microsoft has anything but the bottom line in mind. That's swell and all for the economy (kinda..?) but the bottom line doesn't help me sleep at night. The knowledge that I'm using an OS built by a generation, not a company helps me sleep.

As was stated in "Pirates of Silicoln Valley" - it wasn't that Microsoft did it best, they just did it first. Any CEO that would say that... whose best interest did HE have in mind???

R-

1000th Post!!!

[On Lawn]

Is Linux as Secure as We'd Like to Think?

That depends on how secure we'd like to think Linux is. Its fast becoming my pet peeve of the internet that after ripping someone up on premise, faulty logic, and everything else someone should base an arguement on they turn around and say "yeah but your not perfect".

While I clearly admit to not being perfect, the discussion is really not ever about my level of perfection. This story is about the same thing. While previously the security of Windows was discussed very well in the article "Windows insecure by design", this posting amounts to be a simple "yeah but Linux isn't perfect" as if to deflect the majority of technical problems people have with Windows?

So if you think Linux is perfect, then perhaps this article is for you. But if your main concern is whether or not Linux is inherently more secure than Windows this article (although pretending to answer that question) does not do a very good job of discussing that point.

On the web site you'll see an ad stating that over 50% of the web defacements they've categorized have been Windows, while closer to 25% web defacements are Linux. That inspite that the last 24hours figure puts Linux at 61%. But no matter which is out front, the answer can only be that they are both not perfect and has no merits in discussing which is more or less secure.

And to me its the "more secure" and why that is important.

As a personal note, this is my 1000th post. I've been around since Rob Malda was known for WindowMaker themes and was just starting out programming a blog. I suppose that means I'm not a very active poster, I'm sure that there have been people who've posted more in less time. But its still rather a milestone...

Hitting a moving target

[The Tyro]

That's an excellent first post.

I think you are about half right about the first point... how many really clueless users do you know that run linux? To run linux, a person has to get over the "activation energy" of actually getting it installed. This goes beyond just having a pretty GUI installer rather than some text-based option... it's actually knowing how to answer the questions the installer asks: How many joe-sixpack guys even know what an IP address is? Or know their primary and secondary DNS server addresses? If some well-meaning geek has installed a linux system for their grandma, they probably set up IPtables and killed all the unnecessary services... that's a HUGE security advantage right from the start. It's amazing what a clueful install can do.

But onto your second point. I think it has more to do with the variety of linux users/systems rather than their iconoclastic attitudes (though the latter probably breeds the former, so in a way, you could be right). As a medical professional, I'd compare it to a genetically heterogeneous population. In a MS-centric environment, there's only so many ways to skin a cat... Win2K, WinXP, et al. That lack of variability has administration advantages, but that sword cuts both ways. Common systems are easily administered, but just as easily cracked if they share a common vulnerability.

In nature, genetic variability is your friend... keeps an entire population from being wiped out by a plague. The Cystic Fibrosis gene is a defect, but saved some people from death during the cholera epidemics of the middle ages, and the gene has stayed in the northern european population ever since.

Variation on systems is FAR more prevelant in the linux world. Different kernel versions, different daemon versions, different firewalls, different configs (chroot, etc). Add that to a tech-savvy population, and a successful linux worm becomes a serious challenge.

It's really apples and oranges to compare linux and MS environments.

Re:Hitting a moving target

[jedidiah]

MY linux doesn't require the end user to enter any TCP/IP networking details.

Perhaps you should acquire and install a modern commercial Linux distribution.

Re:Hitting a moving target

[The Tyro]

Really? What distro might that be? Most of the reasonably consumer-friendly linuxes I've used (Redhat, Mandrake) at least require some basic info... DNS servers, default gateway, etc. at the minimum. This isn't a flame attempt... I'm really curious what distro automates ALL your networking.

Disclaimer: I have not tried Redhat 9.0, or the very latest Mandrake.

Re:Hitting a moving target

[ZorbaTHut]

Good thing there's nobody working to make Linux easy for clueless users.

Re:Hitting a moving target

[The Analog Kid]

Using DHCP does. I'm sure some noob Linux OS like Lycoris or Lindows does, too. I think in Red Hat all you have do is click Use DHCP.

Re:Hitting a moving target

[kapok_tree]

Darn you for pointing that out before I got to reading this thread. I agree exactly - the heterogentiy of the systems is beyond doubt an important factor in limiting the number of virii/worms/exploits against linux. As linux gains mroe acceptance ont he desktop there's sure to be a move to limit these differences, but the open source community will doubtless keep reinventing the wheel, hence assuring that we won't all be running the same thing.

Re:Hitting a moving target

[Andrewkov]

I believe DHCP is the default anyway.

In any case, same goes for installing Windows. If you don't use DHCP, you still have to know your static IP, gateway and DNS server(s).

Re:Hitting a moving target

[adoll]

hehehe good point. I wanna record this.

"Linux programmers will doubtless keep reinventing the wheel, thereby ensuring system heterogenity"

-AD

Re:Hitting a moving target

[toddestan]

I've used Mandrake and Knoppix and in both cases they managed to magically set themselves up on my networks all by themselves without issues. If you have some things like proxies ,or maybe you don't have a DHCP server - that could be a problem.

I should also note that once I load in the drivers for my network card, even Windows 95 has no problem hooking up to my network without any additional help.

Re:Hitting a moving target

[The Tyro]

Beautiful, isn't it? Just like in nature... evolve and adapt, differentiate, or perish.

That wonderful variety is what keeps half of the net functioning while the other half is patching their boxen.

In nature it's thanks to a bit of UV light, background radiation producing random mutations, strange chromosomal breakage during meiosis... in programming it's the constant drive to improve the code.

Three cheers for reinventing the wheel.

Re:Hitting a moving target

[pompomtom]

Speaking as a linux neophyte knoppix does.

Re:Hitting a moving target

[kumokasumi]

dee aych see who?

Headline says a lot

[M.C. Hampster]

The question asked "Is Linux as secure as We'd Like to Think?" (emphasis mine) reveals a lot about the mentality of Slashdot. Not all of us are zealots who ignore the shortcomings of Linux while blasting away at any slightest problem with Windows. Some of us realize that there are insecurities in all pieces of software and that proper administration of our systems is required for security, not just a simple choice between OS's or web servers.

Please stop acting like everyone here is part of the Slashdot groupthink.

Let us face facts

[Archfeld]

If Linux was based on a system developed 15 years ago it would have problems too. Linux is based on UNIX which has 25 years of learning and growth experience. While my choice of os is a *Nix, you gotta admit M$ drove lots of features onto the forefront of consumer computing, sadly they did it with horrendous coding discipline. Anytime you introduce that many new features, a LOT of holes and bugs will crop up. The real 'CRIME' is their lackadaisical approach to fixing them. I really think if/as the Linux user base spreads out, as soon as you begin to acquire the general (L)User community you will see the incident rate shoot up.

But you're talking bout EVERY Linux user.

[Anonymous Coward]

I have yet to see a single Linux user who actually doesn't bash anything non-Linux to date.

Re:But you're talking bout EVERY Linux user.

[Anonymous Coward]

Other than all those Linux users who run Mac OS X on an iBook? Not a small number from what I've seen around the LUGs....

An analogy...

[koa]

One of the reasons why Linux is not as vulnerable to virii and worms is becuase it is so configurable.. I would liken it to the immune system in humans, everyone has the same "type" of human immune system, however, some people are immune (to a potential virus or infection) due to a slightly different configuration in that system.

On that logic, windows is like a million clones of one person.. So when one virus takes hold, there is no genetic diversity.

Anyone have any similar ideas?

Is this a challenge?

[univgeek]

Is man_of_mr_e trying to tilt the numbers in favor of Linux? Posting this story on /. is like waving a red rag in front of a raging bull. Here come the 1337 script-kiddies!!!

Re:Is this a challenge?

[Sri Lumpa]

It seems to be working, when I checked it was:

ZONE-H TODAYS VERIFIED ATTACKS
20 single IP
1 mass defacements

Win 2000 (100.0)

Take THAT MS ;)

It doesn't matter

[Anonymous Coward]

The entire system is only as strong as the weakest link. What is really needed is a virus that searches out PCs unprotected by firewall/anti-virus prorgrams and deletes all of the addresses in their address books. Only then will these things stop proliferating.

In the meantime, I suggest that everyone forward all of the Blaster and Sobig messages they get to Bill Gates with the subject line: I think this was meant for you! Maybe then we can all get back to work.

Are OSS fixes really faster?

[StonyUK]

Sure the OSS community releases fixes faster, but how quickly do they penetrate the userbase? I think Windows Update is a far superior platform for distributing fixes than currently exists in the Linux world, if only because not every Linux distribution offers such a powerful tool.

Now I realise that you can also be the unwitting recipient of functionality and licence changing updates through Windows Update, but as a technology I think it's way better than what is available in the OSS world right now.

Re:Are OSS fixes really faster?

[Kevinv]

windows update sucks. you have to run it multiple times to make sure you got all the patches, you have multiple reboots, and many patches require being installed by themselves before any other patches.

The 2 distributions I've run, Debian and Gentoo, have none of these problems. Unless the kernel is updated neither requires a reboot. All installs take place in one session, all patches are installed in the correct order.

Both update systems are also very easy to script from the command line, Windows Update requires Internet Explorer and everything to be done by hand.

Re:Are OSS fixes really faster?

[Anonymous Coward]

I thought the thread started out about Linux users being smarter?

You would think someone who runs Linux would be able to use Windows Update properly. Don't blast your experiences out in public and think because it happened to you, that's just the way it works. Windows Update works fine. Linux needs a similar technology with the 10-15 vulnerabilities found each week.

Re:Are OSS fixes really faster?

[StonyUK]

Well clearly our mileage varies, because I've never had to go through multiple reboots on Windows Update, nor have I had to use it several times in a row because it misses patches.

Mind you, I'm referring to the automatic update service rather than their website.

My point wasn't really XXX is bad and Windows Update is great though, what I was really trying to point out was that Windows Update (via the auto-update service) is a far more pervasive mechanism than any of the distribution-specific techniques. I think that far more of the user base of Windows gets automatic updates than do Linux distributions, if only because by default it is configured to happen automatically and without any user intervention other than to click 'Yes' when you are told there are new updates to install.

Re:Are OSS fixes really faster?

[overbom]

I wish I had mod points for you.

I think that apple's software update and sun's pprosvc are both better than windowsupdate (which reports patches as installed when they're not, and requires IE to run), which is in turn better than Redhat's up2date, which is in turn better than FreeBSD's cvsup. I long for binary package updating from FreeBSD, and the day that I can install patches without a compiler.

Re:Are OSS fixes really faster?

[Qzukk]

I've been using the automatic update service at work, and last monday, it tells me that I have an important update to install to fix an RPC bug. (Yeah. *That* one. That was fixed a month before. Why hadn't automatic update gotten it before? At least our systems are behind a competent firewall) So I installed it. (It didn't require a reboot).

Tuesday morning, I come in and Automatic Update tells me I have an important update to install to fix the RPC bug. Again.

At least it only happened twice (hey! it should be Very Fixed now!), and just a month later (its like a fine wine, gets better with age). I still have faith in automatic update, its just buried in the mud out back along with my faith in the rest of humanity.

As for its pervasiveness, I'm sure everyone who does get their fixes hits yes and they install, but I recently noticed that I'm still at XP service pack 0... autoupdate won't download and install service packs for you.

Re:Are OSS fixes really faster?

[Acidangl]

I would have to disagree. Using VBScript, Polices, and SUS i keep over 300 client machines up todate. It doesn't require Internet Explorer, or anything to be done by hand. All updates are downloaded one time and automaticly insatlled for end users.

The blaster worm and email virus spreading are targeted at end users. Does your desktop machine need to have years for uptime? Will it effect you that much to reboot your computer from time to time?

It is uninformed zelot posts like this that turn me away from Slashdot.

Re:Are OSS fixes really faster?

[|>>?]

Sure the OSS community releases fixes faster, but how quickly do they penetrate the userbase? I think Windows Update is a far superior platform for distributing fixes than currently exists in the Linux world, if only because not every Linux distribution offers such a powerful tool.

While I agree that not every Linux distribution offers "such a powerful tool", I must also point out that with the current Linux userbase, most are able to run their respective tools. (I prefer apt-get update ; apt-get upgrade myself)

Having used Windows Update, I would shudder to use it and the word "superior" in one sentence, but I leave room for other experiences.

My experience has to date been as others suggested; IE required with multiple reboots and multiple updates, not to mention the sheer volume of suggested updates - none of which I asked for - given that they all appeared to add extra software, not fix existing code.

Now I realise that you can also be the unwitting recipient of functionality and licence changing updates through Windows Update, but as a technology I think it's way better than what is available in the OSS world right now.

I can only surmise that you have not experienced the joys of the update that I do regularly on my workstation. Some days I'll put off doing an update because it slows down something else I'm doing, but overall, my updates just happen in the background - eg. I fire off my favorite two commands and every now and then check the terminal window to see what's going.

Please don't get me wrong, I'm not saying Debian is the end-all-and-be-all, but for me it works where Windows plainly does not (anymore).
--

Percentage

[Andy Smith]

A little pedantic but... from the story:

Note also that the 'Unknown' category is rather high, and certainly contains at least some Linux systems, further increasing the percentage

This would increase the *number* of Linux defacements, not necessarily the percentage.

Re:Percentage

[thebatlab]

Increasing the number of linux defacements would by nature of mathematics cause the percentage to go up would it not? If Linux has 25 out of 100 defacements, if an unknown becomes known to be linux, then it is now 26 out of 100. Even if you add a whole new linux entry to the numbers, 26/101 is greater than 25/100.

Or were you meaning something else??

Re:Percentage

[Andy Smith]

Okay I just typed out a long explanation of why I thought I was right, and I've convinced myself that I'm wrong.

My mistake was that I thought the percentage applied to the number of known operating systems, but of course it would include the unknowns as well, so having a few Linux boxes in the unknown set would increase the overall percentage.

Sorry :-)

The Obvious Question

[Guppy06]

"Linux accounts for 61% of the defacements in the last 24 hours"

Does Linux hold a 61% share of webservers overall? If not, is it more or less than 61%? By how much?

Q&A

[MrEd]

Are there other reasons why the likelihood of a "Sobig" or an "ILUVYOU" would be lower for Linux than Windows?

Yes. Windows machines all have Outlook Express and IE and comprise 99% of the desktop market. Dumb answer for a journalistically 'dumb' question. Got me to answer, so it worked!

Someone more insightful than I can do the math. Exacerbating the problem is that while you can firewall vulnerable Windows machines, unless you also know about mail filters then the trojan horses will roll right through.

Statistics are misleading...

[tellezj]

I'm not entirely sure of the numbers, and I'm currently too busy (read lazy) to do the research, but I recall that linux/apache accounts for a large percentage of web servers. I would like to see a comparison between all the different web server platforms v. the defacement statistics. I would be willing to bet that there would be no statistically significant difference between any of the OS/web server program combos.

Linux more virus prone

[KingRob]

I suspect the bug rate of Windows is similar to that of Linux (at production release) If Linux had the popularity of Windows, we would likely see even more viruses. Why? because the vulnerabilities are well documented - the source code is readily available. Linux systems patch no quicker than Windows.

about fscking time

[Anonymous Coward]

someone asked about the true nature of how secure linux is.

looking at the kernel and some drivers code is absolutely disgraceful.
how can such flawed, unclean code get checked in?

it inevitably makes you wonder how secure such a system is.
and whether it's getting as much attention from the hackers as a windows box.

Maybe there is a correlation

[Anonymous Coward]

On the /. Windows security bashing session based on the Washington post article, many claimed that it was a myth that Windows was more often attacked because it was more often used. They then cited Apache vs IIS as an example of how Linux was as widely used, but not attacked. Apparently, they were wrong to assume that Linux wasn't getting attacked on the web front. So maybe the correlation between use and probability of attack does hold some water.

Operating System Transparency and the Application

[Above]

There are really two different problems when it comes to securing against worms and the like, and for the moment I think Linux (and any Unix) has an advantage in both areas, although it's probably not as big as many people think.

First you have to look at what a rogue program can do once in the system. For this the entry vector is unimportant. With most Unix like systems the default is for the user to not have full privilages (eg, not be root), and thus the rogue program cannot make full use of the system. That doesn't mean it can't complete it's mission, but it does make several things much harder:

• Hiding from the user / administrator. Almost all rogue programs try to hide. When a user only has disk permissions to their own area, and not to the entire machine there are fewer places to hide. Also due to differences in the system it's more routine for users and administrators to be presented with system data (eg, ps output) and it's easier for the administrator to collect data about programs running (ps, accounting, lsof, netstat). I know, you're going to say all that can be done on windows. The problem is windows goes to great pains to make the average user, and the average administrator not know that.
• Automatic execution. To better hide rogue programs often don't want to run all the time. Again, by design most users can't edit startup files, or couldn't append a wrapper around a standard system program on a Unix like box. Indeed, many users have no programs installed in areas they can write to. Windows on the other hand allows users to add TSR's and edit all the applications, allowing a Rogue program to hide almost anywhere.
• Built in defense mechanisms. Almost all Unix flavors come with some defense standard now. Mostly in the form of nightly scripts checking for SUID programs and the like. Some are more fancy, some less, but at least there is some attempt out of the box to notify the user / administrator of a problem.

The main issue is, most of the operating system differences don't mean much, as it's the applications that are the holes. From the simple password in a URL, to a complex buffer overflow attack applications are very often the vector into the system. Here you have to separate the cultural differences from the application differences.

Cultural: Many Unix users still used text based mail clients in xterms, and even when they don't the GUI's were designed to more closely mimic the behavior of those interfaces. Attachments are evil, when run are generally carefully handed to a program as data. In windows virtually all mail programs are graphical. Many users demand them to implement things like javascript that auto-execute, many of them will happily run a foreign attachment with little more coaxing than a mouse click. At the end of the day these differences require user education. That may be helped by a transparent OS, but it's still a user education difference.

Application Differences: Windows (Microsoft) encourages developers to build tightly coupled applications. Look no further than OLE. That ability to embed excel in your word doc and have it just pop up over the UI requires a tightly coupled API for program to program interaction, generally exposing full interfaces. Rogue programs can exploit this, often not needing to know what application is in use, but rather just the API. Unix developers / enviornments generally encourage a loosely coupled behavior. Programs provide some command line / pipe oriented service and handle all their own details internally. You need only look as far as printing to see this quite well, as windows pushes driver bits into the application to change behavior, while unix makes it all happen with a "system()" command running a new program.

At the end of the day, I believe the following statements are all true:

• Windows is targeted because it is the dominate platform, and rogue programs generally want to have the highest chance of suc

I too support the need for POSIX ACLs

[Ayanami Rei]

and MAC by default in linux.

BUT!

That does you little good in some situations as there still are local root exploits. At the very least one should take measures against executable stack exploits (why haven't you used GRSEC yet?)

Also, we need better auditing and unified log formats for PAM and syslog (ala Apache, or Sun's BSM). SNARE is getting there, but it still needs work.

TMHBT

[mangu]

Stuff a clothespin is made of: steel
Stuff the Empire State Building is made of: steel
So the Empire State Building is as flimsy as a clothespin? I think The Moderator Has Been Trolled...

Re:TMHBT

[NanoGator]

"So the Empire State Building is as flimsy as a clothespin? I think The Moderator Has Been Trolled... "

That might be a fair statement if AnonV's comment didn't have a good deal more content in it than the part you are arguing with.

Judging from the other ignorant replies, I'd say that he had an anti-troll honey token going on here. You're all busy arguing that detail of his post that wasn't critical to his point and not actually engaging his point head on.

Very clever on his part, assuming he did it on purpose. "Ah, he's trying to fight my analysis with a sarcastic response that sounds more relevant than it really is. I can safely ignore this troll."

Not as secure as we'd like it to be

[El]

There are some differences in the design philosphy of the two systems. Linux is built by and for techies. It emphasizes transparency and modularity, and ships with a model that no port should be left open by default, i.e. services should be explicitly turned on by a presumably non-naive user. Windows is built with the philosophy that the end user is an idiot, with an emphasis on all apps sharing data. Windows traditionally ships with every port M$ apps may eventually want to use wide open. Yes, I'm sure this model is changing. But go to their knowledge base, and they'll still tell you that you should just buy a firewall rather than disabling the Microsoft Message service that allows anybody on the Internet to broadcast pop-up messages to your box!

Easy Answer

[moby]

Most people who can use Linux don't double-click first and look at the attachment later...

statistics?

[Punto]

shows that Linux accounts for 61% of the defacements

I'd hate to be regarded as one of the thousands of people in denial posting on this article (I actually thought it was a very good topic), but I wouldn't place too much value on those statistics..

Suppose we have 10 linux servers, and 2 windows. 3 servers get defaced: 2 linux and 1 windows. So we have 66% linux and 33% windows.. but we also have that 20% of the 10 linux servers got hacked, while 50% of the 2 windows machines got hacked. Again, I'm not trying to add to the denial, I'm just pointing out that statistics need to be handled with care (or not at all).

Security isn't the issue

[Andy Smith]

It has always struck me as disingenuous that Linux advocates claim Linux to be more secure than Windows. The common perception is that the entity "Linux" is inherently secure but the entity "Windows" constantly needs patching. This clearly isn't true, and it ignores the ongoing development cycle of *both* operating systems.

When a Linux advocate says "Linux is more secure than Windows" what they actually mean is: "When a flaw is discovered in Linux, someone fixes it quickly and a patch is released. It takes longer with Windows."

The quantity/severity of security flaws is not the issue. Both operating systems have security flaws and always will. The issue is the speed with which security flaws are fixed.

Don't fall into the trap of believing that Linux programmers are somehow "better" than Windows programmers, simply because the former are doing it for love and the latter work for Microsoft.

Similarly, don't forget that Linux is only secure because of it constantly being patched. This is exactly what people complain about with Windows!

Does this really need to be explained???

[glenebob]

Email viruses are Windows specific for two reasons.

1: Windows does a piss poor job of providing isolation for non-admin user accounts. In practical terms, you're forced to run your desktop as an admin because it's too hard to switch to an admin account to do mudane things like install printers, and some software will just not run right in a restricted account.

2: MS likes to provide all sorts of neat 'features' in their apps, like scriptability and 'run the attachment' stuff.

Put those two together, along with a few bugs (which ALL systems have) and a gullible user base, and you have a great virus propagation system at your disposal.

Linux (or any system with true multi-user support) is not very vulnerable to email viruses because programs run fine in 'mere mortal' accounts, so that even if a virus does get executed, it can't do ONE BIT of system-level damage. It CAN destroy the user's data, but the system continues to boot and run and other users are unaffected.

Service exploits are a completely different animal. They rely on bugs in the service software. ALL systems have bugs. As a programmer, it's annoying to keep hearing about the infamous 'buffer overflow', but they exist all over the place in all sorts of software. Until server software is either written in languages that provide better buffer support (I.E. not C), or programmers stop writing crap network code, the problem will continue.

Bad Statistics

[photon317]

Linux probably has a greater share of the webserver market than anyone else, seeing as Apache is known to have the biggest share and Linux is probably the most-used platform for Apache. To say that 61% of defacements are Linux without stating what percentage of total websites are Linux is misleading.

All operating systems, XP and Linux included, have a variable amount of security, which varies with how persistent and knowledgeable the sysadmins involved are. Linux isn't universally more secure than XP, because there are so many variables involved, mostly at the sysadmin or user level rather than the code level. However, I think it's a fair and rational statement to say that given the same level of security expertise and dedication to security, a person can be considerably more secure in a Linux environment than a Windows one.

Look closer

[jjshoe]

I realize at this point no one will probly see this but lets look at this issue closer. Linux is a kernel, not a distro or a program. This is a main point. Windows also is a kernel. The amount of exploits on the Windows kernel vs the amount of exploits on the Linux kernel is where we can claim that linux is more secure. I use Linux everyday but i must say i have more faith in an experienced NT admin then i do on someone starting out with redhat or any other distro.

Rather then flame on about this that and everything it would be nice if we could all work twords a common good. Linux facilitates such an idea more then Windows which is why i use linux.

Look at the numbers

[FlukeMeister]

Go here

Check out Apache's numbers. That would be about the same percentage as servers compromised, assuming the vast majority of Apache sites are running on Linux servers.

Now let's look at which web server runs most virtual hosting environments.

That would be apache again.

So, considering that compromising a single apache host could count for defacements of *thousands* of sites, is anyone still surprised about the numbers?

Website defacements are a poor measure of security

[lesinator]

The community of crackers that commits website defacements considers it "uncool" to deface windows servers (because its "too easy"). Their targets aren't chosen at random, from all the webservers out there, but with a delibrate intent to prefer Linux targets to Windows targets.

L

It's all about the vectors

[stand]

Any virus, worm, etc. is designed to exploit weaknesses in a *specific* piece of software. Homogeneity is the enemy because it allows a virus to roam far and wide across identically configured systems. Thus, Microsoft suffers the downside of monopoly.

What they don't tell you is that...

[Anonymous Coward]

What they don't tell you is that probably 95% of the systems had Microsoft's Frontpage extensions installed...

Is Linux as Secure as We'd Like to Think?

[Anonymous Coward]

Not if Bill has his way. Legions of MS evil code monkeys are studying the source code of LINUX to write anything to discredit the perception of security.
</sarcasm>

Seriously though, Patching is the key to every OS. I was shut down by my ISP because they had received complaints that I was hacking other users. I had fallen behind on my firewall distro pathes and the LINUX box was the culprit, not my windows box. So, I wiped the trusty p200 clean, installed a new firewall package, and cleared things up with my ISP and life goes on.

Re:Is Linux as Secure as We'd Like to Think?

[Anonymous Coward]

Also .. It has something to do with the english used when errors happen, Linux uses better English so any old geek can know what happens .when something goes tit's up ...

Windows Uses techno-waffle so no-ones got a clue what it's jabbering on about when something goes tit's up.

In other words .. the two are completely different things ... comparing windows to linux is like comparing sausages to a veggie burger.

it just dosen't work.

security is a mindset, not a feature

[archen]

As others have said, any lazy admin can fuck up a perfectly secure system. And now days it really doesn't even take that much effort. In the network I'm on I have multiple Linux servers which I consider to be quite secure, but there is the one server I DON'T admin that's so bad that I consider it a total write off - all other servers actually drop all packets from it. And the guys who run the server refuse to fix it (redhat 7.0) because "something might break". Well whatever, I'm sure when the shit hits the fan, I'll get blamed - but it made me realize that Linux isn't by itself secure.

Is it more secure than windows? Yes. Download a virus and double click on it in windows, chances are you just got the virus. Do the same thing on Linux. Now you have to assume that A) you're running as root, or that the virus can exploit something to gain root. B) it would have to be marked as executable in the first place to run.

The difference comes in the tools that are available to increase security. Mounting partitions as noexec, chroot, etc. Better yet, when you go to the BSD side there even more security tools to mess with. One thing that Microsoft will probably never understand is that it isn't always that "x" is cheaper than "y" or that "x" is faster than "y" - sometimes it's the tools, mindset, power and flexibility that count the most - and in this area, Linux will probably always be ahead.

Sobig.L (Linux special)

[Qbertino]

Hi there, Hunny-Bunny.
I got this soooo kewl little shellscript, which is sooo sweet and good and all. You just have to do a little 'chmod u+x' on it and then it will dance just for *you*. PLEASE try it! Really, you've got to check this out!!!!

Attachment:
SayByeByeToYourData.sh

Re:Sobig.L (Linux special)

[glenebob]

This is flamebait? This is pretty much what it would take to get an email worm to propagate on Linux. And it still couldn't do any system-level damage.

Re:Sobig.L (Linux special)

[Qbertino]

Flamebait???
Actually I'd hope for it to be funny. I thougt it was funny anyway.
I guess that last Wormwave left some Windozer quite humorless. :-)

Different kinds of vulnerability

[Morty]

Vulnerabilities come in many favours. Linux's and Windows' relative vulnerability depends on what you look at.

Are Linux desktops in general more or less vulnerable to email viruses? Probably less, because (1) most Linux mail clients are smart enough to not execute code sent as an attachment; and (2) most Linux processes run as an unprivileged user rather than as root/administrator.

Are Linux servers more or less vulnerable to service exploits and service worms? Probably more, because (1) Linux comes with a lot more services, and a lot more services tend to be installed; and (2) most Linux variants make it more difficult to patch a Linux system and don't provide patches as long.

Are Linux systems more or less vulnerable to trojan horses? That's out of scope -- trojan horses are a human issue. Both Linux variants and Windows have/plan to have a notion of a signed package, but the system doesn't require it, so a determined human can install a trojan horse.

Are Linux systems more or less vulnerable to privilege elevation exploits? Probably more -- Windows systems don't privilege elevate as much as Linux.

Are Linux systems more or less vulnerable to physical attacks? That's out of OS scope -- with physical access, any OS can be preempted. [Cryptography in the FS can guard the data and/or OS install, but isn't usually used, and is impractical for the OS as a whole in most scenarios.]

The statistic that started this was website defacements. Note that apache has an unusually high percentage of websites per www.netcraft.com (63.98% for August 2003), so it's not surprising that Linux has an unusually high percentage of defacements.

JAP has a back door!

[Anonymous Coward]

That's interesting, but have you heard the news about JAP having a back door? Now that's news. Run a fucking story about it already, slashdot!

Propagation

[messerman]

A good portion of Windows-based virii spread through e-mail. Address books are read and copies of the virus are sent to all of the victim's friends and associates.
Because this form of attack almost always hits Outlook, it just isn't a problem for Linux. I've received CHECK OUT MY C00L SCREENSAVER and I LOVE YOU viruses, but amazingly they don't seem to bother my mail client. A linux virus that could deal with multiple distros and multiple email clients (elm, pine, mutt, etc) could potentially propagate itself as well as a Windows virus, but who would want to go to all that trouble when hitting MS products is so much easier?

Not so helpful

[man1ed]

It seems to me that all of those results deal with how to go from 6.0 back to 5. Not very helpful for someone who wants to eliminate the program completely.

Re:Not so helpful

[Gherald]

You are probably better off staying with 6 in that case, as it is more secure (although I doubt anyone remembers how to break in through 5 anymore).

If you are forced to use a MS OS then the best solution is, as usual, to just accept whatever comes pre-installed by default and run Windows update regularly. (IE 6.0 service pack 1 is pretty secure.. for now)

Crakk0rs r00ting boxes

[billstewart]

A couple of years ago I used to run out-of-the-box RedHat 5.x and 6.x on a spare Pentium-60 on my lab DSL, as well as Win95 on some similarly lame machines. As an old Unix hacker, it annoyed me that not only did nobody ever crack into the Windows machine, but that the Linux box would get 0wned within a few days. After it had been brutally and senselessly killed several weeks in a row, I renamed it from "localhost" to "kenny". Eventually I installed RedHat 7 on it, and it stopped getting attacked, and later put it behind a firewall.

The biggest holes were probably in the FTP servers, and one reason the Windows machine was safe was that it wasn't running any Microsoft servers, only clients and freeware web server that nobody had apparently cracked. I first discovered the problems when I saw (from the tcpdump that runs any time there's nothing better to do) that my machine was pinging a machine at a university in Sweden a lot - I contacted the admin there, who told me it was the Staecheldraht DDOS zombie program, and pointed me to a site with info on cleaning it up. (I'd already killed the process - the crakk0r's rootkit modified ls and ps so that it wouldn't show up, but didn't bother with /proc and some other tools....) The next week it was pinging WashU in St. Louis, which seems fair since I was running wuftpd, and the following week it was responding to pings from a machine that looked like it was at MIT (after getting ZERO usable contact information from MIT's web site or student help desk, I contacted one of their security honchos that I know from other channels - he said that it was actually a machine in Japan that had an IP address that was byte-swapped from MIT's, but somehow managed to be running DDoSware anyway). After I cleaned it up that time, the (*^%*(!&%#ers got annoyed and reformatted my disk drive....

If you could, would you really want to.....???

[3seas]

People do things for reasons. Remove the reasons and they won't do something based on a reason that doesn't exist (there are exceptions to all the rules and mindless people wondering around to insure this).

Often the defacement of a site is like a graffiti (sp?) paint spray can artist. They are just taging a spot saying they were there. Meaning the results are more often then not just pointing out a weakness in the site that needs to be fixed.

As to security issues of OSs, again, give someone reason to break in and they will. Now don't we all know that there is plenty of reason to give MS grief and that MS have actually earned the receipt of such grief?

Consider the DoS attack on SCO. Would it have ever happened had not SCO earned it?

You want security from internet invasion? The only sure way is to not be connected to the internet. For what we make we can break and locks are only for honest people.

There is the question of GPL source files having been accessable to someone who cracked into the FSF system and over a period of months before being detected. But it appears there was no damage done, via pre-existing check-sums of the files.

The point is - if you could crack a site, would you really want to? And if so, what sites would you want to crack and why?

More to the point

[soloport]

Take your most savy Linux guru and your most savy Windows mouse-clicker (can often be one and the same person). Let each setup a secure server and point each server to the Internet.

Now sit back and wait for shit to happen.

Eventually it will be proven that the best platform is freebsd.

Re:More to the point

[pboulang]

Well phrased. Took me until the last word of your post before I started grinnnig stupidly.

Bravo!

Re:More to the point

[jazman_777]

Eventually it will be proven that the best platform is freebsd.

The trump OS: OpenBSD.

Re:More to the point

[Anonymous Coward]

Amen, OpenBSD wins.

Though, remember it is easy to have the most secure system running then make it insecure. Key, here is where does the line between the configuration and the tools fall to define the secure system. Another way to say it is this, "You can have the most secure OS and supporting software around but if you do not change the default password, how secure is it?"

The game is, who is ahead and who is behind. Do not sleep becuase you are ahead.

Re:More to the point

[Anonymous Coward]

FreeBSD!

Re:More to the point

[quantum bit]

OpenBSD is a great secure server platform if you want to run... uh... OpenSSH...

It's like all the people who want a Mac for gaming. I mean, there's tons of great games on the Mac. Like Warcraft 3. And... Warcraft 3. And the little apple puzzle thingy...... photoshop?

So if you want to run a very secure SSH server, OpenBSD is the way to go! For anything else (i.e. anything not in OpenBSD's "secure by default" install, which is everything besides OpenSSH), it doesn't make a whole hell of a lot of difference what OS you run it on.

Re:More to the point

[1lus10n]

actually the best OS is ..... Trusted Solaris.

however provided you dont want to spend the price of a car on an OS then whichever has the smallest market share is the one that wins. but if you run apache on it your asking for trouble because apache is top dog, and i would venture that apache, sendmail, and bind account for nearly 95% of all Unix/Unix-like exploits.

Re:More to the point

[Telent]

So if you want to run a very secure SSH server, OpenBSD is the way to go! For anything else (i.e. anything not in OpenBSD's "secure by default" install, which is everything besides OpenSSH), it doesn't make a whole hell of a lot of difference what OS you run it on.

You, sir, madam, or genderless being, are amazingly incorrect and misinformed.

A default install of OpenBSD includes:

• Chrooted Apache
  
• Sendmail hardened with OS-specific patches
  
• ftpd
  
• popa3d
  
• dhcpd
  
• Perl 5
  
• pf
  
• NFS tools
  
• Lots more I can't think of off the top of my head...
  

Now, admittedly, in the default install, only sshd and sendmail are turned on. Big fuckin' deal. With five seconds of work, it's all on and ready. And most of those are hardened software. You should diff the source trees against the original packages someday...

OpenBSD has always been all about giving the end user a complete server-in-a-box, so to speak. In fact, most of this stuff is off by default in FreeBSD and NetBSD.

Re:More to the point

[jazman_777]

OpenBSD has always been all about giving the end user a complete server-in-a-box, so to speak. In fact, most of this stuff is off by default in FreeBSD and NetBSD.

And OpenBSD's pf makes firewalling and NAT ridiculously easy compared to Linux/iptables. And they're constantly auditing the codebase for security. Linux by comparison is downright Microsoftish.

Re:More to the point

[Trolling4Dollars]

Dude... I've been running a well secured Linux firewall and a separate Linux based Apache web server since 2000. I've patched and updated the systems so far from their default install (RH 6.2) that they are no longer really RedHat boxes. These boxes have not been cracked once. If you are vigilant and knowledgable, a Linux box is the most secure choice going with the most available software.

Re:More to the point

[HolyCrapSCOsux]

there's no need to resort to profanity. But, since you started it, BSD, Last I tried it, was a bitch to install. True, it was on a laptop, from a parallel CD-ROM, With an unrecognized PCMCIA NIC, But a bitch nonetheless. Linux installed fine. Secure, who cares, it was a laptop. If I was worried about security, the entire freakin OS will be Read-Only (read KNOPPIX) same for my website (another CD-ROM) deface that!!!!

Re:More to the point

[Anonymous Coward]

post your website then. ;-)

Re:More to the point

[Amomynos Coward]

>Eventually it will be proven that the best platform is freebsd.

No, eventually it will be proven that the *BSD is dying.

Re:More to the point

[dmrt_viper]

Are you for real ?

The OpenBSD ports tree contains over 2000 packages. Hell, it emulates FreeBSD/Linux when needed ;) We use OpenBSD in production for years now, serving apache/ssl/openldap/mysql/imap-ssl/postfix/squid/i rcd/bind/pf next to sshd.

Trolly comments like these makes me wanna reply back with http://www.antioffline.com/freebsd.html :)

Re:More to the point

[Lord of the Wazz]

It's like all the people who want a Mac for gaming. I mean, there's tons of great games on the Mac. Like Warcraft 3. And... Warcraft 3. And the little apple puzzle thingy...... photoshop?

If you're going to more or less directly quote the "Apple Switch" piss-take video on Red vs Blue then at least be honest about it ;)

Re:More to the point

[dmrt_viper]

the entire freakin OS will be Read-Only

Read Only RAM memory as well ?
I doubt it ;) ramdrive filesystems are just as scary.

Find vuln. / Exploit vuln. / gain root / echo leet h4x0r > /tmp/www/index.html /
restart httpd with own httpd.conf pointing to a ramdrive fs (lets say /tmp/www)

The big disadvantage you have using a life cd lies within updating your software ;)
Linux distro = daily-+ updates.

And don't tell me it's hard to install OpenBSD ;)
http://www.openbsd.org/faq/faq4.html
If you can read that, you can install it. (No scary questions it's an walktrough)
If your hardware is `really` scary use NetBSD that even runs on the desk the computer is standing on.
(Always verify http://www.openbsd.org/i386.html)

Re:More to the point

[steeviant]

wtf are you smoking?

In the absence of a Debian install disk, and desperate to get a web proxy going, I grabbed a nearby openbsd machine and fired it up for the first time, following the install guide I got the machine up and running as a bridging firewall/transparent proxy, and over the next couple of days proceeded to install bash and gnu fileutils, set up anonymous ftp, and wfq and rate limiting. My network has never worked better.

I'm not trying to say that OpenBSD is a good desktop OS, but it certainly compares well with linux as a network infrastructure box. It's fairly obvious from your demonstrated lack of knowledge that you've never actually made a serious attempt at using OpenBSD for anything.

I'm sick of seeing Linux babies who make five minute evaluations of operating systems based on the software installed by default, or complain that other OSes are 'incompatible' with Linux because they have bizzarre idiosyncracies that are not the same as Linux's bizzarre idiosyncracies.

The biggest tragedy here is that one-eyed closed minded bigots like yourself will never actually get to find the experience that best fits them because you won't try anything new. I'm just ranting and sermonizing now so I'll shut the fuck up, but you need to bear in mind that not every piece of software in the world is built with someone like you in mind, unless you explore and try new things, and learn to recognize where your favorite platform is deficient, you're robbing yourself of the best experience.

Re:More to the point

[Anonymous Coward]

I use Linux, OpenBSd, Beos and QNX in a network wich is secured by an OpenBSD box attached to a Linux server. I love OpenBSD for its simplicity, its security and its speed. Same reason as a love Linux!
I am sick of first-time OpenBSD users who think that
the "know" there way around and therefore "know" OpenBSD. In fact OpenBSD is a very very good desktop
OS but as long as will not try anything new...

Re:More to the point

[n3k5]

HolyCrapSCOsux wrote:

there's no need to resort to profanity.

;-)

Re:More to the point

[quantum bit]

If you're going to more or less directly quote the "Apple Switch" piss-take video on Red vs Blue then at least be honest about it ;)

I was wondering if anyone would notice :) I love that video! Was going to attribute the quote in the original post but it didn't go well with the theme of the joke...

Re:More to the point

[Telent]

Where's my "You must be THIS smart to use a free, open-source OS that doesn't hold your hand every step of the way" stick?

But, since you started it, BSD, Last I tried it, was a bitch to install. True, it was on a laptop, from a parallel CD-ROM, With an unrecognized PCMCIA NIC, But a bitch nonetheless. Linux installed fine.

I have no idea which BSD you used, but since the conversation is about Open, I'll assume that (if it was Free or Net, you're right; the curses-based installers are a pain). By "a bitch to install", I'm going to assume you mean "waaaah! waaaaah!!! aaaigh! it doesn't hold my hand and be all nice and graphical-like!"

Personally, Open's installer is the best I've ever used. Onto one of the most stupid things I've ever read in a Slashdot post...

Secure, who cares, it was a laptop.

This is where intelligent beings WORRY about security. Use that thing on your neck for more than a hat rack, could you? Think about it. The laptop gets carried around with important data on it. Someone steals it, or you forget it somewhere. It falls into the hands of Mr. Evil-Nasty-Cracker-Guy. Tell me, do you want an OS with encrypted filesystems and swap, or do you want to say bye-bye to your data security? Or let's say you're carrying your laptop along to a convention, and they provide wireless. Do you want to get cracked in the next five minutes, like you would with a default install of Red Hat?

If I was worried about security, the entire freakin OS will be Read-Only (read KNOPPIX) same for my website (another CD-ROM) deface that!!!!

Oh, my God. We've got a live one here.

First: I take it you're planning to never update your website and burn THAT to the read-only media, too.

Second: As a member of the global Internet community, I don't give a shit whether your petty little website gets "L@MERZ I RULE A$$ OK PLZ THX~!!!!!!??!?!?!/" plastered across your front page. I DO, however, care if you get rooted -- amazingly enough, being on read-only media is not enough to prevent you from getting rooted via a remote security hole, imagine that -- and start DoS'ing people under the control of some script kiddy.

Re:More to the point

[buffer-overflowed]

That's also true of windows.

If people had been vigilant and knowledgable, work within the boundaries of it's flaws, we'd see a lot less breakins, viruses and the like.

The problem is, most people don't, and that's OS independant.

Re:More to the point

[mausmalone]

Eventually it will be proven that the best platform is freebsd.

Yeah... 'cause nobody cares enough about freebsd to hack it. That's like saying the Mac is the most supreme system because people simply aren't writing many virii for it.

I have no real experience with linux servers, but I did configure a solaris server before (as a for-fun pet project). It got hacked to high-heaven. So, uh, unix ain't so secure. My IT department shutdown my port after I got a virus that scanned successive IP's. They said "Install every patch"... on a Sparc 5... sure... I've got 3 days to spare, let me do that.

Re:More to the point

[bafu]

I have no real experience with linux servers, but I did configure a solaris server before (as a for-fun pet project). It got hacked to high-heaven. So, uh, unix ain't so secure.

Solaris is definitely not secure out of the box. It is amusing to me that Debian, RedHat, SuSe, etc. all ship more secure than this highly-touted commercial Unix. Of course, it is easy to fix that (and there are loads of sites warning you of the dangers and telling you how to deal with it), but it's embarrassing that Sun continues to ship the box wide open.

They said "Install every patch"... on a Sparc 5... sure... I've got 3 days to spare, let me do that.

Installing the latest recommended patch cluster is simple enough (and takes a lot less than 3 days), but it won't fix the problems. Solaris ships with all kinds of services turned on that are totally inappropriate for anything but a very trusted environment. Always have and, it seems, always will. A lot like Windows, really, in that regard. Pretty funny, huh?

Re:More to the point

[Trolling4Dollars]

Actually, I agree with you here. If the person maintaining the internet exposed Windows box is on top of every critical update and keeps aware of all possible exploits, then Windows can be secured almost to the point that Linux can. The major difference is that for Windows to be fully secure, you need to invest in additional hardware (DSL Router/Firewall) or software. Some of the software is free, but the better quality stuff always costs. In the land of Linux pretty much all of this stuff is free (beer) and can be tweaked to be even better. However, this is all based on the user. The plain fact is that the majority of Windows users and admins are just not THAT into their systems. They constantly talk about "having a life" and not wanting to dedicate their time to their computers that much. What they tend to overlook is that if they actually invested the time, the Linux platform would be no more difficult than the Windows platform to configure and secure. And with the experience, it really doesn't take any longer to do the same kind of things on a Linux box that you can do on a Windows box. I "have a life" and do plenty of other things besides work with my Linux boxes (bike riding, renovating my 100 year old house, road trips out west, etc...). The claim that "Linux is free as long as your time isn't worth anything" has no teeth. It should be "The value of my time increases with the gain in my knowledge and is inversely proportional to the amount of time I need to spend gaining knowledge on the subject of Linux". So... if you become more learned, your time is worth more, and you spend LESS time on maintaining your Linux boxes than anyone ever does on their Windows boxes.

Re:More to the point

[buffer-overflowed]

Quite an astute way of putting it.

linux vs. windows isn't the issue

[motorsabbath]

The issue is that scads of IT shops consist of people who are skilled in applying some vendor's patches and security updates, but not in the underlying system(s) or network technologies. Whether that vendor is Microsoft or Red Hat, all the worker bees know how to do is install patches. And this patching and support is mainly what all the corps are paying for.

Think of it this way - using linux or bsd as an example, doesn't it make more sense to use a free one and employ admins and programmers who know how to build and support your network, and have *them* hire worker bees as needed? Why pay an external party for support when it might cost less to hire knowledgable engineers in house and have them do the work? Or, if the admins are already savvy and are working hard even *though* you're paying for some vendor's support, then why pay for that support anyway? Just use a free opsys and do the same amount of work.

As long as IT shops are filled with patch-pushers, these issues will continue. With linux the chances of a massive worm or email virus outbreak would definately be smaller, and bsd smaller still. But the opsys isn't the only problem. Corporate IT is it's own problem.

Run your servers on openbsd - they'd love to be held accountable.

If you think it's secure...

[MazTaim]

It probably isn't. A secure network is a network with all devices unplugged from the network. A secure server/workstation is a server/workstation that is powered down, in a vault with the key thrown away.

What's the most secure option?

- Constantly update all software/firmware/antivirus.

- ALL employees should frequently change passwords (consider forcing changes on a regular basis (1 week where I work).

- Monitor your networks.

- Create restrictive firewall rules (boo hoo...the workers can't IM their buddies...GET BACK TO WORK!!!).

- Antivirus should be installed on all machines (servers/workstations).

- E-mail virus filtering solutions must be implemented.

- Keep up to date with security publications, lectures, software, concepts, etc..

That's all the prentative requirements. Now on to the most important part of security, realizing that you still have a good chance of being compromised.

- Intrusion detection software wherever possible.

- Have a plan ready to implement in the case of an intrusion.

- Use the 5Ws and an H (Who, what, where, when, why and how.).

- Make sure you have contacts for any help handy and available to any personel who might be involved in post-intrusion procedures.

All of this is a pretty big job. Something that should perhaps be handed to a person or group of persons (depending on the size of the company you represent) who can work this on a full-time basis.

Security is as strong as your weakest link. You are the weakest link. Get some stacker 2 and beef up!

Re:If you think it's secure...

[Junta]

In general some good ideas, but some flaws. Generally overly anal network policies do more harm to productivity than it does to enhance security.

One questionable practice is thath the change password enforcement just doesn't work. If users can make it the same, they will. If not, they will generally alternate between two. And in all cases, a user that might actually choose a hard password to guess/crack might be less inclined to do so if it is going to change in a week and they have to remember another. I am skeptical of the benefits of enforced password changes...

Also, going too far in securing systems frequently has a far worse consequence: impeding productivity. For example, when a building was seen as having Blaster infected systems at one place, they literally pulled the power cord on the router to that building, completely cutting it off from the company network and internet in the name of security. The result was a lot of people having their productivity destroyed for days while they manually sought out problem systems. Blocking off RPC would have been so much more appropriate, but the panic over it spreading one second longer was just too much... Just like the strategy of unplugging a server from the net in the event of a DOS. You may have a sense of accomplishment from not getting hit directly by the attack, but the end result is more success than the DOS could have ever technically achieved on its own.

Assuming that IM='evil productivity eater/security liability' is also quite a mistake. I have a number of business contacts on my lists. It is an excellent non-intrusive way to keep in contarct with important people. Also, employee morale is not something to be ignored. And on top of that, if they need to communicate, they can either a) be tied up on the phone where it is difficult to work and talk at the same time or b) discuss it in IM in the midst of everything else. The whole strategy of micromanaging how work gets done is just flawed. You can only look at the resultant productivity. If the level of productivity is at a satisfactory or better level, who cares if they spend some time on IM? It probably enhances their non-IM work effort by fighting burn-out. While you are at blocking IM traffic, why not do away with paid vacation, after all, that time is just sucking up company resources and employees would be much more productive if they never took a break, right?

Re:If you think it's secure...

[MazTaim]

I came up with the list in about 5 mins of work space-out time. I am not a security expert and I agree with some of your points.

I do question frequent password changes, probably the biggest advantage is security from internal attacks. Giving out a password to a co-worker who needs access to some files I have access to, but am not around to retrieve for them is a common occurance (I don't do it myself, but I wouldn't mind getting a penny for every time this example occurs). There are still flaws with that reasoning as well. People start to use incremental passwords, etc..., but I do feel a little more comfortable in that instance. What about hardware tokens? I don't know if this is a good way to go either. Increased costs, more support, single point of intrusion (key stores) are all pretty negative sides to using a solution to such. Perhaps it's best that people consider as many possibilities and decide what's best for their situation.

I don't go for unplugging devices or nodes on a whim. If an area does become completely infected, then I would say that losing productivity by bringing network connectivity down is a moot point by then. Productivity is already lost. Preemptive isolation, however, is just plain wrong.

(Damn...I should learn to think a little longer on some of my ideas)

I don't assume IM is evil. Again, this is a choice that each company must make. I use IM internally to contact several different departments with speed and grace. IM DOES increase speed of communications.

I am all for IM, but if your company does not need IM for internal/external BUSINESS productivity, why use it? This isn't about cutting peoples rights. IM is a relatively new concept in the business model, you really aren't doing anything so bad as "doing away with paid vacations." After all, they didnt' have IM readily available to all employees back in the late 90s and earlier. I was really aiming at closing unneccesary ports, considering the necessity of the software that is generally installed, etc...I still contact friends by e-mail, and I am talking to you by /. comments :)

Security is as each company does. I just scratched up a list, slapped some pretty on it and out the door it went. I would ask for a strong firewall, a serious plan of attack/defense. And I always love my patches/updates.

did you fix it for yourself, or for everyone?

[donutz]

When I installed PHP-Nuke (yes, I actually use it) I went through the PHP code with a fine toothed comb before I opened the site to the public. I found lots of potential SQL injection, external file call and global variable exploits that needed fixing.

So just out of curiosity, did you submit your changes to the PHPNuke folks? Or just fix it for yourself? Seems it would be a kind thing (good for your karma, and not just the /. kind) to submit security fixes, if you know they exist.

Care to comment on where you made some of your fixes in the code, so that if you didn't report them yourself, then someone else can make those fixes public?

Thanks!

Re:did you fix it for yourself, or for everyone?

[BrynM]

I'm working submitting the fixes I've created actually. I've only recently (in the last two months) started the site, so it's still in-process - code submissions and all.

It all came about because I am building a module for Nuke. I started looking at the code and decided to do some house cleaning. Most of the fixes I implemented are already in the public (look around at Nuke Forums or search for "php nuke exploit"), so I'm betting that Francisco Burzi (the creator of Nuke) is working on implementing them for the next version if they aren't already in. He's been good about including fixes as problems are found.

Most of the exploits are simple SQL injection exploits, which affect all PHP/SQL code and not just Nuke. Let's say you want to query user data from a MySQL table named USERS with the USERID as the criteria:

?php mysql_query("select * from USERS where USERID=5"); ?

This will work great for one user, but to make the code portable, you'll need to use a variable for the USERID, so it becomes:

?php mysql_query("select * from USERS where USERID=$USERVAR"); ?

When the variable is passed by an online form it will look like this:

http://foo.yoursite.com/file.php?USERVAR=5

Because PHP doesn't keep strict varaible types, $USERID could contain the number 5 just as easily as it can contain the string "foo". Since the variable is at the end of the SQL query, we can append SQL to the end of our URL like:

http://foo.yoursite.com/file.php?USERVAR=5%20or% 201=1

As a result, PHP will hand MySQL a query that says "select * from users where USERID=5 or 1=1" (remember that %20 is an URL encoded space). Since 1 will always equal 1, MySQL will dump every record in the table instead of just the one with a USERID of 5. The way to fix this is simple. Before your line of PHP with the query, just do a simple

?php $USERVAR=intval($USERVAR); ?

Since our exploit relies on $USERVAR being interpreted as a string, it will fail as PHP intval() will discard everything in the variable from the first encountered non-integer onward. Thus malicious value of "5 or 1=1" becomes the number 5 again. There are a lot of places where this needs to be fixed and I haven't found them all yet. I'm working on a list that I plan to give to Francisco rather than have him try to keep track of me telling him about many individual ones and lose something along the way. Many nuke users have already fixed these themselves as well. There are other checks that need to be done for string variables, but I've already veered way too far offtopic.

I would be quite the selfish bastard to only fix the security holes for my use and no one else's. I'm glad you asked though. It never hurts to remind OSS users of their responsibilities should they touch the code. ;)

Re:did you fix it for yourself, or for everyone?

[Anonymous Coward]

You know what? To generalize, most coders on the PHP Planet are really sucky newbies and they don't care.

These sorts of exploits have been pointed out time and time again. There's been entire articles published attacking the coding style found in these apps and in other PHP example code. From what I've seen, the overall code quality of public PHP stuff is significantly worse than average ASP code -- and that's saying something.

If these people can't bother to clean the shit off their ass, other people shouldn't care either. What they should do is encourage service providers to not install this stuff as freebies for their customers.

Apologies to any professionals out there working on PHP.

Re:did you fix it for yourself, or for everyone?

[Anml4ixoye]

>Most of the exploits are simple SQL injection
>exploits, which affect all PHP/SQL code and not
>just Nuke

Actually, that affect just about any web language where developers trust inputted code.

I personally think that is one of the biggest challenges with the web. You have people who have had no formal training in programming, design, etc being able to build these complex applications. Often times the test cases don't take into effect anything other than the user doing what she is supposed to.

For example, we recently had to have quite a lengthy discussion at work about why Javascript should *not* be relied on to format user input code, nor can just Javascript and HTTP_REFERER. On the web, there is no such thing as client side validation, except as a nicety. If you aren't doing proper server-side validation, you're dead in the water.

One further note: if you are checking user authentication by the SELECT * FROM users WHERE username = $username and password = $password be sure to check that the password returned from the query matches that which was submitted. That foils quite a few injection attacks very simply.

Re:did you fix it for yourself, or for everyone?

[kazad]

There is also mysql_escape_string which can clean up quotes for you.

Re:did you fix it for yourself, or for everyone?

[Anonymous Coward]

When the variable is passed by an online form it will look like this:

I guess the solution is to not use PHP until the developers grab a clue..

I started writing non-CGI interactive apps in RXML.. which automaticaly escapes all varaibles - if you insert a variable into a page, the variable is automatically escaped, to prevent stuff like this..

It's possible to get unescaped variables, but you have to forcibly do it.. so the end result is that by default the code is secure, and the programmer has to make a concious choice to make it insecure..

I was appalled when I began learning PHP, and found that the default is true - that by default everything is insecure, and if you want it to be secure, you have to make a concious choice..

Re:did you fix it for yourself, or for everyone?

[schon]

that affect just about any web language where developers trust inputted code.

The developers of the language, or the developers of the app?

I personally think that is one of the biggest challenges with the web. You have people who have had no formal training in programming, design, etc being able to build these complex applications.

Again, are you talking about the developers of the app, or the PHP developers?

Not all web-based languages are insecure by default.. any good language will treat all data (whether from the user, or even the SQL DB) as untrusted, unless the developer explicitly requests the data in it's raw format.

Re:did you fix it for yourself, or for everyone?

[Permission Denied]

mysql_query("select * from USERS where USERID=$USERVAR");

If php-nuke contains lots of code like this, it should absolutely refuse to run if magic_quotes_gpc. is OFF. This setting will not, of course, protect against the problem you described, but if the code contains this kind of stuff, almost all SQL statements could do much nastier stuff.

Also, I hope php-nuke does not rely upon register_globals (your example makes it look like it does).

I'm looking for some kind of message board system similar to php-nuke, but it needs to be rock-solid since it will be running in a sensitive environment. I'm willing to write my own, but don't have lots of time so I might be hiring someone to do it (idea is that it's much easier to carefully audit 100% of the code if it follows my spec and contains only those features I need). This sounds like a trivial project to write, but as I spec it out, it ends up being a lot of code.

Anyone have any suggestions? It needs to be modular code as I will be ripping out and replacing chunks of it (logins will go to our LDAP server, groups and boards will come from our existing SQL databases), it does not need spurious features, it needs to look very polished and professional, but most importantly, it needs to be very careful, audited code. I would prefer php or python over perl.

Re:did you fix it for yourself, or for everyone?

[BrynM]

it should absolutely refuse to run if magic_quotes_gpc is OFF

I tried it and PHP-Nuke still ran. I even browsed a lot of my site. A good sign!

I hope php-nuke does not rely upon register_globals

It doesn't and I refuse to turn it on. I excluded the global call because I was in a hurry. I was at work. :)

Since PHP-Nuke is popular and GPL, there are a few PHP-Nuke derivatives that have been locked down pretty well. Start by looking at Nuke Fixes, Nuke Resources and Nuke Forums. The derivatives worth a look that I know of are:

• MyPHPNuke
• Postnuke
• Nuke Cops PHP-Nuke Enhanced Bundle

Some things to remember are that you should look at every bit of code for every *Nuke module that you intend to use or are using and that you should be your own worst cracker/hacker. Try to break in and run exploits yourself to see what they do before some k1ddi3 does. Also remember that PHP-Nuke is GPL, so share your changes (as was said earlier in this thread). I realize that you probably already know these things, but it's like a "Coffee May Be Hot" warning - You have to say it.

Sutistics

[Anonymous Coward]

Note also that the 'Unknown' category is rather high, and certainly contains at least some Linux systems, further increasing the percentage.

The 'Unknown' category probably contains all of the listed systems in much the same ratio as known systems. I don't see how that would change Linux percentage.

Same goes for Mac OS

[Pingsmoth]

Whenever a virus or worm creeps its way around the internet, my daily routines are pretty much unchanged. I don't worry about .exe files showing up that I don't know about, I don't worry about getting viruses in my email, and I often don't even worry about lots of pop-up ads. My girlfriend asks me about these viruses too, as she wants to know if her computer will be safe, and I always tell her the same thing: don't worry about it.

We both have Macs.

Traditionally, the Mac has had its share of viruses and trojan horses and everything else, but "its share" is way less than the Windows world. Market share alone tells us that only about 4% of computers out there are Macs. Simple math tells me (an English major, so correct me if I'm wrong) that there are 24 times as many people who code viruses for Windows than those who code them for Macs.

So, when these things go around, it's almost always for Windows. I do check up on the latest viruses and worms to make sure, but so far there has been no major attacks for the Mac.

What all this means is not that the Mac is any more or less secure than Windows, but that it is simply less popular. As is Linux. If Linux were on 96% of computers, there would be just as many, if not more, of these things going around than there currently are for Windows. The only reason my Mac is secure is because there aren't many of us out there compared to our Windows counterparts.

It is frustrating when Linux users (and Mac users too, though they aren't as militant about it) blather on about how insecure Windows is. To me it's almost a form of sour grapes. Microsoft has Linux outnumbered any way you slice it, so Linux users respond by pointing the finger when Windows users are bothered by these worms and such. I'd like to see what would happen if the positions were reversed.

Re:Same goes for Mac OS

[drfreak]

I'd like to see what would happen if the positions were reversed.

We'd probably have a lot more computers hacked, but I doubt the outcome would be as globally severe as an OS running on millions of computers with the same code base which nobody is allowed to audit. If Linux became more ubiquitous, more people would be around to audit the code. And since Linux is heavily modified by particular distributions, the likelihood of *everyone* running Linux getting hurt is much less likely. It's a win-win situation.

Security is as strong as its weakest link

[CHaN_316]

All the security precautions you take are rendered useless if the weakest link is broken. For example, if a script kiddy gets a root password via packet sniffing, dictionary password cracking, grabbing password off a sticky note on your computer, etc.. all your security is compromised because one link has failed. Notice that some of these weak links are not even dependent on operating system, it's human error.

Script kiddies also have a lot of sources of information these days for hacking the gibson. For example, all script kiddies would know that the most common passwords are god, sex, and love if they have seen the movie hackers. These great reference materials are turning script kiddies into hardcore black hats. Hollywood has captured the nature of hacking with suprising accuracy which can be used against us. IE wearing flashy clothes with rollerblades to hack while being highly mobile and trendy, using GUIs that simulate a computer system as a digital city, visualizing how a worm actually works. Scary.j/k

you got it all wrong...

[orpx]

its not about what system is most secure. its about which sys admin is most competant to setup their servers. It's pure stupidity how this starts becoming a red team, blue team situation.

Define "Linux"

[Twillerror]

Not to sound like RMS, but what exactly do we mean by is Linux more secure.

We really need to say is Linux, Samba, Apache, Mozzialla.....more secure then windows core ( which would include things like the DCOM exploit ), or SMB, IIS, and IE.....

The real question here is, can one company be as secure as the open source community.

This is a really complicated question. In one way you could say yes, because of the huge testing advantage an OS project has. This could also be turned to no if no one gives a fly f*ck about the project except its core developers and it doesn't get tested. Microsoft has a disadvantage about testing, but a much more real obligation to provide secure systems. Linux users like to boast, but windows has a very real financial obligation ( they are public ).

MS is going to get hit more, because they have more users, and the users they have are not always up to date or as intelligent. They also have a lot of people who blindly hate them. This is actually going to be to their advantage in a few years.

There are two very real problems with MS and the way they go about patches that I see, two problems that Linux is on top of.

1) most require a reboot.
If this wasn't the case, it would be perfectly okay to automatically patch. My production database server couldn't be patched right away because it needed the uptime ( I had 225 days before the damn blaster thing ) and we can't afford a cluster to switch over to while we upgrade. I tried every work around, but ultimately I had to patch and restart the thing at midnight on a Saturday. I'm sure on a linux box I could have fixed the exploit without bothering my database box. Or maybe I'd have to disable a feature while it happened.

2) Patches not very available.
I remember MS's site went down the day I was patching for the dcom exploit, because of a DDOS, but this is retarded with the web. They should affiliate with trusted providers like download.com to make sure you can get to these.

MS puts out some good products, sometimes they make stupid mistakes in design ( but sometimes so does the linux kernel ). The real advantage here is that Linux patches itself ( the community ) while MS seems to always have a security firm find there crap. There was absolutely no reason to have a buffer overflow in DCOM, none, zilch, zero. If it had been some weird or interesting exploit I would have felt something for them, but a buffer overrun, get your crap together.

The same goes for C/C++ linux guys. I'm suprised there hasn't be a security library standardized. Java guys can rest easy, at least for the buffer overruns, but there are plenty of ways to write an insure java app.

I think overall the response was good to blaster, but worms do have a real threat, but they utlimately the immune system of our computers ( their programmers ) will figure a way around.

short answer

[butane_bob2003]

Windows is just bad code for the most part, (not that we could see it, but you can always tell..) Linux is, for the most part, just better code, especially underneath where it counts. Its true, most linux users (and admins, hopefully) are more security savvy, but there is also the fact that it's much more difficult to run arbitrary code as root on a unix system. Getting root the dirty way in windows is much easier. If people are dumb and allow access to WU-FTP or something, of course they are going to get hacked.

It's a wash

[Black Perl]

If you look at the Netcraft survey of web servers, you'll find that about 66% are running Apache or Zeus.

Within the margin of error of the statistics, it's pretty much an even distribution of defacements across various OS's.

Something else to think about:

[Anonymous Coward]

> Species of Windows Programmer: Human
> Species of Linux Programmer : Human
> Chances of human error making it into the code: Equal

Ratio of Windows versus Linux Internet platforms: About 5:4

Ratio of IIS versus Apache Internet servers: About 2:5

Ratio of Windows/IIS versus Linux/Apache major real-life exploits: Over 10:1

Number of current unpatched IE security holes: 21

Possibility for the user to patch IE himself: 0

Conclusion: The biggest problem-causing factor is Microsoft.

Re:I think its the apes

[Pinky]

That is dangerous! There could be a hidden or obfuscated loophole. I, for one, never run any code that hasen't been written by myself while under polygraph examination. I keep my website running in a concrete block under the ocean and I keep all the clocks in my appartment running at different times, just in case my future self came back in time to try to sabotage my project. Every one should do it.

When I introduce someone to coding I chop off their hands and then hide them to be sure they won't code anything. New users think I'm paranoid and arrogent but I don't want any one of the mindless rabble to come and get me in middle of the night when the KGB hacks their site. :-)

All depends on the people...

[Kjella]

Most of those I know run Windows, but they are also rather tech-savvy and run it

a) patched
b) firewalled
c) with anti-virus scanner

And they're not bothered with any problems. Then we have this one guy I knows. He'd open and run anything and everything, gator, backorifice, subseven, irc worms, the works. No firewall, no anti-virus, not updating the OS.

Linux would do no better if people ran around as root all the time and would launch whatever was sent their way (because people would *want* it so that they can easily launch it).

Though I suppose Linux would score much higher on one group - those with one tech-savvy guy (read: the geek) and a bunch of non-tech users (read: mom, dad, imaginary gf, younger (or elder...) brothers and sisters etc.) At least unless they got tired of it and all want root access, that is.

Kjella

Linux mail clients

[pjrc]

Last time I checked, linux-based email software would not pass to the shell the contents of any attached file who's first line was "#!/bin/sh" when the user simply clicks on the icon/text that represents the attachment. Likewise for ELF and a.out format binaries.

I personally use Mozilla for email on linux (redhat 9), and as a simple test I sent myself an email with the /bin/ls binary attached. When I click on the attachment, I get a save dialog box which gives me the option to "open using an application" or "save this file to disk". There is no option to execute the code, let alone having such a dangerous choice be the default!

Continuing the test, I saved the file to /tmp, and Mozilla set the permissons to -rw-------, so in order to actually execute the contents of that file, I would need to use "chmod" (or the equivilant in a gui-based file manager) before it could be executed.

I have not tested with Evolution or other popular email clients. But if they are anything like Mozilla, where the user CAN NOT EASILY EXECUTE ATTACHMENTS and all attachment files are SAVED WITHOUT EXECUTE PERMISSION, I think it's safe to say the linux-based systems are much more resiliant to email-based virus code.

Of course, Microsoft Windows could have been made similarily secure if Microsoft (and others) had taken these simple measures. Well, at least not allowing executable code to be executed with a single click of the attachment. It's been many years since the first MS executable virus code and it's a continuing problem. When with email client software on the Windows platform finally reform to disallow easily executing attachments ??

Even if that were the case, to equal the level of protection the Mozilla/linux has by default, windows would need to implement execute permission (does it have this feature, even if it's never used to disallow execution?). Then the software would need to save all attachements without permission to execute them.

This exists today on Linux with popular email clients. Until Microsoft and others take these exrteemly simply precautions to prevent casual users from easily executing attachments.... or creates of Linux-based email clients make these incredibly unwise design decisions to allow easy execution and turn on execution permsission by default on saved files, I believe it's safe to say that Linux systems are much more secure than Mircosoft windows based PCs, in terms of propagting email attachment virus code.

Re:Linux mail clients

[ratfynk]

"Of course, Microsoft Windows could have been made similarily secure if Microsoft (and others) had taken these simple measures. Well, at least not allowing executable code to be executed with a single click of the attachment. It's been many years since the first MS executable virus code and it's a continuing problem. When with email client software on the Windows platform finally reform to disallow easily executing attachments ??"

Simple when they finish the pay off to Symantec for the patented disk and system tools that they stole. Longhorn will fix this problem because the user will only be able to run certified Inet code in user mode. So the virus will need to have a valid certificate to get past the security. No more security head aches just easy provider control of content use! Right..and the Pope smokes crack!

Comment removed

[account_deleted]

Comment removed based on user account deletion

I think the issue is obvious...

[chocolatetrumpet]

It is clearly the duty of the users to serve the computers. Users exist only for the computers' benefit.

And if whatever I want to happen takes longer than I'd like, it better be a damn pleasant experience along the way!

Thou art 'root'.

[The Monster]

configured the systems so that all of the users did log in as root.

I work tech support for a software company that formerly handled distribution and support through a network of VARs, which we have since acquired. Some of them decided that the best way to resolve permission problems under Unix

(the overwhelming majority of our sites use an OS by an infamous three-letter company that's sued another three-letter company and told them they can't sell their own, allegedly 'derivative' three-letter *IX product, which in turn is used by our largest customers, but I shan't name names.)

is to edit /etc/passwd so that every user is user 0.

So, even though the standard Unix security model offers more protection than the Windows 3.x/9x lineage, you can still pull an XP Home (where by default every user is an Administrator) if you work at it.

In addition

[phorm]

I'm not so sure. There are lots of those savvy and knowledgable people on Windows, just as there are lots of "k3wl, I'm so 1337 d00d, because I run Linux and not M$ Winblows" amateurs out there

These same users are the ones who end up configuring their webserver with passwords such as "god" or "admin." A secure O/S is fine and dandy, but it doesn't help all that much against the same general stupidity that afflicts windows and linux users alike. How many servers are defaced because they're either very behind on security, or simply easy to get into?

Not only that, but we have a lot of people who don't know as much about security as we would like. I personally don't know as much as I'd like. How many admins who know how to configure httpd.conf for apache are good at plugging with iptables?

At work, any sensitive online-based sites are restricted to a certain port, and allowed only from local addresses. Yes, by IP-spoofing they could avoid that, but at least it's an extra level of security. How many people bother with this? A lot can be done at the firewalling level, before any attack even gets near your daemons...

Re:In addition

[arfonrg]

These same users are the ones who end up configuring their webserver with passwords such as "god" or "admin."

Crap! How'd did you guess my username AND password!?!

Re:In addition

[Zeromous]

These same users are the ones who end up configuring their webserver with passwords such as "god" or "admin." A secure O/S is fine and dandy, but it doesn't help all that much against the same general stupidity that afflicts windows and linux users alike. How many servers are defaced because they're either very behind on security, or simply easy to get into?

You can mod this down as a troll if you like but let's face something here:

So long as the linux crowd holds on to generalizations such as this, the linux crowd shall remain easily marginalized.

Re:In addition

[cbreaker]

I agree.

Any generalizations are bad, no matter what you're talking about.

I hate to see all these linux fanboys. Get off it. I want Linux to survive and thrive and become the desktop everyone uses because I like it, I like the idea of it, and I like the fact that it can be made very complex and very simple. The more people that use it, the more cool software will be made. Not because I'm anti-MS, not because I'm an uber geek, and not because I consider Open Source a religion.

Sigh. I guess it comes with the territory. But really, there's some fairly intelligent people out there that act like blind fools when it comes to Windows, or flaws in Linux, or whatever.

Re:In addition

[holzp]

well, hell, you have to start somewhere. When i first installed linux in college it was a stock install from red hat, i did not know shit about linux or unix, and wanted to learn. someone 0wn3d me three days later (thanks sendmail!). everyone was an amateur once...

Re:In addition

[submergent vegetatio]

I have to agree with this. It does not matter how secure the OS is if the admin is just plain stupid or ignorant.

Two years ago I took an art director position at a small manufacturing company. The network admin was a complete idiot. Of the 25 users on the network, nine used the company name as their login password, four used a portion of the company name, five used their first name, two used one of their children's name, two used their dog's name, two used their birthday and only one person had enough sense to use a nonsensical letter/number combination.

The password to the hosted web site, e-mail server and the network firewall was the company name. And, this is the kicker, the network admin's password to the server was her dog's name. After realizing what a severe security breach this was (and being told that since I used a toy computer -- a Macintosh -- and as such didn't know anything about computers) I struck up a conversation with the network admin about her likes/hobbies/family. 30 minutes later, armed with several possible passwords, I successfully gained access to the server and locked her out.

Re:In addition

[phorm]

Sendmail is the devil. Running debian on my servers, I tend to feel reasonably secure. A bit out-of-date to be sure, but reasonably secure nontheless.

I have no illusions that my systems are 100% uber-hacker-proof. In fact, I'm aware of a few ways that a hacker could obtain, say, a user password - but it's a choice between convenience (not necessarily for myself, but for the users) and security.

Redhat is a good distro to get started on, and many of us (including myself) started on it. I wouldn't recommend it on commercial systems, but much of that is personal preferences.
I think my primary beef with RH is that people seem to assume that Linux IS RedHat, with drivers/etc often being only available as RPM's of a closed-source solution. Linux is very much about open source, and in an optimal world drivers would be source-available so that they could be matched to any distro. People have started distro holy wars over less, so I'm not going to get into it, but in my mind RH has always been better as a desktop distro (until I found morphix/knoppix).

But it's all about stepping stones. As an email forwarded to me once stated: You start out with something like RedHat, then you maybe go a bit more trimmed like Deb. Eventually you go to a distro where you make your system from the kernel up. By the time you get to the stage of creating your own distro... you end up realizing that it will be a very very long time before you ever get laid again, if ever!

The worst are not those who screw up, it's those who don't listen to words of wisdom, or learn from their mistakes. You get those no matter what OS/distro you use

Re:In addition

[holzp]

actually in the time since ive moved to FreeBSD ;)

Re:In addition

[Boiled Frog]

Any generalizations are bad, no matter what you're talking about.

Including that one?

Re:In addition

[cbreaker]

Indeed. Some are worse then others.

Fewer is a good strategy

[exp(pi*sqrt(163))]

Why do so many organisms reproduce sexually? They're shuffling their genes around meaning that each generation has variety. If a virus attacks chances are some members of any generation will have the genes required for surviving it. What is fatal is to have a monoculture. If the wrong virus hits everything is wiped out.

Here's the important point: given any organism there's a virus that'll defeat it. So the strategy is to ensure that your offspring have variety.

Unfortunately what we have in the computing world is something of a monoculture. Everyone (OK, I exaggerate, but only slightly) runs Windows and everyone is at risk from the same viruses. And when those viruses hit everyone is taken out.

If people valued security, and chose an OS with a smaller user base as a strategy to deal with security, we'd have that variety and we'd all be much better off.

It's funny. When A says "I use Linux and don't get any viruses" and B repsonds "that's because so few people use Linux" B is failing to see that that's actually a perfectly good reason to choose Linux.

Re:Fewer is a good strategy

[seanadams.com]

Even organisms which reproduce asexually can mutate. Witness the /. crowd!

Re:Fewer is a good strategy

[Anonymous Coward]

Yeah but then writing software for the varietal culture turns into the same kind of job that designing clothes for the masses is...

You have different styles, body types, sizes, etc. With clothes its easy - same basic design, retool the knitting lines.

Unfortunately, software is a bit more complex than clothing.

Re:Fewer is a good strategy

[Bueller_007]

It's funny. When A says "I use Linux and don't get any viruses" and B repsonds "that's because so few people use Linux" B is failing to see that that's actually a perfectly good reason to choose Linux.
And apparently, you're failing to see that it's also a perfectly good reason NOT to choose Linux. The smaller user base is exactly what scares many people off, because the applications that they know and love (or are at least accustomed to) are available for Windows. Yes, there are substitutions available for Linux, but it's not the same.

Re:Fewer is a good strategy

[Anonymous Coward]

yeah, windows is a monoculture.. ever tried moving a disk between machines (the boot disk of course)? well on two *identical* (afaik) machines (both compaqs, exactly same model, etc., *everything*) w98se needs about 3 reboots to sort the drivers out.

call that a monoculture ;>

(btw, i *do* understand your point and agree ;)

Reply: Maybe Stat-Lie ...?

[OldHawk777]

Is that 61% a stat-lie?

If there are significant more Apache websites compared to MS-Win websites on the internet, and the numerical coefficients of the variables used in the equations were not weighted appropriately, then a condition (of at least) co-variation was not taken into account ... the interpretation of 61% is in error.
Also, novice websites (Apache, MS-Win, ...) are frequently defaceable. I believe, due to the obvious (cost for a Linux+Apache+Skill+Daring) already stated by others, means that the most easily defaced website are in fact probably "Linux+Apache", but also the best most secure website because of the open-community+collaboration+... implies (for me) "Linux+Apache" makes the best websites for business and government.

So, I suspect stat-lie. However, I ain't done any major data crunching with FORTRAN and arrays in almost as many years as serious code.

OldHawk777

Reality is a self-induced hallucination.

Re:Reply: Maybe Stat-Lie ...?

[KrispyKringle]

I know a small amount about statistics, but I'm not familiar with that terminology.

Regardless, I don't think the explanation is anywhere near as simple as there being more Apache websites on the Internet (there aren't more Linux/Apache sites, but there are more Apache, I believe). After all, the number of factors in getting defaced is pretty high. Linux boxes may be numerically more common, but not as common on high-profile machines likely to be hacked. Or the average experience of the admins may differ, as we discussed above. Or Windows machines may be targeted for social or political reasons, as described above (or the opposite; isn't it more fun to brag of hacking an OpenBSD box than some luser's home PC running IIS?). You get the idea.

So I don't think real-world statistics can be accurately interpreted to give any relevent data. We could probably get closer, of course, with stats on things like the number of security vulnerabilitys discovered in a month, mean time between discloser and bugfix, etc. Because when you evaluate a product for security, you don't want to be learning stats about the average experience of the admins who use it. You want to know the actual facts on the product itself, since the experience of the admin is, presumably, not something that changes in relation to which server you buy--this is assuming, of course, that you are the admin (and you should of course choose that with which you are most familiar).

I suppose controlled tests with admins of the same experience and attackers of the same experience could be valuable, but what metric do you use for the experience levels on IIS/Windows and Apache/Linux?

Anyway, you get the picture. I think, unfortunately, that there is little way to get any accurate results from these statistics, and your best bet is just to do a lot of reading, a lot of research, and make decisions based on your own particular situation.

Re:Reply: Maybe Stat-Lie ...?

[Anonymous Coward]

Reality is a self-induced hallucination.

Are you sure? Maybe you're just hallucinating that it is?

Ah... The popularity of skepticism despite its blatant logical inconsistencies never ceases to amaze me.

One more thing

[ThyTurkeyIsDone]

There is one more aspect to this problem which I think doesn't get mentioned as often as it should be - Windows is a lock-in (or lock-out, depending on your perspective) platform, and Microsoft's own apps for it are also designed to tie you to that platform. So yes, it may be that in 2010, 65% of the great unwashed will be running their shiny new LindowsOS 2010 as root and get the same amount of viruses as today... but I won't have to give a sh*t about it, because I will be able to run FreeBSD, or the Hurd, or OpenBeOS or whatever the heck I want. Without pressure. Without people telling me "Sorry, we only support this OS / browser / office file format, because 95% of the world uses it anyway. Why don't you just run [insert expletive here] like everybody else?"

Once an open-standards platform gets into the mainstream, anybody who runs the exact same software as Joe Blow will have only themselves to blame. Anybody who actually cares about security or any other IT-related issue will be able to avoid the mainstream if they wish to do so.

Sorry for the rant. I just had to get this off my chest.

The very first Internet Worm

[drfreak]

was written for Unix. I hope people don't forget that, but I doubt they will. The difference is most Unix people care about reliability and most people from the Microsoft camp relish viruses becuse the truth of the matter is tech support revenue is much greater than the cost of Windows.

Simple probability

[noda132]

There are some stats (look for the pretty pie charts) which can help explain the percentage, along with a few key thoughts and speculations:

• Most web sites run Linux.
• Linux boxes cause so little fuss it's easy to forget they're there (for better or for worse, most distributions, especially older ones, are very content to leave you alone). I've never run across a Windows server that didn't ask for personal attention at least once every hundred days.
• Website defacement is often a direct act, not a simple script which happens to take down a site. All operating systems being equal, a cracker would pick sites at random and crack them; Linux would get cracked more than any operating system, assuming the cracker is great.
• In any operating system, the security is only as tight as the administrator makes it. Well-secured servers are VERY hard to come by.
• A website defacement is not a remote root. It could be a simple cross-site scripting bug in some CGI/PHP/Perl code, which is not the fault of the operating system.

Re:Simple probability

[Pvt_Waldo]

You make a telling comment when you say "it's easy to forget they're there". What this translates into is many Linux boxes that remain unpatched because people forget they are there.

That's the real statistic we need to answer the question. What percentage of Linux boxes are unpatched and out of date?

It's not that hard to update

[anourkey]

People just don't take the age old adage of "An ounce of prevention is worth a pound of cure"
Most people are just too busy to apply the patches. I admit that I got hit with Blaster, but only because I had other priorities.
Windows XP has automatic updates, if you don't like to use it, then MS provides a nice little link to the Windows update site on the Start Menu.
If you're a Debian flavored Linux fan, "sudo apt-get update" works easily and well and runs nicely in the background. If you want it to be automatic, stay with stable and put it in the cron.
Of course I saved the best for last. For the Mac lovers out there, System Preferences > Software Update is two clicks away, and for most people it is already automatically set for a weekly update.
That's just my $0.02. Now if I could only get away form /. and go patch my 'puter.

Cause: M$ Attitude to their products.

[kosmosik]

Thats Simple: In GNU/Linux most of things concerning security are done beacouse they'r needed. F.E. Some code can be possibbly buggy, so a bunch of people/firms/institutions/whatever before they start using this given software, they make an audit of code, and any posibble holes are fixed etc. Most of cracker attacks compromising Linux are related with simply people not installing patches or buggy not updatet OS scripts running their websites etc. Windows also could be fixed but M$ won't fix it! Beacouse they don't want to. Beacouse this would break compatibility (which still tends to be more important to them than security issues) etc. I'am talking about those holes in MSOE, MSOffice that existed long time and still aren't fixed etc. these holes/dangers are still there!!! Next thing is about updates. Windows is harder to maintain. Still nobody wan't to install tons of single, so called "patches" beacouse they may make the system unusable (Yes! they may do that!) or this is just uncomfortable to instal 100 patches. So people think "If it works - leave it as is... Till it works". Still M$ delays SP2 (so called "cummulative patch") for Windows XP due to "unknown reasons" etc. - this is riddiculus! Vendors WANT cumulative patches so they can sell a system patched OOTB. So do users - users WANT cumulative patches so they can patch their system easly etc. M$ is talking bullshitt about their Trusthworthly Computing bla bla but these are just words - security means that you must drop some compatibility issues and user friendly features due to have a more secure system. F.E. make Windows work nicely without running everything on an super-user "Administrator" account. PS. Sorry for my English - I'am not native English speaker.

You *need* to get out and about more

[leonbrooks]

I've never met anybody who was smart enough to write a good virus and simultaneously preferred using Microsoft Windows as his/her desktop OS.

I can introduce you to at least four. One of them writes anti-trojan software for his living.

Wowzers!

[rsm00th]

That Zone-h place is reporting 404% linux break in rate!!!... oh, wait...

My Red Hat 7.2 system got hit with one ...

[Anonymous Coward]

... a few years ago. Based on a writeup I found on the SANS site, I think they came in through an un-updated lprng. I lucked out in several ways and was able to stop it and get rid of it.

It was basically no different from the Windows worms making their way around that scan the net for victim machines.

I now run behind two firewalls (a hardware firewall and the built-in Linux firewall).

Linux can slow the bad guys down and can block some kinds of attacks, but it is just as vulnerable as anything else to sophisticated attacks.

root access

[rumo]

The idea of having a userid (root) which is exempt from all security checks is a clear indication, that UNIX was not designed with security in mind. Secondy it is not so long ago, when all UNIX administrators wanted us make believe, the r-commands ARE secure. So why would we use ssh then in the first place ?

MS users hate MS

[solprovider]

there are a ton of anti-Microsoft people out there who would love to see Microsoft go down in flames

Because they are forced to use MS products. Most people do not have strong feelings about stuff they have not personally encountered.

While I would never go so far as to say that Linux people purposely write virii to take down Microsoft, I certainly wouldn't say that Microsoft users are the guys writing virii to take down Windows Update.

The script-kiddie viruses require MSWindows to write, or at least test, the virus. Linux users have already escaped; why would they worry about MS? It is the MS users that write viruses to hurt MS.

I also like the theory that the MSBlast virus was written by MS. The primary purpose behind that virus was to annoy all the users enough to patch their systems.
- It also required every unpatched MSWindows PC to report itself to MS. MS might be able to use that information.
- The virus also seems to have been poorly written. MS may not have the monopoly on bad programmers, but they definitely have the largest concentration of them.

Anybody who wanted to cause real damage would write a virus that spends 24 hours spreading itself, and then silently wipes the "drives" starting at Z: and working backwords to C:. That would cause a few heart attacks in the corporate world. It would also force the world to switch away from MS. The MSBlast virus was just a warning shot, and I doubt it was written by someone who actually wants to harm MS.

I've never met anybody who was smart enough to write a good virus and simultaneously preferred using Microsoft Windows as his/her desktop OS.

With scripting kits, brains are not a requirement for writing a virus. See the stories about the virus writers who have been caught; none were particularly smart. (OK, they were CAUGHT, so the sample assumes some incompetence.)

Very few people prefer MSWindows; most people do not know there was a choice.

---
The Linux community wants to succeed by demonstrating that the community development process develops better code and applications than hidden proprietary code can produce. MS's security holes are a demonstration that their development process has severe faults. Linux and OpenOffice should remove MS's revenues very soon, and then MS will fall. We want to win fair.

Re:MS users hate MS

[YellowElectricRat]

The virus also seems to have been poorly written. MS may not have the monopoly on bad programmers, but they definitely have the largest concentration of them

This is one of the most ridiculous statements I have ever read. Do you have any idea how difficult and competitive it is to get a programming position at Microsoft? Whether you like to believe it or not, Microsoft has some of the best programmers in the world - it also has some of the most rushed programmers in the world, and some not so great QA. Even the very best programmers don't often get their code perfect the first time around, and if a problem with some MS code is not picked up by MS's testers and QA people, it doesn't get fixed.

Idiot Lunix zealots.

Re:MS users hate MS

[Anonymous Coward]

Whether you like to believe it or not, Microsoft has some of the best programmers in the world...

I believe the point was that the MS OS has a large concentration of bad programmers, not MS the company.

incontinent MS apologists.

Re:MS users hate MS

[shaitand]

I've worked for many fortune 500 companies if not microsoft. It's generally harder to get a job at a small business. At the small business you actually have to show you know something, you have to impress it and then show it to keep the job.

At a fortune 500 you have to go through a reem of warnings that reset before they run out and you can know lots of technospeak without knowing how to write a proper line of code and STILL keep the job.

Re:MS users hate MS

[Anonymous Coward]

Do you have any idea how difficult and competitive it is to get a programming position at Microsoft?


Why is that? Is it cause they want to make lots of money or because they're really good?

There seem to be a lot of really great programmers *OUTSIDE* of Microsoft. Curiously enough many of them write open source software and would never want a job at Microsoft.

There are major design flaws in .NET (like the collection classes) and I can't understand how they managed to get into a shipping product after passing so many highly qualified eyes. It must be really foggy up there in the north west.

I'm not trying to say that Microsoft doesn't have some great programmers (Dave Cutler, Tony Hoare etc are lengends) but equating the amount of competition to the quality of the employees is foolish.

Re:MS users hate MS

[PeteQC]

- It also required every unpatched MSWindows PC to report itself to MS. MS might be able to use that information.

I don't think so, since you can download the patch without going on WindowsUpdate, it's available at http://support.microsoft.com/default.aspx?scid=kb; en-us;823980

Re:MS users hate MS

[Anonymous Coward]

No shit microsoft has a lot of good programmers, look how huge they are. But have you ever seen the APIs for many of the libraries that MS has released? A good bulk of them (especially now days, since they mostly use COM style programming) are complete garbage, it doesn't even look like they were thought out very well. Take DirectX for example. Every new release brings a completely different API to the table (they're at version 9 now). OpenGL code written 10 years ago will still work when OpenGL 2.0 shows up.

I'd also like to mention that it is hard to get a programming position at MS because the HR department there is run by morons. A lot of the people that are there are there because they knew somebody that worked there that could bypass HR.

Re:MS users hate MS

[Geek of Tech]

Idiot Lunix zealots

Lunix? Is that like a mixture of Luna and Linux? Where can I download Lunix?!

Re:MS users hate MS

[aldousd666]

You're right, it was only a warning shot. A for Effort, F for payload. They had 'root' on every single unpatched host out there, and all they did was spread the worm. That could have been much worse. Someone who really wanted to take out microsoft systems could have easily come up with something more destructive.

Re:MS users hate MS

[The Phantom Buffalo]

It's an OS for the C64.

You can get it here.

But, I can't believe there are that many Lunix zealots.

Re:MS users hate MS

[1lus10n]

if microsoft has some of the world's top programmers then perhaps they should have them teach the other morons how to code correctly.

every single issue they have comes back to thier own incompotence, from making a shitty unstable piece of crap that made many people hate them, to intertwining the OS with a web browser and email client. it is their own doing, and that in and of itself proves that they dont have any good coders. and if they do i would like to know what the hell they do everyday.

stupid cash-whore microsoft zealots.

Re:MS users hate MS

[Anonymous Coward]

Do you have any idea how difficult and competitive it is to get a programming position at Microsoft?

Yeah, you simply have to be from India and work for $2 per hour.

I'd sign this but I'd lose my job.

Re:MS users hate MS

[zcat_NZ]

While I would never go so far as to say that Linux people purposely write virii to take down Microsoft, I certainly wouldn't say that Microsoft users are the guys writing virii to take down Windows Update.

I also like the theory that the MSBlast virus was written by MS. The primary purpose behind that virus was to annoy all the users enough to patch their systems.
- It also required every unpatched MSWindows PC to report itself to MS. MS might be able to use that information.

In support of this theory; blaster didn't attack windowsupdate.microsoft.com, and Microsoft didn't 'switch' sites around as most slashdotters seem to believe. windowsupdate.microsoft.com is the address coded into a clean install of Windows98.

windowsupdate.com was a simple redirect, and was most likely registered because it's an obvious typo.. microsoft probably didn't want it to get registered as a porn site like whitehouse.com.

windowsupdate.com also happened to be on a completely different subnet from the rest of Microsoft's stuff, so there was little danger of the blaster worm affecting any of Microsoft's 'real' websites.

However the theory falls apart at this point. Microsoft removed the DNS entries and took down windowsupdate.com before the worm went live.

Re:MS users hate MS

[Anonymous Coward]

If Blaster was done by MS, then they would have targeted win9x, or even better, everything except XP. All versions of windows had the flaw, and MS is trying to get people to upgrade to the newer versions. Instead, Blaster targted only Win2k and XP.

Re:MS users hate MS

[llzackll]

Dude. DirectX is completely backward compatible too. Apps written with DirectX 2.0 still run with DirectX 9. You can also still write code targeted for older versions of DirectX with the DX9 SDK.

Re:MS users hate MS

[Jens]

"Anybody who wanted to cause real damage would write a virus that spends 24 hours spreading itself, and then silently wipes the "drives" starting at Z: and working backwords to C:. That would cause a few heart attacks in the corporate world. It would also force the world to switch away from MS. The MSBlast virus was just a warning shot, and I doubt it was written by someone who actually wants to harm MS."

That's not so easy. KLEZ did that already. Other variants searched your network and infected MP3 files and MS Office files, everything that was writeable.

Many companies are not going to switch because they are locked in. They have three or four years worth of expertise, invested hundreds of thousands of dollars in applications, and their users are used to Windows. No matter how often it breaks (and most people assume it's "normal" for a computer network to totally crash once a week at least), they will continue to use this stuff, until

• their killer apps are available for other platforms (which often not only means groupware, but also specialized apps for niche markets)
• somebody bribes the descision maker more than MS does.

And that last point is VERY hard. In 1999, the administration of Schleswig-Holstein (North Germany) published they wanted to update their systems and a consulting company did the math for them:

Upgrade to Linux: ?300'000 in education, ?10'000 in licenses
Upgrade to Windows: ?200'000 in education, ?200'000 in licenses, ?400'000 in necessary hardware upgrades

The ?10'000 for Linux was for commercial products (I think databases) which eased the switch, and support by SuSE. Education was mostly needed for the admins. The users were desktop users that only needed their "office" and "email" and "browser" buttons and not much more.

Of course, they decided for Linux (provided by IBM and SuSE). Only, very strangely, a Microsoft representative visited them shortly after this descision was made. And half a year later they suddenly had switched to Windows 2000 and nobody had noticed. Another couple months later, the Schleswig-Holstein IT representative - the guy who had decided for Windows despite the horrendous costs - unexpectedly left the facilities.

Business works with money. And if you cannot convince somebody with a better product, you can often convince them with bribery - and you don't even need to call it that. Rumour has it that Intel (or was it Compaq?) only accepted the "early adopter program" for Windows 2003 for their publicly visible servers because Microsoft agreed to pay all their hardware upgrades AND the admins.

Another important point is that Windows users are "used to things not working". At my GF's house there are altogether 12 PCs and laptops (and two Macs) wirelessly LAN'ed together with an Airport router. The router is a WIn98 machine with some kind of LAN software. IT crashes about thrice a day. I wanted to put fli4l on it and show Linux to my GF, but she doesn't want it - yet, because she doesn't know what to do if things break. Rebooting XP a couple times a day and reinstalling printer drivers because XP forgets them maybe once a week is apparently "normal" for her, and I don't blame her, that seems to be the accepted procedure with computers for many people.

Re:MS users hate MS

[smeenz]

my two cents worth:

1. Not entirely backwards compatible. 3DMark2001, for example, complains that it requires directx 8.1 or better and quits if DX 9 is installed.

2. Try obtaining any version of directx other than the latest one, or if you were lucky enough to have kept an old installer, try downgrading directx.

Re:MS users hate MS

[n3k5]

With scripting kits, brains are not a requirement for writing a virus.

Your parent poster talked about a good virus. Of a good virus, I'd expect it to get past recently updated virus scanners at least in the first week of it's existance, instead of only compromising insecure boxes. You can't do that with a scripting kit (maybe unless you're the first user of this kit who releases his creation into the wild).

Re:MS users hate MS

[jonnyfivealive]

Idiot Lunix zealots.

i was with you right up until there. your whole post made perfect sense and i agreed exactly until you made taht incredibly stupid statement.

idiot windows zealots.

Linux is fake anyway

[satyap]

Doesn't matter, according to this guy Linux is a fake OS anyway:
http://www.df-21.net/ubb/Forum1/HTML/0025 27.html

Astroturfer.

[Anonymous Coward]

Astroturfing weenie. Go back to Redmond.

In webserver-land, it *is* reversed

[leonbrooks]

Microsoft IS the biggie out there, and Linux isn't, but we all [...] would like to see that reversed?

There are twice as many Apache sites as IIS sites, so one would expect to see twice as many Apache defacements if they were attacked equally often and defended equally well.

IRL, the Apache machines will more often be doing multiple duties (e.g. Internet gateway, email server), further skewing the results against themselves because there are simply more services to break into on those machines.

If I was a selfish, destructive little cracker, I'd be breaking into Linux boxes simply because they're more useful than a corresponding MS-Windows box once you 0\/\/|\|3rZ them.. A lot more stuff will install off-the-shelf in scripted fashion, or already be installed.

Re:In webserver-land, it *is* reversed

[Martin Blank]

A lot more stuff will install off-the-shelf in scripted fashion, or already be installed.

And this is one of the major security problems.

In my last job, I was a bit of a security hawk, particularly on the Win2K boxes. I managed to get procedures in place to remove all of the selectable modules during installation, and then disable unnecessary services (like RPC on some boxes) and features (like the POSIX subsystem). I wish I could have removed OE, but since it was never configured with a server through which it could send, I wasn't too bothered by it. The Unix guys would configure our Solaris boxes by adding in a lot of things "just in case", even to webservers. I never questioned them on it, since I figured they knew better, but something always rubbed me the wrong way on it.

Some *nix distributions can be just as bad as Windows in installing unneeded items, and some people are even worse about throwing in more. Extra code means extra room for bugs on any software.

Re:In webserver-land, it *is* reversed

[Tony-A]

In my last job, I was a bit of a security hawk

Try this for size.
Install Linux, install everything, "just in case".
Watch security stuff. Disable, uninstall, workaround anything that comes up.
See how long you can go without patching or updating anything.

Now try it with Windows.

Re:In webserver-land, it *is* reversed

[Reziac]

A while back I tripped over a bunch of rootkit archives. As I recall, there were a lot more of 'em for *NIX than for Windows. Dunno if that's an indication of "one easy route into WinBoxen" or "lots more ways to crack *NIX boxes". But the fact that these rootkits exist should be a warning in itself.

the difference is...

[penguin7of9]

You can screw up security on any system, Windows, Linux, Solaris, whatever.

The difference between Windows and Linux is that on Linux, you actually have a chance of getting it right if you know what you are doing. In part, that is because you can really get rid of pretty much every network service and piece of software on a Linux system except for what you actually want to run. In part, that is because you can actually look at the source to figure out how something works.

Comparing apples and oranges...

[jafo]

Using the number of web-site defacements probably isn't a very good metric of how secure an OS is. Windows runs more desktops where Linux runs more servers (as a vast generalization). Also, compromising a server running virtual hosting for 200 clients may count as 200 sites defaced due to one insecure server. You get the idea.

The reason Windows gets so much scorn about security is that it has this whole class of security issues that are much less an issue under Linux. Linux people don't tend to send around binaries for people to execute. In Windows it's very common to send executable attachments, but they implemented that while shunning safe ways of doing it.

For example, if Microsoft hadn't scorned Java, in favor of their in-house technology which has huge security issues, they could have been using sandboxes to limit the access this arbitrary code has to your system.

All systems have problems if you don't regularly update the software. There are things that can help that, but in general I think it's safe to assume that all systems need to be regularly updated to be secure.

There are a whole different class of problems that Windows seems to suffer from, which Microsoft hasn't really addressed. Obivously, they need to.

Sean

Major flaw in logic everyone seems to suffer

[fzammett]

There is this common problem with so many people's thought pattern that goes something like this...

Most Windows users are clueless and that's the main reason Windows virii and worms are so prevalent.

Or perhaps something like...

If people that use computers would simply learn just a little bit about their systems, they could avoid most problems.

The problem here, and this is a problem in general that the Linux community, and the open-source community as a whole to some extent, suffer from, is that they have a problem with how easy Microsoft has made computer use (relatively speaking).

Think about how difficult, relatively speaking, it used to be to drive a car. There was a time when automatic transmissions didn't exist. Even before then there were how many different controls that you had to manipulate?

No one complains thar cars have gotten easier to use, and more accessible to the masses. And no one seems to complain that it's now easier to run someone over because you aren't going to stall the car by slipping of the clutch.

Computers are becoming a commodotized appliance largely because of Microsoft. I hate this as much as the next guy, and I can readily admit why: for most of my life working with computers, I've frankly been flat out superior to most of the people around me in my knowledge and expertise. I was special.

That isn't the case any more, and for all but a very select few in the world, isn't true for very many at all.

But, the number of AVERAGE users has risen dramatically. Is this a good thing?

Depends on which day you ask me :)

But it IS a fact, and it's also a fact that the majority of people in the world WANT THAT TREND TO CONTINUE. Part of the cost of that trend is security because security by it's very nature demands a certain level of expertise.

If you pick a fight with an accomplished martial artist, you only stand a chance either (a) having a big gun and using it before you get hammered, or (b) have a similar skillset to combat him with. Same with security. You can't expect mom & pop to have that level of exertise required to do security right.

But, mom & pop want to use a computer. They don't WANT to develop that skillset. THEY ARE THE MAJORITY.

Microsoft realizes this, and they cater to that desire, and they obviously do so more successfully than anyone else does. The Linux community by contrast may know better when it comes to security, among other things, but the majority simply do not care.

So, the minority position continues to fight the good fight, but in the end, as is the case with most minority groups, the will of the majority will win out, whehter the human race is bettered because of it or not is irrelevant. This is a sad observation of our world, but it also happens to be accurate.

What is my point after the rambling, pointless post? Very simple:

The world is the way it is because most people want it to be that way (or are weak and allow it to become that way, the effect is the same so the result hardly matters). Microsoft is a success despite the problems they unleash on the world because most people view the benefits of their products as outweighing the negatives. Simple as that.

The sooner the Linux community comes to that realization and stops trying to convince the world they are right (which they probably are, but that doesn't matter), the sooner they stand a chance. Understand, the progress we've seen Linux make against Windows isn't really important, because in the end, the majority does not WANT Linux to win.

They are happy with the status quo, and that's that.

Sorry to hit you with a realism bomb, but there it is.

Re:Major flaw in logic everyone seems to suffer

[Mooncaller]

Sorry but your reasoning is all wet. All you have done is reiterate the History Of the Desktop according to Bill Gates. People want what MS tells them they want.

Re:Major flaw in logic everyone seems to suffer

[fzammett]

Ummm... uhhh... what?!?

Microsoft got where they are today because until very recently, there really was no viable alternative.

Don't try and say Mac was an option... Until OS X it was always behind technologically.

Don't try and tell me OS/2 because it suffered the same problem Linux still does, which is it's overly complex for most users.

So, the best option didn't float to the top, the ONLY option floated to the top. Not exactly a ringing endorsement I admit, but it does describe reality.

Now, we could get into how they KEEP the dominant position, but that's a whole other post.

Re:Major flaw in logic everyone seems to suffer

[Mooncaller]

Sorry, your wrong on both points.

No, but

[Cyno]

I bet we could run into the same problems with Linux today if it was as widely deployed as Windows. But that's not even a possibility.

The question is not if Linux is as secure as we think it is, but if the people developing the technology would be willing to step up and make it secure if faults were found. Or would they sit on severe security warnings and attempt to brush them under the table, avoid bad PR and include the patches in the next service pack.

I think with the NSA's security patches being included in the 2.6 kernel along with our collective efforts to build a reputation of security, stability and compatibility with Linux there's nothing really left to worry about.

Open Source...

[MoeMoe]

Could there be a Linux 'Blaster' just waiting to happen?

Yes, there could be... But in case you forgot, WE CAN FIX IT!! (without having to wait for some lazy, rich programmers to make a patch). That's the point of open-source... If there is an exploit, WE WILL ALL KNOW WHY, and WE can find a way to fix it. The Linux community as a whole is far superior to those guys working for MS and half as lazy (provided we have our caffeine)... Though we all wish we had their money ;)

long live netware!

[Anonymous Coward]

it might be relevant to bring up the lack of virus and exploits for netware.

Corrected statistics

[menscher]

Ok, first of all, when I go to the site, I see 17 attacked machines, all of which are Win2000. It doesn't show any linux defacements. Did the writer of the article just make this up? or has the site just been massively updated?

Re:Corrected statistics

[r00zky]

It's a daily list of verified defacements...
Yesterday was 61% linux, today seems 100% win2000.

Worthless statistics.
Would be better to know what are the numbers in, lets say, a year.

Anyone know the url to this data? Or better a mirror, seems the site is under huge load.

Your implications are false

[DrSkwid]

I have a friend that runs linux, the only skill he needed was to burn a CD using Nero and reboot.

He doesn't know a kernel from a koffice

Also, what is this "Linux" of which you speak?

[leonbrooks]

there are a ton of anti-Microsoft people out there who would love to see Microsoft go down in flames, and Linux take its place.

So... exit Microsoft Corp, stage left; enter Linux Corp, stage right? Have I got the picture?

But Linux isn't a corporation; and Linus would happily agree that Linux isn't a person. It has, in its enemies' words, "no centre of gravity", no central bastion to attack. It has no war-chest, no lawyers, no production facilities. If it is distributed from France or Germany, it isn't because of some strategic global plan, it's just where the distributors happened to live.

In short, while you can happily replace MS-Windows with Linux, there is nothing to replace Microsoft itself.

Yeehah! (-:

Re:Also, what is this "Linux" of which you speak?

[kien]

So... exit Microsoft Corp, stage left; enter Linux Corp, stage right? Have I got the picture?

Well, I think you might have gotten the picture at the expense of missing the boat. :)

But Linux isn't a corporation; and Linus would happily agree that Linux isn't a person. It has, in its enemies' words, "no centre of gravity", no central bastion to attack. It has no war-chest, no lawyers, no production facilities. If it is distributed from France or Germany, it isn't because of some strategic global plan, it's just where the distributors happened to live.

Right. This is why I think you got the picture. The boat that I believe you missed is that the lack of the centralization that you emphasize is precisely the attraction of the different distributions. The variety offers choice and the opportunity for customized solutions. The freedom to view and modify the source code is simply a value-added benefit for people skilled enough to recognize that value.

In short, while you can happily replace MS-Windows with Linux, there is nothing to replace Microsoft itself.

While I'd love to see Microsoft get onboard the FOSS development model, their self-defeating business model means absolutely nothing to me. I don't need to replace Microsoft. Irrelevant companies have an historical tendency of obviating themselves. If you need a first symptom, which company very publicly bought SCO's license?

--K.

Re:Also, what is this "Linux" of which you speak?

[Harry8]

Sun Microsystems? :)

Re:Also, what is this "Linux" of which you speak?

[Anonymous Coward]

Self-defeating business model? $40 billion in the bank can't be wrong.

Re:Also, what is this "Linux" of which you speak?

[mausmalone]

in its enemies' words

As though linux is at war with Microsoft. Nobody's attacking linux, just trying to out-do it. Microsoft is killing it in the whole popularity contest, and when they cut "free" deals, they're trying to out-do linux' main price advantage. Competitors, yes... but not enemies. If your decentralized amorphous OS has enemies from which it needs protection and against whom you need to fight back, you've got waaaaaaay too much imagination. Linux has competetors, against which it must compete.

I feel like I'm opening a sealed bomb shelter and trying to convince people the cold war is over...

Re:Also, what is this "Linux" of which you speak?

[kien]

Self-defeating business model? $40 billion in the bank can't be wrong.

Oh, don't get me wrong. I don't mean to disrespect the business acumen of Microsoft in the past. Their business actions, though deemed monopolistic abuse by the United States, have been very profitable. Thus, the bankroll you mention.

What is interesting to me is how the company has reacted to alternative operating systems that don't cost anything. It took them a few years to even recognize the contender and contemplate the fact that they can't continue to overcharge their customer-base. It's even more interesting how the company continues to attempt to restrict and control the actions of their customers...almost as if they're drawing a line in the sand saying "cross this line and lose our patronship". :)

They do have the cash to continue to experiment with just how much they can get away with. But I imagine their shareholders might start to get interested if that cash reserve begins to dwindle without any dividends being paid.

--K.

You are showing your ignorance

[Anonymous Coward]

Why is the parent post currently marked as "+4 Insightful" when it is ignorant of the facts???

The 1000-to-1 Honda to Ferrari analogy is meaningless in this instance.

The actual ratio of Windows to Linux Internet server platforms is 5:3 (see Netcraft).

There are also more Apache servers than IIS.

And there are more Unix e-mail routing servers that there are Outlook servers.

In other words, there should be just as many exploits occuring for Linux/Apache/Unix-mail as there are for Windows/IIS/Outlook.

But instead, the exploits of Microsoft's software are more numerous, more destructive, and longer living -- by far!!!

Why? Because Microsoft has never cared about security (they put cool features like e-mail scripting ahead of security), and their software quality is extremely poor.

Log in as "root?" Can you spell that?

[skintigh2]

At a previous company, the demo systems were set up for everyone to log in as root. We get a call from a photo shoot that nobody can log into the systems and set up the pretty picture for the shoot (some screen displayed on a 2x2 grid of flatpanel monitors).

We drive out there and they go on about the problem. It makes no sence, so I ask them to show me what they are doing. The guy sits down and at the username prompt types "route"

That's not even the saddest story I have.

PHP Insecure

[Anonymous Coward]

PHP and other frameworks are notoriously insecure.

This could account for the large number of Linux-powered site defacements.

Distributions are to blame for much insecurity

[ICMP_FRAGMENT]

I prefer GNU/Linux distributions to the BSDs... I find the userland to be a lot more friendly and modern. But I absolutely loathe the fact that every time I do a default install of nearly any Linux distribution, I have to spend lots of time either (a) downloading security patches; or (b) disabling extra software I don't need.

For one thing, whomever believes it's a good idea to continue relying on sendmail and BIND deserves broken bones. There are secure, faster alternatives available, and while they're whining about backwards compatibility and the fac that DJB doesn't want them butchering his software, their users are getting rooted.

We also need to remember the distinction of what Linux really is. I'm not RMS, but we do have to remember that Linux is simply a kernel. It has indeed had security problems (the most recent that comes to mind is the ptrace exploit), and sometimes this is unescapable. But when I hit up for instance the slackware security advisory list, I notice that while there are a handful of system problems, they are also listing problems with software that has little to do with running the Linux system (BitchX, EPIC4, etc).

And then I remember that each time I go to Windows Update, I'm slammed with a list of critical security updates, some of which are even rollout packages containing many other security updates. And the volume of security updates on Windows Update still far surpasses that of my favorite distro.

Handing your average computer user your average linux distribution's default installation is like handing a baby a bunch of knives... the system usually works damn well and quite stable from the get-go, so they install it in a dark corner and forget about it.

Design Philosophy

[Valar]

It's about design philosophy. Windows tries to tie everything together. Email clients aren't just email clients. They include html browsers, which include script interpreters, which are allowed to make system calls. Under Linux and Unix in general, generally, tools are only large enough to work. Email clients are email clients. Borwsers are browsers, and generally the scripting in them isn't allowed to run too far unchecked. That being said, let us remember that the Morris Worm primarily exploited unix...

No.

[wasabii]

As has been said many times, security is only as good as the admin responsible for it. Yes, there can, and will be a Linux blaster... There might some day be a email worm too... but not like sobig.

Lets examine the reasons why blaster and not sobig. Blaster exploits a buffer overflow, requires no user interaction. Find a overflow in Apache, you'll have a worm. Not a whole lot admins can do to prepare for this except application level filtering. It will happen. Those of us who are "in the know" will be patched long before.

SoBig: This is a user spread virus. It does not exploit any vulnerbility. It mearly requires the User to click on the attachment and hit open. It relies on badly designed software, that allows a user to execute code legally, easily. Windows lets you click Open.

Contrast that to most unix mailers: You have to deliberatly save the file to disk, chmod +x it, and then run it with ./. Yeah, a bit harder eh? Nobody I know will be able to manage this.

About the web site defacements. Linux is more complicated to administer, I dont think anybody can argue that. Lately, people have been given this sense of "if I replace Windows with RedHat i will be more secure". That is not true. Security is up to the ADMIN and the ADMIN alone. I would venture to say that a Linux box is MORE dangerous in the wrong hands than a Windows box. Hence your 60%.

Nothing about this changes anything at all. Those "in the know", generally Unix admins, will not be exploited, weither on Windows or Unix.

This doesn't mean Unix doesn't raise the bar of your security... you just need an admin that knows how to use it for it to be even close to it's potential. With Windows you are always stuck at whatever MS deams "secure enough".... bar writing your own IIS filter or something. :D

What we need are more smart admins using Unix, not sucky admins that give us all a bad face.

My two cents.

Re:No.

[kumokasumi]

Contrast that to most unix mailers: You have to deliberatly save the file to disk, chmod +x it, and then run it with ./. Yeah, a bit harder eh? Nobody I know will be able to manage this.

Um. You say that last bit like it's a good thing. UNIX software is getting easier to use. If you're running Nautilus, say, you certainly don't need to get to the command prompt to run a file. You'll probably be "able" to run it inside the MUA eventually, and can't you already with, say, Evolution? Isn't Evolution the mail client most Linux newbies would be most likely to use? I mean, it looks just like Outlook and it's feature-rich. No learning curve and lots of functionality.
(Not that only newbies use Evolution or something silly like that. I use it, heh.)
It just seems a bit shortsighted to say that there will "never" be a SoBig for Linux because the fools that would run it won't be able to figure it out. There are some genius fools out there.

Re:No.

[wasabii]

Nautilus does not let you run executables the last I checked. Evolution also does not. It allows you to Open a file, surely, but not execute it. Executing a file requires chmod +x. Unless these programs do that for you, they won't be able to... and at this time, they don't. And that's a good thing. By nobody I know, I mean, none of the users I admin.

Stats 101

[Anonymous Coward]

Note also that the 'Unknown' category is rather high, and certainly contains at least some Linux systems, further increasing the percentage.

This doesn't increase the percentage, in all likelihood. The "unknown" category will contain a variety of systems, probably distributed much as they are in the known categories unless some system-specific feature lends itself to remaining unknown. The percentage stays the same.

*cough* shared libraries *cough* dynamic linking

[DrSkwid]

still running inetd?

Multi-User Philosophy

[ca1v1n]

Unix is designed under the assumption that there are supposed to be users who can do whatever they please as long as it doesn't interfere with the operation of the system as a whole.

Windows is designed under the assumption that if you're not giving someone full control of the machine, it's because you don't want them to be able to do certain things that have no bearing on the rest of the machine whatsoever.

The result is that a typical Linux installation will create a user account without root privileges that you are expected to use except when you absolutely need to be root. The windows installation will prompt you to create accounts other than Administrator, but they will still be Administrator-level accounts, because the registry and the windows installer are designed to make it difficult for anyone who is not an administrator to install software.

This is why I'm an administrator on my work machine, where I do tech support and thus need to be able to mess around with things to replicate problems, and I'm a non-root user (with sudo privileges) on my home machine. I can screw up the work machine a hell of a lot faster than I can the home machine if I open up the wicked screensaver.

If windows didn't require a completely separate login to do administrator-level stuff, this problem might go away. XP's user-switching is a far cry from this. If Joe User can't copy and paste from his non-admin web browser to some admin system tool, he'll just be admin all the time, and then when he breaks beyond all repair he'll call me along with the other hundred users I talked to today at work. AAAAAAAAAH!

Re:Multi-User Philosophy

[JKR]

If windows didn't require a completely separate login to do administrator-level stuff, this problem might go away.

It doesn't. Read up on the "runas" command. Want a root shell?

runas /User:Administrator cmd

About the only thing you can't trivially do is runas explorer (the shell, not the web browser) - you need to kill the running explorer process first, with task manager.

Jon.

Re:Multi-User Philosophy

[ca1v1n]

Good to know. Now why don't they actually TELL ANYONE about this? If I've never heard of it, Joe User sure as hell hasn't either. That's why Joe User doesn't use it. If I try to run kpackage as a normal user, I get prompted for a root password. If I try to install AIM on windows (which I know can be run off a network share from a computer it has not been installed on) I just get "You need to be logged in as administrator, punk."

Re:Multi-User Philosophy

[JKR]

Er, if you try to run a program installer (setup.exe, InstallShield exe, MSI package etc.) that's exactly what happens - you get a dialog saying "Do you want to run this as your user, or as an Administrator?"

<sarcasm>Where did you think KDE stole the idea from?</sarcasm>

AIM is just a piece of crap; badly written software is badly written software, whatever OS it's on.

Jon.

Re:Multi-User Philosophy

[ca1v1n]

Again, good to know. Now I know to bitch at the guy who made the image at work (which does several other weird permissions things). Well, I'm glad to see that Joe User has some hope now. I guess we'll have to beat it into their heads, since the windows installer still wants to make them all administrators. Thanks.

My boss often asks me where I hear about the things I know, and thinks I'm joking when I say "slashdot".

As long as there are servers on the net.

[Mentorix]

This question almost seems moot to me. There is no question in my mind that a worm targeted at linux systems will some day (sooner rather then later) spread as fast as the last few windows worms did.

People seem to forget that in this case the time between the security builletin(+patch) and the release of the worm was barely 1 *friggin* month!

Worm makers are getting "smarter" all the time, the last 2 blaster variants demonstrated new strategies of infection like scanning both for public ip's and private ip's. And there was the nice feature of renewing your payload to stay active. There's no doubt that in a few years worms will become more modular and be able to alter their payload and their scanning algorithms just to make your life a bit more miserable.

The only thing that can save you is updating your system once a day, and just pray to $fav_deity that some blackhat evildoer isn't gonna find some big ugly gaping hole in some generic app.
If a worm can't survive more than 24Hrs by default I would think all the fun is over for the worm writers.

Microsoft and Linux do their OS's Very Differently

[TyrranzzX]

Microsoft tackles the problem like this:

"There's a problem. How much money will it cost us to correct the problem if it gets out, PR wise? If that's greater than the cost of fixing the problem if it's exploited, then we'll fix the problem."

Linux does it a different way

"There's a problem in MY software? MY SOFTWARE??? WHAT!!! BLASPHMEY!!! KILL KILL KILL!!!"

Just by this principle alone linux should, over the years and years of work, be more secure than windows. The only time that bugs are not fixed is if the designer is too lazy to fix them.

But even if it wasn't. Lets say tomarrow a major virus, say uberblaster, that exploited a bug in both the linux kernel, mac, and the windows kernel (effecting all windows platforms) came out, all requiring a decent amount of work to fix.

The linux community would be agast, and pissed off and take it personally. I'd even bet linux himself would be up, 24 hours a day with caffine in hand to get it fixed. The patch would be released within a few hours to mabye a day. If linux couldn't get a patch out, other people could as, remember, it's all open source.

MS on the other hand would say "Fsck, we've got to work on this, kick the PR department into full kick on this issue and get the programmers working on a fix posthaste". And in a week a patch would come out.

Linux is, by principle, more secure than windows. We'll only know for sure that it is more secure once it hits the average joe market. With desktops like kde sporting kewler features than the rehashed windows desktop (which, face it, hasn't changed since win95) running on a solid linux backround, you'd hope that people would be happy with it. Until then, distribute antivirus and firewall packages to everyone who has a windows machine and advice them to run windows update until microsoft pulls another "root your machine" ploy's.

When will people learn

[dodell]

that system security has more to do with the systems administrator than the underlying software? Of course you can break into all sorts of vulnerable systems. Tons of people run tons of vulnerable applications for various reasons (one of the biggest being compatibility). Others are just smitten with idiot administrators. One can make a Windows system just as secure as any other, required time and effort notwithstanding. So before we go blabbing about who runs the most secure OS, lets talk about system administrators first. Kthx.

why...

[Anonymous Coward]

Yes it is!

Linux does not require technical ability

[solprovider]

Linux does not require technical ability anymore.

There are several distributions (Mandrake, Lindows, ...) that may be installed by the complete novice.

That said, I am using RedHat (because I live in the US and it is still the most popular distribution here.) The RH9 installer does not even make suggestions for how to partition the hard drive. (A friend asked if he should make the root ext3 or a swap partition? The interface implies that this is acceptable.)

Once Linux is installed, a typical user would never see the command line, and only needs to learn one GUI.

Linux can also remove some of the fear of computers because you do not need to worry about the usual viruses. Your aquaintances that have trouble right-clicking and double-clicking may be better with Linux, since the menus are usually written before the context menus, so every option can be accessed with one button of the mouse. (My grandfather uses the ENTER key instead of double-clicking, since a couple of strokes have upset his timing for double-clicks.)

You also assumed that the Linux users must have installed Linux. In the corporate world, computers are installed by IT, regardless of the OS. And today the home consumer can buy a computer with Linux already installed. That assumption is not safe.

---
Good application designers assume the users are complete idiots. Applications designed that way are easier to use, require less documentation, and have more safeguards to prevent GarbageIn. And when the complete idiot does ask for support, invite them to be a primary tester. Even idiocy can be useful.

For Linux to become the main personal computer operating system, it must be designed for use by idiots.
- Why does it seem that most users are of below-average intelligence? Do smart people avoid computers?

Re:Linux does not require technical ability

[rbullo]

You use Red Hat because it's the most popular distro in your home country?

cheap simpsons quote

How rebellious... in a conformist sort of way.

end cheap simpsons quote

Re:Linux does not require technical ability

[Anonymous Coward]

yeehaw, let's all use Linux from Scratch.

Let's run a corporation off of it!

Re:Linux does not require technical ability

[Lost Race]

Why does it seem that most users are of below-average intelligence?

Most people are below average intelligence, because most people are stupid, but a few people are smart, and those people are really smart, except when they're stupid, which is most of the time. So yes, everyone is below-average.

Re:Linux does not require technical ability

[ebf]

I do. And it works.

Re:Linux does not require technical ability

[splibs]

"The RH9 installer does not even make suggestions for how to partition the hard drive. (A friend asked if he should make the root ext3 or a swap partition? The interface implies that this is acceptable.)"

Bad example. If you install Red Hat it will either wipe the disk and choose its own partitioning scheme (which is Red Hat doing more than making suggestions, it's actually implementing them), or, if your friend chose Disk Druid (implication: "I am technically competent"), it won't let you put a mount point on any partition you define as type "swap". The interface won't let you do what your friend thought might be possible.

If your non-technical friend chose the third option (fdisk) then he's explicitly saying "I am technical!". In which case the analogy is that he decided to edit the Windows registry.

Re:Linux does not require technical ability

[Cro Magnon]

Modern Linux distros don't REQUIRE much technical ability, but the very fact that you CHOOSE Linux puts you ahead of Joe Winpack who just grabs whatever is at Best Buy. Until you can walk into Best Buy and get a RedHat computer as easily as an XP box, the "average" Linux user will be more knowledgable than the "average" Windows user.

Re:Linux does not require technical ability

[xYoni69x]

> My grandfather uses the ENTER key instead of double-clicking, since a couple of strokes have upset his timing for double-clicks.

Modern Logitech mice (I don't look at any other type of mouse - Logitech are simply the best) have at least a thumb button, and the newest mice (MX-#00) have even more buttons. You can configure one of them to act as a double-click button.
My mouse has the standard buttons + a thumb button, which I've configured to double-click. It's quite great. (I don't have a problem double-clicking, but it's just much more comfortable this way...)

> Why does it seem that most users are of below-average intelligence? Do smart people avoid computers?

No. Smart people avoid calling tech support, so you don't notice them. =)

Re:Linux does not require technical ability

[Wolfrider]

> Linux does not require technical ability anymore.

--You are SO WRONG... Making a blanket statement like that. Check out the Knoppix support board sometime. Knoppix is a live-cd that autoconfigures your hardware and boots straight into GUI, and we STILL get people asking questions that would be simple for them to solve if they had some basic tech understanding.

http://www.knoppix.net/forum/viewforum.php?f=1

Re:Linux does not require technical ability

[solprovider]

I think you proved my point. These Knoppix users ARE USING LINUX WITHOUT TECHNICAL ABILITY.

Linux does not require "technical ability" to use. It may require some slight brain activity. It would be useful to have a finger or other body part which can move and click a mouse.

"Technical ability with computers" could mean:
- Understanding the difference between RAM and a hard drive storage.
- Knowing the difference between a program and a data file.
- Not referrring to the monitor as the "computer" and the actual computer as a "hard drive".
- Not thinking a 3.5" floppy is a "hard disk".
- Understanding that internet cookies are not viruses.

Most Slashdotters would upgrade the list to:
- Being able to partition a hard drive.
- Knowing a computer language, or at least a command line shell.
- Being able to put a computer together from parts.
- Knowing the difference between USB and Firewire.
- Understanding HTTP and SMTP.

I followed your link. The top notice was someone asking about where Knoppix installs Java without any understanding of the difference between the JRE and the JDK. I doubt this person has "technical knowledge", yet he is able to use Linux enough to be looking for more information, although a little knowledge would help the question make sense.

My aunt probably makes the mistakes in the first list, but she was able to use Mozilla and OpenOffice on Linux without any help from me. (OK, she did have to send me the file the next day so I could convert it from .SWX to .DOC, but that just proves she has no concept of file extensions.)

My point was that it is possible to USE Linux without technical ability. Knoppix even makes it possible to install Linux without any technical knowledge.

The woes of small business consulting

[swb]

I wish this were so funny. The last two VARs that a business I know of has gotten accounting systems from have configured the systems so that all of the users did log in as root.

If you've ever installed systems (of any kind) for small businesses (~50 people), you'd know why this was such a temptation and often a functional necessity.

Many of them have no full-time technical staff. The typical scenerio is a "operations manager" who spends most of their time dealing with production issues; a "back office" person (who's usually the consumer of the system, often the head financial person); and then whoever ends up being the technial liason, which in my experience is whatever office flunky can get WebShots installed the best or who has the copier repair phone number.

It's sad, but I've done a ton of installs where basically everyone who uses the system is root/wheel/administrator and there are no permissions. If I'm lucky and can figure out there's no one to even reliably change tapes before the equipment is set up, I have it do alternate full backups on different physical disks; I figure it's better than a burned up tape.

It keeps you in business, but it kind of sucks, since it's apparent that nobody really gives a shit...

Re:The woes of small business consulting

[Anonymous Coward]

man...! ever heard of sudo? i have several systems where people need to do root-only stuff. they login with a non-root acct and have a horde of trivial scripts (say /usr/bin/foo does 'sudo /usr/sbin/foo_root') so that they don't even know all the magic behind the curtains. they say 'foo' and it works. plain and simple, using sudo's access control with nobody realizing it.

just my 2c

Parked domains

[Spazmania]

The percentage is high because a lot of domain speculators park the domains on cheap out-of-the-box red hat systems. When the box is breached, so are all hundred of the domains on it. NT boxes are much more likely to be corporate web servers with only one domain on them.

This also tends to weight linux higher in the overall web server percentages.

Lindows

[dpilot]

Reading the discussion on this thread, there's no concensus. There seem to be two extremes, though:

One hand: Windows is simply a bigger target, if Linux were this big a target, it would be in just as much trouble.

Other hand: Windows is not designed for security, so it's an easy target.

Gripping hand: (my opinion) Both are true.

Security needs (at least) architecture, implementation, and culture. It's easy to argue that Win9X-based OS's fail on all three counts. It's possible to argue that WinNT-based OS's may even be superior to Linux, having stuff like ACLs from the get-go.

As for implementation, I'm not sure. It seems to me that most (not all) of the Windows exploits are really architectural, not implementation. It seems like the exploits take advantage of the tight integration Windows offers rather than buffer overflows and off-by-one, Code Red obviously excepted. Linux exploits are generally in the implementation area. One might wonder how many implementation flaws are in Windows, once architectural flaws are closed.

IMHO where Windows falls flattest is in the culture. So what if the OS can separate users from admin, when a lion's share of software requires admin to run? As others have said, Windows users expect things to be insecurely easy.

But what really scares me is Lindows.
Running ordinary users as root throws away the single simplest, strongest chunk of security we've got.
It also brings out one other aspect of Linux - I suspect/fear once a box is r00ted, it's a much more powerful base for further mischief than Windows.
I just wish Lindows could come up with some other ease-of-use scheme than running as root all the time.

Linux less likely to have large-scale worms...

[c0d3h4x0r]

Are there other reasons why the likelihood of a "Sobig" or an "ILUVYOU" would be lower for Linux than Windows?

The only reason I can think of is that no two Linux installations are even remotely close to identical. Linux comes in so many forms, different distributions, with different libraries, software, and packages installed, that to write a virus or worm that would take down 90% of the world's Linux systems at once would be impossible. There's just too much diversity.

In the Windows world, nearly all versions of 32-bit (and now 64-bit) Windows have the same libraries, services, and thus the same vulnerabilities. Far less diversity, so far more vulnerable.

On the one hand, consistency is good for end-users. They need it so they don't have to relearn the computer every time they sit down at a different one. But on the other hand, if all systems are identical, then a virus writer must only find one vulnerability to bring down the entire world. It reminds me of one of the big arguments against cloning for agricultural purposes: if all cows are clones, and a virus evolves that is totally fatal to that one particular genetic makeup, then all cows are dead.

A Lot to Know (long and ranting)

[angst_ridden_hipster]

I think one of the problems is that, to have a secure machine, there's a hell of a lot to know.

I've been using Unix or one flavor or another for maybe twenty years. I've been doing administration on servers for maybe ten. I know something about Unix, although I wouldn't call myself an expert. My focus is on programming rather than admin (although to be a good programmer you need to know a lot about admin, and vice versa).

The fact is, even with a lot of experience, there is an enormous amount to know if you want to keep a machine secure. And while most of it is pretty straightforward, some of it is really complicated stuff.

Couple that with the differences between flavors or even Linux distros. While the basic concepts tend to be the same, the methodology is different (for example, compare removing specific network services on Debian, RedHat, OS X, and Solaris). Security is a full-time job.

Technical people often make the analogy that the level of technical computer understanding most people want to maintain is like their house or car or office. Bar the windows, lock the doors, set the alarm. Set up the cameras if you're paranoid, and monitor them. While the top-level concepts are the same for operating systems, the kinds of attacks are different. There are only so many ways to get in through a window -- but how many programs turn up exploitable? Once you secure your windows, you know the threat level (rocks, pry bars, glass cutters, etc). With software, you may have a general idea (buffer overflows, privilege escalation, out-of-band data, unexpected input, etc), but it's continuously evolving. In both cases, vigilance is critical. In both cases, if you're security-minded you can be more or less secure, even in a hostile environment.

The problem is, this model is wrong for most people. They want to interact with their computers like they do their DVD-players or TVs. They want to use them as simple, versatile tools: think swiss-army stereo system. They don't want to have to think about security. They don't want to know that there's an /etc directory with configuration files in it. They don't want to run Windows Update every time they turn on their computer.

That's where the problem lies; people who are concerned about security will be secure whether they run Windows, Linux, or whatever. The people who just want a device that can play music, edit spreadsheets, write documents, send and receive email, and surf the web will likely be insecure no matter what OS they run. How many times have you had people volunteer passwords, watched the guy pound out the alarm code "1234", or had a user tell you their password was their cat's name?

Sure, some systems make it easier to be secure than others. But security is more an attitude than a system.

(This leaves out the whole issue of the heterogeneity of the Windows world, the desire on the part of worm writers to hit the largest "audience," and the anti-M$ attitude among 'leet hackers.)

Re:A Lot to Know (long and ranting)

[xQuarkDS9x]

You are correct - there is a hell of a lot to know to keep Windows systems secure including firewalls - proxies (web browsers) ways to prevent spyware and viruses and what not.

The sad fact is a lot of Windows users don't know any of this and they surf the net with everything WIDE open in the browser - email and even OS itself then wonder why the hell their system is being "owned" and going downhill fast from all the viruses - spyware - and hacking attempts.

Re:A Lot to Know (long and ranting)

[NullProg]

Moderators +5 on parent.

Re:A Lot to Know (long and ranting)

[windex82]

You compare using a computer to using a tool, you wouldnt just set little timmy free with a table saw, or many other power tools. All it takes is a little common sense and some general knowledge (goes along with common sense really --reading power tool safty tips::reading the error message that "JUST POPPED UP") about the tool to be used properly.

Ive had a lady say to me before, "I bought this computer to do work on, i shouldnt have to know how to use it!" The main problem here is that the genreal public DOSNT feel they should have to know anything about this tool because its a computer, and was made to make our lives easier --so why should we have to know anything about it.

And my little rant:

Were talking the same populous that still refers to our proffesion as "crap" - how often have we heard, "i dont know anything about that computer crap!" Just goes to show the mentality of the average user really... put someone down but still expect them to help you even though you havnt bothered to pick up a few key terms after using this tool for a couple years, by this i mean the people who still dont know what to do if you say "minimize that window". You would that that after using a tool for a givin period of time you would begin to at least understand it a bit better. I know for one that if i were to use a jackhammer at least once a week i would begin to get proficient and understand some of the main problems that would occure and general maintnence and repair. Heck, I know guys that worked at the mill and have been phased out but because they worked on certain machines that have been automated that the company has to call them in for 2k a day to repair it when it goes haywire. But change the machinery to a computer and they dont seem to appear to even soak in any part of how to use it, let alone make an active attempt to learn anything.

Re:A Lot to Know (long and ranting)

[angst_ridden_hipster]

OK, but think about it from the perspective of the layman. Much of that time and learning goes into understanding the applications themselves.

As an example... How long does it take to become proficient in Word? We joke about creeping feature-itis, but programs like Word have an overwhelming number of options, especially for someone who just uses it for putting out newsletters or memos or something. They don't wnat to learn all the features. They just want to do their jobs. Over time, they gain knowledge of using Word. They *do* learn some of the tweaks and quirks and features.

It comes down to the original problem -- there's a hell of a lot to know, and most people just aren't interested.

Linux Attacks

[uisqebaugh]

While it is true that a linux system is less vulnerable than other systems, because the user base is more informed, and because one must have root permissions to get to many vital components, it is a big mistake to assume that linux is totally secure. New vulnerabilities are constantly found. I can't even begin to count the number of security vulnerabilities my RedHat 9 system has discovered and patched with updates. Missing these updates is just as bad as missing the patches for Windows. Folks, these vulnerabilites which the various worms and viruses have exploited in Windows were documented, and often protected by installing the newest patches, which is exactly what is happening with Linux. As an example, I know someone who installed linux a while ago, and was hit with a sendmail exploit. Suddenly, he was getting protests from other users and his ISP for sending spam. Sure, he fixed the problem and the exploit, but crackers are like cockroaches; once they find a way into your system, they're hard to get rid of. In this case, the spammer was irate that his victim and patched the hole, so this spammer proceeded to send a DOS attack against this man's machine. One can be arrogant and coy that this man could have taken steps to prevent this attack, but the point is, this is a learning experience for everyone. Everyone out there starts as a novice, and he was no exception. The point is this--exploits exist in linux, just as in Windows. One must constantly keep up with the latest updates and patches, as well as practice some safe computing habits, in order to avoid these attacks.

This is ironic

[Darth Daver]

I just went to Zone-H, and it said that 100% of the defacements were on Windows 2000.

okay....

[Anonymous Coward]

Well, it seems no one is willing to stand up for Linux as a more secure OS.

Let's make a few points, feel free to flame:

- Firstly, say what you might, but Linux does make it harder to operate as root all the time.

- Linux points you toward creating user accounts and tries to make you stay there, in a gentle way. Windows just runs you are root, by and large.

- Under windows, even as a basic user on a default install, almost full access to the file system is granted, including reading all files and program installation to anywhere on the system, including altering key system files. Hence an exploited user account can be easily escalated. Linux makes this harder. Not utterly impossible, but a lot harder.

- There may be more windows boxes in the world, but the majority of permanently net-connected, fixed IP machines are Linux and BSD, *BY FAR*. These are especially servers, firewalls, gateways and systems with big bandwidth and access to interesting data and corporate networks. These are also embedded systems and appliances, which are not routinely updated. If there was an easy way to exploit a Linux box, anywhere near as easily as it is to exploit a Windows box, most crackers would leap at it.

- There are slightly more warnings issued for Linux in total than windows, but they are alo pre-emptive in almost all cases, so that systems are secure, rather than MS releasing patches after exploits exist in the wild. Also, Linux exploits don't tend to break other patches and open up new vulnerabilities.

- Linux boxes are a diverse environment, proving much harder to attack than the uniform windows environment.

I'm sure there are more points I could make, and I'm sure people can and will respond about the quality of administrators, etc., but the fact is that a windows box in the wild is about ten times as likely to be broken into for defacement than a Linux box.

Moreover, to put it simply, look at the results. If there are more Linux and BSD connected machines, then why is it that we don't hear about a Linux Slammer worm taking down all of Korea's internet access? (Remember that Slammer attacked database servers, and there are far more of those on Linux than windows.) When was the last time that universities were brought to their knees by their networks being crippled by Linux worms? When was the last time that a nuclear power plant lost safety systems due to a Linux worm? When was the last time that a train network was crippled by a Linux worm?

Does anyone see a pattern here yet?

It is easy to say that Linux can be just as insecure as windows, and that Windows, if completely patched up can be secure, with a good admin. At the end of the day, however, the situations above illustrate what is happening in the real world, right now. Running a windows server clearly correlates with serious security issues, where Linux systems don't. That's the absolute bottom line.

I can appreciate that people want to give a different answer to saying that Linux is more secure. I can appreciate that they want to find an alternative angle, but what happens if the obvious answer is, in fact the right one?

We can not blame the users ... soley

[qoquaq]

We can not blame the users soley. For the success of GNU/Linux the architects of the system have to take the reins and make the system secure. We can not put that responsibility soley on the user. The average user not just "joe six-pack" is and should not have to be as aware of the lower level functions of the system. This is the job of an architect. We should not sit back and impose the enormous mental model of entire system on all users if we expect to gain ground as a desktop operating environment. I believe GNU/Linux is beyond a platform for engineers only. Where else but with free software do you gain so much e.g. GNU tools, open source, a community based on code quality and sharing of knowledge. I have learned more about computer science learning within this community than in school texts.

If security is our main concern our community should then form a culture around it and get everyone involved. Look at what OpenBSD community has acieved by creating a culture around security with minimal effort of the user.

Perhaps a culture around security with high availability and operability could be a win win for the community as a whole.

Lets not rest on our laurels. This community has gained so much in a short amount of time. Lets move forward once again and gain more ground.

Bad statistics! Need size of at-risk population

[Tsu Dho Nimh]

"Linux accounts for 61% of the defacements in the last 24 hours " ... what is the defacement rate per thousand or 10 thousand or any other number of sites hosted on Linux systems? And what is the rate of defacements for non-Linux hosted sites, expressed in the same numbers? What ZoneH reports are the raw attack stats (and only attacks they know of), and without any indication of the populations at risk, there is no conclusion to make. It's like my saying there were 10 murders in my home town last year, and you saying that yours only had 5 ... how big is the town?

"Are there other reasons why the likelihood of a "Sobig" or an "ILUVYOU" would be lower for Linux than Windows?" ... Linux doesn't let you double click and run things (yet) ... you would have to download it, deliberately execute it, and then it would probably crash because it's on the wrong distro and can't find the libraries it needs. It would also have a heck of a time taking advantage of the cache and address books because these things are not in as predictable a place as they are with windows.

Linux is secure ... However..

[Stonent1]

Many distros may not. Any distro that is running telnet by default or any of the clear text authentication based services are never a good idea. Installing for example an old version of Redhat or Mandrake would not be very secure. The same could be said for Solaris or Irix. Now, I believe that niether of them enable telnet and provide SSH as an alternative. The other things are simple like do not allow remote root logins may be disabled.

Summary of this discussion

[AlXtreme]

69% of these comments are about how stupid the administrators are, and that they need to read their Linux-for-dummies again. These are comments from the general Linux zealots^Wusers, and are naturally ignored. We already know that admin's are brain-dead.
7% talk about how safe their MacOS is, but 93% will skip those comments, as Apple is just another Microsoft OS (MS has a large portion of Apple's stock)
3% blame Apache, and promote the use of proprietary solutions as they are So Much More Secure(tm). Good for a laugh.
8% are the BSD-trolls. Only problem is that they still have to use lynx to post their remarks, nobody cares about them anymore. Especially not the general Linux zealot^Wuser reading their posts. BSD, pfff, something that free can't be good. I mean, Windows used their code...
6% are the trolls ranting against something called google, that makes all those script kiddies so-called blackhats after enough time. Yes, your kid brother has just grown up, and has exploited apache and your 2.4.20 kernel to gain root privileges on your box. Even worse, he's just told your mother about your secret pr0n stash in /root/.this/.is/.secret/. Life's a b*tch...
4% are the MS-trolls, those who have lived under a rock for the last decade. Or at least the last few weeks. Anyway, there would be more of these posts, but i'm afraid 98% of people using Windows(tm) were attacked by all em scary worms out there, and rebooted for the 50th time today. Whoopie! No Blue -Screens anymore!
2% are the ones commenting the BSD trolls, but nobody sees their remarks or could care less.
1% are the lame people that rant about how deceptive statistics are... this post is one:

lies, damned lies and statistics.

We now return to our regular programming...

A few of us are.

[Anonymous Coward]

Actually, one or two of us are security geeks. My title is "Webmaster" at the moment, but I've spent much of my time convincing our administrators to move from a buggy, incredibly insecure proprietary linux (NetMAX), to a more secure, normal linux installation. It's now RedHat (8),but at least it's well patched.

No, the real people you need to worry about are those that have been doing web design "for years", but never manage to make it out of Dreamweaver or Frontpage. I consider myself a programmer before a web designer ( also wrote our company's setup CD software, for instance); for me, HTML is like a vacation.

BTW, the vast majority of the "/c/windows/cmd.exe?" queries are from the Code Red virus, not hackers.

Re:How about this? (same as biology/farming!)

[ron_ivi]

Interesting... This the same claim as some organic farmers make against large-scale farms replacing all of certain crops with identical strains. A specific bug can wipe cause much more damage.

Could there be a Linux "Blaster?"

[Anonymous Coward]

I don't know, but you just gave me a great idea...thanks!

The Problem with most Windows users...

[xQuarkDS9x]

The problem with most Windows users - whether they run 95/98/ME/NT/XP/2000 is that they DON'T understand how to lock down the system or that alternatives exist to Microsoft software. They don't know jack s*** about a firewall or better alternatives to Microsoft software that is often more secure, not to mention actually VIRUS scanning email attachments and downloads..

If you have to do e-mail - a very good and secure e-mail client is Pegasus Mail which does NOT blindly open up email attachments and run code like Outlook does.

Get a decent firewall like Sygate PRO or if you must even ZoneAlarm PRO and make sure it's configured properly. Again some windows users would have problems even with something so simple as this sadly.

Want to avoid the nasty crap in Internet Explorer or other browsers? Get a proxy like Proxomitron and JD5000 Filters for Proxomitron which then allows you lock down all that nasty MS crap like VB/ActiveX/Flash/Forced Download scripts/ADS and more that cause problems.

But as everyone else has mentioned here - all it takes is a moron to run a windows box - linux box or hell even a MAC OS X box and not keep up to date with patches. If he/she doesn't know what they are doing any of the three will be insecure.

Also with Microsoft a lot of users I believe are afraid to get the patches - because you keep seeing more and more supposed "horror stories" of how a patch broke Windows or a "feature". Same crap could also apply to same user running a Linux box.

Who Is "zone-h" ...

[Mooncaller]

... and why should I trust what they say? They can't even survive a little /.ing, so I'm not impressed.

Re: Bad MS programmers

[solprovider]

Did you chuckle when you read my post? Or frown?

Are you a MS programmer that I insulted? Or did they not hire you, so you assume the ones they did hire must be better than you? Or you believe that a company that makes that much money must be doing something correctly?

(Sorry that sounds like a personal attack. I hope you answered "No" to all but the first question.)

Read the websites about the hiring practices for MS. They are looking for a good personality fit with their processes. Maybe the questionaire asks, "Are you willing to release bad code because of deadlines?" and a positive answer gets the position.

I have no personal experience about the quality of programmers at MS. My personal belief is that there are very few good programmers anywhere. I do know that every time I need to fix a problem with MS software, I think about:
- how I would have written the code, then
- how a beginner programmer would have written the code, then
- how to write it worse than the beginner.

Then I assume the last case is true, and work around it. I have a reputation as a miracle worker for being able to see inside the code.

Best programmers do not rush. They know that code that works is much better than code that almost works. Taking the time to design something well is always worth it. By definition, well-designed programs take less time to write and test.

The problem with MS's code is not that it was not written well the first time, but that they have not done it correctly after hundreds of attempts, even after their customers report problems.

---
I am not a "Lunix zealot". I do not use Linux in the corporate world, and barely use it for personal stuff.
- I do recommend Linux to people and companies that cannot afford Apples (which I have not used in recent history.) And much of my recent work has been battling an incredibly poor multi-threading model in some of IBM's software.
- I am anti-MS because I am tired of rebooting, and know that I could design their apps much better than they ever will. If they have some of the best programmers in the world, why are their applications so bad?

Maybe it's the culture.

[cgreuter]

I have a theory.

If you take a look at SourceForge and Freshmeat, you'll see thousands of projects that a) aren't anything new and/or b) don't work and/or c) were abandoned after release 0.000001. I suspect that a lot of the people who started those projects would, were they Windows users, be writing virusses and worms instead.

Getting industrial-strength development tools for Windows is hard. They're expensive, the documentation is bad, the APIs are horribly complicated and the beginner-oriented tools (e.g. Visual Basic) hide the underlying workings from you. With Linux, though, you get everything for free. The APIs are small and well-documented and there are dozens of industry-standard programming languages just there for you to use.

For a geeky fifteen-year-old, the coolest thing he can do under a typical Windows installation is to write a Word macro virus. Under Linux, he could, if he wanted to, reimplement his entire operating system piece by piece. And that's a lot cooler than writing a worm.

Then, there's the open-source culture. Linus managed to become rich and famous by writing free software, all while sticking it to a giant evil corporation. I think a lot of open-source coders secretly dream of becoming as famous as Linus someday.

So my theory is that, because of the wide availability of development tools and the geek culture surrounding OSS, lots of potential virus writers get diverted into less harmful things.

(Obviously, there are other factors as well but I thought I'd bring this up.)

Re: Bad MS programmers

[Anonymous Coward]

I chckled when I read "Best programmers do not rush" - that's 100% totally correct - unless management says, "You know that deadline we set for the end of February? It's now the end of September." I'd laugh - except I have to live with it (for real).

I do NOT have the luxury of simply saying, "no" and having the problem go away because I've said it and explained it's not a situation of being unwilling to do it but one of being physically incapable of doing it in that time. I can't get more resources, I can't get more time. Therefore I WILL rush knowing full well the end result will fail.

Fact is... Some apps need to run on IIS or other

[Anonymous Coward]

Flame wars aside, some applications we run require IIS.. There are no opensource equivalents. Some apps run on Irix because there are no Linux equivalents and the list goes on.. I have two examples:

1. PDF web server w/ Photoshop Engine.. The PDF server uses PDFLib w/ proprietary windows license fonts.. There is no way it will run the fonts on linux w/out licensing problems. PDFlib w/ php won't cut it.

We have the IIS also use Photoshop because there is a COM object for Visual C or Visual B.. You can script Photoshop with a IIS webserver. The com object allows us to run scripts, manipulate channels, layers,etc.
We tried ImageMagick, GIMP but they don't support our 1-2 gigabyte files regardless of how fast or fully loaded the servers were.. Photoshop has a nice virtual filesystem management that actually allows us to handle 4 gigabyte files. Moreover, files are from macintosh clients which requires resource forks, On NTFS, you can manipulate resources and data forks in streams.. We have a server object that reads resource info from quark or indesign files and processed them as blob data to SQL server.
You can't do this with linux/GNU equivalents. (no real tools for resource and netatalk has issues)

if you think you can handle a 1 gig CMYK layered Photoshop file with opensource, post your contact info and I'll get back to you.

Trust me, a 600 meg file will make a P4 Xeon linux machine w/ 2 gigs of ram process the file for over 40 minutes running imagemagick while a 1 gig P3 using W2K and Photoshop/IIS will do it in 10 minutes.

2. We also have SGI servers to handle ripping of proprietary pre-press files which have no OSS equivalent.. E.G. pantone color matching, quark, etc.
They work with certain workflows.

People need to get off their OSS frenzy.
point is.. each platform will have their specific tools unavailable to other environments.

I run Linux and I have had no security breaches!

[MrJerryNormandinSir]

I run Linux and I have not suffered from any
hack, worm, or virus. If you know system administration you can build a tight box.

post your IP and let me run nmap, nessus and other

[Anonymous Coward]

Any box can be hacked.

It's the user, not the OS.

[Beardo the Bearded]

I run Windows 2000. It's up to date, and it has been since I installed it. I don't use a firewall, and only installed a virus scanner two days ago after my wife insisted. Despite that, I've never had a virus. My prefered method for dealing with people trying to get in is pop up a message on their computer to stop. Either that, or I call their mom. (Which is usually a very funny conversation - give it a try sometime!)

Anyway, I blame my College for my lack of infection. The only email program we could use was pine. I still use it to this day, and it's my favorite email program. Nothing to configure, nothing to install, works anywhere in the world, extremely lag-resistant. The most important feature - you can't click on anything.

I digress: back to infection. No matter what program you're using, you can't just run whatever random garbage Undugu sends you. The majority of users will not understand that. My father, for example, can't understand the concept of Spyware, Adware, or Pr0nware. Eventually I had no choice but to physically destroy a CD he bought. It installed Spyware and Pr0nware, and he would not beleive me, no matter how many times I explained.

So, what does that have to do with Linux? It's simple. The majority of Linux users are smart enough to not click on any random thing that gets sent to you. That's the difference. It's like a gas station that offers free gas. The catch? It's 50 octane. A lot of people would go. Yes, they would. Those of us who know something about cars would know that that kind of rating would seriously mess up your car. Sure, you could install a refinery into your car and add anti-knocking agents, but you're better off not getting gas there.

People who use Linux are, from my experience, very well knoweldged about computers and take care of them. Once the goal of "Linux for the Masses" is achieved, then - AND ONLY THEN - will you see the true devastation that rampant idiocy can wreak on an operating system.

yo yo yo

[Anonymous Coward]

yall be haytuz yo.

Worm potential

[MeanMF]

Are there other reasons why the likelihood of a "Sobig" or an "ILUVYOU" would be lower for Linux than Windows?

I think the biggest reason that something like Sobig is unlikely is that there are so few Linux machines on the Internet as compared to Windows machines, and since a majority of Linux installations are on servers an awful lot of them are behind firewalls. Worms like this spread by seeking out more systems to infect. If 95% of the systems are running Windows, a worm can spread a lot faster than if it is looking for a fraction of that other 5%. A similar worm on Linux would take a _lot_ longer to spread and would give us more time to react and put a stop to it.

Re:Worm potential

[gutbucket]

Worms like this spread by seeking out more systems to infect. If 95% of the systems are running Windows, a worm can spread a lot faster than if it is looking for a fraction of that other 5%. A similar worm on Linux would take a _lot_ longer to spread and would give us more time to react and put a stop to it.

95% of the Linux systems out there don't share 99% of their configuration. 99% of the Windows out there share 99% of their DNA. They are clones. There is a build... and there is precious little ability to deviate from that build.

For 10 given linux systems you'll find 22 different configs (that's right, twenty-two, including backups, failsafes and testsets, if you're a good admin...)

Re:Worm potential

[MeanMF]

95% of the Linux systems out there don't share 99% of their configuration. 99% of the Windows out there share 99% of their DNA. They are clones. There is a build... and there is precious little ability to deviate from that build.

True for the most part, but don't forget about all those RaQ servers at Yahoo and other hosting services...

Maybe it's not "cool" to do Linux worms yet?

[MtViewGuy]

I think right now the reason why Linux security breaches are rare is the fact it's not yet really considered "cool" to hack Linux servers.

If I were an al-Qaeda terrorist with lots of computer knowledge, I would find a way to show that hacking into a Linux machine and causing serious damage isn't so hard after all--especially now with more and more large-scale computers running Linux.

According to MR GATES...

[shaitand]

About 1/3 of all windows XP machines crash 3 or more times daily DUE TO THE OS NOT APPS. And that is just the ones that actually click "send report".

1/3 is 1/3 regardless of how many there are. 80+% of the web runs on apache last time I looked. So to be on even keel the other 20% would have to all be IIS (which they aren't) and 80% of defacements would have to be on apache sites, and 20% on IIS. This would make it 50/50, IIS+ windows is no more or less exploitable than linux+apache.

Remember boys and girls... microsoft may have a monopoly on the desktop. But in the web sphere they are WAY out of their league.

Now what we have is 60%, not 80%, and then we start chopping... how many of those defacements are due to insecure cgi scripting (my guess would be damn near all of em), php scripting, etc. How many are due to servers which have no been properly secured. How many of them are due to applications rather than OS itself (we'll be fair, only microsoft made apps continue to count against windows 3rd party don't, and only project maintained by linux torvalds count against linux).

Actually if you think about it, as depressing as 60% sounds... These numbers show linux to be MORE secure than windows, not less.

Linux Security

[Anonymous Coward]

I worked for a company last year whose Red Hat systems had been invaded by a root kit that listened on an IRC channel and launched DoS attacks on command.

Which is probably how the current/recent DoS on SCO's site is being managed - - from compromised corporate and family Red Hat systems.

Linux Viruses? Yes!

[Anonymous Coward]

Dear man_of_mr_e,

I'm afraid to tell you, but there is a Linux virus, or shall I say virii (plural virus). Many Linux virii are known but seldom publicised. Many like the PLEASE_DELETE_ME.sh and the AWWW_COME_ON_DELETE_ME.pl are prime examples of the plethora of known virii that exploit the unwary and gullible Linux user.

Like all things Linux, Linux virii are open source (you can see the code) and are for the most part, free for you to download. These virii come with the GPL license attached and are subject to those license stipulations. That is to say, if you make modifications to the virus code, you ar oblicated to provide your source code for the rest of the world to benefit. Of course, you must make an attempt at running the said virus which, well, I'll answer that next.

I mentioned the PLEASE_DELETE_ME.sh virus earlier. This virus shares a common trait with all Linux virii: The intended victim is honor-bound to run the virus himself, which will in turn delete everything from the users hard drive without question rendering the computer a doorstop. completes its designated task.

man_of_mr_e, I hope this little chat we've had has been helpful in understanding the differences between the proprietary virii (such as the ILUVYOU virus, the SoBig.F virus, or even the WindowsXP virus) and the open source virii. Don't be afraid to use open source virii in any of your daily tasks. Open source is here to stay and so are its virii.

Take care.

woman_of_ms_terry

dumb windows users

[Anonymous Coward]

I may be an anonymous coward, but I am certainly smart enough to write a good virus and also prefer using MS Windows as my desktop OS. I know a lot of people who are smart enough to write virii and have no problem using Windows as their primary OS. You made some good points but this "Linux users are smarter" thing is foolish.

SE Linux

[bobbuck]

While Linux may have its weaknesses, it holds up pretty well. Where I work we have a Linux box connected to the internet doing routing and other work. It has faced infected computers from three directions without problems. Our Windows computers have been infected several times despite being behind a firewall and they get loads of spyware (thank God for Adaware), not to mention the fact that they crash often enough without any kind of attack.

It will be beyond question that Linux is more secure when (if?) Security Enhanced Linux is adopted and used sensibly. SE Linux could even prevent process A from damaging process B's data when they belong to the same user. Say I download a new program and it turns out to be malicious or overly inquisitive, Mandatory Access Controls could prevent the program from accessing data outside its own little box like a very fancy chroot environment. I may have been asleep, but I don't think that has even been considered for Windows.

This is not a very interesting observation

[dsfox]

The fact that the average person using one system or the other is more or less competent isn't a very useful piece of information. If you are interested in comparing Linux to Windows you need to do so on the merits of the systems themselves, not on those of their users. What if the user base changes? Then we know nothing. What if we want to give a Linux system to someone used to Windows?

I've also got to respond to the usual arguments about security - that by not running as root you are somehow safer than if you run as root. I'll grant that you are safer from your own mistakes, but to believe that any computer user will be happy because, though all their personal files are wiped out, the system is still humming along smoothly. What possible use is a functioning system that has been wiped of all your personal data? Its no more useful to me than a system sitting on the showroom floor at Fry's Electronics.

my 2 cents

[eok20]

While 61% of the defacements may have been on linux boxes, the percent of linux webservers that get defaced is less than the percent of windows webservers that get defaced because linux/unix webservers make up about 70% or more of all webservers. Also, while there may have been similar linux worms if the majority of people had run linux it would be easier to get a patch. Because MS is closed source there was only one place to patch your computer and when that system went down everyone was screwed. With linux, however, there are many more people working with the O/S so the problem would be fixed faster and more efficiently.

This is the wrong question to ask...

[EvilAlien]

... Linux is about control of the code running on your hardware, not about a perfect out of the box solution that any idiot can deploy without having to turn on their brains.

Linux is as secure as we want it to be without being hampered by bad programmers, because we have the power to fix what they broke, bad strategies, because we have the power to plan what they didn't, and bad default settings, because we have the power to install it how we wish. Linux isn't better because it is magically more secure... it is better because we can make it more secure without relying on someone else to be the vendor.

Linux is Open Source

[Anonymous Coward]

As soon as we find areas where Linux security is lacking, we can change it. Lots of people can make changes, and we can use "survival of the fittest" -- In general, the best changes will survive.

Just to say the obvious!

Re: Bad MS programmers

[Anonymous Coward]

Actually, according to McConnell's "Code Complete" (which is MS Press, but is still an excellent book on coding practice), it is true that the best programmers do not rush. Instead they clearly and methodically lay out their design before proceeding into what then is a trivial coding task.

However, solprovider, you must be incredibly arrogant to just assume you could do a better job. If so, why don't you go down to MS and give it a shot? They pay very well, and the benefits are great. I use my XP systems all the time and can't remember the last time I had to reboot. Maybe the reason that their applications aren't bullet-proof is that writing a solid application is a lot harder than complaining about it. I can't help but think you are one of those coders that asks developers to send you a half a million line program so that you can add feature X in a week. But I forgot, you are a miracle worker. Next week, why don't you just code up Longhorn and sell it to microsoft. I'm sure they would be glad to avoid two or three years of work, you would be doing the world a great favor by writing the first program with no bugs, and you could probably make several million dollars in the process. Or are you one of those programmers that don't believe in getting paid either?

Those statistics mean nothing.

[DNAGuy]

In my opinion, you can build a comparably secure system using either Linux or Windows. I have run both, and have never had an intrusion, a virus, or any other malicious nasty.

Based on my anecdotal evidence, if you are aware and stay patched, you are very unlikely to have a problem. If you do not stay on top of things, you are very likely to find yourself in trouble.

Neither OS is the pinnacle of security.

Linux or Apache?

[AstroDrabb]

How can you make a statement on Linux security based on Apace? If Apache is hacked it has nothing to do with Linux. It is just an application that is completely unrelated to Linux. Saying Linux is insecure because of the last Apaceh/OpenSSL hole would be the same as saying FreeBSD or OpenBSD are insecure because someone broke in through Apache. Apache is a whole lot more secure then IIS, though it still had some problems. While it may make sense to complain about MS security problems because IIS is one of their products, it is silly to say Linux is insecure because of Apache. I do think security under Linux needs to constantly be watched, it is very easy to get a big head, become lazy and sloppy and get all kinds of holes. Thanks to efforts like SE Linux by the NSA, Linux will keep getting more and more secure.

Re:Linux or Apache?

[reverendslappy]

How can you make a statement on Windows security based on idiot users opening nasty attachments and not keeping their systems patched? If an idiot user opens malware contained in an email attachment and doesn't keep their system patched it has nothing to do with Windows. It is just an idiot user being an idiot, completely unrelated to Linux...

I could go on, but I've already dipped way to far into troll-land... ;-)

Re:Linux or Apache?

[AstroDrabb]

My point was I could see calling a line of products from one company insecure. Such as MS has bad security because of IIS, Outlook, Outlook Express, IE, Office VBA, RPC, etc. However to say MS is insecure because an exploint in Photoshop brought down 1,000's of systems is just sillly. The latter is what this topic is suggesting. The security of Apache has nothing to do with the security of Linux. Oh, and for a very long time, outlook and outlook express would happily "autorun" viruses for you. It took MS a LONG time to understand the simple concept of not "autorunning" attachments. I do agree that most MS Windows users would not be getting hit so hard by viruses if they would patch sooner and not run unknown attachments. However, MS has focused on the non-technical and have done a good job at simplifying the UI, and have done a bad job at giving that non-technical user a secure environment.

oops my bad

[Anonymous Coward]

I only use windows for playing games that dont work on linux. I don't keep it patched and really dont care how many virii get passed through it because the bad press for M$ makes me smile.

Or...

[cubal]

just quote the variables...

mysql_query("SELECT * FROM users WHERE userid='$USERID'");

That would expand (with your malicious value) to ... userid='5 or 1=1' and so would be harmless. In the worst case, I believe all strings are c-quoted too, by MySQL, so quotes couldn't be escaped either... you'd just end up with userid='5\' or 1' which again would just return nothing.

Much easier in my book, and one less function to execute :)

Re:Or...

[Anonymous Coward]

1. This doesn't work with all RDBMSes (because USERID is an integer)

2. It's easily bypassed:
userid="5'; DROP DATABASE FOO; SET X='"

Re:Or...

[Chutzpah]

I usually run all stuff taken from a user on the net through a function that cleans it up a bit (escapes any single quotes, etc, and I always put all queried values in quotes. (generally I am targeting Postgres, and not worrying about other RDBMS's anyway)

Also, I would truly hope that the database user you are using with your web app does NOT have access to drop databases, I just give the user the minimum access required to make the app run, and nothing more (don't know too many apps that need DROP DATABASE)

Re:Or...

[jani]

Also, I would truly hope that the database user you are using with your web app does NOT have access to drop databases, I just give the user the minimum access required to make the app run, and nothing more (don't know too many apps that need DROP DATABASE)

Fine. Replace "drop database" with "UPDATE user SET password = 'lala'", then. Still unlikely?

I'd recommend learning how to use bind variables, among other things.

Shameless (but relevant) book plug for a friend:

Innocent Code: A Security Wake-Up Call for Web Programmers

Re:Or...

[Chazmyrr]

Very unlikely. At least against my databases. The web user only has permissions to run certain stored procedures. The stored procedures require a 128-bit session token generated at login. Application permissions and row-level security are enforced by the stored procedures. Someone could still hack the web server and alter the application pages to perform some operation when a highly privileged user logs in, but that requires much more effort than mangling some form submissions.

The only drawback to this approach is that providing adhoc searches and/or reporting is much more complicated/difficult since dynamic SQL is not an option. A reasonable compromise when the data is not very sensitive is to create views and grant select to the web user. Then the application can create dynamic select statements.

The biggest problem isn't that the web pages aren't coded properly, it's that the databases aren't designed properly. People write a web app with a DB back end but don't know anything about databases aside from a basic knowledge of SQL. The database itself should implement the strictest level of security and integrity checking within the application. It's closest to the data. The other layers should do their own checks but that's just so something doesn't fall through the cracks.

Re:Or...

[Chutzpah]

I for one certainly wouldn't use username as primary key, I generally index on a generated user ID, and certainly don't use plaintext passwords, I use hashed passwords. Also, in the last app I wrote the user database was stored in a completely seperate database as everything else, with a completely seperate database login. It's not extremely hard to write good web code, you just have to remember that you can NEVER trust any data from an external source.
Also, for user login I generally use sessions (usually a table in the database with current login sessions) and make sessions unique to the IP, and make them timeout after a not very long time, so it would be difficult (I admit there are still ways) to take over a user's login session.
I know that it is impossible to write truly secure code, but there are ways, without overly large amounts of effort, to raise the bar a bit for the crackers, and mostly exclude script kiddies.

Try again...

[lkturner]

Outlook doesn't come with Windows. Outlook Express does. And does your same logic apply to other operating systems? As in, since these 1200 apps came with the distribution cds, any vulnerability in them would be the OS makers responsibility? After all, they were all made by the same "company" (the open source community).

Re:Try again...

[Anonymous Coward]

And now you can tell me how to uninstall outlook express.

Security through obscurity?

[slewfo0t]

Linux is more secure than Windows out of the box by default, but what makes Linux less susceptable to worms and things like ILUVYOU is that no 2 linux systems are alike (Well, almost). If you look at a Windows package, you'll notice that Outlook Express is the default mail program, Internet Explorer is the default Web Browser, plus a whole host of other "Default" tools, utils, programs, etc. The average Joe user just installs this stuff and uses default everything complete with errata. A Linux user doesn't really have a default anything... Each user will have their own flavor of a web browser... An E-Mail Program... etc... Since these worms rely on a common piece of software for the exploit to work, making a worm to exploit Linux is difficult at best.

- Slew -

Ad running on top

[WindBourne]

There is a top ad on the zone-h site put out by zone-h that states that current defacement is

• 53% for windows
• 29.1 for Linux

so by the submittor stating that it is 61% for Linux defacement really does make me think that the submitter BSed or that zone-h had been hacked.
I would love to see the real stats, but the submittor did not give the archival link, but he gave the current link which looked hacked, not /.ed

BTW, 2 years ago, Windows accounted for 49% of all web sites and Linux counted for 29 % according to Netcraft. So the question is, has Linux gone up or down and the same question about Windows. Somehow, I doubt that Linux has gone down, and I seriously doubt that Windows has gone up.
I wonder when netcraft will give that info again.

Linux Blaster worm

[hcetSJ]

You can bet there'll be a blaster worm for Linux soon. Why do you think Microsoft recently started a Linux lab?

Seriously, though, I can imagine Microsoft doing this (albeit very secretively). After all, who knows how to crash a computer better than Microsoft?

Format happy here

[Lost Penguin]

My uptime is about a week before I "try something new" ie format/reinstall or change my os to the "new" one, of course I am the same under Windows, but Windows does not have as many choices in distributions. The plus side is, I get to practice disaster recovery/backups. If they was an exploit I might be "owned" for a week or so.
(before I hosed it ...again)

No Contest

[gutbucket]

The only security parrallels between Windows and Linux is the susceptibility to lazy users. If you don't patch... you're dead in the water and you deserve it. Linux, windows, whatever.

That's where the similarities end. Linux is inherently more organic, configurable, stable and open. Windows has an upper limit on the config bashing you can do and the efficacy of doing so.

If I, with my Linux box have a vulnerabiltiy that that vendor, or code monkey who wrote the thing, doesn't have a patch for... not a problem. I can do any one of a thousand things to make my linux system either more secure or less susceptible including looking for alternative programs that do the same thing. From the kernel to userland... I have control. It's more work, perhaps, but so is police work.

Windows. Please. I'm at their mercy. Their patches. Their schedule. Their patches to their patches. Bah!

Look at it this way: Windows is a prefab house. It comes in one flavor. Once shape. and one color. It is architected (sic) in the hopes of being able to withstand a wide range of climates.

Linux, or any of the unixen, can be a tent you use to climb Everest. Or a mansion in Palm Beach. Or a Hotel in Monaco. Or a skyscraper in NYC. Whatever you want. It's up to you and how hard you are willing to work.

This is stupid

[Anonymous Coward]

Web-site defacements are completely different than a worm. When a cracker defaces a site, he must actively site there and exploit vulnerabilities/holes, whereas a worm preys on insecurity so severe that it can spread without and human interaction.

Like many have said, the human factor is biggest. Bad unix admin = vulnerable unix system. Nothing, really, is inherently secure.

Imagine this-

Windows- expensive, fairly secure safe. However, many users don't or don't know how to close the door and work the lock.

Linux- free, very secure safe. Users are generally more knowledgeable about how to close the door. However, it is less colorful and user-friendly.

In both cases, if the safe-keeper leaves the door open, your money is f*cked. Get it?

Another thought about server OS

[missing000]

According to netcraft the percentage of sites running Apache is 63.72%.

If you consider that the windows version of apache is rather insignificant, I would assume that the total linux web server installations are in line with this number.

Therefore, one must conclude that the predominate cause of web site defacements is negligence, not the opperating system one chooses. After all, technically competent sites such as the one you are reading now almost never get hacked.

Re:Another thought about server OS

[Anonymous Coward]

Well the number of domain names that relate to the Apache http-Server doesn't relate to the number of Linux installations. Take a look at

http://www.netcraft.com/Survey/index-200109.html

and you'll see that about 50% of physical servers on the internet runs some version of Windows.

Re:Another thought about server OS

[julesh]

According to netcraft the percentage of sites running Apache is 63.72%.

If you consider that the windows version of apache is rather insignificant, I would assume that the total linux web server installations are in line with this number.

Actually:

1. There are a significant number of people who run apache on windows.
2. There are also a significant number of people who run apache on solaris, mac osx, bsd systems, or other posix compatible operating systems.

I would expect no more than half of those apache installations to be running linux.

Re:Another thought about server OS

[benhaha]

The troll posted a link to the September 2001 survey...

Nice try.

Re:Another thought about server OS

[42forty-two42]

http://slashdot.org/articles/00/09/29/1245218.shtm l

*cough*

Re:Another thought about server OS

[42forty-two42]

After all, technically competent sites such as the one you are reading now almost never get hacked.

*cough*

Faulty assumptions

[Large Green Mallard]

Just because more defaced sites run linux, it doesn't mean Linux is less secure.

1) Linux security holes are often due to configuration, ie something that a clooful admin could have fixed.

2) Windows security holes are due to the operating system, ie something a clooful admin can't fix (except by installing Linux :) See 1) for considerations of that

true

[10bt]

first, let me state the obvious: there are idiot linux users out there. there are even idiot linux users who are zealously anti-microsoft and pro-linux.

now let me say something that tends to get lost in all this anti-microsoft bashing: the average microsoft programmer probably has a higher IQ than the average joe-shmoe who likes to write "M$" and "microshit". even less obvious (or blindly ignored) is the fact that a lot of if not most microsoft people are actually linux geeks! microsoft runs a bunch of linux servers. go figure...

Deadly virus

[RoboProg]

Actually, if you just delete data, it gets restored from backups (hopefully).

If one *really* wanted to play havoc, you just periodically corrupt something at random. BUT PLEASE DON'T!

I think most of these really are just the work of vandal script kiddies. Except for a few nasty industrial espionage level things that destroy all evidence that they were ever there :-) (what, me worry?)

Re:post your IP and let me run nmap, nessus and ot

[Anonymous Coward]

True. The point of security is not to make your system un-crackable, it's to make cracking your box more trouble than it's worth.

Re: Bad MS programmers

[Boltronics]

I realize that 90% of what you said was over-the-top sarcasm, however I use Windows XP too (in a dual-boot setup with Gentoo). I admit I rarely use Windows except when my uni requires me to write code for it.

Having said that, I do still check for Windows updates every now and then. Last time I checked (about three days ago) I had two updates. I had to reboot. I don't think I have ever had to reboot Gentoo for an update, be it for security or features. That's why I have also deployed it as a server on numerous occasions.

Recent events have shown all too well what happens when you don't do your updates. Do you mean that you didn't update your box?

Hello??

[bahamat]

YHBT.

YHL.

HAND.

C programming intrinsically unsafe

[adoll]

Bang on! The problem is the C platform is not what the engineering profession calls 'intrinsically safe'. Less flexible platforms (Pascal, Java, etc) are designed with things like strong typing or a sandbox model in order to prevent silly things like buffer overflows and underruns. These are safer ways to build programs.

Would you want to work in a mine I design if I didn't put 'end of range' detectors on the skip that runs up and down the shaft?

-Alex Doll, P.Eng (Alberta)

Re:C programming intrinsically unsafe

[Anonymous Coward]

1) It's sad to not see many people using assert() inside of their programming ;)
2) Yeh. That's right. Someone is going to commit the atrocity of writing a low-level program in Java??

Too many Daemons

[BroncoInCalifornia]

When I first installed Linux, it had all kinds of daemons on by defualt. I had no idea what they were and I had no idea how to turn them off. Because I did not know what they did, I did not want to shut them off.

This was a very insecure installation. Lucky I was behind a NAT.

Re:Too many Daemons

[deaddrunk]

That was also a long time ago and common-sense has prevailed since.

OS versus applications

[TWX]

"I am anti-MS because I am tired of rebooting, and know that I could design their apps much better than they ever will. If they have some of the best programmers in the world, why are their applications so bad?"

Hell, I'd be happy if their OS didn't crash, even if the applications did from time to time.

I've been using Linux at home for many years, and I've noticed that applications do crash. Mozilla crashes, ABIWord crashes, StarOffice crashes, but there are two important points to this. First, the applications that I've described are either free or inexpensive. So, I haven't shelled out $500 for a suite of applications that is faulty. Second, it's only the one application that goes down in flames. It isn't the OS, it usually isn't the GUI interface (though X is a hair weak for what I'd like to see), and the other programs remain running without issue.

I don't think that an application should have the ability to crash an OS. That is absolutely ridiculous.

Re:OS versus applications

[mantera]

i have windows xp on a laptop and i really got so sick of crashes, it was almost once a day, that i decided to install linux on it. While trying different distributions one debian based distro fed back to me during the expert bootup that i may need to update my BIOS, so i went to the vaio link update to see if they had any BIOS updates and they had none, however they had 3 driver updates for the ps2 touchpad and sound and some other thing i forgot, altogether over 10mb in downloads. Those updates weren't actually listed on the windows update site. I installed those on the windows XP and ever since it's been rock solid, i've been very satisfied with its stability. I then remembered that, having had this machine for almost a couple of years now, that i have done this a long time ago, and as a result i had gone for many many months, i'm sure over 6, maybe 8 or 9, without a crash bringing down the OS. Perhaps till i suddenly decided to format the HD, i think i was testing redhat/mandrake 8 or something, and forgot about those drivers updates. Maybe you need to get some driver updates from device manufacturers as in my experience, although good, windows update is not so comprehensive, and also, from my experience above, if it crashes too often it's a sign something is wrong rather than it being inherently a problem with the OS. Windows XP can actually be very very stable if this stuff is sorted out, which is something you could easily do.

Re:OS versus applications

[Samhain138]

Well, add Opera & mozilla to that list.
I run a MySQL server on my computer for some of the workers in my office.
They usually use it for their own experiments (I don't ask too many questions :)).
Anyway, one time someone wrote a BAD query (I'm not sure what it was!) and my computer froze.
I was in X, tried to switch to the console and kill MySQL...
After 15 minutes I understood that I'd rather restart and not let the system swap...
X crashed on me a lot of times, but the system kept running, that's true.
This time my entire system was dead.

So I stopped saying that Linux doesn't crash... :)

Re:OS versus applications

[Anonymous Coward]

The problem I have (on linux --not *with* linux) is that sometimes applications can crash X. This basically kills all my other applications.

I find this is really annoying. What someone needs to do is either put some SIGPIPE/broken connection handling in xlib (so that it can wait and try to reconnect if it gets disconnected) or put something else between the client and the server to achieve the same effect.

It's not that X crashes often (about as often as windows did), but that it *needlessly* takes all my applications down with it ( MY ANIME DOWNLOADS!!!!)...

anyway /rant

Re:OS versus applications

[Junks Jerzey]

Hell, I'd be happy if their OS didn't crash, even if the applications did from time to time.

Sigh. I have never had a single crash using Windows 2000 for over two years. Not one. Ever. Windows really sucked back with Windows 95/98/98SE/ME, but not with 2000 and XP. You can bring down XP with some really weird video driver problems (as I've also had happen with X Windows), but otherwise OS-level crashes are a thing of the past. Heck, I've had Linux crash a couple of times--seriously--which is more than Windows 2000.

Re:OS versus applications

[unDees]

I've personally seen Win2K crash/hang somewhere between five and ten times on three different PCs over the past two years, including paging hopelessly and unrecoverably; hanging during shutdown; and a few full-on, core-dumping BSODs.

Granted, that's not nearly as often as I saw with Win9x, but still....

Re:OS versus applications

[mausmalone]

Hell, I'd be happy if their OS didn't crash, even if the applications did from time to time.
I've been using Linux at home for many years,...

figures... I'm very sick of this argument. Yes,.. linux has always been more stable than Win98. But, other than hardware failures, I haven't had WinXP die on me at all. Even then,... with hardware failures, it usually runs just fine. It wasn't uncommon for me to have 2 weeks of uptime on corrupted RAM. The only system instability I have right now are ATI's shitty shitty drivers. Every once in a while, they cause a program to hang, or fail in allocating an overlay surface, or even crash completely. But WinXP just drops to VGA mode when that happens, and tells me what went wrong.

And... I can configure stuff Without using 27,000 different command line tools! I can configure a web server without using a 300 page book and the support of an angry newbie-hating newsgroup! Seriously, though... I'm sure you'd get peeved if I kept comparing XP to Mandrake 6. I don't see why so many people keep using the BSOD as a reason... it's been removed for 2 years now... WinXP just resets when a major error occurs. If you're still complaining about BSOD, you haven't used Windows recently.

Re:OS versus applications

[kumokasumi]

"WinXP just resets when a major error occurs. If you're still complaining about BSOD, you haven't used Windows recently."

That's quite possibly the most absurd thing I've read today! I don't care how it crashes, I want it to not crash! And I assure you, my friend, it has certainly not been removed. I've seen BSOD's on XP boxen, and no lie.

And while we're sharing personal stories, it's not uncommon for my dad's XP desktop to slowly grind its way to a halt and /beg/ for a reboot. I'd almost rather it would just BSOD and get it over with.

I don't think I've ever used 27,000 different command line tools, a 300 page book, or, for that matter, a newsgroup full of newbie-haters to configure my software. I have been known to RTFM early and often, and I've saved myself a lot of grief that way. I've had way fewer problems with bad documentation on my Linux boxen then I have with Microsoft products, and the Linux ones with poor documentation at least seem to follow the principle of least surprise. Have you ever tried to get Microsoft's Network Load Balancing to work properly with any sort of complexity? Dear god! The documentation even openly contradicts itself, and the more advanced configurations are hopeless without it, because it's just so unintuitive.

Go on, keep comparing. I want to hear this.

Trust Issue

[KalvinB]

"Linux is Secure" is thrown around like it's gospel so much it's easy for people to say "my site's running linux so it's secure" while completely oblivious to the fact it's not simply because they blindly believe the "gospel" and never realized you have to do things to MAKE Linux secure.

I don't trust Windows with security. I don't expect Windows to be secure or care that it isn't. I have a router that blocks every port I'm not using. And every program that runs on the open ports (25,21,110,80) are checked for security hazards. That keeps out remote exploits. Then I also run antiVirus software which takes care of local exploits that may happen to get on through FTP or whatever.

I can say "My server is secure" because *I* made it secure. It's not some mindless gospel chant that magically protects my server. It's actual research and dedication to making it secure.

I also log my server in as an admin because I don't care that Windows is insecure. It's irrelavent.

Linux would get hacked a lot less if the "gospel" got replaced with the "truth" that it takes work (and third party hardware like a router) to properly secure any network regardless of the OS handling the server programs.

Ben

Passwords are too blame...or

[Anonymous Coward]

The would all be really bad passwords that were too easy to break. Or really insecure software that shouldn't have been put on the system anyway. But if you have to guess - it was the password.

Paul Seamons

Re:Passwords are too blame...or

[Anonymous Coward]

Nope. Work in a webhosting company...most defacements were done not by cracking the actual account, but by using various small scripted exploits against things like PHP, Cpanel, existing perl scripts etc.. Mostly it just replaced the index.html page and was easy to fix.
Some root exploits were done by running ptrace exploits from phpshells etc. before secure kernels went out.

It's partly negligence on the user's side and partly 3rd party "management" softwares' fault. Most of these servers do not have a dedicated admin clamping every aspect down. Openings for hackers are almost unavoidable in that light. And guess what: a reinstall is a lot cheaper (usually free) than paying an admin. That's what most people choose to do.

see..

[ShadowRage]

people think that "linux is already secure, so I can just run it!" so they do, and dont bother securing it any, and get hacked, not to mention most admins have no clue what they're doing, or read up on how to properly secure a box. to properly secure a box, you must think like a hacker. simple as that. these people need to read up on iptables and keep updates on the latest security issues. most people dont. so yeah. it's not linux' fault, it's the person behind the wheel, it's like accusing a well secured car with a good chassis that wont crush you when you crash of driving you off a cliff. you're the one driving, not the car. same goes for linux. the system only does what you tell it to do, unlike windows.. which controls what a user does. Linux is your system, and it's up to you to make it secure. What people mean by linux being secure is that most bugs and security holes within gnu apps andt he kernel are flattened out most of the time and when discovered, fixed immediatly. and the fact it allows you to secure yourself. and the fact it's security tools are some of the best. that's what they mean by linux being secure. it also depends on what OS you run as well, and hw you set it up, so dont blame a perfectly fine system for the problems lazy/dumb administrators do. sadly, it's those with brains that must do the dirty work to keep the stupids from hurting themselves.

Arrogance and Hatred

[FinalCut]

First off the reason so many posters think Linux is "more secure" is purely arrogance. The primary reason Linux isn't more notoriously hacked is because more people Hate Microsoft. Someday, if Linux succeeds as well as it has the potential to do - Linux will be the hated guy on the block and some new young OS will be the flavor du jour. Bad linux press will abound and the new OS will be touted as the greatest thing ever..

do you take the bus to work too?

[adoll]

I guess getting to email and solitare quickly are more important than making sure all the personal data she has on it is safe.

Not to sound like a troll, but what is wrong with that? People weigh the results of decisions every day: do I drive to work (unsafe, fast, comfy) or take the bus (safe, slow, smells funny). Do I vote for the party that offers free this, free that, and offers to tax the rich to pay for it; or do I vote for the party that offers minimal government services and tax cuts.

She's a grown-up. She's capable of living with the results of her decision, so lay off.

-AD

Now it's 100% windows 2000

[spineboy]

Obviously a snapshot out of time can not really give a good average -it's likely to be skewed.

But I wanna know is that did one of our crafty readers take it upon themselves to , ahem, indulge in a little bit of average shifting? ;-)

Re:Now it's 100% windows 2000

[Felinoid]

Maybe maybe he was just impressed by the 24 hour snapshot.

3 things to consider. Especally with a 24 hour snapshot.

1. Most hobby websites often use Linux. Most Windows servers are entirely business orented.
2. In a 24 hour snap shot no doupt it's the defaced websites themselfs that report.
Often the tools a business uses are reflected in the way the business works.
Open source: Open honnest and part of the community. Will report the defacement.
Windows: Closed dishonnest and protecting stockholders. Will pretend defacements didn't happen.

3. 24 hours is a very short snapshot. What your seeing right now could easly be 100% Win 2K or 1 Win 2K reports being defaced and nothing else.

That explains why a 60% Linux at one point and a few days later 100% Windows...
I've looked at web site defacement records showing days of no defacements.

Right now Windows admin are going to be more frightend than normal and are franticly downloading patches they've ignored for years while Linux admin are preticuarly smug.

Well it's one thing to say..........

[crawdad62]

or at least if I get the gist of the article, to say Linux isn't as secure as everyone would like to think. Come on if it's out there then someone can hack it. Period.

But defacements? It one thing to say someone took a piss in your front yard. It's another thing entirely to say someone pissed in your living room carpet.

Re: Bad MS programmers

[Anonymous Coward]

I am anti-MS because I am tired of rebooting, and know that I could design their apps much better than they ever will. If they have some of the best programmers in the world, why are their applications so bad?

Right.
That's all fine and good until you realize that a typical application is FAR too complicated for a single person to design, even for such a gifted miracle-worker as yourself. So you wind up working with a team of people that hate you because you're so arrogant and a pain in the ass to work with, thus delaying the project.

1 reason why linux *must* be more secure

[Anonymous Coward]

MS would have written a worm to trash any Linux desktops out there ;-)

and how to defend yourself

[Isomer]

The reason defacements are so frequent, is that insecure PHP code (in particular PHP Nuke) and then they can read/write what the web server can, which often (for some reason) includes the web pages. (Even though usually you don't want your web servers to have write access to your web pages, people set it up this way for some unknown reason).

I've had a server exploited before because some user ran phpnuke. Sigh. It didn't appear they got root, but we had to reinstall everything anyway. Grr, from then on, new sites had to be approved by me.

As one of the security precautions that I ended up adding, was firewalling outgoing network connections from the apache user. Apache needs to connect to port 25 on the SMTP server (since we have some apps that send mail) and port 53 on your DNS server (for various reasons). Also incoming connections to non-port 80/443 are REJECT'd. This mitigates the damage a user can do once they have compromised a system especially as most "exploits" seem to want to try and download the rest of the exploit usually via HTTP, without network access they can't. This is now a standard item on any web server I install. If you're interested in this, look up iptables for --uid-owner.

You can repeat this trick for other services (such as DNS, SMTP etc) that you have to run.

GNU/Linux can have a lot of artificial difficulty

[The Revolutionary]

Having learned how to use ipchains or iptables doesn't say very much about how intelligent you are.

Having learned how to write scripts for sh or bash doesn't say very much about how intelligent you are.

Having learned the syntax for sendmail configuration doesn't say very much about how intelligent you are.

Configuring, patching, and building Linux (kernel) doesn't say very much about how intelligent you are.

If it is not your job to know these things, and if were you to put in the time and effort you could learn these things, then your not knowing how to do these things says practically nothing about how intelligent you are. These syntaxes and semantics are very ugly, temporal, technical things.

Will we even think of these things in ten years? Is a programmer who knows COBOL like the back of his hand and yet couldn't if his life depended upon it learn to follow good OO programming practices or how to use Scheme or Common LISP, very intelligent so far as this field goes? No, no I do not think we would consider such a programmer to be very intelligent at all.

If doing your job requires that you write VBscript and use a GUI to configure ACLs and various servers, and you have successfully learned to do this, you are in virtue of this alone no more or less intelligent than any GNU/Linux or *BSD admin using shell scripts and text-based configuration files.

Knowledge of these passing things is not the measure of a (wo)man.

From WordNet: intelligent, 1: "having the capacity for thought and reason especially to a high degree."

That said... Screw you, Microsoft.

Mine is...

[RevSmiley]

My copies of Linux are more secure. They are not out of the box secure installs however with stuff running I don't need. No OS is secure by default. Generally you have to make it that way and keep it that way. By the way the only time any of my hosted sites were ever cacked it was on a BSD machine.

SECURITY IS AN ILLUSION

[Proudrooster]

Yet another raging battle on which is O/S is more secure. Hear me when I say this, "Security is an ILLUSION!". Even if humans could create a flawless bulletproof secure system, that system is going to have users and, as soon as you add users you can throw security out the window.

Look at all the companies that were taken down by Blaster and Nachi. Didn't all these companies have extremely powerful and sophisticated firewalls guarding their networks? Sure they did, but the VPN/dialup/laptop users were able to get in after becoming infected and circumvent all the elaborate and expensive security. Somtimes I think firewalls are a total waste of money.

I won't even get started on the topic of extremely weak user password, unsecured dialup modems, and firewalls with way too many open ports.

Luckily all the worms and virii to date have been "mostly harmless", but the day is coming when a hacker in China or Russia is going to get the urge to make a political statement and start wiping out data.

Argue and discuss this topic all you wish, but know that the dialog is meaningless. SECURITY IS AN ILLUSION!

secure email

[autopr0n]

Another example, a little more relevant to this case: people want their email for sending dirty pictures, HTML joke pages, funny Flash or Shockwave animations, Active X games, etc.

Other then active-X, none of those things even NEED to be left out of a secure email system. Assuming that the Flash and JS interpreters were bug-free. In fact, if windows was done 'right' you could even run active X (but it would still be a bad idea)

Re:secure email

[Art Tatum]

Yes, but my point really was that users were expecting that email was a perfectly legitimate delivery system for anything and everything; and also that access to aforementioned multimedia and binaries should be completely uninhibited. Email applications, and especially Outlook, is really a poor vehicle for distributing games and applets. Anybody can send you anything unsolicited and unsuspecting users often don't realize just how malicious some people can be.

Who's to blame?

[Max Threshold]

I was just thinking the same thing this afternoon. You're totally right. But, who do we have to blame for this? It wasn't the users' idea. They were perfectly happy with plain text email until some idiots came along and developed an email client that supported HTML and scripts.

You really need to learn some history

[Anonymous Coward]

Have you never heard of Robert Morris???

Moron

Re:You really need to learn some history

[Anonymous Coward]

Bob,

What have y0u don3 4 m3 L8ly?

Sincerly, the first internet worm, circa 1988

http://world.std.com/~franl/worm.html

The one thing that is more interesting to me than anything else about this case was that Bob is the son of the former chief scientist at the National Computer Security Center -- part of the National Security Agency (NSA)

I just wonder if Bob hadn't been reading too many of pops' notes and unleashed one of the first military attacks on the internet, accidently.

More Savvy != More Secure

[Nishi-no-wan]

- As a result, people with more tech knowledge tend to also run a more secure system [...]

According to this reasoning, companies that have a good IT department with knowledgable system administrators shouldn't have been hit by these latest two bugs. And I'm sure that nobody will argue that the DoD doesn't do everything in their power to make sure that the only spyware on their machines is the spywhere they put there to monitor their minions. Yet, I recall reading that the Navy/Marines' network was also brought to its knees (although no intrusions were reported for "really" secure systems).

I guess there's nothing any of us can do to be totally secure beyond unplugging that network cable.

So what exactly are they exploiting?

[Nailer]

Since a vanilla Red Hat install leaves one port open by default - a DHCP client.

Not reinventing, re_implementing_

[Ayanami Rei]

No one reinvents (it) without using older models as a guide (those that don't usually get torn apart for being shallow).

eeprom security-mode=password

[Ayanami Rei]

n/t

A password on her laptop...

[Ayanami Rei]

will not protect her data if the laptop is stolen. It can help prevent remote attackers from accessing it (or you DID help her activate the built in firewall and disable the Windows Server service, right?) :-)

Short answer No, Long answer "Of Course"

[MickLinux]

Is Linux as secure as we'd like to think it is? No. I'd like to think that my Linux box is completely secure, thank you very much.

But that said, in my finest Lewis Carollian tradition and practice, I not only *think* it's inherently secure, but for five minutes per day I outright completely believe it's inherently secure. If you remember, Lewis Caroll was a famous British mathematician, and quotes of his are incredibly important within the computer security industry.

It's just that I already wasted my five minutes today, and don't have more time to spend on it, while I made this posting. Catch me again next week with Taco's Weekly Topic Rerun, and you'll see me post a proof of why Linux must be 100% secure, and an insecure Linux box does not exist.

Application diversity is key

[infernalC]

There are of course many possible reasons why particular platforms are more susceptible to or are more frequently targeted by malicious activities. I contend that application diversity on a platform is key to its susceptibility.

For example, virtually all Microsoft Windows systems have very similar web browsers, scripting engines, pop/imap clients, and CIFS services. This makes a widespread exploit very likely.

UNIX and Linux systems, however, exhibit a much greater variety of applications. A typical GNU/Linux user might use PINE for e-mail, Mozilla Firebird for browsing with a Blackdown JVM, postfix for an MTA, etc., while a no-less-typical user of even possibly the very same system might choose to use elm, Konqueror with a genuine Sun JVM, and sendmail, while yet another might choose Evolution, lynx and fastmail. Get the picture?

UNIX systems are extremely diverse, much more diverse than in days of old when the was only one MTA. Just about the only ubiquitous daemon out there anymore is Apache httpd, but even it has good alternatives for certain applications. It is very difficult to write a worm to take out the vast majority of UNIX and Linux systems because they are all so different.

Windows systems, on the other hand, are about as diverse as the shoots of asparagus in a tin can. There is only one packager. There are only about five major default configurations out there, and the is only one default TCP/IP application suite. The installer has no options for activating or even making system administrators aware of security measures such as state-tracking firewalling. This bland array of distributions of Windows makes for a class of systems ripe for the picking.

Perhaps Microsoft would be better off offering an array of products (a nice web browser, a good proprietary scripting engine, etc.) but letting other folks distribute them as best-of-breed packages; I'm not saying that they should make their software free but that they should make their software the best and rely on the merits of their software to support their business model instead of monopolistic shenanigans and vendor-lock. Perhaps if MS let others package their software in other-than-Microsoft's-default-way, then the differences in configurations might just be enough to disuade a little of the viral heat. Also, this would lead to the distrubutors having a vested interest in the integrity of MS's software and would place the burden of creating good security-conscious configurations on third parties. Apache httpd can be just as bad as IIS if you set your DocumentRoot to /, let anyone run scripts anywhere, or had PHP set up with a super-high http post file upload limit.

Just a few rantings and ravings.

Teach them Bash.

[MickLinux]

Teach your guys how to use Bash. Then have them write their own little Bash shortcuts, which take only 2 characters plus a target name, assign them executable status, and put them in their personal bin folders.

Have them tell you about them, and post useful shortcut names + Bash command, each week, near the coffee machine. That will help standardize their commands within the company.

Problem solved.

Savvy Linux users?

[msobkow]

It's not necessary to be all that "savvy" anymore. If you're running a stock box, you can have a SuSE or Mandrake system running on the 'net with a high speed link in less time than it takes to install WinXP.

Just leave it at the default workstation settings, and answer the questions -- same as you do for Windows.

Granted it's not set up the way I'd want it, but current releases are pretty damned good for mom & pop who just want to browse the net and read their email. It even helps protect them from the "social engineering" click-me trojans, as most of that junk is engineered for Win32.

What bothers me more is the mix and match of OS and webserver stats in the main slashdot article. Most desktop Win32 users aren't running IIS, so why would we include Apache breakins and such under Linux when comparing/discussing security?

Re:Savvy Linux users?

[nojayuk]

It's not necessary to be all that "savvy" anymore. If you're running a stock box, you can have a SuSE or Mandrake system running on the 'net with a high speed link in less time than it takes to install WinXP.

Just leave it at the default workstation settings, and answer the questions -- same as you do for Windows.

I tried that recently, using the latest professional copy of SuSE (8.2?) After asking me a lot of questions the installer started up the DVD and failed to find any of the files it was wanting to install. I gave up and loaded Windows 2000 instead which seemed a lot less inquisitive.

I don't think I've ever successfully managed to install Linux on a box -- no, I tell a lie, there was the one that I squeezed into restricted hard disk space allowing it to choose what to put in -- Mandrake 9.0 if I recollect. When I started it up I found it had not put in any networking or dial-up support as it couldn't fit it into the 1.6Gb I had allocated. There were a lot of compilers and other stuff I didn't need though (what does a user need a compiler for?) I went back to Windows which fit on 500Mb with networking.

Re:Savvy Linux users?

[hitmark]

sounds to me like you forgot to select the nwtworking part of the package while you selected the development selection. as fo 9.0 mandrake have been very easy to set up (alltho is stuffs in 3-4 spreadsheets, atleast that many wordprosessors and god knows what else if you select the base office selection). only real problem i have had with mandrake was getting a friend on the net (some internal isdn solution, similar to a winmodem i suspect) while ones when i wanted to install win2k for another freind i ran into problems douring hardware detection (some winmodem or other, removed it, installwent fire, reinsert and detect)why it hanged there but could handle the device fine if inserted after windows was installed is just strange, inconsistant behaviour...

Re:Savvy Linux users?

[nojayuk]

sounds to me like you forgot to select the nwtworking part of the package while you selected the development selection. as fo 9.0 mandrake have been very easy to set up

I had 1.6Gb of HDD space to take an OS plus some apps. I let the Mandrake installation decide what to put in there. What it gave me was a whole load of things like compilers (which I'd need to hand-patch the kernel or whatever) and zero networking support. The W98Se install I followed this with gave me no compilers (as MS doesn't expect the user to have to patch the OS by themselves) but it did give me networking and it all fit in 500Mb (including, I think, swap space). Linux is bloatware but it can be trimmed back by a knowledgeable user. Windows is bloatware too but it's on a diet and watches what it eats.

Re:Savvy Linux users?

[hitmark]

windows is bolatware and does not let you customize the install, linux may be bloat if you let ist install whatever it likes but if you pay attention it will not installsomething you dont want. and i can claim that i never have patched a kernel myself, i just download the latest from mandrake:)

spunds like hardwaredetection didnt detect a modem, isdn or network card as if it had im sure mandrake would have installed the neeed stuff to use that. do you recall what kind of hardware you had?

Re:Savvy Linux users?

[Stephen Samuel]

e. What it gave me was a whole load of things like compilers (....) and zero networking support. The W98Se install I followed this with gave me no compilers (as MS doesn't expect the user to have to patch the OS by themselves)

This reminds me of a quote from a comedian about party crashers.

You know how some people will show up unannounced and spouting about how you forgot to tell them, and they're sure that if you'd seen them, you would have told them???? Well, I want you, now, to know:

If I don't tell you, it's because I don't want you to know.

Compilers for Windows are an extra couple hundred dollars. The reason why XP doesn't load compilers is because they're not available.

Unlike Windows, Linux installs are capable, out of the box, of setting up anything from a kernel developers box to a minimal firewall.

I've never done a Mandrake install, but I'm sure that it's got a "desktop office box" style of installation. Asking mandrake to "just install whatever" into a relatively limited space is just asking for trouble. 600MB of disk space will fit a Linux installation with about the capability of Windows (i.e. no compilers, word processors, etc), but you do need to say what you don't want.

Re:Savvy Linux users?

[KRW]

Are you crazy?? If Linux was installed and had as few apps as WIN98 (as I recall it doesn't even have a winzip equivilent), it would take far less space. With Linux taking that much space (anywhere near 1.6G, you had about everything but networking installed!!!!!!

No OS is perfectly secure...

[borgheron]

To say otherwise would be a lie.

Windows has a great deal of exposure. Therefore more people hack it. Windows also was not designed to be secure. This is apparent in some of the things you see in it every single day, like how a single Window's box handles multiple users (not cleanly in my opinion).

GNU/Linux was designed to be secure, but doesn't have as much exposure although it is doubling pretty much every 12-18 months. If this moore's law like trend, let's call it Greg's Law ;), keeps up then I predict we will see more security vulnerabilities showing up in GNU/Linux as time progresses.

The assertion that less worms implies more secure is a logical fallacy to begin with. If no one is writing worms for your OS (that is not to say no one is *using* it... lots of people are including myself) then any security issue you've got won't be apparent.

GJC

P.S.

[msobkow]

I'm not kidding about the install time. A SuSE 8.1 3-disk install was asking for the config details before WinXP was done identifying hardware (same box.)

Add in the time and hassle of temporarily swapping out NVidia GeForce series video cards to do the initial WinXP install, and the raw-hardware-to-internet time is less than an hour for Linux, and almost 1.5 for WinXP on the same hardware (CUSL2 PIII/933 512M/PC133/CAS2 60G/7200RPM GF2MX.)

Hypocrisy Again?!

[metalmaniac1759]

Just yesterday there was this story on Slashdot about a new version of OSSTMM (Open Source Security Testing Methodology Manual) being released. I noticed, only 6 replies to that.

And as soon as there is some story even vaguely hinting the words Windows, Linux and security - there are 100+ replies.

When will we stop comparing Linux with windows and start doing our own thing?

Nandz

Automatic login isnt bad

[Anonymous Coward]

It is a myth that automated login is unsecure.

Anyone with some physical access to a machine and a boot disc/CD can hijack the said machine.
And this with EVERY OS out there.

The only REAL protection is an encrypted filesystem, but very few people use it. After all, their PC is worth more than the data on it. So when the PC is stolen, they dont worry about someone reading their archived email, but about the money they need to replace the PC.

Therefor automated login FOR A PHYSICALLY PRESENT USER isnt bad. Some Linux Distris offer this as well and as long as you dont have kids/a girlfriend that you dont want to run into your hidden porn folder, automated login does no harm.
Requiring a password from the person sitting in front of the computer is really just like putting the cookies on the highest shelf. Anyone tall enough can get it, but you imagine your 3-years-old wont ;-).

So the automated part of the login of a physically present user does no harm. However, I suspect that your girlfriend does automaticly logs in with administrator rights and this IS a problem.
But it is a problem even if she would type a password.

Exactly - its a server OS

[gad_zuki!]

Its a server OS that comes bundled with every service imaginable. I can almost picture the parent's IT department. "Yeah we're running redhat behind a firewall so its cool." Actually no, you still need to patch and be just as viligant, if not more so, than using a windows server.

What these "keeping the net healthy with secure computers" arguments come down to isn't really security design or user knowledge as much as it is the number of exploitable services running by default per machine. Imagine if Windows didn't allow file, print, RPC, etc on the WAN connection by default. Or if IIS was a seperate download that when installed also installed autoupdater to patch the machine every so often with .asp off.

Same with any OS. I'll take the "controversial" stand that the net is better off with Windows machines than Linux machines. I've seen the default installs on both and the Linux vendors and distro makers really need to learn what "install only what I need" means.

Most people, even power users, don't need DNS, Samba, telnet, ssh, ftp, etc running by default. Yeah, I know some distros are cracking down on this, but if every windows machine was replaced with a popular linux distro from last year we would probably be in a worse situation than we are in now.

The only saving grace I can think of is the Linux is usually bundled with a firewall, but a lot of good that will do you when the "click-through easy setup" opens all the exploitable ports anyway.

Isn't that why we have "owner/group"?

[MickLinux]

It seems to me that when I wanted to set up my sound system, I didn't actually have to start logging in as root. Rather, I set up a "sound" group, gave it specific privileges, and then added my user name to "sound".

Now, it seems to me that that is role-based privilege. That is distinctly opposed to the Windows system, where you assign a program "trusted status", and then everything it does is considered okay.

I suppose there is a possibility for a third model of security, perhaps something you'd call database security. Every program and subprogram has the subprograms/GUI routines that it calls, and when you set up the program, you specifically give it access to those routines and no others. Then users' shells are just another one of those programs, and each shell has its own database reference list. If you need mail priveleges, you have to ask the admin.

But that kind of a security setup is going to take a ton of time to check as a program runs, and even that is going to be "broken" for a lot of business models.

As a result, there's a different kind of security I favor: it's the broken network security method. You have your internal computer network, with whatever security it has. And you have your webserver/email server. And those two computers are not on the same network. Rather, it takes physical access to get data from one to the other. Either that access is through manually installing a network cable for a short period of time, or transferring a CD-R, or some other similar method. But 99.4% of the time, there is just no access whatseover. Such a system is mostly secure against net-based attacks, 99.4% of the time. I say mostly, because someone with insider knowledge could concievably root your net box, and then have it wait until someone connected in the other network, and immediately launch a predefined attack... but that's probably less likely than J03 51XPAcK owning your 100%-internet-available company network.

Re:Isn't that why we have "owner/group"?

[IntlHarvester]

Not really, because that scheme does not prevent you from running malicious or buggy programs that mess with your sound settings.

I'm thinking about something more along the lines of a "sandbox" system. When you install a CD player, for example, you'd see a dialog for what privileges the program has:

[X] Adjust Sound Settings
[ ] Send Email
[ ] Move/Delete Files
[ ] Open Network Port ...

Programs that vector in from email could have artificially restricted settings.

Of course, there's a host of implementation problems, not the least being that neither Linux or Windows was designed with this sort of security in mind. This would also be very PC specific -- in most cases it seems like existing model works for server systems.

Linux "defacements"

[FS]

Zone-H mostly posts defacements, and the reason this is easy is because of all the wannabe linux people out there. It isn't all that hard to download a RedHat ISO, slap an exploitable phpnuke on it (or some other php based web tool with a hole) and bam they go down. Maybe it takes a month or two for an exploit in their version of to surface, but when it does, they aren't paying attention as much as the people doing the exploitation.

Keeping a box up to date is important no matter what the OS. Windows makes it easy with WindowsUpdate. RedHat and many other Linux distros make it more difficult with pay-to-update or oops we-broke-your-config updates.

Linux can be more secure, but only when you know what you are doing.

I'm late to posting, so this is probably redundant by now.

Re: Bad MS programmers

[solprovider]

I had sworn off responding to ACs, but you agreed with me so I'll answer you. I am currently reading "Code Complete". (Well, I am in Ch.11 and haven't touched it in a month because there is too much work and summer fun.) I learned from people who had read the book, and much of it is common sense, so I am not learning from it, but I would highly recommend it to any new programmers or PMs.

First, I am not an OS developer. I do not pretend to be one. I am a consultant that builds applications for very large corporations, and yes, I believe in getting paid.

I could help with the DESIGN of MS products.
- Start with removing tabs from almost everything. They are a very poor interface. Computer data is meant to be viewed vertically. Sections (twisties that hide vertical data when closed) can keep things organized. That interface has been proven easy-to-use. MSWindowsExplorer, AcrobatReader, and Mozilla uses them for menus on the left. They are also very useful for content. Having your important network settings scattered on 3 of 7 tabs (with only one prioritized since it opens first) is painful.
- Properties boxes that allow context sensitive settings are great. OpenOffice and Adobe and Lotus products use them. Why doesn't MSWord?
- Pet peeve: MSExcel. Try programming it. If you make one mistake, it pops up an error. You cannot see the code while seeing the error. And if you click/type one thing wrong, it deletes the code with no warning. Nobody can call this user-friendly. Lotus 1-2-3 did it better in the 80s.

I have probably worked on a half a million line program so that you can add feature X in a week. I never asked how many lines of code there were. I do not need to read an entire program to find where code needs to be inserted to add a feature or remove a bug. I was able to locate and fix 200 bugs in a large application in 6 hours. The PM was upset because I was not testing the fixes (he was very paperwork oriented), but the 6 developers were doing the testing as I worked and were happy that the bugs were disappearing.

I do not want to work for MS:
1. I do not like their ethics. If I treated my customers like they do, I would not have any customers.
2. I believe MS is about to go down in flames. Why join a sinking ship?
3. They may pay very well, but I probably make more as a freelance than they would pay for any technical position. I would also lose control of my time.
4. I live on the wrong coast. I travel frequently for work, but a "job" with MS would probably require relocating to Washington.

I almost took a job with IBM; I like their software, and would like it to be more usable. But I doubt I could survive working in an office.
I am unable to work 9 to 5 for more than 2 weeks without going crazy. I am too comfortable having a few months off each year. I like results; I do not consider office politics to be fun. I am a consultant because I have to be, not because the money is fantastic (but it doesn't hurt.)

Not a Linux problem

[gerardrj]

A web site defacement on a Linux machine is probably not a problems with Linux, but a problem with Apache, ncFTP (or UWFTPD or any of the others), SAMBA, Sendmail, or anoy of the other projects that people tend to run on top of Linux.

Arrogant Gifted Miracle-worker

[solprovider]

Here is another response to an AC.
I covered some of this in a post above that is currently modded Off-Topic. How can I be off-topic when I am responding to a response to my own post?

Yes, most projects involve many people. Even if there is just a single point of contact, that is one other person with whom the developer needs to be able to work.

I have several advantages when working with teams:
1. My great personality ;)
2. I am usually added to a team because they have a problem they could not resolve. Everybody knows I am there because I have abilities that were not already present. I must be very careful not to rub their nose in that fact, or I will not be invited back. (I actually had a PM doubt my abilities because, while I let my confidence border on arrogance during the interviews, I was "too nice" when I met with the team.)
3. People who work for companies rarely have the opportunity to learn from people outside their corporations. Almost every one of my assignments involves some "knowledge-transfer" to the regular employees. The teams WANT to get along with me so they can learn from someone new.

I know that many "gurus" have the reputation as arrogant and a pain in the ass, but the reality is that if you want to be a successful consultant, you cannot be either.

Re:Arrogant Gifted Miracle-worker

[110010001000]

"I have several advantages when working with teams:
1. My great personality ;)"

Obviously.

I'm no statistician but....(the last word?)

[s4m7]

The website defacement archive at Zone-h shows that Linux accounts for 61% of the defacements in the last 24 hours

that's funny. Netcraft says that apache accounts for 63% of www servers. I can't be sure, but there may be some reason for this correlation.

Security experts have said for years, here and elsewhere, that security is a process, and a function of administration, not some tangible goal that can be reached. Ultimately, it is up to whoever has a secret to make sure their secret is safe.

Linux is one of SEVERAL fine operating systems that give the independent system administrator the ability to examine the security flaws in their system, and to correct the problem on their own, given they have the know-how. The paranoid often do. Closed-source operating systems simply cannot offer this level of security.

What in the... I thought I was reading Slashdot?!?

[reverendslappy]

I'm SO looking forward to scrolling down and reading about how those defacements were results of irresponsible administration or loose apps... But it's going to be hard for me to remember that I'm reading about Linux and not Windows.

Jeez... What the hell happened to the /. I know and love? Another article like this and the "News for Nerds. Stuff that matters" might have to change to "Fair and Balanced".

*grin*

Defacement not really applicable

[brucmack]

Defacement really has nothing to do with a widespread virus... In the case of a defacement, a hacker is specifically working on ONE system. Next time, the exploit used to get in could be completely different.

Since there are so many different flavours of Linux, the chances of having one virus capable of attacking millions of computers at once is lowered substantially. Whereas Windows systems are pretty much identical.

Unless there is something really really wrong in the Linux kernel, not every Linux installation is going to be vulnerable to one virus, methinks.

Now, this could of course change if Linux gets mainstream, because end users are going to want some kind of standard build... that's when Linux virii will become a problem.

61% of sites run php

[realkiwi]

Linux has nothing to do with site defacement. Buggy Apache modules do...

I have used off the shelf exploits on my brothers IIS web server that got me into his web servers file system. I don't know who is to blame - Windows or IIS... But when you see a defaced Linux web server the answer is nearly always "php"...

Linux is not inherently more secure

[kris]

If you want to discuss the success probability of a worm, there are three aspects here which need coverage: First is the actual quality of the implementation of the operating system. Second is the concepts behind that implementation. Third is the density of the system population.

The quality of the implementation in Linux is highly variable, depending on what part of the system you are looking. There are parts of Linux that are of an extremely high implementation quality such as the kernel, the Apache web server or other active and well researched projects. There are other parts of only medium quality such as for example the popular PHP language.

And there is a lot of stuff that is of actually pretty low quality, badly researched and incredibly crappily written from a security point of view. Common PHP applications such as PHP Nuke, TikiWiki or other "CMS" style applications belong into that category. Getting web server privileges through one of these using a pathname exploit, badly written uploads or other commonly known classes of security problems is usually a piece of cake. From that you need to find a local root exploit to own the machine. That's a little harder to do than a simple web exploit, but also nowhere near impossible.

Also, current PHP coding techniques do little to minimize the amount of such code being written and to encourage clean coding. Brings us directly to the concepts section: There is no equivalent of ASP.NET type infrastructure and tools in the PHP world. Window may have bugs, but in this particular instance they may be in an area where PHP for example has not even code to show...

When you are discussing security concepts, Windows often is on par or even surpasses common Linux systems. Windows failure is too often in the area of implementation, or it fails to leverage and deploy the concepts it implements. That's why Windows passes US and European securty evaluations, but does not feel "more secure" in day to day use. For example, Windows had Access Control Lists as part of NTFS since the very first 3.0 days.

Only with the advent of Windows 2000 Microsoft started shipping Windows with halfway decent defaults, though. Also, getting to see and check the ACLs of a directory hierarchy with onboard tools is laughably complicated to what Unix presents (namely, a moderately complex security system with ugo/rwx and ACLs tacked on for that special cases, and "ls -l" to mass check an entire directory with a single command).

Windows also has superior concepts regarding impersonation (instead of SUID), RAID as part of the default operating system way before the actual Unices had it, a PKI and a directory service as part of the default operating system shipment (and code that actually uses that, by default, unlike Unix, where you have to jump though hoops to get your mail server, samba server, your different logins and your client applications to use such a service if you had one by default) and serveral other things that look nice in the book.

Unfortunately, all of this is of little use against worm style attacks. Here the conceptually bad parts of Windows reign: Treating data as code and in some cases even automatically execute data that has been recognized as code (HTML mail with Javascript, Office macros, HTML with Javascript that is being executed when entering directories) is the major attack vector. Also, badly designed and protected desktop IPC, allowing for the shatter attack and other legacy sins make the Windows desktop a primary target for worms and viruses. None of the above security mechanisms help protecting against this style of attacks, which is why Windows looks good on paper, but not on your desktop.

Also, unfortunately, the Windows population in your average company is dense enough and homogenous enough to allow for wildfire type effects when the attack is spreading over the network.

Linux has similar vulnerabilities as Windows has, but we do not see them at the moment, because even if there were a worm that could uti

Isn't this spurious data interperetation?

[Dispader]

The website defacement archive at Zone-h shows that Linux accounts for 61% of the defacements in the last 24 hours (note, this figure changes, so it might be different when you view it). An analysis of the last few weeks of their archive shows a similar percentage of exploited Linux systems

I may be missing something, but this quotation seems kind of misleading. According to Web Host News, over 62.5% of all web servers are running Apache. I'm presuming that most of those Apache servers are Linux servers (does anyone have the numbers?), and if that's at all close to true... it seems like highest number of Linux site defacements is proportionaly less-than-equal to the number of Linux servers.

Also, I've never seen any high-visibility sites stay on MS/IIS for very long (MS hasn't even run MS on some of its high profile sites at times, because the platform simply couldn't handle the load). If it's even true that a disproportionate number of high-volume sites run under Linux (and I certainly know some of my customers do); well, wouldn't those sites be the most likely to be targets for defacement?

And, if either one of those mitigating factors is close to true: that's a pretty good track record. If neither is true, it's still a good thought experiment which demonstrates that taking these numbers at shock value doesn't really further understanding of how the different OSs are performing security-wise.

I don't think anyone should be so bold as to say that there will never be a security problem with a system, but throwing evidence like this out seems as scientifically responsible as trolling or grandstanding. The data just doesn't seem to mean anything.

Jake

Sure

[dazk]

There *will* be new Worms with Linux or more exactly Services running on Linux as a target. There will eventually be (more) Viruses (than the proof of concept viruses we have today). But to be fair, you have to make a difference between the types there are. Sobig is a completely different beast compared to the blaster thing. Blaster like outbreaks are definately possible with Linux. Eventually there will be another easy to use root exploit (think wuftp as an example) and then there will be worms exploiting it. It just has to be in a service that is default for most distributions. OpenSSH an Apache would probably be some of the most dangerous targets because of their installed base. Worms like blaster exploit programming errors. Since programming errors will always happen, there's always the chance of them happening in highly relevant places in regard to security.

The Sobig stuff is a completely different matter. Those are enduser worms. They need help of an enduser clicking on something. To be exact, those worms are outlook worms. Microsoft could stop or slow down those worms by making it harder for endusers to execute the malicious code. Linux is only (much) more secure here since poeple would have to save the attachment (seeing the full name, not just the xxx.txt part of xxx.txt.exe), make it executable and actually run it. As long as Linux mailers will not offer click and run for mail attachments, worms like that have the threat leavel of those sigs you sometimes see, saying hey, I'm a sig virus, please copy me to your sig. I'm sure though that an Outlook version that shows the full filename and does't allow executing attachments, maybe even marking them red will drastically reduce dangers of emailworms. And no, the recent methods to tackle the problem are not the right way. Blocking executable attachments completely will just make people disable the measure since it reduces peoples ability to use the software.

MODS ON CRACK!!!

[Travoltus]

Zeinfeld's post is not a fragging troll.

He doesn't write like a bullshit artist, and although I REALLY have a problem with his WinSHIT defense, he's got some good points. Linux is a patchwork system, although it's quite good at it when stuff actually interacts. Linux has quite a bit of room to improve.

Re:MODS ON CRACK!!!

[Anonymous Coward]

"Zeinfeld" has always been a fraggin' troll. He posts the dumbest crackhead fantasies and gets modded up because people are all nostalgic about the Seinfeld show and don't read carefully enough (these are Slashdot moderators, remember?) to notice it's not Jerry posting.

You could probably use the name Linuss Torvald and fool people into modding you +5,Informative on hourly Soviet Russia botposts.

That depends.

[Anonymous Coward]

How secure do you think Linux is?

Apples and Oranges...

[Dillon2112]

There are many different ways to twist statistics...if there is one thing I learned being an Operations Research major, it is that statistics tell the story you *want* them to tell...
There many elements to this analysis:
1) What percentage of servers run Linux vs. Windows? This is key to understanding the percentages of exploited servers.
2) Define security. I'm not so sure defacement==security, and certainly it might be shown that while Windows and Linux are both exploitable, the nature of the majority of the exploits present on each system differs greatly.
3) The security of an OS may be best represented by *fully updated* versions of that OS. I doubt many of the defacements on Linux systems were using the most recent patches, but I believe SoBig took advantage even of the most updated Windows machines. MS released another patch AFTER the virus was out there, to my knoweldge. If I'm mistaken, great, but the point stands that it is not fair to rate the security of an OS based on old versions that are known to have exploits. Its always important to keep systems updated no matter what you choose to run. Security is not a scale of where the software is, as much as it's an attribute that is determined by the deployment of the OS, and how well the authors of the software, and the administrators of the servers keep up with the scene. There will always be new exploits.

We certainly have shown that proprietary software has one serious weakness: when an exploit is found, the patch is coming primarily from one source, and worms are learning to exploit that weakness. While SoBig didn't do it well, there will come one that will. The idea is certaihnly out there.

Err... rootkits are post-crack tools

[leonbrooks]

In other words, they're what you install if your intrusion succeeds, so they don't tell you very much about the number of ways to crack stuff.

They also suck, since many of them are built statically against old and broken libraries, which results in even the overt parts of them not working properly (and in some cases killing your system completely).

Re:Err... rootkits are post-crack tools

[Reziac]

Yes, but -- I think it's a good indication of possibilities and the level of cracker interest. And it does indicate that there are nn-many ways to exploit what you've busted into.

I viewed available source for a few of 'em, and even to a non-coder, some looked ugly and kludgy. Some even had comments about "this is the sloppy way but I'm too lazy..." etc. So it's no surprise if they don't work right. :)

Re:Err... rootkits are post-crack tools

[Anonymous Coward]

Well, with most of the rootkits I have seen, they function the same way that a virus/trojan works in windows... recording keystrokes, opening certain ports so that the cracker can connect to the computer, and other things of that nature.

Yes it's not and no it is

[Felinoid]

Linux is more secure than Windows becouse we know it's not secure enough and never will be secure enough.
Windows however knows for a fact that is secure enough as a direct result it's not secure at all.

The latest clame that Windows is insecure by design is basicly saying that Microsoft didn't even think about security when the first designed the operating system years ago and just folowed the basic philosophys behind Dos.
At the time Dos was the only operating system to have viruses and people were crying fowl over this. That Microsoft could do better and if they do make a new operating system they should.

(It wouldn't be untill Apple adds multitasking that Macs would have any viruses)

To ferther the point a number of products entered the market to make Dos more secure. Password protection to keep users from using the computer and the ability to write protect hard disks were just two security features available from third partys.

All commertal network pacages I have had any experence with had quite a few security features to deal with the fact that they were missing from Dos. Yet people didn't use those features effectively and would leave systems open to virus infections passing over the lan. This would forshadow the Internet as it is today.

But in the end it's viglence not design that keeps Linux secure.

Becouse for as many windows worms we have seen lately and as many clames that BSD is the most secure Unix around....
The one and only BSD worm did the one thing no Windows worm could do. It took down the Internet. It flooded the network with billions of infections.

This could happen to Linux.

We can show Windows is insecure ground up. Viruses and e-mail worms need an insecure operating system to work.
Viruses need to be able to infect other binarys once run under the user account. This simply won't happen under a secure operating system.
Email worms need an e-mail client that will run programs attached to e-mail.

But normal non-email worms hack in from the outside. Look at that statistic again.. Even if only 1 Linux box is hacked that means a worm can do it. A worm can be made to hack into Linux systems just the same as a hacker could himself. Before you know it the worm has infected many systems. Millions of infected systems in the time it takes for one hacker to deface one Linux hosted website.
It could happen... IF...
If we sit on our butts. Worms take a while to write so it may be a month or so after 'discovery' that a worm is actually created.
If we sit on our butts and not make a patch,
Sit on our butts and not test the patch,
Sit on our butts and not apply the patch.
Then a worm could be released.

If we don't secure our systems.
Applying patches and bug fixes is only the start. There are countless procedural errors that could be made. Get something to test your system for all the known ways someone could hack your system and test for them. Know if your safe.

I remember one Solarus zellot actually freaking out when she discovered an SGI system was being used to run a website. She pointed out that the machies were not designed to run websites.

In other words the operating system was "secure enough" for a stand alone workstation.

Comparison

[vaceituno]

I think we should compare apples to apples here. Windows is suffering from a larger installed base plus virus plus worms. I bet most defacements exploit misconfigurations in Linux. When you configure a box just rigth, very seldomly it will get compromised. You have a guy doing some "work" to deface you. With a worm you just release and sit down. The installed base will do the dirty work for you. There are far less Linux worms than windows worms, reasons twofold: - linux people are more security concious. - linux has a smaller installed base. No need to evaluate these OS technical excellence. You can do that when you get the same percent of the market.

The real difference

[shurdeek]

There are 2 major points here: in reality the security of the system is a mix of the software and the people working with it. If the people don't have security in mind, no software will help them. The more important thing though, the difference between Win and Lin isn't that one of them is more secure per-se. It's just that I find it MUCH easier to secure a Linux machine than to secure a Windows machine. With Windows, one never knows WTF the beast is doing, and one is used not to care. MfG shurdeek

Safer distros - a wishlist

[Jeppe Salvesen]

Frankly, the fact that certain distros charge money for using their automatic update system shows that we've got a way to go! After all, when you put the stuff out there and continue to put it out there, you've got a responsiblity of making sure your software is not endangering the integrity of the internet.

Here's a wishlist:
1. Automated updates by default - the likelihood of a break-in is greater than breakage because of updates.
2. Better firewall configuration tools. Maybe a standard interface for having servers request
3. Better monitoring systems - not just as emails to root, but something better.

And completely unrelated, making a secure-coding class mandatory wherever coding is taught.

Re: Bad MS programmers

[beuges]

tired of rebooting?

*checks win2k uptime*
35 days, 20 hours, 6 minutes and 7 seconds

this is not a server, locked up in some dark room somewhere, with no gui to make it crash, with no techies too scared to touch it because typing 'startx' may take down the whole network. it is my work machine. i currently have 3 instances of visual studio 6 open, one which is running a service in debug mode, another which runs a test app to the service thats running in debug mode, and the third is for working on another project i'm assigned to - up until recently it was also running another service in debugmode, for over 3 weeks if i recall correctly. i run distributed.net, irc, msn messenger, sql server constantly as well. query analyser is constantly open, as is outlook, opera, internet explorer, terminal services, and many in-house applications. i've also got cisco IP softphone running continuously, because of some dumbo IT decision to have software phones instead of normal phones.

im not the greatest programmer by anyones standards - heck, i'd guess i'm only slightly above average. this means that my code breaks(in all 3 instances of visual studio)... often(in all 3 instances of visual studio)... before it gets fixed. strange that my dodgy code, and my "crappy" OS is able to still remain running without any hassles?

so how have i managed to not reboot in over a month?

Re:Linux (In)Security

[Anonymous Coward]

1. Linux's security model, when properly used, makes it harder for an intruder to go from "foot in the door" to "root access."

That is a popular myth, but it is not true. The UNIX security model was developed for an environment where users, including the root user, are friendly and can be trusted.

This is something completely different from the environment we find on the Internet today, where you are better of trusting noone.

There is sufficient evidence to support this, such as: http://groups.google.com/groups?selm=2003052519003 7%2470c6%40gated-at.bofh.it

2. In the case of Linux, you won't have a whole new set of remote root exploits that need patching 6 hours later.

Right, it will take less than 6 hours.

The fact that Microsoft has been doing a terrible job at security for years, does not mean that most Linux distributions are really that much better.

The advice to shutdown services is a sign that you cannot trust Linux. Otherwise it wouldn't matter if someone broke in on a service, he couldn't do anything harmfull if he did.

All this pointing by Linux users at Microsoft Windows is like Dumb pointing at Dumber after doing something stupid. But fortunately, there are projects like Adamantix and Gentoo-hardened which are actually doing something about it.

These distributions offer the following things that are important for increasing the level of security (even though they are not perfect):

1. Protection of process memory, to keep executable code and data separate. Buffer overflows often try to execute data as code. Bad thing.

2. Compiler extensions which try to intercept buffer overflows.

3. Mandatory Access Control (MAC), where the kernel enforces a system-wide security policy. Normal *NIX systems have a Discretionary Access Control (DAC) model, where the user decides about the security of his files. (E.g. you can decide to chmod 700 $HOME or chmod 777 $HOME, not the system).

Opensource project to write a Linux virus?

[daybyter]

Ok, it might sound a bit strange, but isn't the best way to test a security system, to have a group of people trying to compromise it? And since we are a OSS community and want to learn from each other, it should obviously be a Opensource virus, so distro vendors could make sure, that there system is safe from it...

Is Linux as Secure as We'd Like to Think?

[Anonymous Coward]

umm let me think about that one a second ...
answer = NO.

The simple fact is that Linux has Less of a market share and is mostly run by profficient administrators whom by no choice of there own *have* to know what they are doing to use linux.

so, Less market share, and more profficient users = Linux seemingly more secure.

also, where's the fun in saying "Linux was hacked! - OMG I Got a Segfault (linux's version of the Blue Screen)!" umm there is no fun in that, because Linux is a geek os, and geeks know what a segfault means.

They also know how to use the damned thing properlly because it's "cool" to use it.

in a nutshell? Linux *seems* to be more secure because there's no fun in reporting every single incident of Linux being hacked as people do with windows.. because windows is the dominant OS in the market.

Windows has more market share, thus it seems less secure because it's attacked more. and because it's made by microsoft, and microsoft is the number one technology company in the world... it's fun to poke microsoft in the eye .. and that's what people do every five seconds.

so, the answer is quite clearly NO. Linux Isn't more secure - it's just less fun to poke it in the eye, because of the nature of the project.

Less market share = Less interest, = Less "news" about linux being hacked, and It's as simple as that.

There are viruses ...

[Anonymous Coward]

and there are hacks for linux .. (just as many as windows) ... just, NO-ONE cares cos they mostly know how to fix it when something goes wrong.

UNIX virii/worms

[hackerm]

One comment you often hear from Linux/UNIX people is that their systems can't get infected because all code executes in userspace and cannot do any harm to the system. You can just kill the process/delete the file and all is good again. And if people execute unknown code as root, they have themselves to blame.

But many UNIX worms/virii don't rely on code being executed as root. They spread using security holes such as buffer overflows, and doesn't need anyone to click on an attachment or execute an unknown binary.

I don't have the links to back it up, but wasn't the first worm ever a UNIX worm, written by a kid whose father was in the security business and told him about security holes in UNIX systems?

I don't think that the OS decides whether a system is secure or not. Sure, it is a factor, but sloppy administrators and developers are to blame as well.

Re:UNIX virii/worms

[ptr2void]

Erm... where did you find those "Unix worms" that you're talking about? Obviously, there aren't that many...

Re:UNIX virii/worms

[hackerm]

Check this page, it has lots of info on UNIX and cross-platform (yes they do exist) virii.

Down the page there are further references to other pages.

Re:UNIX virii/worms

[SuiteSisterMary]

The Morris worm.

Back in the day when you could telnet into sendmail, ask it for root, and have it cheerfully comply.

Back in the day when you could overflow lpr and, guess what, get root.

Folks, UNIX isn't any more secure than NT, it's just been around longer, and had more bandaids put onto it.

Distinctions

[LuYu]

The simple thing is, and I have not seen this commented about, is that there is a difference between human attacks and virus attacks. With Windoze security, any stupid virus can destroy your system.

With Linux, however, the situation is different. Since privelege escalation is not trivial in Linux/Unix/BSD, viruses can generally only exploit userspace. Privelege escalation usually requires human intervention (or, at least, I have never read or heard of a virus that could escalate its priveleges on a Linux/Unix/BSD system). This means that Linux/Unix/BSD systems that are compromised are cracked by deliberate attackers with the attacked system specifically in mind. This is as opposed to some dumb bot that tries to infect everything on the net. Why there are not terms for the differences in these classes of attacks I cannot say, but there is no doubt that they are different. I will call them direct (human) and indirect (virus/bot).

Viruses, with the exception of superviruses, are also generally written to take advantage of one or two security holes. They cannot be written to contain every historical exploit that may exist in the wild. So, human attackers have possibly thousands of methods at their disposal while a virus has a few. One of the most commonly known military defense tactics is to get your enemy to attack you from one defensible point. Any enemy with thousands of entrances will find a weak one. Direct attacks are much more powerful than indirect attacks.

The simple conclusion is this: If someone knows what they are doing and wants to get in, they are going to get in. However, it is doubtful that Linux will ever be afflicted to any damaging degree by these silly mass mail viruses that damage your email or even wipe your hard drive.

The weakness of Windoze security is that even indirect attacks work on it.

Re: sig (OT)

[http]

enlightenment: straight to path, or a GUI jacket?
(sorry. punning is its own re-word)

people use the M$ concept with linux

[igorko]

UNIX and lookalikes weren't designed for the would-be user. Still, most users just migrated from M$ will be happy with the out-of-the-box install of RedHat-latest and Apache. That is simply not the way to go. A UNIX takes a lot of time to configure and then administer, and if this isn't done, you might as well pronounce yourself a windows admin.

The key concept of UNIX are it's building blocks: you build it from the ground up, not the other way around. A good server install should use the linuxfromscratch OS, with as little installed as absolutely needed. Then you hardify, using your KNOWLEDGE of the system. That's what most users think comes with linux by default. Wrong.

With M$, you get to do what M$ thinks you will do. With linux, you get to do what you want to. The downside is you must know what you want and how to get there.
-i

Misleading question

[JeffHunt]

Hello,

I think this question is very misleading. The truth is, regardless of what kind of system you run, more often than not your system is only as secure as you make it.

Some systems are designed to be "secure" out of the box, but it is the responsibility of the administrator to make it so.

I'm sure that other people have posted similar remarks, but I haven't taken the time to see so for myself.

It might be as holy, but...

[Anonymous Coward]

Linix might be as holy as M$ windows, but it dosnt stay that way for long. Its an open source community that has more insentive to fix problems quickly. Any holes are patched, and published (hopefully in that order). If you maintain, and update your system, the I wouldn't worry.

Re: Bad MS programmers

[Hast]

In a big corporation one brilliant programmer doesn't make a difference. In fact I bet that even if 10% of their programmers were brilliant they could easily dissapear in the machinery of a big corporation like Microsoft.

I don't know what the problem is at Microsoft, but considering the amount of holes in their software (And more importantly the amount of stupid default settings.) something is.

Re: Bad MS programmers

[Samhain138]

Weird.

I have a Win2K machine at home and it crashes like a maniac.
It freezes on me a lot of times.
I usually use Photoshop, nothing more.
3 days ago Internet Explorer didn't even run.
When I shut down, it says "Saving your settings" for like 10 minutes.

I should mention that it's a pretty clean install, it's not full of junk or something (and even if it was full of junk, that's not a reason for it to crash).

What is your trick? Share with us! :)

Re: Bad MS programmers

[Anonymous Coward]

"I have a reputation as a miracle worker for being able to see inside the code."

Wow, and modest too ;P

"I am anti-MS because I am tired of rebooting"

I use Windows all day every-day at home and at work and I never have a problem with it. MS-Word on the other hand is a pile of crap, I don't think I've ever heard anyone defend it. But that's one app, not the whole corporation.

"If they have some of the best programmers in the world, why are their applications so bad?"

Years of trying to maintain backwards compatibility and simultaneously change the underlying data format several times over due to decisions made by PR guys with no clue what that actually means. Etc, etc.

I've worked on Windows apps myself and I'm not bitter.. not bitter AT ALL! :/

Security loves diversity and openness

[bigsmoke]

1. The biggest threat to security is uniformity. Pluriformity is the best safeguard to the automized compromizing of operating systems. GNU/Linux is less vulnerable to worms and viruses, because Linux comes in countless incarnations. *nix in general is even less vulnerable because it includes an ever greater amount of incarnations.
2. Another reason why GNU/Linux is more secure is because of the peer review and the lack of secrecy surrounding GNU/Linux insecurity

What newbies see is what they get

[Crayon Kid]

Once Linux is installed, a typical user would never see the command line, and only needs to learn one GUI.

True, true. I frequent several Linux online communities on a constant basis. Lately (in the last year or so) I've seen an increasing number of complete Linux newbies asking "how do I open a terminal or a console?"

Think about it: they have never even seen the Linux command line. To most anyone who's been using Linux for more than two years (until now) this idea seems inconcievable.

Yet the people turning to Linux for the first time these days are reacting in the same point-and-click manner they would under Windows. Their user experience is limited to whatever they had the luck to get installed by default and whatever they see in the "Start" menu or on the desktop. That's what their Linux experience borns and dies with.

In many cases they don't even think that they could choose a better application than the defaults. They don't know (or care) that they have a choice, they don't know that on Linux you have more than the usual to choose from, sometimes they don't even know how to install new stuff or uninstall the old.

And even if they surpass all of the above, their install tools are limited to whatever the distro provides. Don't let me even start on the "qualities" of various graphical package managers out there in the popular distros right now.

Re: Bad MS programmers

[ThaReetLad]

Good versions of drivers (check forums for people saying version X of your driver causes crashes)

Test all your components for hardware compatability issues. (I've had RAM thats good in one machine, bad in another. I've had NForce sound hardware that caused crashes. I've had video cards which really didn't want to work with my motherboard)

I think that almost all of the problems I've ever had with windows can be put down to hardware or driver problems. I.e. not Microsofts fault. So long as you run a good firewall, an AV program and check windows update regularly your system should be as stable and secure as most linux or BSD boxes.

Flame me if you like but I really like windows XP/2000.

Unknown systems = higher % linux systems hacked?

[afekz]

"An analysis of the last few weeks of their archive shows a similar percentage of exploited Linux systems. Note also that the 'Unknown' category is rather high, and certainly contains at least some Linux systems, further increasing the percentage." This is true *if* the _proportion_ of Linux servers in the Unknown category to the entire population is significantly greater than the _proportion_ of Linux servers in the 'known' category. The statement as posted seems to indicate that a greater number of Linux servers in the unknown category directly results in an increase in the proportion of Linux servers hacked, which is untrue.

Yet Annother Stab at Windows

[Anonymous Coward]

The number of security fixes released in the last week for directX should have anyone thinking the platform is inherantly secure quaking in their boots. Imagine if there was an openGL vulnerability in Linux, or if an X server which wasn't listening on any ports had a major remote security flaw. DirectX has had so many recently i've lost count, and it's neither a security nor a network system.

It may not be the coders fault, the problem is simply that the windows internals are screwed up. It may look like it's all shiny and cean on the surface, but underneath it's just kludge on kludge.

Re: Bad MS programmers

[Samhain138]

I checked.
It's a Dell optiplex, the only PCI card I added is an Intel ethernet card.
I downloaded all the drivers from Dell, for this specific model.

Linux runs PERFECTLY on it.

I also update it, and run an AV (not that I trust these programs...).

Windows XP runs so slowly, I have no idea what they shoved to the kernel...

Anyway, Linux is /not/ ideal in my eyes (and yes, everything is hack-ish, in my eyes), and I use windows a lot for graphics (I adore Adobe Photoshop) etc.

But right now I prefer using Linux for most things.

stolen passwd, faulty php script

[dimss]

Our Linux servers were attacked three times. In two cases they used stolen passwords. In one case problem was in faulty PHP script (input data not checked).

Its been done, but spread was fairly moderate.

[TheOrquithVagrant]

Of course its possible. There's been at least 3 "linux" worms that I can remember: ramen, slapper and lion. AFAIK, slapper was the one that had the worst spread, with something like 20000 systems infected, if i remember right.

Its highly unlikely, however, that you would be able to write a worm today that would be able to infect "workstation" linux systems, since modern linux distros tend to have firewalling turned on out of the box, few services running as root, and no server services running by default. If you're fast, and a new remote-root hole is discovered in apache/SSL, that would be your best bet for making a worm with any spread at all, but I very much doubt you'll be able to get even as wide a spread as Slapper again.

If you want to try for a linux equivalent to something like Blaster, which could infect essentially ANY NT-based windows system connected to the net and not behind a firewall, you're SOL, however.

Skill, Knowledge, and Effort

[Anonymous Coward]

It really doesn't take a lot to secure a box reasonably well, but a lot of people don't take the time to do it.

Put it this way, I work for a Fortune 500 company that I will leave unnamed. The IT group uses a "default install" for the servers... we still have servers running Win2K SP2, with a ton of security patches. Our Sun boxes have Telnet and FTP open, no TCP Wrappers, no SSH, and a ton of ports open like finger, rexec, rsh, etc. Nobody ever bothered to lock them down. The Linux (RedHat AS) boxes are a little better, but its a default install... our web servers come loaded with Squid, and well.. pretty much everything. Stupid, Stupid, Stupid.

I'm trying to change it, but I'm also working against a corporate mentality that says that even though *I'm* in charge of production boxes, I can't patch them... there is another "team" for that. So, I could have them all fixed up in a week, but can't touch them.. I need to define what I want and request it from the team at the data center.

the real problem

[hitmark]

isnt these wormholes (get it?) but the default mail and webbrowser programs that come with the os, sure most of hte nasty stuff have more or less been patched but getting a user on a dialup to install a number of patches going into the 50+MB range is not going to happen! if they got a notice onscreen saying that they should stop by theyre local electronics shop and pick up a free patch disk then we would be seeing more patched boxes out there.

then we can start nailing down stupid stuff like a webrowser able to install software in the background without asking the user (those porn dialers is a familiar sight) and a mailclient that support inmail scripts out of the box (big nono!) and able to run software without warning users that hello this is a program file or shortcut or something other nasty, not a IMAGE FILE (check yesterdays user friendly for a upbeat look at this:)

im damn gald i use mozilla as my default web enviroment, just need to get rid of that gameing adiction...

So what?

[n3k5]

Dude... I've been running a well secured Linux firewall and a separate Linux based Apache web server since 2000. I've patched and updated the systems so far from their default install (RH 6.2) that they are no longer really RedHat boxes. These boxes have not been cracked once.

While I don't doubt that you set yourself up a very nice installation, this doesn't prove anything. For my parents' web surfing and my own gaming needs, I've been running two highly insecure Windows boxes (the second replacing the first when it grew too old) since 1993. I hardly ever patched and updated it (just new Windows versions and patches for _really_ frightening security holes). These boxes have not been cracked once either.

Reply: "How to Lie with Statistics" ... D. Huff

[OldHawk777]

Dear Kringle,

Important point we agree reality is a bit more complex than that frequently implied by media, religion, politics, and sometimes ... EU, US, I, me, we... whoever. There are a few (very few) honorable and ethical statisticians at state/public universities.
In business, politics, ... I trust none to be honorable and ethical, but maybe there are a couple. I have read some significant business and government reports on surveys, samples, reports, .... I finish (9 of 10 times) reports with the feeling that the findings frequently reflected the recommended outcome of the company, agency, ... that paid for the report/paper/BS/smoke (no fire).
I used the abbreviation a hyphen and the present participle of lying [Stat-Lie]. It is short for the BS/smoke (from questionable authoritative sources) that is presented (as fact/truth) to place a positive top-spin on the self/special-interest of business, market-media/news, politics, religion, ...

BPM Disraeli; said, "There are three kinds of lies: lies, damned lies, and statistics."

How to Lie with Statistics; 1954, Darrel Huff

OldHawk777

Reality is a self-induced hallucination.

Today on Zone-H

[xutopia]

40 single IP
17 mass defacements

Win 2000 (98.2)

Linux (1.8)

Isn't OpenBSD the most secure OS?

[topopardo]

Only one remote hole in the default install, in more than 7 years!

If all OSes were like this, sysadmins would lose their job...

Re:Isn't OpenBSD the most secure OS?

[Pitr]

That's how I lost my last job. Switched everything to linux. "Everything works now, thanks. Here have a hero cookie and a pink slip."

Wrong

[Anonymous Coward]

Very few people prefer MSWindows

Wrong, very few SLASHDOTTERS (and the poor users who are stuck with them as their admins) prefer Windows. *I* prefer Windows to Linux, FreeBSD, or OSX. *I* can secure a Windows system, because I've taken the time to learn how to. *I* was not in anyway affected by sobig, blaster, code red, nimda, or fuck, even Melissa! Why? 'Cause I know what I'm doing. *nix users are always talking about how technically savvy they are, yet when you put them in charge of a Windows box, they bitch and whine so much that they don't take the time to learn what's actually going on under the hood (and you CAN do that without having the fucking source code, we're all tired of that whine. Real men don't need source.). They bitch and whine that you have to be a moron to use Windows, but they couldn't lock down a Windows box if I put a fucking button on the screen that said "Lock Down". Hell, I could PRESS THAT BUTTON FOR THEM, and they still couldn't do that.

Backpedalling: the voice of the new Linux generation.

Problem With root Login

[tds67]

The last two VARs that a business I know of has gotten accounting systems from have configured the systems so that all of the users did log in as root.

Letting users log in as root is okay as long as you disable the password. Otherwise, they'll be calling you saying they forgot their password and it'll make your job that much tougher.

Without evil, there can be no good

[Psyborgue]

...how else do we define good but by contrast. If, by some wonderful chance, linux does become more widely used than windows on the desktop, and M$ is eliminated, who will we rant against. With the exception of SCO recently, we haven't really had a "villan" other than Microsoft.
Now say for the sake of argument, that Redhat becomes the big distibuter of linux, and M$ is reduced to rubble. Power corrupts, and absolute power corrupts absolutely. I hold no organisation or group infallable and although i trust Redhat right now, but there is no way to make sure they would not abuse their power. Argue that teh GPL protects us... that is true, but it is also true that there are always loopholes and "some rules can be bent... others can be broken." The desire to accumulate capital is what drives capitalism... Make no mistake, Redhat is not a charity (arguable), they want to make money gain market share. Even though it serves their purposes to support the oss community right now, just wait until they don't need us anymore. People will stick to the name "Redhat" and use "their" OS becuase they no nothing else. Redhat has always been one to include "bonus cds" with commercial/binary only software. What happens when they start integrating that software into the system more and more. They would create an addiction to it's product, as M$ has with word, offive, etc... It is important to remember always that Linux is the kernel, and the kernel _only_.
I can see a demand right now to add support for hardware in linux that only have decent drivers in binary form (eg. nvidia). For now redhat has refused to include them for that reason. Eventually they might bend (as some other distributers have done) and include nvidia.o with their kernel module package. If you give an inch to corporate America, they will take a mile... and then some.
I realise that this may seem off-topic but it really is quite relavant to the discussion at hand. Binary only software means less reliability. Linux works well right now because if a bug is found, it can be fixed by anybody. If there is a bug in a binary only package, the best you can do is e-mail the company and complain.
Right now, linux is "hard" for users to learn because it is different. If one can learn to open his/her mind to new ways of doing things, linux is fantastic. It's the only OS i use right now and for everything i use it for, it's perfect for me. Linux blows windows away in terms of speed, linux is more secure. The last time i rebooted my desktop was when i last recompiled the kernel in june. As far as apps go, I've rarely seen an application marked "stable" that crashed.

Well, that's my two cents.

You moron

[jpmorgan]

From what you're aware of? You're apparently aware of nothing. If there's one thing that pisses me off, people being really arrogant about a topic that they obviously know nothing about really, really pisses me off.

Start your journey into the mysterious and complex world of Windows NT security here.

Re:You moron

[I_redwolf]

From what you're aware of? You're apparently aware of nothing. If there's one thing that pisses me off, people being really arrogant about a topic that they obviously know nothing about really, really pisses me off.

Been there many a time, nothing new is there. Here's what.. again, like I've offered others PROVE IT TO ME. I'm a put up or shutup type of guy, if I'm wrong i'll retract my statement. Until i'm proven wrong it will remain fact to me. I'll even put up the WinXP box and all.

I'll make it like microsoft.kernelcode.com or something. Also jpmorgan, I don't care how pissed off you are. It's irrelevant to the discussion. As for me being arrogant, I just made a simple statement, again I've offered many people, close friends, a friend of mine who is a microsoft employee; a whole host of people who have said NT doesn't operate on that notion. Now I offer that to you.. Again.. I will put up the box and you can prove it to me. Let me know if that's what you want to do. I'll provide the necessary information and you can get to work. Otherwise; stop spouting off.

Hey, let's not blame QA here...

[gosand]

Whether you like to believe it or not, Microsoft has some of the best programmers in the world - it also has some of the most rushed programmers in the world, and some not so great QA. Even the very best programmers don't often get their code perfect the first time around, and if a problem with some MS code is not picked up by MS's testers and QA people, it doesn't get fixed.

As a 10 year tester/QA person, let me say that even if a bug is found by the QA/Test team, it may not get fixed. Project Managers rule, and have been known on occasion to ship software with known bugs in it. I can't imagine Microsoft is any different. I'll bet there are some QA people at Microsoft who get to say "I told you so" on a daily basis. :-)

A matter of numbers

[CRB9000]

It's a matter of numbers. Many of the WIN worms, etc. are aimed at exploiting user machines to perform some sort of attack elsewhere. Linux may have a good portion of the server market, but until Linux is as popular as Windows on the desktop, and as long as Joe User is capable of ignoring patches, updates, and security best practices, Linux will be as vulnerable. There will always be something.

... and people always root for the underdog.

[Psyborgue]

Eg: Linux is good, M$ is bad. thus attacking M$ will bring people to linux... which is good. It sounds like fauty logic but it does work. No i don't support it but it has made people desire a more secure OS.

Different mentallity

[Anonymous Coward]

One thing I hated about windows is that all programs connect to the internet to "contact the homepage and do something". ALL OF THEM.

If you run a scanner to see which programs are sending packets to the net, you'll see most of them and some others with strange names like zxwdll.exe, msblaster.exe, foozap.exe, etc. Call me paranoId but how do I know they don't send my private data to CIA? Huh? How do I know that?
Hell.

In linux, the only program that sends packets to the net, is mozilla. And only if I tell it to.

Secondly, in windows you're always executing programs you download. Virtual girls that strip on the desktop, pirated versions of partition magic, upgraders, javascripts, asps, NET, auto updates, trojans, etc. And all this as root (yourself in your single-user home system).

In linux, you seldom do. Because there is no piracy, because there is the source, and definitelly even if you do, you won't do so as root.

So it's a completely different mentallity when working in linux.

Linux is multiple magnitudes spyware-safe than windows.

61% of attacks yesterday, but only 29% overall

[ahaile]

The original poster was confused by zone-h's reporting. Yes, linux accounted for 61% of defacements yesterday. And today it's only 1.8%. The deviation is just statistical noise. Zone-h is currently running their own banner ad with the cummulative stats:

Windows: 53%
Linux: 29.1%

Tells a rather different story, doesn't it?

It is Insightful, not just Funny

[Anonymous Coward]

Comparing Linux security to Windows security is like comparing the Detroit Lions and Cincinnati Bengals football teams.

Re: Bad MS programmers

[coffee_admin]

Not that I really like Microsoft all that much but I have to say I agree. I have one PII running Windows 2000 and the only time it reboots is when I tell it to (oops... can't forget the reboot for the weekly Microsoft security patch). It's not a super machine by any means but it's set up mostly for my wife who installs god-knows-what and for myself when I break my Linux box (being still quite a newb, that's pretty often).

Diversity is key

[ajs]

Every zelot in the world needs to get this: there is no *right* OS for everyone to run. Not Windows, not Linux, not BSD, not OSX, etc.

The *right* OS is the one that you feel comfortable with, and which meets your immediate needs. You might even do well by running several (at home I dual boot my game machine depending on what I want to play: EverQuest or BZFlag).

What's more: diversity is very important to resisting any kind of infection, viral or otherwise. If the net were an even mix of Linux, Windows, BSD and OSX, we would benefit from the competition, different security measures, etc.

That being said, Linux already has a great deal of diversity internally, so a virus or worm that wanted to infect Linux systems would have a hard time covering all of its bases. A Debian system would be hard to penetrate if your worm was written for Red Hat or visa versa. It's not impossible to write a cross-Linux worm, but hard. Then you have to deal with differing shells, various degrees of stack protection, radically different end-user software, major revisions being more common and thus software incompatiblities even between multiple hosts running the same vendor's OS, etc.

*sigh*

[Anonymous Coward]

When will you people understand?

BSD is dying!

And it has been for a long time. So stop y'r yapping, you fan boys.

Stupid necrofiles...

Re: Bad MS programmers

[ShaggyBOFH]

*checks win2k uptime* 35 days, 20 hours, 6 minutes and 7 seconds

Ok, your either lying or your the typical winders user. I run a wintendo at home because I still like playing Broodwar with a friend after work. I update my system since I'm on a wireless Univ system. I have to reboot every time I update which is usually once a week.

Now, at work I use linux. When I update, I may have to restart a service. I only have to reboot when I upgrade my kernel and even then I can do it at my convience.

Don't mean to sound like an arse, but people that like linux have used windows. Windows users rag on linux because they once saw dos running and think that linux is just dos with a GUI.

When I call you the "typical winders user", I simply mean that your not security conscience and never update. Even the holier-than-thou linux zealots will admit (maybe) that there's as many if not more patches for RH/Mandrake/Deb/etc than windows. The diff is that we pay attention and install them (this is probaly because patches very very rarley break things or cause your system to become unstable/slow).

After re-reading my post maybe "lying" was too harsh...then again, maybe not.

---

Microsoft Office

[divisionbyzero]

As to your last point, there is one reason viruses like those metioned won't work on Linux: Microsoft software doesn't run on Linux. ;-)

Passwords and back doors?

[Frobozz0]

I'm no Linux fan (I use OS X), but this number could be a bit misleading. Just because a web site is cracked does not mean the computer is less secure. It also is not comparing apples to apples, because cracking a web site could be as easy as finding the dumb-ass password ... some people actually set it to things like "password" or "12345", etc. That's not insecurity based on the OS, that's user error.

They are comparing cracked sites with the theory that the system it's self is insecure and vulnerable... to WHAT exactly? Viruses? Well, again, given a proper password and basic security precautions, Linux rarely (if ever) will use the built in software to take over not only YOUR system, but OTHER PEOPLE'S systems. In the Wintel world, this is the norm. Why on Earth do people use Windows? Aside from it running some proprietary app you have in house I can't see a single reason...

Re:I think it's the apes

[Anonymous Coward]

That's silly, Pinky. The KGB doesn't exist anymore.

Monoliths and modules

[Anonymous Coward]

Sounds like waffle. As he says elsewhere all big systems are built from modules. Reliance on more interconnected components has never made systems more reliable. Than those with less dependencies. It isn't impossible to make big complex systems reliable, just very difficult, ask Boeing.

Reliability is usually top of the list of desirable security attributes.

I think there is a case to be made for saying that NT based systems can be more easily be deployed with more advanced security features than Linux. However that difference is quite small (check boxes and wizards versus some pretty fiddly cofiguration files - whether the Microsoft checkboxes actually do what they say, and what happens when they don't is another issue), and doesn't apply to Internet connected systems.

The main reason I suspect is market forces, people who demand serious security in their systems rightly or wrong usually buy certified systems and until recently Linux lacked suitable certification.

This led to the bizarre situation where certain military customers could buy Windows 98 because it was certified to the lowest possible security classification ("We know it is junk"), but couldn't run a Linux or other "free" Unix distribution, even if it had all sorts of fancy stack protection and other features compiled in, because the companies who built these hardened systems couldn't come up with the money to pay for certification. Even though the boxes were regularly proving themselves superior to market leading security products on the Internet day in, day out.

Free software allowed more security to be done, but the market structures prevented it being deployed. Now we see the commercial entities behind Linux getting bigger, and richer, these problems are disappearing.

Most "out of the box" Linux distros include no significant structural advantages over NT on the security front, other than less services installed by default. Linux also typically ships without features like ACL enabled, and less tools for manipulating them. But heck how many times have you seen Windows Administrators choose "Everyone, all rights, recursively....". You can drive any car badly.

I'm out of touch with the security products in Linux, but I think distros like Trustix, and some BSD derived OSes include some basic security enhancements that will actually make a difference to security. Most of these enhancements aren't rocket science, and cost in performance, but 99% of computer buyers don't need to buy based on performance any more, reliability is a bigger issue.

Next time you choose an OS, make security more of an issue.

Re: Bad MS programmers

[jon3k]

35 days? What did I do with that copy of the dcom exploit code ...

Good guess...but wrong!

[FreeUser]

Sun Microsystems? :)

No. They bought it very quietly, and kept the fact that they did so very close to their chest for quite some time.

Microsoft, in contrast, held a news conference. (slightly toung in cheeck ... they at the very least issued a press release, and may well have contented themself with that).

Sun Microsystems and Microsoft are the two backers of the SCO FUD and Fraud, but Sun was considerably quieter about the fact than Microsoft was. Not quiet enough, probably, as that little stunt may well push their business further into the toilet as well, whereas Microsoft will likely come out of it relatively unscathed, at least until we have an administration in Washington interested in upholding the law again.

i don't think its a programmer or q.a. problem.

[LifesABeach]

it doesn't take a team of programmers over a year to clean up simple documented security holes in their program logic; let's try to anywhere from 1 hour to 3 weeks. the problem is at the project tasking level. those that task determine what is most important. programmers and q.a. types are TOLD what to do; and to their credit, they do.

Windows is not as unstable as you Linux people say

[Anonymous Coward]

I have no idea why you linux fanatics all say that windows crashes constantly. I'm sorry but that is a flat out lie. Yes, Windows 95/98/ME is not that stable. However, W2K+, with its multiple layers, is at least as stable as a solid Linux install. To listen to Linux freaks, you would think W2K bluescreens if you breathe on it the wrong way.

If an application crashes on W2K/XP, the OS does not go down. The process ends and no harm done. A hardware failure/device driver problem will crash the system, but that is true for linux as well. We have over 200 xSeries servers here. All running W2K S or AS. There are hundreds of applications running across these servers, and I can count the number of times I've seen a bluescreen, not caused by a hardware failure, on one hand.

A lot of you really need to get a grip on reality. Sure Windows isnt perfect but Linux is not any better imo. The only reason there isnt large scale Linux virii incidents is that nobody would bother writing a virus that would only hurt such a tiny percentage of end users.

Common... at least provide a link

[mlrtime]

To the funniest clip ever!

http://www.wiredvideo.com/clips/av/applegamer.wm v ...well pretty funny

Re:Common... at least provide a link

[quantum bit]

I think it may originally be from here.

There's also negative quantities

[fizbin]

Remember when slashdot posted a few links to sites selling the famous swingline stapler?

Well, it turned out that in the spot where you entered how much you wanted of each color, you could type in negative numbers as well - I got all the way to the page that asked me to enter my credit card number for 100 red swinglines and -100 black ones for the cost of shipping. I didn't actually go ahead and place the order, but I wonder if it wouldn't have gone through...

Religion and politics

[grayantimatter]

There is no real reason to believe that the Linux loving script kiddie community is any more or less 'systems-savy' than a competent Windows admin. Just more malicious in how they choose to apply their skills.

Windows is attacked because it is what's there. Linux isn't there. Linux has not reached critical mass, certainly not the way that Windows has. Imagine the world that most /.ers dream of. Windows is dead and Linux rules the desktop and server. What do you think will be happening then? What if Linux actually were to become the 900lbs gorilla of the IT world? I'll tell you. You can expect Anti-Linux zealots to dedicate themselves and their resources to attacking it, and all the security shortcomings that are not heavily publicized now (because right now no one knows or cares other than the zealots that are trying to promote Linux, do you think they'll be forthright?) will creep to the surface. And Linux will be exposed for what it is, just another OS choice. No different than Windows, Netware, OS/2, or BeOS. People are delusional if they honestly believe that Linux is somehow inherently immune to malicious attacks. Changing the OS of choice will never be a substitute for the single largest rarity in the IT world, quality system administration.

Another bunch of resaons!

[canesfan]

Another possibility as to why so many Linux systems are exploited is due to the quickly increasing user base migrating from windows without the knowledge base required to secure a Linux system connected to the web. I work with a bunch of windows guys who have recently made a visit to the "darkside" (their description not mine...) and after installing redhat and clicking through the menus they are content to forget it's there connected via ATM network and let it sit unpatched and with a default config. On a network with no security I might add!!! Second... If you wanted to do the most damage with a virus my guess would be you would write the virus for a platform that had the widest user base as well as the largest unskilled user base. Enter MS Windows (Fill in the version).

Bill Is Trying to Cleanup His Mistakes

[g_goblin]

Most of the culprits out there are earlier Windows machines pre W2K. If you think about it, none of those OS's were designed to be hooked up to the internet or even a lan for that matter. It's all money driven.

Remember when Gates thought the internet wasn't going to be anything and then suddenly IE came out. A trend was set and MS adapted to it and put its iron fist down. Now they realize in order to sell more licenses of their latest version of 0's and 1's, they need to make it more secure especially for businesses which are looking at alternatives.

They are taking a step in the right direction by putting a firewall in their new OS and turning off unneeded services. I just wish they weren't 3 Years behind the *NIX community when it comes to security features installed by default.

If I'm going to put a box out in the open, there is no way I am going to put a Windows box out there for the taking, I simply don't have the time to take care of the damn thing 24/7.

Yeah right

[Anonymous Coward]

Dude, you have to be smoking crack. 61%? My ass...I even went thru the archives. I can only find a handful of Linux machines. Go back to jerkin' off

History of Desktop Computing 101

[huckamania]

Let's set the record straight.

Microsoft became the dominant desktop OS because they provided choice to the consumer. First, the conusmer could choose what hardware to buy (motherboard, memory, chasis, soundcard, video, etc). Second, the consumer could choose where to buy their hardware (HP, Compaq, Dell, Joe's PC shack, etc). Third, the consumer could choose from a wide range of applications provided by third parties (games, development tools, office suites, etc). Finally, the consumer could choose to upgrade their OS when MS came out with a new one.

Contrast this with Apple, MS's original competition. Apple made the consumer buy a fixed set of hard from only them. Apple also used to be the #1 provider of software for their users (now it's MS). Apple has a long history of making thier OS upgrades incompatable with the systems they sold in the past. Finally, Apple marks their systems up by an astonishing amount (the original Mac was marked up 100%, 50% pure profit).

All of these things are still true today. Sure, if you want to buy a PC from Dell (HP, Gateway, Joe's PC Shack) they may charge you for an MS OS, but isn't that more Dell's (HP's, Gateway's, Joe's PC Shack's) fault? Is it not also your fault for not just buying the parts and putting together your own machine? People talking about how superior they are technically and then bitching about some preconfigured machine they bought is pretty funny when you think about it. Almost as funny as some Mac ho talking smack about the MS Tax.

P.S. OS2 failed because IBM did not support it. I owned a copy of OS2 and was supposed to get a free upgrade. An IBM support center burnt down and then they burnt all of the consumers who had shelled out for their beta release. I went from hardcore OS2 zealot to hardcore OS2 and IBM hater.

P.P.S. Want free software? There is just as much free software written for MS OSes as there is for Linux. Probably more, considering how long Windows and DOS have been around.

kernel stupidity

[jemele]

The parent is correct; what's worse is ms engineers gloat about the shit they shove in their kernel

http://insight.zdnet.co.uk/software/windows/0,39 02 0478,2133899,00.htm

You pushed some of the IIS into the kernel, didn't you?
We have what we call a listener, an HTTP handler that we pushed into the kernel. We were looking at how to improve performance. Requests come in and go all the way through the networking and back into user mode where they're handed off. There is a huge amount of the web traffic that you can respond to very quickly without having to have a user mode. So there's HTTP.SYS, a driver that runs in kernel mode and responds in ways that are very well understood, with some parsing and quite a bit of caching, and it handles sessions and it's a huge performance win.

Open Vs. Closed source, Not Windows Vs. Linux

[hogger]

It's not necessily a matter of Windows Vs. Linux. It's a matter of open-source mentality Vs. closed-source mentality. Open-source software evolves, naturally. Closed-source software only evolves when the keepers of the code are forced to improve it, and usually only if they stand to receive some money for their work.

It's very hard to beat mother nature. Try developing AI software that's smarter all-around than an average five year-old child. It's similarly more difficult to harden your OSs security holes in a sterile lab, Vs. letting the planet full of open-source savages hammer away at your sourcecode and then considering their suggestions for improvement.

For instance, RPC has been enabled for use from the internet since Windows NT, and it's been a problem since Windows NT. It remained a problem through NT, windows 2000, and windows XP. It was no secret that:

- c$ shares open to the internet were a problem
- many many boxes had username=Administrator, password=blank
- guest accounts were enabled by default
- psexec and psreboot were freely available

Was anything done by MS to fix this problem? No. Why not? Was it because they're evil and should be equated to the borg? No. It's because MS is profit-motivated, and their bottom line wasn't negatively affected by leaving these problems unaddressed. Their customers would surely have benefited by a fixed OS, but that's not the driving force for a company such as MS.

When the OpenSSH exploit was identified as a problem, it was immediately fixed. Practically ALL the linux distros made the patched version of OpenSSH available immediately, and all subsequent versions of their distros had the patched OpenSSH. Was it fixed because we Showed the Money to the owners of the OpenSSH sourcecode? No. It wasn't an issue. Mother nature dictated that it was time for OpenSSH to evolve, so it improved or it died.

Those that don't look at these issues as matters of principal deserve what they get. Those that continue to ignorantly use closed-source and proprietary-file-format OSs and software, placing all their sensitive accounting and other business data into closed-source developer's hands, have no one to blame but themselves.

I'm not saying that everyone should train themselves to be a ninja programmer and write their own software. Business owners need to hire intelligent IT staff, and treat that aspect of their business with the respect that it deserves.

The IT decisions (apache Vs. IIS, outlook Vs. ANYTHING_ELSE, exchange Vs. IMAP, Windows Vs. Linux, MS OFFice Vs. OpenOffice) should get the same attention as accounting decisions, legal decisions, and HR decisions. That's not usually the case though. If the business owners don't know the right answers, they should hire at least one or two seasoned IT veterans to advise. Many of these unpatched business computers are the result of sloppy hiring at the upper IT level. If competent people manned the upper IT positions, better firewalls would be established, PCs would be patched, and possibly there'd be a little bit less closed-source, closed-file-format, proprietary software and OSs in use.

DiskDruid

[solprovider]

OK, I ALWAYS choose the "allow customization" option, and usually recommend my friends do the same. In this case, my friend was setting up dual-boot with Windows, and did not want RH to remove the Windows partition. I believe that requires DiskDruid (please correct me if I am wrong).

The DiskDruid interface has SWAP under type of partition AFTER you have picked which partition you are setting up. Then when you click OK, it complains that SWAP is not valid for /boot. Why doesn't the interface make it clear that SWAP needs to be its own partition. And if you try to continue without making a SWAP, it complains, even though SWAP is not on the list of partitions that need to be created. [I understand all this, but the interface is confusing.]

The current pull-down selection system, with options that do not match, and dialog boxes warning what is wrong, is awful. It does not help that every other line is "Free Space 1K". And that the dialog box to add new partitions hides the list of current partitions, so you have to remember if you already specified /boot.

The interface I would design would:
- list all the partitions, current and all possible.
- with a checkbox next to the ones that are optional (including all current partitions)
- with a text box for the size to be created (with default recommendations),
- with the minimum size displayed,
- with the recommended size displayed (based on current free space minus mandatory free space). Yes, this is repeating what is in the text box, but it is better than using a RESET button when you realize you made a mistake. (A "SET ALL TO RECOMMENDED" button would not hurt, but the info is more important than the button.)
- option to make recommendation while leaving specified amount of free space.

An alternate would be to allow removal of existing partitions before the create partition screen. Then the create partition screen knows exactly how much space can be allocated.

To make it easier for newbies, place a definition of each partition under its name:
\boot REQUIRED [100MB] Minimum 100MB Recommended 100MB
(The Linux kernel files required to boot the computer.)

Can someone send this to RH and the DiskDruid maintainers?

---
Personal philosophy:
Pop-up dialog boxes usually imply a poor UI. Write everything so it will work in a web browser. Pop-ups can be used for alerts where the current action must be stopped, but even that can usually be accomplished by reloading the same page with all of the errors/required actions at the top. [Note the ALL in the last statement. Having a form suggest filling in one required field per submit attempt is just annoying.]

Linux IS better

[Anonymous Coward]

The same issue was brought up several months ago because Linux had a higher number of security postings last year than Windows... But the same argument still range true then: It's not the number of vulnerabilities that really matter, but the net effect (value) of them. The design of Linux is another differentiator, having been built with security in as well as the openness. The speed and relative breakage when "fixed" is also a key where Linux tends to shine.

No, we are not invincible. Security is still a process for us just as anyone else.

Re: Bad MS programmers

[Anonymous Coward]

- I am anti-MS because I am tired of rebooting

I've had my XP Home box for about two years and I have never crashed.

I've got zero downtime, assuming thunderstorm-induced power outtages don't count.

Granted, it's not your run-of-the-mill Dell/Gateway machine, but it IS pretty standard hardware on WindowsXP.

No crashes, no bluescreens(does that still exist?), no problems at all.

I'm not an MS fan, but with XP, they finally got things stable enough that I don't curse them daily. Or even monthly. It's become a dependable utility instead of an annoying novelty.

How many 1.6GB HDDs sell nowadays?

[msobkow]

The point is for new users installing on stock, default hardware. Where exactly did you buy a system less than 5 years old with a 1.6GB HDD?

OK, wise guy...

[Anonymous Coward]

You're talking as if there is some actual bug that allows this (which obviously you do). So what is that bug? Of course, if you know about it, it's been patched by now. Note that "guessing that password" is not considered an exploit for the purposes of this post.

Seriously, though, the point is that bugs can be fixed once they're discovered. NT does not have any such bugs that cannot be fixed once they're known. The problem with Unix is that SUID is not a bug that can be fixed -- it's a "feature".

In the NT security model, there is no method for gaining access to another account's privileges without their authority. Even an administrative account can't run a program as a regular user without the user's password/token/ticket. In the Unix model, SUID is required in order to run necessary parts of the system, such as login and su (even mkdir, once).

aQazaQa

Re: Bad MS programmers

[beuges]

i could post a screenshot of my network connection status dialog if you like... i hope you dont think i'd waste time doctoring that - this really doesnt mean enough to me to go to all that effort. if you still think me a liar... well, thats your opinion

regarding security... i do install patches henever the little icon thing in the system tray tells me to... now that you mention it, i havent seen that thing in a while... i guess i'll manually check for updates tomorrow when i get back to work. the IT dept at work is highly jacked up when it comes to isolating our internal network from the outside world, so i have some protection from them. i know thats no reason not to update my own machine, and, like i said before, i always do whenever i see the icon... it seems that the icon's on vacation at the moment, so i'll call it up manually tomorrow.

most of those servers are UNIX that were hacked!

[Anonymous Coward]

Why dont you check the servers that were hacked on that site first, their report sux!
headers say its UNIX not Linux!
So where's the patch?
Most servers were in .de etc whats up with that?

Another psychology reason.

[Vitus Wagner]

Any teenager seeking self-approvement in Linux world can do something more useful than virus - fix, or at least report bug in some popular package and recieve kind response from developer, start kewl project on sf.net which can either grow into something useful when our teenager grows into adult, or just be forgotten few weeks later, etc, etc.

In commercial software world, it is much harder to prove oneself in constructive way. So people try to prove theirselves in destructive way.

Yep: Hallucination ... Flashback ... whatever?

[OldHawk777]

Anon,

Thanks for observing the obvious, I think?

Vivid hallucinations that would induce an altered-state of consciousness allowing a perception of reality different from my own or yours', there would be no inconsistencies for the observer of the reality, and no room for skepticism of their/our belief of the reality.

Therefor, for us all including me and you, " Reality is a self-induced hallucination." PLEASE (as I do), always consider that the other perspective/perception is not a threat and may have validity for our own reality.

OldHawk777

Reality is a self-induced hallucination.

Yah, most crims are basically lazy...

[leonbrooks]

...that's why they take the criminal route instead of working to earn what they want. Oddly enough, I've seen crims do more work to steal things than it would take to earn them, and that's not counting the risk. Maybe they're just nuts? (-:

Re:Yah, most crims are basically lazy...

[Reziac]

As the saying goes, prisons are full of crooks who did things the hard way or the stupid way :)

But yeah, that's true -- often a perp goes to more work to steal something than it woulda cost 'em to just buy it. It's the typical "poor-folks mentality", tho -- just like you can often fool that type into paying more than something is worth just by labeling it "Discount", because they don't know what stuff is really worth.

What, from the inside?

[leonbrooks]

I feel like I'm opening a sealed bomb shelter and trying to convince people the cold war is over...

If you call what The SCO Group and Microsoft do "competing", then be sure that someone will stand you against a wall when the revolution comes - any revolution. Loonies are dangerous.

Psychology does play a role

[Anonymous Coward]

Being a switch-hitter on administration and C/C++ programming-give me the respective compiler and enough time, and I can code for Un*x AND the NT line-I feel qualified to add my $0.02.

I once did technical support for a clientele in which most, if not all, of the callers possessed bachelors' degrees. I once suggested a client "whip out an XTerm and PING us" when our software seemed to misfire on the WABI emulator. I believed that a user had to apply more thought to the matter of using any given Un*x than to the versions of Windows then (1996) floating around.

More often than not, however, I found myself in situations where the caller showed a lack of general computer knowledge. Sometimes it was a question of training:in a botched attempt at self-preservation, someone presented computer use as more difficult that it actually is. This, naturally, cut into the users' ability to do their jobs, and therefore damaged the client firms' bottom lines.

In other cases, it was a question of the individual user's cognitive ability. Sometimes, I got lucky, and dealt with someone who was open to learning how their machinery worked. Other times-hooboy!-the caller barely had any concept of an operating system/shell, a modem, or their ISP. Then there's the failure to "check for reasonableness" regarding strange email (subject line sounds nothing like the alleged sender, has no context, attachment easily recognized as an executable)-which still plagues the computing world to this day.

To the above, add cheesy equipment, such as dial-up Internet connections in firms with the resources for a dedicated high-capacity line, sneakernet file transfers, and network administrators who know little more than TCP port 80. The result, to an old-school mind like mine, is one or more IT disaster areas.

Such can be the case in any computing environment. It ultimately boils down to the human factor. If you've got a bunch of PHBs-in-training, you're eventually going down like RMS Titanic. If your people have IQs in the triple digits, you'll at least stay afloat, and possibly torpedo your marketplace opponent(s).