Slashdot Mirror
Security FUD On Linux
bobmatnyc writes "InfoWorld reports that Microsoft is planning an "security assault on Linux" by hyping results of a commissioned study pointing to the number of security holes in Linux vs. Windows, the number of days it takes to fill the patches, and by raising questions as to the reliability of code submitted throught the OS process. I suppose if they focus very narrowly on one measurement of security, completely ignore script-level vulnerabilities, default settings vulnerabilities (such as root access for all users), and the demographics of the user population, as well as a zillion other things I'm not clever enough to think of off the top of my head, they may have a point. "
As somebody pointed out to me not too long ago, as long as MS talks about security holes that are remotely exploitable, I don't think Linux has anything to worry about.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
First they ignore you
Then they laugh at you
Then they fight you
Then you win
Mohandas Gandhi
Physicists get Hadrons!
>> InfoWorld reports that Microsoft is planning
>> an "security assault on Linux"
Microsoft prefers marketing...
Linux prefers a solid product...
Perhaps Microsoft should spend some more money on fixing their own products instead of trying to bring down others, it's turned in to a politcal compaign for them.
Linux isn't perfect. By design, the implementation, or the way people admin their machines.
There is an understanding that MS is also not perfect. People expect security holes, and bugs and crashes.
I think it is good that this might result in a nice list of where linux has gone wrong in the past, and what hurdles to overcome in the future.
If the competition wants to make you the "Build a better OS HOWTO" I think they should be as free as anyone to add to the LDP.
Given that Microsoft got caught lying to a Federal judge (during the antitrust case) why is anyone suprised that they'll lie to their customers?
Isn't that a given?
Anybody looking to a vendor to provide accurate data about its products or the products of its competitors deserves the crap they get.
DG
Want to learn about race cars? Read my Book
such as root access for all users
On Windows, even the Administrator account (which is the level that lots of people log in to) is not really root access. The Local System account is comparable to root. The Administrator has control over all user-controllable parts of the OS but there are parts that are not user-controllable.
Any sufficiently simple magic can be passed off as mere advanced technology.
That's no help at all if arbitrary users can elevate themselves to administrator priveleges. NT-XP is fundamentally broken. Maybe the next version of Windows will solve this design problem, but I doubt it.
This hole exists and actually has working exploits.
-- perl -e'print pack"H*","6e656d6f406d38792e6f7267"'
They're taking the appearance of security seriously: whether or not the security is real is effectively irrelevant to those who can't tell the difference. (It's a matter of who they listen to, and whether that 'who' is Micro$oft.)
John_Chalisque
Hey Guys, For the first time after a decade on the net I was scare to connect to the net.. Do you know why? I just moved to a new house and I had to transfer my SBC/yahoo DSL account to there. They gave me 10 days for complete the moving so, I am without dsl connection on my house... I had to use dial-up (I forgot was slow it was) but the only machine I had available with modem was a station with Windows 2K professional that my wife use... To be sincere, I was too lazy to install a modem on my linux desktop that I use was a firewall for my home too. So, I looked to the Windows Desktop connected by dial-up and I start thinking... Jesus, I am connected to the internet using Windows and without a firewall or anti-virus (I don't like any anti-virus...I don't think I need one till I see my M$ windows connected to the net)!!!! As soon as I connected I got that SPAM using the the message service! Windows is a hell! Microsoft is a hell!
They'd probably be better off if they just shut up about the issue and hope it goes away. Drawing attention like this could easily backfire.
You haven't "worked" in IT, have you? Part of that time is testing the patches to make sure they work and don't break something else worse that what the worm/virus/hole will do. Anyone who lets Windows update run fully automated on production servers is a fool.
Microsoft's apparent idea of security is to sue people who expose vulnerabilities and to put out bounties so that others who might be encouraged to exploit those vulnerabilities would be afraid to do something. This doesn't suggest that Microsoft is taking security seriously, it suggests that they're pissed that people are exposing how Microsoft ISN'T taking security seriously. Microsoft can create as many initiatives as they want, but so long as they continue to live in the world where providing dancing paperclips on the screen in a single click is more important than making sure that users have to actually understand their machines before letting programs change system files - they aren't doing the world or themselves any favors.
They also have the cash to pursue security problems, their problem appears to be design flaws that can only be 'corrected around'.
An obvious example is integrating their Web Browser into their OS to screw Netscape, a political decision taken by his Billship. Bugs in IE lead to the equivalent of root exploits, bugs in Mozilla mean that one user account can be compromised.
Another political decision has been to install software to offer all kinds of services, basically to keep third party vendors out. This software defaults to being active. What was that database port vulnerability again? Another consequence of this is that a virus/worm writer has reliable idea as to what components will be running/active.
They have the cash for PR *and* fixes, but political decisions have led to a situation where this does not help. Having said that, if as many computers ran Linux as the various Win versions, we would also be seeing more problems that at present - they just would not be as serious.
Mielipiteet omiani - Opinions personal, facts suspect.
But what about all the other possibilities ? What else can happen ?
1) First they ignore you
2) Then you screw up and fail!
1) First they ignore you
2) Then they laugh at you
3) Then others laugh at you, and you fail!
1) first they ignore you
2) then they laugh at you
3) then they fight you
4) and they win !
Where are all those people ? I'd reckon they're still running OS/2.
In Soviet America the banks rob you!
The biggest score Microsoft has had is convincing it's users that all of the rebooting and crashing and poorly-designed security features are to be expected in powerful software, and to expect to not only pay for such software, but buy extra software and pay consultants to work around these misfeatures.
I don't know if making "Redhat" a synonym of "Linux" is all MS's fault though.
MS can release "news" as a press release, and the newspapers eat it up. The public believes it. The hardware manufacturers "sell" this crap because they sell MS to consumers for Microsoft at a profit. Wall Street helps the process. Analysts hype the latest "features" for the latest vapor product from MS, due in 2012.
MS sells themselves to the public by issuing press releases. They can say whatever they want, as long as they make a claim that they're doing something. There is no accountability. No one holds them responsible. Consumers keep throwing money at MS. Occasionally, someone points a finger, but MS then releases more press releases about vaporware due in 200x.
Politicians do the same thing, "We need to spend more money on _____. We've been spending money on _____ for ___ years, and we've not solved the problem. We are renewing our effort."
In other words, "We're going to light some money on fire, pose for a few photos with the underprivileged, and then waste a lot of money on cigars, dinner, and entertainment."
Microsoft has excellent people playing the press release game. Everyone sells Microsoft products for MS.
How many people have actually met a Microsoft employee? Yet 1/2 of the planet owns or uses something with Microsoft products in it.
-- No sig for you!
No. It makes it better for YOU. 0.5% of people who use a computer. How is that BETTER?
Nuts. It makes it better for everyone. Look at it this way: would you rather take a drug that has been tested by hundereds or thousands of independent testing labs around the world, who published their results for all to see, or one that was produced by some big company who assured you that theirs was safe and effective, but wouldn't tell anyone what was in it?
You don't have to be an independent testing lab to benefit from the existence of independent testing labs. Likewise, you don't have to be a coder to benefit from open source software.
-- MarkusQ
It's been said many times before, but it bears repeating:
The truthfullness of a statment is independent of the number of times it is repeated. (Is not! Is too!, is not! is too! is not times infinity!)
First, they ignore you,
Then they laugh at you,
Then they fight you,
Then you win.
SCO have been ignored, laughed at, are being fought at the moment, so do you expect them to win too?
Exigo spamos et dona ferentes
From the time that they acknowledge a bug until it's patched is VERY FAST.
The problem is that they won't acknowledge a bug until they already have a fix for it. Often bugs are known about by the world for months, and MS says there's no such bug. When they do acknowlege it, then yeah, there's a fix out within hours or a day or two at most.
So, apples and oranges. If Linux takes 4 days to patch a bug as soon as it's known, and Windows takes 4 months to acknowlege a bug's existance, then 2 days to patch, which is better?
Unless we're missing something... Who's to say that Microsft haven't been doing a little unpublished research, looking for buffer overflows and other vulnerabilities that they're soon going to demonstrate?
[...]
If they like many of us see Linux as the biggest credible threat out there, they might resort to fighting dirty.
The thing is, most OSS developers I know (myself included) welcome public review and full disclosure. If I get advance notice of a security problem, I look at that as a luxury, and have no problem with finding out along with the public. Once problems are pointed out, it's usually easy enough to fix them quickly. Having Microsoft auditing open source code for free would actually be quite beneficial.
The reason full disclosure is so important is that without it, these holes still exist, circulating among the black-hats. Unlike Microsoft who'd rather sweep problems under the rug. Disclosing problems isn't "playing dirty"; it's step one in getting them fixed.
This has been a long time coming, from the looks of it--Many of you are probably familiar with the Halloween documents, "an internal strategy memorandum on Microsoft's possible responses to the Linux/Open Source phenomenon." This was back in 1998. MS verified the documents as authentic but claimed it was "a mere engineering study that does not define Microsoft policy."
They've probably been building up a case for a long time. But as Linux is systematically sound, they've apparently been forced to find specific, technical problems since their Ominously Vague Murmurs don't seem to be taking. The problem for them is whatever they pick is, by definition, fixable and not an element that defines Linux as Linux. Additionally, if you find 50 holes in Linux and 25 in, say, Windows Server 2003, that's not nearly as relevant as the average lifespan of the hole. With all the Linux distros, there may be dozens of holes at any given time, but there is only one Windows Server 2003. I challenge them to focus on one major distro.
Lastly, MS is has been coming off increasingly hostile and banging the "Linux BAD!" drum so obsessively, that they run the risk of sounding like they're accusing corporate Linux licensees of incompetence, rather than trying to merely educate them.
So, even if Linux was the most bug-ridden operating system with massive security holes, it wouldn't even matter. It certainly doesn't excuse one of the largest and most powerful software companies on the planet, i.e., one that can marshal a massive amount of resources and money to produce respectable software, from the ridiculous numbers of security issues and bugs that arise in almost every product they release.
Politicians love tu quoque, by the way.
--Rick "If it isn't broken, take it apart and find out why."
Pointing out that a some other, "free", product has flaws is hardly a good defense for flaws in an expensive one.
A customer who takes this advice and removes Linux simply makes any Linux problems irrelevant - it doesn't make the past, present, and future Windows security problems magically go away.
I suspect that you're probably correct to a degree. However, I think that MS will probably dump all security problems, whether they're actually part of the Linux OS or not into the hopper and use that as their basis of comparison. For instance, problems with OpenOffice will be counted, but problems with MS Office won't because "MS Office is a separate product, while OO is distributed as part of the Linux system." This approach of counting Linux app problems against Linux, but not counting similar MS app problems against MS has been used before.
I'm not going to lose any sleep over a new MS offensive as the truth of the situation is obvious to anyone who looks at the situation with an unprejudiced eye. Yes, Linux has problems; yes, sometimes it takes a while to get patches out; yes, the Open SOurce process doesn't necessarily have a single point of contact when it comes to fixing a problem. The fact remains that, by any honest count, Linux has fewer problems, the problems get fixed faster, and the lack of a central contact means that a potential fix can come from anywhere. MS FUD notwithstanding I don't recall that Linux servers and workstations had problems with SOBIG, Blaster, etc. Let's approach this issue carefully and not fire until we see the whites of Microsoft's eyes.
Just my $.02,
Ron
Impeach Barack Obama for violating the Constitutional requirement to be a "natural born" citizen to hold the office of P
People favour the things they favour. That should hardly be surprising.
The interesting question is why, given its relative user base, is Linux favoured so strongly by so many?
I hear very little subjective promotion of Microsoft (except where subjective == for profit), especially given its large user base (I hear a lot of complaints from their users, though). Isn't the relative intensity of voluntary, subjective lauding of software an assessment as objective as any at the end of the day?
I for one welcome our new SCOviet Russian overlords to whom all our base are belong.
Are you stating these as times since you did an install until you got compromised?
Becuase if you have a Windows 98 default install and give it an unfirewalled connection to the Internet with a real IP address you've got 5 maybe 10 minutes before you're compromised.
I'm assuming you meant ftp server and not client, as for your box to get 0wn3d through a client requires your participation to some level.
The Nachi virus *does* root you. That's what's amazing about Windows. Many Linux vulnerabilities allow some types of access, but full remote root vulns in Linux itself are rare. Windows just doesn't seem as infected becuase most virus writers aren't out to wreck your machine and delete your data. Nachi, or any of the other ones, could have easily deleted your files, or read them and mailed the goods to the bad guys.
I'd stake money that one day in the next couple of years some malicious virus writer will strike, and all Windows users will realize that every virus since Melissa has had full control of their computers. Unfortunately, until it happens, nobody will think that virus' are more than minor nuissances.
My Linux Command of the Day site : LCOD
One very telling fact, IMHO, is that currently Apache holds over 3x the market share for web servers compared to MS's IIS. (Source November Web Server Survey - 67% vs 21%.) Yet look at the number and type of security alerts for each over the past year or two.