Slashdot Mirror
Looking Back At Windows Security In 2003
thebatlab writes "Help Net Security has an interesting look at security in Windows during 2003, with various blurbs from related parties at Microsoft as well as security 'bigwigs' such as Russ Cooper. It's interesting to read the comments from external parties, as they tend to be very reasoned comments and don't simply attack away over recent 'indiscretions' and 'security lapses' Microsoft has had over the year."
And how do you propose this virus would spread?
Linux isn't quite the easy target that Windows is. Almost every Linux box is completely different when compared to another. Not everyone is using the same mail client, there are several different browsers that may or may not be used, and several different daemons that may or may not be available or exploitable.
You just can't easily write a virus that will infect a massive number of Linux machines.
Note that I'm not saying Linux machines are impervious to viruses; just that I'd be shocked if there was any Linux virus that infects more than a handful of machines.
It basically says it all when an exploit that had been patched for months succeeds in bringing the internet to a crawl.
I buy a packaged consumer product and install it on my computer.
Why should I be expected to know there is such a thing as a firewall and that I should install it?
To put it simply, that's unrealistic. Sure, geeks should know better, but the general public shouldn't have to.
Period.
D
I just hope that in the next few weeks we won't see a disaster like the Slammer worm.
That, in a nutshell, destroys the entire article. The end user shouldn't be forced to "hope" that bad things won't happen to their computers. Any vendor that instills so much lack of confidence in their products doesn't deserve the benefit of the doubt.
Maybe so, but you haven't mentioned any.
The quality of your admins has way more to do with ultimate security.
Can't argue with that.
Agreed that NT has access controls on every object. However they are not visible and not used very much by end users and administrators.
Much like *properly* setup sudoers, groups and file ownerships/permissions.
The UNIX ones are simple and very easy to understand.
That's because they're so primitive. Not to mention some of them aren't really logical - like needing read *and* execute permissions to list the contents of a directory.
Here you have the choice between complicated (you do know the difference between discretionary and inherited rights filters?) and pervasive (every object) versus simple and pretty much only on files (which almost every OS object is anyway).
Properly setting up a combination of sudo, groups and file permissions and ownerships is a monumental task and an administrative nightmare. Not saying ACLs are a walk in the park, but when you're finished with sudo & co you've got an ugly hack around a fundamentally broken design, when you're finished with ACLs you've got an elegant and maintainable solution.
The Windows acceditation is a crock. It is in a non-networked environment with no floppy disk or CD drive.
That's because, IIRC, being without a network and floppy drive were *requirements* of the accreditation - IOW, *no accredited OS* could have had them.
(And we won't even go into the ability of any process in a desktop session being able to send messages to any other process which is probably the flaw Microsoft alludes to).
This was fairly well rebutted at the time - applications can be written so that this can't occur.
In Linux you have to understand chmod.
This is ridiculously (and irresponsibly) oversimplified. You have to understand group participations, file ownerships, permissions, SUID, GID, sticky permissions and the subtly different ways some file permissions can act on different platforms. This is before worrying about things like limitations on how many groups a user can be in and other weird things that only happen on some platforms. Not to mention the inescapable fact that on most unixes, practically all important services and administrative tasks have to spend some time with the unlimited priviliges of UID 0.