The World's Safest Operating System

Fun and games with statistics by erick99 · 2004-02-21 05:21 · Score: 5, Insightful

From the article: "The group discounted the recent wave of worms, viruses and other attacks that have affected Windows systems worldwide. It confined the study to overt digital attacks by hackers."

This is not the best way to conduct research. When I was doing research at NIH we would say of this sort of thing, "After discarding all data to the contrary, the hypothesis was proven."

While this research may show that Linux servers are over-represented in overt acts of hacking, this does not statistically make the Linux OS the least secure. Attacking a particular system simply makes it popular for attack. In order to characterize Linux, or any other OS, as the least secure, there would need to be evidence that an equal amount of other OS's were unsuccessfully attacked or the success rate was lower. Other variables that would required controls would be the hacker, level of sophistication of attack, etc. etc.

To say that "...while Linux servers were the most vulnerable,,," only means that they may have been the most targeted. I am not saying that the conclusions of this research are incorrect, I am saying that from what I have read, they cannot come to those conclusions.

Keep Smiling!

Erick

--
http://www.busyweather.com/

Re:Fun and games with statistics by Anonymous Coward · 2004-02-21 05:25 · Score: 5, Insightful

I agree with this comment whole-heartedly. It seems like what they have proven is that hacking Linux actually requires human intervention while Windows can by hacked automatically. I guess that shows why Windows is the easiest to use :) Can anybody else envision a world where clippy offers to crack a box for you when you have "forgotten" your password?
Re:Fun and games with statistics by MasterSLATE · 2004-02-21 05:27 · Score: 2, Insightful

Also, if you look at the amount of server applications running on a Linux machine, there are most likely more running then on a windows machine.

--

[sig]www.masterslate.org[/sig]
Re:Fun and games with statistics by Frambooz · 2004-02-21 05:27 · Score: 5, Insightful

To say that "...while Linux servers were the most vulnerable,,," only means that they may have been the most targeted.
We all know the average Linux user is more likely to tamper with his setup and run non-model-user applications, like their very own webserver. They are likely to know few things about proper server security, and therefore their servers are more vulnerable.
Windows users are less likely to run a webserver, simply because they're not as eager to play with their system as Linux users. Therefore there will be less insecure Windows servers. The same goes for Mac-OS users.
What I want to know is the percentage of professionally installed and maintained servers that was actually vulnerable.

--
No encryption can withstand the power of the Lucky Guess.
Re:Fun and games with statistics by Anonymous Coward · 2004-02-21 05:30 · Score: 0, Insightful

Listen, you can sit around and act like a problem doesn't exist or you can raise up and resolve it. This reads black and white. It appears that all of your anti-MS energy was wasted on time you could have been patching Linux.
Re:Fun and games with statistics by mojowantshappy · 2004-02-21 05:32 · Score: 5, Insightful

To say that "...while Linux servers were the most vulnerable,,," only means that they may have been the most targeted. I am not saying that the conclusions of this research are incorrect, I am saying that from what I have read, they cannot come to those conclusions.
Then again, what this also means is that linux machines are the most likely to be overtly hacked into.

--
This page was generated by a Barrel of Circus Midgets, and that is the way I like it!!!
Re:Fun and games with statistics by gbjbaanb · 2004-02-21 05:33 · Score: 5, Insightful

So they discounted the viruses and email crap that require some user to click the attachment called 'Im a virus, click me now'.

That actually sounds like a fair attack vector to ignore in compiling these, otherwise you couldn't derive any meaningful stats - eg. if I posted my password on to my monitor, and someone hacked my workstation (by using that password), would you be able to say 'that workstation OS is inherently insecure'? If you couldn't, then you can't allow similar user stupidity to feature in these statistics.

I don't think that runnign updates fall into this 'stupid user' catageory, especially as Windows boxes are more likely not to be admin-ed by clued up admins.
Re:Fun and games with statistics by Anonymous Coward · 2004-02-21 05:37 · Score: 5, Insightful

It also characterizes linux as one big O.S. instead of a kernel...for all we know it could be counting people who install distributions that leave remote shell escapes wide open.
Re:Fun and games with statistics by Hooya · 2004-02-21 05:41 · Score: 2, Insightful

The group discounted the recent wave of worms, viruses and other attacks that have affected Windows systems worldwide. It confined the study to overt digital attacks by hackers.
<sarcasm level="slight"> in other words, the group discounted cookie cutter, script kiddie level, run of the mill, "it's so easy it's like stealing candy from a baby" type attacks. because if they included these common and numerous datapoints, everything else would just round off to zero in comparison. what are they going to write the report on then? 50000000 computers running windows cracked using combinations of simple flaws by unattended, automated bots vs. 2 debian servers, 3 SUSE servers cracked by committed souls who actually had to work on exploiting and possibly even discovering flaws? the pie charts would look a little lopsided don't you think? they had to get rid of the data of the windows viruses and script-kiddie exploits. that's just what is. what's there to talk about? now crack a linux box or a xBSD box -- that's worth talking about. </sarcasm>
they should have left out windows entirely tho.
Re:Fun and games with statistics by Anonymous Coward · 2004-02-21 05:41 · Score: 1, Insightful

Not to mention it looks like this is all based on "REPORTED" attacks. My guess is Linux guys are more apt to actually detect and report an incident than a Windows admin.
Re:Fun and games with statistics by miu · 2004-02-21 05:44 · Score: 4, Insightful

While this research may show that Linux servers are over-represented in overt acts of hacking, this does not statistically make the Linux OS the least secure.
Linux is over-represented as a target of hacking because there is so much low hanging fruit out there, same reason that Windows is over-represented in the malware depart.
The study chose to not consider malware because that is really a UI and social engineering problem, this study was about attacking servers without an inside patsy and Linux came up short. It is dishonest and dangerous to ignore these sorts of results.

--

[Set Cain on fire and steal his lute.]
Re:Fun and games with statistics by Mad+Marlin · 2004-02-21 05:55 · Score: 4, Insightful

First off, as a FreeBSD user, I must quote the venerable Nelson: "Ha, haaa!"
What I want to know is the percentage of professionally installed and maintained servers that was actually vulnerable.

Now, on a more serious note, my belief as to why Linux fared worse than your average BSD is this: Linux is often the first foray into the world of Unix for people these days, including a lot of people not particularly qualified to run a server. BSD is generally viewed as less friendly to new users (a not entirely incorrect view) and therefore sees a lot less MCSE's looking to pad their resume. Given a good administrator, there should be no real difference between a Linux and a BSD server, since most of the stuff past the kernel level is exactly the same anyway.

--
Best Slashdot comment ever
Re:Fun and games with statistics by Oriumpor · 2004-02-21 05:59 · Score: 5, Insightful

Well, I wouldn't say that, there isn't enough data there for a professional security expert to determine anything worthwhile out of the study....

What were the majority of attacks? How many were exploits that took advantage of underruns? How many were due to running apache? Did they do any analysis of UML based systems which are built around the eventual breach of security?

I'm at a loss. Whether or not the Linux servers or hell even the Windows servers followed a good security model (rings, single ring, regular auditing etc.) You can secure an operating system only so far, which is why you only portfw certain ports through the firewall.. Did they attack things like NFS and portmapper which shouldn't be on the outside world anyways?

A step by step analysis of THEIR analysis is needed to understand what they did to come to these results.

IMO FUD.
Re:Fun and games with statistics by damiam · 2004-02-21 06:08 · Score: 4, Insightful

They discarded worms that acquire remote root without any user interaction. You can't chalk that up to user stupidity.

--
It's hard to be religious when certain people are never incinerated by bolts of lightning.
Re:Fun and games with statistics by timeOday · 2004-02-21 06:17 · Score: 5, Insightful

So they discounted the viruses and email crap that require some user to click the attachment called 'Im a virus, click me now'.
They didn't ignore JUST that. It sounds like they ignored every virus and worm that spread themselves automatically, even if due to an rpc bug or what have you.
You, know, those hundreds of default.ida and scripts/..%252f.. requests you get every day? According to these guys the cracked machines behind those requests don't exist, or at least don't count.
Nevertheless I'm going to take a closer look and see how I can secure my linux boxes better. I'm surprised linux fared so badly, because many of the services running on linux (apache, sshd, ntp) are the very same ones running on the bsd boxes which did better.
Re:Fun and games with statistics by Xabraxas · 2004-02-21 06:33 · Score: 1, Insightful

Linux is over-represented as a target of hacking because there is so much low hanging fruit out there, same reason that Windows is over-represented in the malware depart.
The study chose to not consider malware because that is really a UI and social engineering problem, this study was about attacking servers without an inside patsy and Linux came up short. It is dishonest and dangerous to ignore these sorts of results.
No it is not dishonest to ignore these results. These results are dishonest. Raw numbers don't prove anything. There is no statistical analysis done at all. Perhaps there is some worthwhile anylysis in their report but you have to pay to see it. Sounds a little sketchy to me. It's absolutely insane to say that MacOSX is the most secure simply because it is hardly ever used as a webserver in comparison to Linux.
The previous survery they mention was reported here:
linuxword
As you can see they are reporting about only webservers.
As you can see here, Apache is the most common webserver (by far):
netcraft
Considering Apache is the most used webserver and Linux is the most used operating system to run Apache on then I would say that the results makes perfect sense, but prove nothing.
What if I made my own operating system and made it as insecure as possible, then ran a webserver on it but since no one cares about cracking my website it never gets cracked? Am I to presume that it is the "World's Safest Operating System"? It seems you would. It also seems that the "World's Safest Operating System" could be a worm infested zombie and still be considered safe by your standards and by mi2g's standards. You have to admit that at least the title was misleading.

--
Time makes more converts than reason
Re:Fun and games with statistics by wandernotlost · 2004-02-21 06:42 · Score: 5, Insightful

Please. Black and white it most certainly is not. While the information should make us Linux zealots sit up and pay attention, this article doesn't really say anything at all. They didn't tell us the proportions of systems tested, and they threw away automated breaches (and they might have thrown away targeted attacks accomplished through automated/worm means--they didn't give enough information to tell). Without knowing how many systems of each type were present, it's pretty meaningless to give figures based on numbers of systems breached.

For example, the results in the article could be describing a scenario where all machines on their network were breached, and each of those attacks corresponds to a different machine. So they have 13k Linux machines and 2k Windows machines. Would that tell you that Linux is less secure? Not really. It would have been slightly more meaningful to tell us what percentage of attacks on any given system succeeded and failed. It could also be the case that they keep all their important data on the Linux servers, so not many people are trying to break into the Windows boxes. We just don't know, because the article doesn't tell us anything.

Yes, Linux folks should work harder on security. No, this article doesn't really say anything in particular definitively.

P.S. I just looked at the article again, and it says they, "discounted the recent wave of worms, viruses and other attacks that have affected Windows systems worldwide" [emphasis mine]. So yes, from that statement, they actually just discarded all the data on Windows. I kind of doubt that they actually did that, but that's what the article tells us. I guess from that you could say that Linux hackers rely on holes that aren't widely known, whereas Windows hackers just use the same holes that everyone else is using.
Re:Fun and games with statistics by Analysis+Paralysis · 2004-02-21 06:53 · Score: 4, Insightful

The study chose to disregard "automated" attacks. A standard Windows system can be compromised within minutes of being connected to the Internet by such attacks so ignoring them means that only secured Windows systems are included. This makes the research unbalanced since it fails to apply a similar filter to Linux systems. Malware is not simply a UI/social problem - the Blaster worm and its variants needed no inside assistance.
In addition the study only covered successful attacks. How many unsuccessful ones were there? The measure of vulnerability should surely be the ratio of successful/failed attacks, not just a raw number.
Finally how were these attack figures reached? Where these based on government/company IT figures? (in which case factor in maturity of systems/staff and how much easier breaches can be discovered in Linux using free tools like Tripwire) Or packet sniffing of certain domains? (Linux is used by more domains, some of which are set up deliberately to be hacked).
The only conclusion that can be safely drawn is that Linux appears to be a more popular target for manual attack - whether by necessity (automated attacks being far harder), desire (more of a challenge) or familiarity (easier to learn the internals of a free system, especially if you lack the money/connections needed for commercial counterparts). And security is hardly ignored on Linux either - with tools like ipfilters, tcpwrappers and Bastille, admins have little excuse for running a non-secure system.
Re:Fun and games with statistics by Graabein · 2004-02-21 07:01 · Score: 3, Insightful

> Given a good administrator, there should be no real difference
> between a Linux and a BSD server, since most of the stuff past
> the kernel level is exactly the same anyway.
Insightful? In-fscking-sightful??!?
No it isn't. Most Linux distros are full of the same creature feep as Windows, while the *BSDs are minimalist in comparison. This is by design on the part of the *BSDs, not by accident.
If you insist on throwing everything including the kitchen sink into a distro, in order to bow down to the level of the least common denominator of users, 13K breakins is what happens.

--
And remember kids: Never trust a computer you can actually lift.
Re:Fun and games with statistics by Snowspinner · 2004-02-21 07:02 · Score: 2, Insightful

And this is the fatal flaw in Linux. "adequate training and knowledge" is hard to get. Linux is hard to use and hard to set up.

So lots of people going to poorly configure.

Making Linux secure only in theory.

--
Philip Sandifer's academic website
Re:Fun and games with statistics by Endive4Ever · 2004-02-21 07:08 · Score: 4, Insightful

since most of the stuff past the kernel level is exactly the same anyway.

Not really.

Most Linux systems conceal the configuration behind layers of python scripts and shiney-gooey-croft.

Most BSD systems can be properly configured using any 'UNIX system administration' book published in the last decade, and the vi editor.

--
---
Re:Fun and games with statistics by ratsnapple+tea · 2004-02-21 07:11 · Score: 1, Insightful

YES! Exactly true. Thank you for being the first person in this discussion to see the forest despite the trees.
Re:Fun and games with statistics by Digital+Dharma · 2004-02-21 07:20 · Score: 5, Insightful

This has been the fatal flaw for any widely deployed OS, including Microsoft. What kills me is that it's okay when it's linux, but it's an inherent flaw when its Microsoft. Linux is not that hard to use anymore, so that's not an excuse. And securing Microsoft or Linux takes a skilled professional, not your secretary's son, but that's who usually ends up doing the work. I personally ran a network of 65 Windows servers for years without a single breakin. Not one. After I was laid off so the CFO's kid could take my place (he was tech support) the network went from 99.9% uptime to 94% uptime with an average of 2 breakins a month. Go figure. But hey, they supposedly saved money in the long run, eh?

--
End of Line.
Re:Fun and games with statistics by nineoneone · 2004-02-21 07:24 · Score: 2, Insightful

Seems this could be another salvo in the MS campaign to misinform the naive about the relative merits of Linux, and open source generally, and not serious research. Certainly, the way it has been presented looks to be more about headlines than substance.

--
sig under development
Re:Fun and games with statistics by blazerw11 · 2004-02-21 07:57 · Score: 3, Insightful

No it isn't. Most Linux distros are full of the same creature feep as Windows, while the *BSDs are minimalist in comparison.
While true, the parent poster's comment is also still true: It is the same software. So, if you're running a server using the Mandrake Desktop, you've either gotta remove 95% of the packages installed or unplug the network cable.
So, my point is this: We're all correct here. Now, let's go out, get a beer, and discuss important things like how we're going to get Mr. Bush out of office.

--
A great many people think they are thinking when they are merely rearranging their prejudices. -- William James
Re:Fun and games with statistics by void* · 2004-02-21 08:07 · Score: 5, Insightful

More like "Let's discount all the stuff that rely on TOTAL DIPSHITS to execute on their own computer."

So every one of those worms required a stupid user to execute it?

Bullshit.

http://securityresponse.symantec.com/avcenter/ve nc /data/w32.blaster.worm.html

"W32.Blaster.Worm is a worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135"

That is not anything near 'rely on TOTAL DIPSHITS'.

This particular worm actively broke into the machine remotely. Discounting it for a study like this is nothing but 'let's throw away data until we've proven what we want', as other posters have noted.

--

Code or be coded.
Re:Fun and games with statistics by truthsearch · 2004-02-21 13:45 · Score: 2, Insightful

And securing Microsoft or Linux takes a skilled professional, not your secretary's son...

Only someone with paid experience can secure a system? I realize you're bitter, but just because the CFO's son can't do it doesn't mean other smart unpaid people can't. There are lots of kids playing around with their computers at home who can lock down a machine as well as most skilled professionals. Passion creates more skills than pay.

--
Developers: We can use your help.

Overexaggerated by DarkHelmet · 2004-02-21 05:22 · Score: 5, Insightful

I tend to think that Linux machines are more vulnerable simply because there are lots of people who pretty much have the system installed, and fail to do anything in order to make sure the system is updated.

For all the servers out there, I wonder how many people actually run up2date or apt from time to time. I imagine more people run windows run windows update than any linux equivalent.

Let's face it. Linux isn't for just the uber-geek anymore. So logically, more systems are going to be hacked into when people with no security sense are managing systems.

Don't blame the operating system. Blame everyone who thinks they're a competent sysadmin, but really aren't.

Not to mention that this article doesn't weigh in percentages. There are a *LOT* more linux servers out there than there are BSD, Windows and Mac OS X servers. When one factors in percentages, Linux really isn't *that* bad.

--
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i

Re:Overexaggerated by gbjbaanb · 2004-02-21 05:26 · Score: 5, Insightful

isn't this the exact same argument people have been saying (on /. too) why Windows appears less secure than Linux?

Seems all those old posts were just flamebait, either that or all the Windows security patches really have made a difference.
Re:Overexaggerated by MisanthropicProggram · 2004-02-21 05:33 · Score: 3, Insightful

Yes, but posts like yours helps those of us who have no clue to investigate things we never knew about.
Thank you! (I'm not being sarcastic.)
There's so many Linux sites and things to read about that I can't read it all! That's one of the reasons why I spend so much (too much - according to my girlfriend) time on slashdot and Linux sites. I know I need to learn about this stuff - and it's fun!!
But, sometimes people bring things up that I've never have thought of before. Again, thank you. The more you help us mewnbies, the more Linux will gain desktops.

--
There is no spoon or sig.
Re:Overexaggerated by chill · 2004-02-21 05:37 · Score: 4, Insightful

Because the majority of problems with Windows stemmed from system-level vulnerabilities and problems. Linux, however, seems to suffer more from application level vulns (SQL injection, misconfigured or sloppy PHP.

In short, with Linux, most vulns are due to misconfiguration of apps and NOT an inherent flaw in the system.

Windows has, so far, had a bad track record of SYSTEM LEVEL flaws and not necessarily inherent flaws.

-Charles

--
Learning HOW to think is more important than learning WHAT to think.
Re:Overexaggerated by Ogerman · 2004-02-21 05:38 · Score: 4, Insightful

Let's face it. Linux isn't for just the uber-geek anymore. So logically, more systems are going to be hacked into when people with no security sense are managing systems. .. Don't blame the operating system. Blame everyone who thinks they're a competent sysadmin, but really aren't.

It's true, Linux is not just for geeks anymore. But because of that, we need pre-hardened distros (including ACLs, IDS, and stack protection) and automated security updates for systems run by idiots. The ultimate answer (educating people) is unfortunately not feasible. As much as possible, security needs to be idiot-friendly on every OS.
Re:Overexaggerated by DrEldarion · 2004-02-21 05:40 · Score: 4, Insightful

I tend to think that Windows machines are more vulnerable simply because there are lots of people who pretty much have the OS installed, and fail to do anything in order to make sure the system is updated.

For all the desktops out there, I wonder how many people actually run Windows Update from time to time.

Let's face it. Windows has never been for the uber-geek. So logically, more systems are going to be hacked into when people with no security sense are managing systems.

Don't blame the operating system. Blame everyone who thinks they're a competent sysadmin, but really aren't.

You know your argument is invalid when you can make the exact same point for the other side.
Re:Overexaggerated by Curien · 2004-02-21 05:54 · Score: 4, Insightful

Bullshit. A secured box is a secured box. If you turn off all non-essential services in Windows and do the same in Linux, keep your users with low privileges etc on both, and keep both systems up-to-date with patches, they're equally secure.

There are only three variables: how secure is the box /by default/, how easy is it to make the box secure, and how easy is it to apply updates.

--
It's always a long day... 86400 doesn't fit into a short.
Re:Overexaggerated by Anonymous Coward · 2004-02-21 06:02 · Score: 2, Insightful

Of course, it depends on your definition of system level. Note that Outlook, Word macros, etc. are not system level programs. According to most MS-bashers IE is not part of the OS either (in order to blame Netscape's demise on monopolistic product tying).
Re:Overexaggerated by Anonymous Coward · 2004-02-21 06:04 · Score: 1, Insightful

> Windows has, so far, had a bad track record of SYSTEM LEVEL flaws and not necessarily inherent flaws.

Any application that you have running with root privileges is part of your Linux system.

What do they mean by "Linux" anyway? by Great_Jehovah · 2004-02-21 05:23 · Score: 4, Insightful

Different distributions vary greatly in how secure they are out of the box and in how easy it is to apply security updates once they are deployed. Also, talking about absolute numbers of breakins is completely uninformative without knowing the number of systems deployed for each.

I CALL BULLSHIT by Amsterdam+Vallon · 2004-02-21 05:23 · Score: 0, Insightful

It's not because Linux is somehow inferior or less secure, but because the result of the how popular Linux has become in the server world and all these ex-Windows admins who know jack shit about Linux trying to admin Linux servers.

God, people, read the fucking quote by DK Matai (mi2g chairman):

"The swift adoption of Linux last year within the online government and non-government server community, coupled with inadequate training and knowledge on how to keep that environment secure when running vulnerable third party applications, has contributed to a consistently higher proportion of compromised Linux servers."

In other words, it's the administrators, stupid -- BSD is no more secure than Linux!

--

Reply or e-mail; don't vaguely moderate. Ex-O'Reilly/MIT employee, now a full-time Google employee.

This is not news, it's a troll by 26199 · 2004-02-21 05:23 · Score: 5, Insightful

To be news, they need to say what proportion of computers use each OS, and what apps were hacked. It even says third party software accounts for a lot of the Linux hacks.

Nothing to see here except some meaningless statistics. Yawn.

Re:This is not news, it's a troll by DrEldarion · 2004-02-21 05:33 · Score: 3, Insightful

It even says third party software accounts for a lot of the Linux hacks.

... and third party software accounts for the vast majority of Windows crashes, but that doesn't stop people from calling Windows unstable.

Lies, damn lies, and statistics... by LostCluster · 2004-02-21 05:25 · Score: 5, Insightful

Somebody needs to take some basic statistics. The fact that Linux is most often the operating system involved in server compromises is not surprising since Linix is the is most often the operating system involved in servers in the first place. If you normalize out for server market share, you'll find things are more or less even.

When it comes to servers, selecting a bad choice of a password or forgetting to properly set file permissions is still the easiest way to get hacked, and that will always be operating system independent. And, that accounts for the majority of security weaknesses. Worms and viri are a client-side issue, servers don't often get hit with those.

So, good work OSX fans. You finally found a metric by which having the fewest number of servers in actual use makes you look good...

Re:Lies, damn lies, and statistics... by Cereal+Box · 2004-02-21 05:41 · Score: 5, Insightful

The fact that Linux is most often the operating system involved in server compromises is not surprising since Linix is the is most often the operating system involved in servers in the first place.

So how come every time there's an article/rant about how insecure Windows is and someone says the exact same thing about Windows (i.e., "Windows has more viruses/attacks because it is the most widely used desktop operating system"), it's considered nonsense or a copout by so many Slashdotters?
Re:Lies, damn lies, and statistics... by LostCluster · 2004-02-21 06:08 · Score: 2, Insightful

Because this survey isn't counting the number of bugs, but the number of times any bug is exploited. Big difference.
Re:Lies, damn lies, and statistics... by Cereal+Box · 2004-02-21 08:47 · Score: 2, Insightful

The reason this study is invalid is because they deliberately removed two entire classes of breaches that are *major* problems for Microsoft Windows (viruses and worms).

Look... Viruses/worms and direct hacking are different classes of exploits. According to this study, when comparing Windows and Linux in regard to how successful a person would be when directly hacking, Linux is more insecure than Windows. That's all this study is saying. If you turn around and compare ONLY viruses/worms, the results are the other way around.

But beside that, the reason I brought up my original point is to say that the defense of Windows's number of viruses/worms boils down to "there's more people using Windows, so therefore there will be more people trying to exploit Windows, hence more viruses." The original poster said the exact same thing about Linux. I merely pointed out that he's using the same logic people use to defend Windows to defend Linux. Now do you see what I'm talking about?

What if Windows were found most vulnerable? by Anonymous Coward · 2004-02-21 05:26 · Score: 0, Insightful

Would you be cautioning people to understand correct statistical analysis as you just did above, or would you be gloating and laughing at yet another of Gates' follies?

I'm guessing the hypocrite in you would have reared it's ugly head. Your pet OS is found to be lacking, and now you want to advocate "reason". Now show me some previous posts where you don't jump all over non-Linux OSes like a cheap coat, and I might take you seriously.

Re:What if Windows were found most vulnerable? by kfg · 2004-02-21 05:59 · Score: 5, Insightful

I'm guessing the hypocrite in you would have reared it's ugly head.

And this is a good example of discarding all the data, coming to any conclusion you wish, and then putting the onus on others to debunk your unsupported premise, which, as it happens, has no logical bearing on the argument you are attacking.

A very popular methodolgy, but not a valid one.

For purposes of bias I will point out my posting history will show that I use Windows 98, Mac System 7, Mac OS8 and various flavors of Linux at the moment, but have a very strong preference for Linux for explicitly stated reasons, some of which relate directly to the deleted data in this study, some of which do not. You'll find that my position is at least unbiased enough that I have been accused of being both an MS lackey and a Linux zealot, although I don't recall that I've ever been accused of being a Mac head. I have never so much as sat at a BSD terminal or an OSX box, although I would have no particular objection to doing so, it would be fun, and I am inclined to believe that BSD is more secure than the majority of Linux distros at the moment.

If you wish to debunk this you will have to do your own homework in finding evidence to the contrary.

Ad hominem strawman arguments will be promptly and cheerfully ignored.

KFG
Re:What if Windows were found most vulnerable? by Anonymous Coward · 2004-02-21 06:06 · Score: 1, Insightful

You have actual evidence that Windows is less secure than Linux? If they had proven that Windows was less secure than Linux they would have been "respected researchers" rather than a "cabal of liars." Seriously folks. If you want to be taken seriously get past the religion and look at the real world.
Re:What if Windows were found most vulnerable? by jusdisgi · 2004-02-21 06:15 · Score: 5, Insightful

Uh...I haven't read all this other guy's posts. But they don't change the fact that his point here is incontrovertibly correct. Throwing out the most popular method for breaching security is a completely unacceptable way to conduct research that hopes to conclude relative security. That's pretty damn basic.
I mean, do you seriously disagree? You think this study actually shows that Linux is less secure than Windows? Even after you realize that they are ignoring SQL-slammer, Blaster, MyDoom, Nimda, Code Red...............and on and on?
This is one of the most bone-headed studies I think I've ever seen. Anybody duped by this has absolutely no concept of either computer security or basic logic.

--
Given a choice between free speech and free beer, most people will take the beer.
Re:What if Windows were found most vulnerable? by jusdisgi · 2004-02-21 06:24 · Score: 4, Insightful

Sure...we've got evidence. You can even (hopefully) find it in your own memory of the day when the whole Internet had major slowdowns and large service outages when SQL-slammer came out.

Or perhaps you just want to take a look at any number of statistics that compare breaches and don't ignore all worms. I'm not going to go link-hunting for you this second, but if you seriously look for any real studies on this subject and make sure they are taking all attacks into consideration, the numbers are tremendously different.

Seriously...just think about it for a second. Have you ever seen someone perform an attack on a Windows box that would be considered for this study? I've seen several hundred Windows breaches now (I've worked in computer repair shops, and now an ISP, for some time) and so far I think every last one of them involved some sort of worm, virus, scripted exploit or trojan. If you leave all this out, what do your numbers mean?

What a dumbass way to conduct a study.

--
Given a choice between free speech and free beer, most people will take the beer.

it makes sense by Anonymous Coward · 2004-02-21 05:26 · Score: 5, Insightful

::puts on flame-proof suit::

Linux is made up of _many_ distributions, who hack together systems out of many disparate apps. Each is slightly different. This diversity means none can Q.A. their systems as well as a unified project like FreeBSD does. I've seen some unbelievable bugs in a very well-known Linux distro, there for no reason there than their resources are stretched too thin.

Linux is also a Unix. People who put up *BSD servers are Unix hacks. People who put up Linux servers are oftentimes ordinary people who are trying to cut costs from not going with Windows. Unix is powerful, if you don't know how to handle that power, you put your systems at real risk.

Absolute numbers do not absolute truth make by Space+cowboy · 2004-02-21 05:26 · Score: 5, Insightful

How many linux servers are there in the wild, how many bsd ones, and how many windows ones. I'd be tempted to guess that the geeks favourite OS is by far the most popular server OS...

In other words, it's the same story as Windows on the desktop - there are more attacks because there are more servers. Since they don't give us percentages of installed vs breached, the data is essentially useless. Rule #1: Normalise your data before comparison....

Simon.

--
Physicists get Hadrons!

Re:Absolute numbers do not absolute truth make by Billly+Gates · 2004-02-21 06:02 · Score: 4, Insightful

Out of the box BSD is more secure.

Thats what I love about open and FreeBSD.

All the file permissions are set to maximize security while most Linux distros are setup to maximize usability.

Remember guys we are talking about 2 different unixes. We can make Linux just as secure.

Its just that BSD is more minimalist by default and super secure before its given the go ahead to declare the distribution stable. Linux by default has more services running. The ports tend to install the most secure options when installing things like apache.

What this means is that Linux distro's and users need to make things more minimal and secure by default. Many admins are too lazy or incompetant to properly lock down a Linux box. Unix is hard and a pain to setup which is part of the problem.

I think having more linux servers is part but NOT THE WHOLE reason for this.

--
http://saveie6.com/

Linux is the most widely cracked because... by drcagn · 2004-02-21 05:27 · Score: 4, Insightful

The system admins usually don't know what they're doing, and the system gets broken into--it has nothing to do with the system itself. The admins should know how to configure the system - instead of leaving the defaults on. The defaults for other systems are most probably simply safer than the defaults in Linux.

--
Scorta futuere amo!

Re:easy way to fix linux by LostCluster · 2004-02-21 05:28 · Score: 4, Insightful

Nope. This isn't going to fix all of the hacks this report is talking about. Simply pick a root password of "password". up2date won't scream about that... but you're sure to be hacked rather quickly.

Stupidity runs on any OS...

let me just be the first to say by ashot · 2004-02-21 05:28 · Score: 5, Insightful

they forgot a very important piece of information: the percentage of total servers accounted for by these systems.

armed with this statistic and the age old mathematical operation of *division* one could make these results meaningful.

in other news, a new study finds that red heads are much less likely to commit violent crimes. Data for left-handed people is also encouraging.

--
-ashot

Terribly, blatantly flawed study by UVABlows · 2004-02-21 05:28 · Score: 5, Insightful

The group discounted the recent wave of worms, viruses and other attacks that have affected Windows systems worldwide.

"When we ignore most of the break-ins that windows had, it had less than linux!"

followed by BSD and Mac OS X with 555 breaches

This completely ignores the proportion of these OS's that got hacked. If there are only 556 of them deployed, then this is a terrible break-in rate. Obviously there are more than 556, but there are fewer BSD servers than linux servers.

--

<high-level position here>
<name of stupid small company here>

Attacks ? by DanV · 2004-02-21 05:29 · Score: 2, Insightful

I dont want to troll, but wasnt this the same thing with windows ? They have a larger share of the desktop, ofcourse it gets more attacks.
Same goes for linux and servers.
How should I put it ... Unix(Linux) is very user friendly, it's just picky about who its friends are.
Dan

No configuration provided..... by apoch2001 · 2004-02-21 05:31 · Score: 2, Insightful

I am wondering if this test was performed on a system that has yet to be tweaked. After all, if you leave FTP and Telnet ports wide open, of course it's gonna get compromised! I spent some time turning off all my ports, setting up the iptables, etc and now she's definately a lot safer. Exactly what are these 'holes' that are being exploited? Withouth that information, it's like a Windows v Linux experiment run by Msft on an unconfigured Samba connection.

Preferred OS to control your airport approach? by Anonymous Coward · 2004-02-21 05:31 · Score: 1, Insightful

Define "Safest".

It is 4 AM and you're flying into Heathrow in zero visbility.

Which OS/hardware combo would you want controlling your descent and landing? And since this is slashdot, also assume that technicians, and not you, would install the system.

Automatic Update by Mr.+Darl+McBride · 2004-02-21 05:33 · Score: 4, Insightful

Mac OS X has a dumb little icon that leaps and jumps and bounces and begs for attention any time an update is ready. It's impossible to ignore. When the update applies itself and wants a reboot, your only options are "shutdown" and "restart." There's no "cancel" option.

While I'll admit that I find these behaviors pretty annoying, you can bet that Linux would enjoy a somewhat better security record if it were that hard to forget updates. It's a shame more Linuxes don't ship with at least the option of turning this on for desktop and small server folks.

At SCO, we offer increased security by running our website with Linux and only connecting the SCO machines to McDonald's cash registers and machines too old and slow to run root toolkits.

What about normalized numbers? by starseeker · 2004-02-21 05:33 · Score: 5, Insightful

Absolute numbers are fine, but what about normalizing it for the total number of BSD, Linux, and Windows servers in use in this study? That's the more meaningful number. Then, what constitutes a successful attack?

Also, a useful study would look at how machines are maintained, password policies, etc.

Now before I come off sounding like a Linux apologist, it is quite possible there are some serious weaknesses that need to be addressed. If so, I hope they give us full info on the attacks so we can fix the problems. But these numbers as they stand don't tell us a darn thing.

If a dedicated admin configures Selinux and heavy duty firewalls, and puts Klingon password policies in place, I'd personally still be confident to match that system against anything out there. Default Redhat installs, on the other hand, are something else again. So again we need more info. It's all in how things are set up and maintained. The question actually being asked here - which OS is strongest, all other things being equal - is a really really tough one to answer. There are many other issues that must be addressed first.

So, as far as any useful information is concerned, this article doesn't appear to have any. What if the Linux machines simply had the best intrusion detection in place? (I'm not saying they did, but it's a fair question.) Need More Information!

--
"I object to doing things that computers can do." -- Olin Shivers, lispers.org

As a former BSD sysadmin by Anonymous Coward · 2004-02-21 05:34 · Score: 0, Insightful

We really have to admit that FreeBSD is in decline. In all likelihood, there may be only one more (or possibly two) releases before FreeBSD goes away forever.

I know it is now almost a mantra set in stone that "FreeBSD is dying". Unfortunately, the abuse of that fact by trolls has obscured the truth, that truth being that FreeBSD really is dying.

My main reason for moving away from FreeBSD has been twofold. First, to avoid the constant political infighting and bickering. And secondly, to investigate more promising and viable entries in the operating systems sweepstakes. FreeBSD is no longer a legitimate player, I'm sorry to say.

Before people start ranting and raving by elchulopadre · 2004-02-21 05:34 · Score: 3, Insightful

From the article:

The swift adoption of Linux last year within the online government and non-government server community, coupled with inadequate training and knowledge on how to keep that environment secure when running vulnerable third party applications, has contributed to a consistently higher proportion of compromised Linux servers. Migration to Open Source can be fool's gold without adequate training and understanding of the impact that third party applications have on overall safety and security.

I think this paragraph says it all - it comes down to poor admins. If you have a bajillion-dollar lock made out of unobtainuim, but leave the key under the doormat, you're less secure than if you have a 2-dollar master lock but aren't dumb about the key.

Wrong conclusion by ljavelin · 2004-02-21 05:34 · Score: 5, Insightful

mi2g analysed 17.074 successful digital attacks against servers and networks. It states: "With Linux accounting for 13,654 breaches, Windows for 2,005 breaches followed by BSD and Mac OS X with 555 breaches worldwide in January 2004."

They say how many attacks they analyzed, but they didn't mention the pool of hosts that these attacks were taken from.

Were there 1000000 linux hosts, 200 Windows hosts, and 6 Mac OS hosts? If so, that would radically change the conclusion that is implied.

Also, it's interesting to note that they did NOT count automated attacks by viruses, etc.

I'm sure there are interesting conclusions in their study of attacks, but given the lack of data, this study doesn't provide enough data to conclude that one OS is safer than other.

Re:From Greg over @ OS-News by Anonymous Coward · 2004-02-21 05:34 · Score: 2, Insightful

Once again, shoot the messenger. Perhaps you live in denial in anti-MS land. Listen, I'm impartial and I was a smart and educated response from the Linux community. Rolling Linus out there to say "Linux is more secure" isn't enough. I want action. I want patches. I want assurance. Welcome to the business world my friend. Overnight, you could see the adoption of Linux fall into the toilet because the "big lie" about security is uncovered.

All of these studies miss the point by leerpm · 2004-02-21 05:36 · Score: 5, Insightful

We should not be concentrating on which operating is more secure than another. This just promotes the myth that people can 'choose' the most secure operating system and then they are secure. No operating is secure, if you do not keep it up to date and patched.

Everytime I see an article like this, I wonder how many users and administrators will get the false impression that if they just switch to another platform they will have done their job.

Security is a process. It is not all about the technology, and it requires educating users and managers to be effective.

Re:Not to surprising by Xuranova · 2004-02-21 05:44 · Score: 2, Insightful

Linux is secure... out of the box. However without a skilled administrator, it's very easy to open up LOTS of holes. I think that linux is a great operating system for power users, but lets face it, the average desktop user or the new sys admin, doesn't belong on a powerful distro right now. Perhaps lindows, but not Red Hat Enterprise.

Windows is secure... if you patch it and set up the appropriate safeguards(one being leave IIS off) before you put it on the net. However without a skilled administrator, it's very esy to open up LOTS of holes. I think that Windows is a great operating system for power users, but lets face it, the average desktop user or the new sys admin, doesn't belong on a Windows box if he isnt a patch/firewall junkie. Perhaps 98 w/o an internet connection, but not 2k/xp.

My pt should be self explanatory.

--
"There is no real right or wrong, just what the majority accepts at the time."

One unconsidered factor by 0x0d0a · 2004-02-21 05:49 · Score: 3, Insightful

This probably isn't an issue for the vanilla BSDs, but OS X and Windows are both much more likely than Linux to simply be a workstation rather than a server, given the fact that the overwhelming number of Linux boxes are in use as servers.

It's generally not too bad to secure a workstation against remove attacks-- you can just rip out anything listening. On a server, you *have* to be running some sort of server software, and if that has holes, you are open to attack.

--
May we never see th

Re:Longest uptimes, too by Air-conditioned+cowh · 2004-02-21 05:59 · Score: 2, Insightful

Uptimes don't necessarily mean the time between crashes.

Kernel updates require a reboot. Any Linux box that has an uptime longer than the time between kernel updates released by Redhat or whoever isn't being maintained. And that's not good.

Also, the one time I installed OpenBSD was on a machine that wasn't doing anything clever, just DNS. No webcasting, Tomcat, conferencing servers etc. All the bleeding edge stuff I install on a Linux server because I know most things were developed on it and compile on it easily.

Security is a Process. by Blackknight · 2004-02-21 06:04 · Score: 2, Insightful

Security is a multi level process. No OS in the world will make your server secure if you are using weak passwords, haven't installed any updates, etc.

While it's the the multi-user nature of unix makes locking things down a bit easier, it's also up to the admin of the machine to make things are set up securely, and stay that way.

Linux != single OS by IntergalacticWalrus · 2004-02-21 06:04 · Score: 5, Insightful

Great, yet another brain-damaged research that considers Linux an OS, and talks as if all Linux distributions were identical in terms of out-of-the-box security and ease of applying security updates. Hell, if we ever asked those morons what Linux distro they used to compute their Linux results, I bet they would say "uh... Linux 9.0 ?"

Re:Linux != single OS by spinfire · 2004-02-21 07:13 · Score: 2, Insightful

Here here! My linux distribution of choice completes the install with no ports open! That way the admin is made aware of any ports opened by his/her choice.

I think another factor is the often ignored admin factor of security. Some admins have taken a system and created holes you could drive a truck through. Typically, BSD variants are used by more experienced admins. As a result, BSD systems tend to be better maintained. Additionally, the BSD release process is controlled in a more organized process-- no "distributions" -- everything is the same (with the particular flavour BSD) unless the admin changes it.

--
isomerica.net | Foonetic IRC

Greaaat... by Whatthehellever · 2004-02-21 06:05 · Score: 2, Insightful

Give the SCO and Microsoft people something to use against us Linux users.

Maybe this was an article that shouldn't have been posted here at /.

--

---
IMHO, of course.
May the SOURCE be with you.

Where's your proof? by bogie · 2004-02-21 06:06 · Score: 2, Insightful

Sorry you can't just make up things and state them as fact. Since were talking about desktop users let me make a point that is at least somewhat based on fact. Since Windows desktop users outnumber Linux users by at least 25 to 1 factor I'd propose that because of the sheer number of Windows users even if a small percentage of them run web servers they dwarf the number of Linux desktop users who do such. The number of Windows users who really know Windows as opposed to the number of Linux users who really know Linux isn't even in the same ballpark. This isn't 1995 and Windows user aren't a bunch of computer neophytes anymore. As you stated linux users "are likely to know a few things about proper server security."

"Windows users are less likely to run a web server, simply because they're not as eager to play with their system as Linux users"

That's simply not true. Windows users are curious about their computers just like linux users. I assume your never been an admin then? Because if you had you'd realize that Windows users are more than capable of totally screwing up their systems and often run software which acts as a server without even knowing it. Remember most Windows users run as administrator.

"What I want to know is the percentage of professionally installed and maintained servers that was actually vulnerable."

It should be close to equal. A properly secured Windows box is just as secure as a properly secured Linux box. Security is in the process not the OS.

--
If you wanna get rich, you know that payback is a bitch

Re:From the article.... by Garridan · 2004-02-21 06:06 · Score: 1, Insightful

The article is talking about server security. NOT platform security. Which do you prefer -- vulnerability to MSBLAST, which restarts your computer, or vulnerability to a hacker, who steals your data? As a Linux user, I say the community needs to pull its collective head out of its ass and work on this problem PRONTO. We've gotten lazy.

Conclusion by pasv · 2004-02-21 06:10 · Score: 5, Insightful

You are as safe as you make your server/system to be. If you don't patch you will get hacked and will not be safe. Same goes with windows, linux, Anything. Unless you have you're own OS that doesn't have patches :P. Can't stress how stupid it is NOT to put up a firewall blocking ports you really dont need open. Anything out of the box and kept that evil "default" setting Is bound to get h4x0r'd (hehe)

How the tables have turned by Digital+Dharma · 2004-02-21 06:12 · Score: 3, Insightful

Now that Linux is running with the big boys I hear a lot of throat clearing. What happened to being more secure? Worms were discounted because the study was based on one hacker, one server, not a script kiddie writing an automated bot designed to attack everyone's home machine. This was about servers, not workstations. Looks like Linux is in the same boat Microsoft was in with 2000/XP, namely everyone and their mother is setting up Linux servers. Linux was never more or less secure than Microsoft. It's "security" was based on it's obscurity. Now that installations abound, however, the Linux community is having their work scrutinized and put to the test. Sorry boys, the easier you make it to use, the more people will try to hack it. Goes with the territory. Just ask Microsoft =]

--
End of Line.

Re:How the tables have turned by sloanster · 2004-02-21 06:46 · Score: 4, Insightful

Oops, yet another armchair critic shows his credulity by swallowing a sensational headline and jumping to a conclusion.

Linux was never more or less secure than Microsoft. It's "security" was based on it's obscurity.

While that may be the typical joe sixpack understanding of the matter, it's completely wrong. The fact is, unix was a multiuser, networked OS decades ago, and many of the baby steps that microsoft is now beginning to take represent steps towards the type of sophistication unix has enjoyed since the early 80s. Linux, as a modern unixlike OS, inherited a rather sophisticated security model which is in stark contrast to the microsoft culture of "personal computer", where things like networking, security, multiple users etc were afterthoughts.

As to the so-called surver, do yourself a favor and see if you can actually find out the data behind this mileading headline - and I must caution you that you are most likley in for a rude awakening if you expect to have your beliefs bolstered.
Re:How the tables have turned by Digital+Dharma · 2004-02-21 08:06 · Score: 2, Insightful

another armchair critic said: "While that may be the typical joe sixpack understanding of the matter, it's completely wrong. The fact is, unix was a multiuser, networked OS decades ago, and many of the baby steps that microsoft is now beginning to take represent steps towards the type of sophistication blah blah"

Actually I have experience across several platforms, not to mention HPUX, AIX, AS400, etc etc. I've worked with *nix for over a decade now, and I'm still not impressed. What really gets me are the little jihad followers who believe anything the Zealots of the community say without question. Here's What I see has happened:

1. OS pundist proclaim the mightiness of Linux

2. OS pundits continute to be a small voice in a large room.

3. Things start catching on.

4. companies (red had, SuSE, etc) start making it easier and easier to use.

5. Recession hits. Bottom line becomes everything.

6. Linux is free, and therefore at the right place in time.

7. Installations abound, spearheaded by more and more talk of how "superior" it is to other platforms.

8. Because Linux is based on archane, complicated technology, companies add pretty GIUs to make things more user-friendly and easier to set up. The result is that the general masses don't understand the fundamentals of an OS that has remained the sole territory of highly skilled administrators and programmers for decades.

9. Linux becomes the easiest target on the Internet because of a plethora of installations by unskilled and unqualified people who, like yourself, believe that just because everyone in the Open Source community repeat dogma about the "security" and "stability" of Linux over and over, it must be true.

Nothing you said in your rant is anything new. In fact, I've been reading and hearing the same rhetoric for years now. I've seen Linux boxes get owned within hours of being plugged into the Internet. I've seen a Windows 2000 server resist and fend of hack after hack after hack. My dear neophyte, it has nothing to do with the OS at all. It has to do with the person behind the keyboard.

--
End of Line.

Why there's more overt... by sterno · 2004-02-21 06:15 · Score: 4, Insightful

You know why there's more overt hacking of Linux boxes than BSD boxes. Because there are far less BSD boxes out there to be hacked.

You know why there's far more Linux boxes that are being overtly hacked than windows? Because if you are a hacker, what the hell are you going to do with a Windows box? It's just not as interesting or powerful to remotely control a windows box.

I'm not a hacker, but if I was one, I would not waste my time on trying to 0wn windows boxes. I'd go after Linux boxes. Not because they are easier to breach, but because they are more fun to play with when you do.

--
This sig has been temporarily disconnected or is no longer in service

Overt vs Covert by cgenman · 2004-02-21 06:20 · Score: 5, Insightful

Don't forget, they're also only counting Overt attacks, I.E. Verified ones... ones that leave a trace. It could very well be that all of those windows or OSX boxes were at some point Owned, but that the attack was so successful as to not leave a trace. It also requires "modification to any of its publicly visible components whilst executing...data attacks... [or] command and control attacks."

They also don't list their methodology, which I find disturbing. Out of 17k successful, caught, non-automatic hacks, x were against these systems. However, they don't say where those 17k come from, and don't put it in the perspective of the percentage of those systems in use. If you go to their homepage, they list something called a SIPS (Security Intelligence Products and Systems) System. This data comes from "Personal Relationships at CEO, CFO, CIO, CISO level within the banking, insurance, and reinsurance industry... monitoring hacker bulletin boards... and anonymous communication channels." That's a pretty unscientific pool to be pulling data from. Essentially, you're talking about hacks that were either reported by friends in high places, friends in low places, or bragged about by hackers on publicly accessible bbses.

So if you want to take the survey methodology seriously, then the survey proves beyond a shadow of a doubt that Linux has more non-automated attacks involving changing publicly accessible interfaces that were caught and reported by friends to mi2g.

--
The ______ Agenda

Re:Overt vs Covert by GlassHeart · 2004-02-21 07:06 · Score: 5, Insightful

Don't forget, they're also only counting Overt attacks, I.E. Verified ones... ones that leave a trace. It could very well be that all of those windows or OSX boxes were at some point Owned, but that the attack was so successful as to not leave a trace.
Exactly how would you discover an attack that was so successful as to not leave a trace? By definition such an attack cannot or has not yet been discovered or traced. Leaving them out is both inevitable and fair, because there are attacks against Linux that are similarly undiscovered.
So if you want to take the survey methodology seriously, then the survey proves beyond a shadow of a doubt that Linux has more non-automated attacks involving changing publicly accessible interfaces that were caught and reported by friends to mi2g.
I understand that anytime somebody publishes a Top N List the urge to compete externally is great, but why not ignore the others and simply use this as a data point to improve oneself?

Something doesn't sit right with this "study"... by AArmadillo · 2004-02-21 06:21 · Score: 3, Insightful

How exactly does a third party determine (a) that there has been an attack on a server, (b) that the attack was successful, and (c) the OS of the server that was attacked? The only way I could see getting this information is from people filing reports about their server when it is attacked. Likewise, in parts of the study this mi2g group quantizes exactly how many attacks certain 'hacker groups' made during the last month. I'm sure the cracker underground is just jumping at the opportunity to tell mi2g every time they compromise a server. I could see possibly establishing relationships with companies so they file reports whenever their server is compromised, but claiming they know how many attacks a given hacker group performs each month completely destroys any credibility they have in my mind.

Mac OS X 'most secure servers' by ktanmay · 2004-02-21 06:27 · Score: 2, Insightful

Has anyone noticed that 'servers running on MAC-OS' article is from MACWORLD.co.uk...

Root hack or services hack? by Anonymous Coward · 2004-02-21 06:49 · Score: 1, Insightful

This article does nothing to differentiate between vulnerabilities of the OS and vulnerabilities of applications.

OpenBSD is secure by default, you have to open ports for services. Windows requires you to run around closing all of the vulnerabilities in the default install and pray you got all of them.

Time for honesty and modesty from all camps by pcause · 2004-02-21 07:00 · Score: 5, Insightful

It is time to stop the religuous falme wars about "my OS is more secure than your OS".

We all know Windows has bugs, becuase people revel in revealing Microsoft's weaknesses. Hackers love to attack Windows because it is ubiquitous and so it is also the most attacked.

What this report points out, with all its flaws, is the the Linux system has problems too. Linux supporters have turned a blind eye to this and have loudly trumpted Linux as secure, while Windows is not. This simply wasn't true, but made Linux supporters feel goos about themselves. And even if it is a bit better, that isn't the point.

There will be bugs in Linux and Windows and other OS'es as long as new development continues. Further, as long as humans adminster the boxes, admins will do silly things and create vulnerabilities.

The real question is... by defile · 2004-02-21 07:03 · Score: 2, Insightful

What does this study actually prove?

Nothing we didn't already know. Regardless of its conclusions, it's useless for anything but an excuse to argue and troll about the same points as always.

One nit on this... by Leomania · 2004-02-21 07:04 · Score: 5, Insightful

...not that this means you don't have to patch your box. But all major distros these days make that really painless. Or at least a lot less painful than Windows.

Just one bit that I'd say this is not quite on the mark in this closing statement: Windows makes it easy to patch a machine for the consumer, one box at a time; they make it easy for corporate customers with tools that can push updates onto boxes (although the required reboots are an issue unto themselves). Please correct me if I'm wrong, but I'd venture a guess that the issue is that you don't have these tools because they cost money that isn't easy to justify for the number of Windows servers you have.

The major problem as I see is is exactly what another poster stated -- that vulnerabilities may exist for months before a patch becomes available from Microsoft, and we may not be informed of them in a timely manner. The sheer number of ways that a Windows machine may be vulnerable for variable periods of time seems to me to be orders of magnitude greater than any Open Source package or the Linux kernel itself.

The ease of patching vs. the costs of doing so is a very valid reason (among many, obviously) for choosing one operating system over another. But to me it's far more important to know when a vulnerability exists and when a patch will be available. Windows loses in this regard, hands down.

Disclaimer: IANASBIPTBOOS

- Leo

--
You don't use science to show that you're right, you use science to become right.

Before we start mi2g bashing... by flynns · 2004-02-21 07:05 · Score: 3, Insightful

Let's look a bit at the article. If you look at the FAQ link, after "Executive Summary" ( http://www.mi2g.net/cgi/mi2g/press/faq.pdf )

1. mi2g notes that hackers they anonymously interviewed preferred attacking Linux systems, NOT because they're inherently less secure - but because of configuration errors that run rampant from poor sysadmining.
1b. Unfortunately, this immediately invalidates any analysis of the security of the actual operating systems. Not to be redundant, but the system is only as good as the administrator.

2. I don't know where I saw someone ask this, but if you look at section two: "Multiple website attacks resulting from a single system breach" do actually count as many. For instance: if foo.com and bar.com are being hosted off the same server, and that server is breached, they count it as two attacks. Their reasoning is that from an insurance perspective, the industry is shelling out twice as many bucks they would've if it had only been a single page.

====

Okay. This article tells us one thing: Linux systems breached are simply victims of poor sysadmining. This should spur us on to do one thing. LEARN.

Shoot, if you're doing this informally, then get a good friend and learn to hack linux systems together; spend spare time hacking each other's systems. If you're doing this professionally, then *learn*. Readreadread. Patch. Patch. Read some more. Patch again. Retouch the basics; shut down unneeded services; configure permissions correctly. Go drop a hundred bucks at Barnes and Noble and buy a 12 pound book on Linux sysadmining. Or security. Above all, no matter how you do it, or even on what platform you do it...

Learn.

--
'If you're flammable and have legs, you are never blocking a fire exit.'

The point the article makes, however, is... by metroid+composite · 2004-02-21 07:17 · Score: 4, Insightful

Company executive chairman DK Matai said: "The swift adoption of Linux last year within the online government and non-government server community, coupled with inadequate training and knowledge on how to keep that environment secure when running vulnerable third party applications, has contributed to a consistently higher proportion of compromised Linux servers. Migration to Open Source can be fool's gold without adequate training and understanding of the impact that third party applications have on overall safety and security."

Perhaps we should be focusing more on tech support and help files?

Re:Blame the distributions. by antiMStroll · 2004-02-21 07:22 · Score: 2, Insightful

I can't recall the last time I saw a desktop distro running sendmail by default, and telnet? Give me a break.

Divergent usage patterns by ewg · 2004-02-21 07:28 · Score: 5, Insightful

The usage patterns and target market/audience for these operating systems are very different.

There are huge variations in security between

a Linux box set up by a novice student
a Solaris system participating in a cluster serving a major consumer website
a Mac OS X Server machine running stock network services for a graphic design firm

I'd like to hear more about how they accounted for these differences before I make up my mind.

--
org.slashdot.post.SignatureNotFoundException: ewg

Re:Do you google? by harvardian · 2004-02-21 07:33 · Score: 2, Insightful

All that page has is:

A "refutation" of their claim to have been "collecting data since 1995". I put refutation in quotes because they have no proof other than pointing out that in 1995 mi2g was mainly a portal for automotive information. Yeah, I, too, doubt that they were collecting security info back then, but a) who knows, and b) who cares, it's just a marketing line.
A "refutation" that chairmain DK Matai doesn't have a PhD. I put refutation in quotes because it doesn't look like he's pretending to have one. He doesn't put PhD after his name, and his only claim is that in 1999 he was "in the process of submitting his PhD thesis". That's probably not a lie...maybe he dropped out before his defense to get a job; maybe he failed his defense and didn't want to try again. Either way, who cares?
A "proof" that mi2g dubiously uses attrition.org's numbers when counting security breaches. I put proof in quotation marks because the only proof they have is a claim in 1999 from mi2g that "there have been over 1,700 serious attacks world-wide in the first half of this year, costing more than 4.3 billion." Supposedly this number is suspiciously close to what you'd get if you added up the number of breaches on attrition.org and divide by 2 (because they were reporting for half of the year). Ummm...yeah. I don't even need to explain why this isn't even close to proof.

See a pattern here? It's that attrition.org doesn't have any serious proof of wrongdoing at all, just some circumstancial evidence that isn't even particularly strong.

And just for fun, I'll put some flamebait in here: it really pisses me off that I've seen all these posts saying the article is FUD, when y'all mod up posts that are clearly more FUD than the original article.

Numbers are great by L053R · 2004-02-21 07:35 · Score: 2, Insightful

I love to see actual numbers, very helpful and often left out.
The problem here is we don't know what the underlying distribution of Linux, BSD and Windows boxes was. So, the fact that 13/17 of the cracked boxes were Linux and 2/17 were windows doesn't mean much if there were 100 Linux and only 3 Windows in the test population. Odds are my guesses are not correct however, it does present a problem with this article. Maybe not a half-truth but, perhaps an intentional omission.

--
L053R

It's not just the admins.... by RdsArts · 2004-02-21 07:38 · Score: 2, Insightful

Your comparison isn't really fair in itself, either though.

The BSDs have some things which make even that shared software safer. For example, consider that the BSDs have lstrcpy/lstrcat, whereas GNU won't add it to the GNU libc. When you run Sendmail on a GNU/Linux box, it's using a marco to simulate these calls instead of actually using the safer routines.

They're also not as open to remote exploits as one another because they use different kernels and tools, which have different types and amounts of exploits. This will hold true even between the BSDs. Even Free Vs. Darwin will have differences that would make them less open to shared exploits.

Of course, the fact of the matter is every system is vulnerable to some degree. We should see this as a reason to start moving ALL the free OSes to better tools that don't leave them so open to attack, not just to try and dismiss it as meaningless line noise.

Re:Not to surprising by Brandybuck · 2004-02-21 08:29 · Score: 2, Insightful

Linux is secure... out of the box.

"Out of the box" means you install the system with the default settings, and it's secure *before* you start administering it. Few Linux systems meet this requirement, and certainly none of the "newbie" distros do.

Are ALL services and ports off by default? If not, then it's not secure out the box. Period. (I'll make an exception for ssh). Are any of the "only enable this if you know what you are doing" options in the shipping kernel? If so, it's not secure out the box.

Some distros are indeed secure out of the box. But there are so many exceptions that one cannot possibly make the blanket assertion that "Linux" meets this criteria. In fact, one major mainstream distribution actually had finger an telnet enabled "out of the box" last time I used it. Doh!

--
Don't blame me, I didn't vote for either of them!

Linux = Good, Difficult by severoon · 2004-02-21 08:47 · Score: 5, Insightful

I like how the very first post discounts the point of this article right off by saying, sure, maybe linux got attacked successfully a lot, but what about all the other attacks that would've succeeded on Windows?

Come on, people. The fact is, the linux boxes got attacked successfully. That's a Bad Thing, regardless of what happened to Windows. It's an embarrassing thing for us linux people. Here's the real rub...

I've read studies over several years saying that linux boxes are nearly as secure as FreeBSD installations if the administrator sets up the environment properly . The results of the slashdotted study here is the result of the RTFM culture...hard to operate and administer, very little respect for the user in the design of the OS as a whole. I mean "respect" in the sense of "let's make this trivially easy to use because it's possible and respect the user's time" rather than "let's respect the user's intellect by reasoning they'll figure out how to work this thing no matter how ridiculously complicated we make it."

This study ought to convince all the people out there that don't worry about linux being too hard to use...it's affecting everyone, not just newbies. Not just dummies. Even admins can't set up a secure box. We have to keep working on usability folks. Fact is linux is more potentially secure than Windows--but not in practice because no one can figure out how to lock it down.

sev

--
but have you considered the following argument: shut up.

Re:You're on by black+mariah · 2004-02-21 08:51 · Score: 2, Insightful

#/bin/bash # run as root # run in / for maximum effectiveness rm -rf *

;)

Now if I distribute that as a really cool game that can enlarge your penis, and just convince the user to run it as root, we're in business. On a Windows system, that's easy. There are far more ignorant users. On a Linux system, it's a different thing althogether. The above is not a problem with the system, it relies on the user to execute it to do damage. Problems that are related to user stupidity should NOT be counted as successful intrusions into a system. Worms that don't need user interaction to crack a system SHOULD be counted.

--
'Standards' in computing only impress those who are impressed by things like 'standards'.

Bad research by noerej · 2004-02-21 09:08 · Score: 2, Insightful

When talking about saftety it is not verry usefull when counting the number of o.s. hacked and then just say "oh this o.s. is safer" because this doesn't give any accurate data.

When the breach is caused by administrator fault, you can't allways blame the o.s.

In the past it is often argued that the cause of many breaches are because windows administators where less experienced that linux admins. This has nothing to do with o.s, more with culture

Many breaches are caused by application and not because of the o.s. When for example a machine is hacked by a bug in Apache, you can't blame the o.s allways.

Another example are the public accesable web application. Many of them are verry badly written regardig safety! When such application is hacked, does this also count as a breach in the research? This has also nothing to do with the OS.

There is much more to say about this , but from above i can safely draw the conclution that for producing any sensibale data wich can be use to draw conclutions you should do seperate the data in:

* Caused by admin fault
* Caused by bug/weekness in o.s.
* Caused by application

When I was a student they learned me how carefull you should be to interpet measurements. Often people doesn't take the circumstances or correctness into account and often they do the wrong math.

Regardless the conclution, this is just bad research

Windows insecurity by phoenix.bam! · 2004-02-21 09:39 · Score: 3, Insightful

When you say that windows is so insecure because it's users will execute anything, what do you think will happen if windows users move to linux? They will double click an email, see a popup window (assuming the program was written for the right desktop enviroment, which is a entirely different linux problem) that says "You're system must be updated to run this program. Please enter your root password." and BAM! you have a rooted linux box. The attacks tried in this article are do not rely on a bad users, but on insecure OSes.

Re:You're on by Anonymous Coward · 2004-02-21 09:41 · Score: 3, Insightful

#!/bin/sh while :; do $0 & done

OS X is secure right now, but for how long? by ko420 · 2004-02-21 09:46 · Score: 3, Insightful

As an OS X user, i'm afraid that some jackass is going to take the this as a challenge and find a way to hack into my little box. If Apple ever advertises that OS X is the safest operating system that's when it's going to hit the fan. The automatic software updates feature is the perfect distribution system for some buggy code, it seems. But in my opinion, OS X does run more secure than any other OS i've ever used. Best thing - it comes that way right out of the box. -ko

security in obscurity by TheLittleJetson · 2004-02-21 09:50 · Score: 2, Insightful

in general, any time you run something that a lot of other people are running, you'll have issues... out-of-box linux x86 installs im sure will have difficulty... if you want to run linux, pick a different platform (PPC, Sparc, MIPS) and avoid skript kiddies who use pre-written x86 exploits :-P

Linux Security by RAMMS+EIN · 2004-02-21 09:51 · Score: 4, Insightful

Whereas I have strong doubts about the validity of this study, I also have strong doubts about the security of GNU/Linux. It may build on UNIX principles that have been tested through time, and Linus certainly emphasises code quality, but the system as a whole is pretty new and therefore untested, and not all contributors can reasonably be expected to be aware of all possible security issues. Also, the C library is full of unsafe functions (fgets, scanf, ...), and the privilige system is quite coarse, often requiring that processes have powers that far exceed what they need to have (e.g. to install a program in the /usr/local filesystem, virtually anyone runs it with root priviliges - which also allows the process to overwrite files elsewhere in the system.

A lot of vulnerabilities are found in programs that are part of typical GNU/Linux installations. Although patches are typically made available swiftly, it's still the admins' responsibility to apply them. A system is only as secure as you keep it, and with all the wannabees running Linux c0z 1tz 1337, I don't have very high expectations. Also, keep in mind that Linux has been a small target, which makes it less popular with crackers, and that attacks against it don't affect J. Windows Luser's system, so the chances that you'll here about them are significantly reduced.

I run Debian GNU/Linux myself and I am completely in love with it, because it provides a system that Just Works and that I can understand the workings of. Debian puts a lot of effort in quality and security, however, I won't make any claims about how secure it is until I have trustworthy data about it.

--
Please correct me if I got my facts wrong.

Re:The things you seem to not understand. by GlassHeart · 2004-02-21 10:00 · Score: 2, Insightful

No one thinks Linux is invulnerable. Linux is just MUCH BETTER than Windows.

That's exactly the kind of information that I don't think matters. What matters to me is that Linux is better today than it was yesterday, and then better tomorrow than it is today. Who cares about Windows?

Now, there is good reason to debunk biased reports. However, the more important task is to identify what vulnerabilities do remain, and how to fix them. How much discussion of that are we seeing in this discussion?

The numbers are meaningless without the background. Even assuming that those numbers are CORRECT, what does that tell you about Linux?

Were those attacks successful because of a bad choice of passwords? ...or because of permissions set wrong on a script? ...or because of a hole in sendmail? ...or because of a buffer overflow? ...or because of ........?

Indeed. Doesn't it make you wonder? Doesn't it bother you that you don't know for sure that nothing that can be done?

There is no information presented in that "article" beyond some numbers given out of context. Because there is no information given, no actions are required.

How about actively working with the ones who reported the problem to see what can be done about it, rather than doing nothing? Nobody owes us precise and free information on how Linux or anything other free software project can be improved.

No "probably" about it. One of the rules of security is TURN OFF ANYTHING YOU DO NOT ABSOLUTELY NEED.

I'm not talking about the settings on a particular machine. I'm talking about the choice of a distro to leave a service enabled or disabled by default.

Re:Results of *my* survey... by skinfitz · 2004-02-21 10:59 · Score: 3, Insightful

Your survey is skewed because you're completely clueless about linux. It was funny, yet somehow sad, to read of your slapstick antics just now.

With any supported redhat, clicking on up2date does the trick - without the paid rhn though, you will not be able to get the same service - but guess what, you use apt or yum and get all the same updates. once apt is installed, just say "apt-get install synaptic", and from then on, you can point and click you way through package installs from the various software repositories available.

Firstly the original poster claimed that all major distros had an easier patch system than Windows. I disagreed and posted my personal experience. This is reinforced by you tellimg me that I now have to PAY to get a reliable easy to use patch system (Windows updates always have been free). Secondly are you now suggesting that the fact people have to work out how to patch the box is easier than Windows Update and automatic updates?

I disagree. Ease of use is the point of this discussion, not that it can be made to work with a lot of pissing around.

I did not say that. by khasim · 2004-02-21 11:23 · Score: 2, Insightful

"Instead of "deny everything" try to explain why these numbers are wrong for Linux and not for the other OSes."

I did not say they were true for other OS's. From what is presented in the article, you cannot determine ANYTHING about ANY OS.

"Though this will propably be moderated as flamebait I must say that if you take the same care to secure your windowsboxes as you do with your UNIXboxes you will be rewarded with, surprise, secure boxes all over. Windows isn't inherently insecure as well as UNIX secure."

Actually, I can say that about Windows. Here's the evidence.

http://www.eeye.com/html/Research/Upcoming/index .h tml

Look how long KNOWN vulnerabilities have NOT been patched by Microsoft.

With Linux, they are usually patched within 72 hours.

"Every time some evidence of any UNIX, and especially Linux, being unsecure comes up there are people declaring that the evidence is faulty because UNIX is secure..."

Try sticking to the article in question. There is no "evidence" presented. Just numbers presented without any information. If you believe otherwise, then tell me HOW those 17K Linux boxes were cracked. Go ahead.

probably all been said already by chegosaurus · 2004-02-21 11:55 · Score: 3, Insightful

i) the BSDs are pretty obscure. The people who use them do so for a reason. To get into BSD you've initially got to be attracted by something they offer, and what they offer is security. I'd say the average BSD user knows more about Unix than the average linux user. (No, I don't use BSD. Well, not much.)

ii) BSD is not a buzzword like linux. No clueless middle manager ever asked his clueless admin to set up an OpenBSD server because he saw an item on TV about it. Again, if BSD is there, it's probably there for a reason.

iii) the average /. linux weenie thinks knowing how to comment things out of inetd.conf makes him a security expert. He thinks his ultra-leet gentoo boxen are watertight, and doesn't need to implement a security policy or look at his logs, then gets worked over by a script kiddie.

iv) the herd's reaction is "it says something negative about linux, which is perfect, ergo it's FUD"

v) why do linux vendors (and also Sun) feel bundling as much freely downloadable crap as possible adds value to the product, rather than just making more of a PITA to manage properly?

Uhhh. eerrr.. what? by Ayanami+Rei · 2004-02-21 12:01 · Score: 3, Insightful

That "gooey" python stuff only lives on the RedHat derived distros as far as I can tell, and it's never stopped me from using the tried and true methods either. I tend to ignore all of that stuff completely as it's superfluous. (I also tend to just not install any of it... the package selector is nice enough to keep them together)

Also, some of the scripts are damn useful. For example, the redhat-printer-conf. And I've looked at that baby, and it is some _hardcore_ python. It can handle like seven different printing systems, and detects which ones you have installed. It even comes with "Print Test Page".

Mint!

Actually, the worst offender is SuSE. YaST will completely take over all your configuration files. And YaST is written in C. OTH, YaST is pretty friggin complete, and it has a well documented plugin system so it's not as bad as it seems. Still, you just don't install it (or install it but don't use it). Problem solved. ::shrugs::

--
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON

Re:The things you seem to not understand. by MMaestro · 2004-02-21 12:13 · Score: 1, Insightful

One of the rules of security is TURN OFF ANYTHING YOU DO NOT ABSOLUTELY NEED.

But for Joe Average users, the question is : How do you know what you do not 'absolutely need' and therefore need to turn off? As it is, without being a programmer yourself and messing around with Windows yourself, Joe Average isn't going to know what the fuck 'ports' are let alone how to tell which ports are open and how to close them. Sure it may sound like reciting the ABCs for you, but do you REALLY think the majority of the public know what they are let alone know how or why they should close them?

Security is only as good as the person in charge of it. For all Joe Average knows, there could be a program installed in Windows which makes his computer 100% hacker/virus proof but if he doesn't know where it is or how to install it, its useless.

The old "obscurity".. by chrispycreeme · 2004-02-21 12:49 · Score: 3, Insightful

..argument may come back to haunt linux proponents. I know I will get moded down to nothing for saying so, but Linux has been relatively obscure until recently and not worth trying to exploit. Anyone who wanted to create as much havoc as possible would choose the most widely used operating system to attack. That happened to be (and still is) some flavor of Windows.

As Linux comes to be more and more ubiquitous I predict that we will see viruses and worms written for linux that will actually spread. This is not to say that linux is any more or less secure than windows, but all operating systems have weaknesses that can be exploited. Windows main weakness is clueless users in my opinion. Linux doesn't have that problem, but it may have the problem of having over confident users.

I have the most secure system in the world sitting in my den. It is a windows 95 box with no modem and no network card. I will give anyone $1000 if they can even do a port scan on it. Oh and the power supply is bad. Ultimate security! Almost as obscure er..secure as OSX!

Linux is not inherently insecure by mnmn · 2004-02-21 13:10 · Score: 3, Insightful

We setup two firewalls facing the Internet, a MS Proxy server and a redhat9.0 as a test server. The redhat was compromised using sendmail and samba exploits and it was used as a staging area for further attacks before we knew. Thank god the admin password was different on the servers else we would have lost quite a bit of the company.

But I dont think Linux is at fault. I did not use iptables to block unneeded ports on the outside and I did not patch sendmail ( I shouldve used qmail). I shouldve taken close care of suid files, used ssh instead of telnet, jailed most servers, never used root and generally kept checksums of the important binaries. Thats what real security takes, thats whats easily possible on Linux, thats what Windows lacks and THATS what I didnt do.

Altho our firewall now is a single openbsd (which does most of the above by default), I still recommend Linux, but with patches applied, services disabled, ports blocked and servers run in jails. If they compare default installs, Windows isnt running much, older redhats are running too much with no patching of daemons whose sources are available online, and the results are biased. Just give me a server to secure, give the same to a Microsoft representative, some time for us and then attack the two servers all you want.

Just as tomshardware maxes out their test PC's specs to compare video cards properly(radeon and geforcefx will both be about the same on a pentium2 with 64mb ram, 4gb hdd), OS security tests should rule out technician incompetency.

--
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky

But, this is the same problem with Windows by Da+VinMan · 2004-02-21 13:33 · Score: 2, Insightful

Windows isn't inherently insecure either. After all, it's possible to turn off all the services you don't need and to keep your open ports down to a minimum. Keeping your Windows machine patched and all the server products you use patched are also essential. Furthermore, you don't have to use programs that present security issues or, at least, you don't have to use features of those products that are insecure.

In short, those are the same precautions one has to take with Linux. There are some things that *can* make Linux more secure by default, but the same can be said of Windows.

So, as always, security ultimately comes down to the administrators of the servers.

People in the Windows world have been saying this for years. I'm not trolling, but I am glad to see this issue finally come home to roost in the Linux world. There's been far too much complacent smugness in this corner of the IT world and it will do everyone good to kiss, make up, and address the issues as a unified community.

--
Please mod this post only if you think others should/n't read this. I have enough ego^H^H^Hkarma. Thanks!

Stop your whining by Sargerion · 2004-02-21 13:35 · Score: 4, Insightful

Every time somebody comes out with a statistic negative toward windows, the less secure in their reasoning ability among this community always start with the "hurrahs" and "score one for linux!" But whenever anyone tries to tell you you're just maybe wrong, and that, perhaps, linux is not as secure as you think it is, then you get all bitchy and cry and make dumb excuses. Go ahead and mod me into the toliet, but before you do please consider all sides of the arguement for once, jeeze. (not nessesarily saying that anyone is right or wrong on either side in this particular incident, but i hear a lot of flamebait come from a lot of people every time something like this comes up)

Slashdotters react predictably by bonch · 2004-02-21 13:52 · Score: 3, Insightful

Okay, this is the SECOND study posted to Slashdot that has shown that Linux is the most breached operating system on the Internet.

If it were shown to be Windows, nobody would be arguing, but because there is insane bias around here, we get lots of yimmer-yammer trying to run circles around the data.

How many studies have to come out before Slashdotters stop proclaiming Linux as the magic security solution? GNU was hacked twice last year, and GNOME, Debian, and Gentoo were all hacked. What gives?

Just my two cents. I'm compiling Gentoo right now...I love Linux. But I'm not so naive to pretend it's the end-all solution. I haven't read all the comments, but I fully expect to read the same, typical, anectdotal bullshit--"Well, where *I* worked..." or "Well, *I* spend more time on Windows patching..." or "Well, if *I* were conducting the study, I would..."

Re:Slashdotters react predictably by SnowZero · 2004-02-21 14:38 · Score: 2, Insightful

GNU was hacked twice last year, and GNOME, Debian, and Gentoo were all hacked. What gives?

Of course, Valve got so owned its about as bad as the rest combined. I wonder how many other companies just didn't bother to report...
Re:Slashdotters react predictably by innosent · 2004-02-21 15:21 · Score: 3, Insightful

You're absolutely right, no OS is secure. The only defense OSS has is that patches can be released quickly, while Microsoft took 200 days to fix ASN.1 (for which a similar problem was found and fixed very quickly in the BSDs and Linux last March).

How many large companies/organizations running Windows where hacked last year? The point is, most companies/organizations don't report IT security breaches, certainly not like GNU did. If you have a high-profile company, and someone with enough skill wants to, you WILL be hacked eventually, regardless of your choice of OS. Most blackhats don't have the skill level that the GNU attack took, and even that probably could have been prevented, but there is a tradeoff between high security and convenience, and a 0day exploit is hard to stop, unless you can stay awake 24/7 and process incoming ethernet frames in your head fast enough to determine their intent before forwarding them.

I personally would rather be attacked once a month and know of the attack instantly than be attacked once a year and not know. Security starts at the power outlet, once you plug a machine in, you're vulnerable. (And no, you can't have my netblock range)

--
--That's the point of being root, you can do anything you want, even if it's stupid.

Slashdotters love Microsoft! by Anonymous Coward · 2004-02-21 15:37 · Score: 1, Insightful

After discarding all the posts of the Microsoft and Windows haters, I have to come to the conclusion that the data show Slashdotters love Microsoft and Windows.

Applying the same logic to SCO posts, well... I gotta come to the conclusion that there is no Slashdot.

The greatest AC in the world (ignoring all the posts that say otherwise)

DETECTED ATTACKS... by Danious · 2004-02-21 15:47 · Score: 3, Insightful

Notice it's detected attacks? Perhaps it's because the Linux tools are better at detecting and defeating attacks than Windows? How many of those attacks were successful and only detected AFTER the damage was done? Not many, I bet...

Slashdot Mirror

The World's Safest Operating System

119 of 1,014 comments (clear)