Slashdot Mirror
Microsoft Claims Linux Security a Myth
black hole sun writes "Microsoft bigwig Nick McGrath claims that Linux security is highly exaggerated, and that the open source development model is 'fundamentally flawed.' The gist of his argument appears to be his claim of lack of accountability among distributors, coupled with generic statements short on facts. 'Who is accountable for the security of the Linux kernel? Does Red Hat, for example, take responsibility? It cannot, as it does not produce the Linux kernel. It produces one distribution of Linux.' He goes on to say that 'Linux is not ready for mission-critical computing. There are fundamental things missing,' pointing out the lack of a development environment and no single 'sign-on system' giving reference to Microsoft's foundering .Net passport program." I guess Linux can only aspire to the greatness of Windows when it has such secure applications as Outlook and Internet Explorer. Historically those have been proven to be of a caliber all their own.
Twenty years of buffer overflows.
Questions?
In Soviet russia, only old Koreans profit from pictures of Natalie Portman stored on Beowulf Clusters.
Care to elaborate? Just what part of the software stack is missing?
fast as fast can be. you'll never catch me.
Just wait until they roll out WinX, or is it Winux...
Fact: Much of what winders suffers from is incompetent users. Nothing is really stopping the developers from writing spam bots for windows because idiot users on Linux could run bad code just as easily as idiot users on windows.
OTOH, you don't have such dumbass tricks ass tying your browser right to the OS or ActiveX, so you make spyware and whatnot less of a factor.
On yet another hand, however, you have the problem of moron users running sendmail daemons that listen for connections from the Internet and other stupid things. Plus, Linux has security holes. If stupid people don't patch them just like they don't path winders, what good is the security?
Again: You can protect the stupid people from the world if you want, but you can't protect them from themselves.
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
This is the classic case of a kettle calling the refrigerator black.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
If he was wrong, why would Red Hat et al sell service contracts and make money off of them? They accept that money in return for accountability, responsiblity, and SLAs - all of whicha major corporation will demand and which are not present in the pure open source model.
So, he's right, but he's also wrong in that Red Hat is no responsible for Linux kernal security, but they are responsible for getting patches out for issues discovered.
In other news, a representative from Yugo blasted BMW for not putting rear window heaters on their cars. "If you have to push it in the winter, your hands will get cold. What a crappy car."
Unknown host pong.
From Bruce Schneier "Recent data from our honeynet sensor grid reveals that the average life expectancy to compromise for an unpatched Linux system has increased from 72 hours to 3 months. This means that a unpatched Linux system with commonly used configurations (such as server builds of RedHat 9.0 or Suse 6.2) have an online mean life expectancy of 3 months before being successfully compromised." I think the term is not "more secure" but "less vulnerable".
http://www.michel.eti.br
You see, it's called marketing. He is saying exactly what big wig CIO/CEO/C[A-Z]{2} understand and like to hear. Accountability. That's a big thing to most corporations.
Now, him saying that Redhat can't improve the kernel is simple BS, and could either be a fundamental lack of understanding on his part, or just a flat out lie. Given his position, I'm guessing it's a lie. Redhat ( as have most distributers ) patches the kernel with it's own magic, and will often update it on it's own.
Cliff notes: MS marketting with head in sand. News at 11.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
This is another example of Microsoft's marketing prowess. They know that IT managers want to hear about vendor accountability, single source solutions, etc. Those who still are using only Windows are probably not technically competent enough to see through the FUD. The truth is irrelevant here.
Move along, people. Nothing to see here. There's no point in getting pissed off about this; Microsoft shills are liars and exaggerators.
...
I will never forget -- seeing as how it happened only on 19 December just gone -- about my broadband installation. Not wanting to rock the boat nor confuse the cable installer guy, I rebooted into XP just prior to his arrival. He hooked my old beater celery up with DHCP and I surfed for about ten minutes. I thanked him and he left.
So I figured I'd do the decent thing and do the security updates.
Eight hours later, I cleaned off the last of the spyware, adware, malware horseshit.
To Nick McGrath: Fuck off and die, you wanker. How much you want to bet your router at home runs a Linux variant for firewalling purposes?
========================================
Death will come, and will have your eyes
-- Pavese
They take responsibility for their distribution. They will patch their kernel if anything seems wrong with it. From time to time they pay for an audit. Similarly the debian people vouch for their kernel, and so on. The vanilla kernel.org kernel is only accountable to the kernel.org people, true, but most "enterprise" distribution makers will stand up for every package they distribute.
I am trolling
LIMITATION ON REMEDIES; NO CONSEQUENTIAL
OR OTHER DAMAGES. Your exclusive remedy for any breach
of this Limited Warranty is as set forth below. Except
for any refund elected by Microsoft, YOU ARE NOT ENTITLED
TO ANY DAMAGES, INCLUDING BUT NOT
LIMITED TO CONSEQUENTIAL DAMAGES, if
the Product does not meet Microsoft's Limited Warranty,
So, are we believe that if Windows crashes my data, that I can hold Microsoft accountable?
At least with Linux I have access to the source code, and can hire programmers to scratch my itches for me. Somehow, I don't think microsoft would give out source code if they went under.
McGrath is not making a technical argument, but a management/legal one. In business, security (ie peace of mind) is not defined by the tightness of a piece of code but by who you can make accountable for any failure.
Microsoft at least is the clear and sole owner of its product. Though any single customer's ability to make it responsible for product deficiencies is slight at best, a statement of "we're here and responsible for our stuff" is superficially reassuring.
a world in progress...
There are fundamental things missing, ... no single 'sign-on system' giving reference to Microsoft's foundering .Net passport program.
Please, someone, tell him about kerberos...
"You mortals are so obtuse." -Q
Linux is not Windows
So the Microsoft bigwig Nick McGrath says 'Who is accountable for the security of the Linux kernel? Does Red Hat, for example, take responsibility? It cannot, as it does not produce the Linux kernel.."
Well Ok Nicky - you are implying then that MS DOES take responsibility for the security of its products? If tht is so then you are lying because the last time I read YOUR EULA it states that you guys will take our money but will not take responsibility for any defects etc in YOUR products.
Once again we have idiots making statements for none other than the idiots that are running the IT industry...
Come now. This is rediculous:
I guess Linux can only aspire to the greatness of Windows when it has such secure applications as Outlook and Internet Explorer. Historically those have been proven to be of a caliber all their own.
This is true, I will agree.. in my humble opinion. Let's save the editorializing for the comments. This is 'News for Nerds' - this sort of snide comment has a place in an Op/Ed page, but certainly not the 'front page' of a news site. I suppose there are divergent ideas of what Slashdot really is, but I think that endeavouring to be unbiased would be great.
I'm not meaning to troll or to be 'flamebait' here, just to point out a disturbing trend I've noticed in biased story submissions.
"There's no success like failure, and failure's no success at all."
- Bob Dylan
Unfortunately, part of marketing, especially when your product is getting negative publicity, is pointing out perceived flaws in competing products. I believe the term often used is FUD, and it's nothing new or unique to MS. Heck, it's pretty much how GWB won a second term.
When it comes to this sort of thing, they have a wide lattitude of opinions they can express, especially when there is no Linux, Inc. to sue them for slander. The Linux community, however, has been quite good at spreading the word about MS badness; they're just trying to do the reverse because their feelings are hurt.
The CB App. What's your 20?
Spyware:
Windows: I run a spyware checker every week or two, and it almost consistently finds new spyware.
Linux: Is there a spyware checker for linux? Does there need to be? I know that my Linux box runs consistently fast, and has no search bars.
Edge: Linux
Default Habits:
Windows: The Windows XP install, by default, seems to create an Administrator account with no password, no User account, and no suggestion that there should be a user account. Also, there's many services that are on by default, that really shouldn't be.
Linux: All linux distros I've used require a root password, and strongly emphasize that root is not to be used for day-to-day computing. Depending on the distro, most unnecessary services are off by default.
Edge: Linux
Updating:
Windows: Use an insecure browser, tied to the OS itself, to browse to Windows Update, wherein the system is updated. Note that these updates have a nasty habit of breaking things, and this does not update third-party software which may be vulnerable.
Linux: sudo apt-get update; sudo apt-get OR upgrade
sudo emerge sync; sudo emerge --update world
Edge: Linux
Do I need to go on?
...especially because they claim they are explicitly not responsible for anything.
i really don't want to play down the problems linux has with its development model and i sure have heard great things about the microsoft development process!
but i'd rather have a more secure system now, which lacks in development stringency, then a provenly unsafe system which can prove exactly when, why and how their bugs came into the system...
microsoft is just far too lax concerning their outward security policy (like not caring about the blatant RC4 exploit). their "patch day" with all those patches that never quite close the exploits is just a farce!
well, gnu/linux with all its applications has had a bad streak of exploits as well recently and i would strongly recommend a stricter development process, but if i were microsoft i'd definitely tone down on the linux-is-insecure-and-lacks-accountability bashing and instead invest some serious effort in making my own product look a little more convincing and less like the bug-ridden security hole that it is!
jethr0
Mike Tyson accused Michael Jordan of being "violent and out of control."
And Richard Simmons accused Charlton Heston of being "way too gay."
Lawrence Person (lawrencepersonh@gmailh.com (remove all "h"s to mail)
http://www.lawrenceperson.com/
I corrected it for you: Apparently it's well-known at Microsoft that Linux doesn't support **Microsoft's deliberately incompatible version of** Kerberos.
Yes, what a good point. There are multiple DE's for linux. This is a bad thing, because it means developers have a choice. There should only be one piece of software for each category, and it should be manufactured by Microsoft. Choice is bad, people!
My Systems
Microsoft bigwig Nick McGrath claims that Linux security is highly exaggerated, and that the open source development model is 'fundamentally flawed.
Why, of course he does. That's his job.
In other stories, water's wet, sky is blue and women have secrets. More news at 10!
If so, isn't a huge advantage of using ANY *nix in production that you don't have to have the overhead of running a graphical desktop environment if you don't need to?
This is not a recent strategy... in marketing you commonly look at your strengths and weaknesses - and then see how you are perceived by your customers. If your customers already know your strengths, your marketing strategy is to convince them that your weaknesses are also strong.
It just sounds silly to those who know. But it does work in most cases...
while (sig==sig) sig=!sig;
how insecure would Windows be if you were able to remove IE and Outlook from the picture?
If Firefox becomes the great white hope for secure browsing on the Internet and the other one where it incorporates calendaring into Thunderbird has as much success as Firefox is getting(can't remember the name for the life of me), could this in itself slow Linux adoption? Windows has improved stability-wise over the last couple of years by leaps and bounds and supposedly they are looking at making it more secure (but I am not holding my breath too much).
Just a thought.
First of all, I can't trust this article because it's not digitally signed!
Now, on to the point. If someone comes out and says: "the default Linux kernel released by most distributions is not secure." I'll say 'hell yes'. Note that this is not what TFA states, it is a much broader screed against open source in general.
The problem is that if Microsoft wanted to launch a rational attack on Linux's security they would also be attacking their own products. I'm not even talking about the differences between open and closed source here, I'm talking about the ways that Linux and Windows both are susceptible to security issues. Right now most default Linux distributions put out kernels and user-space utilities in a system that assumes every piece of software has to be perfect to ensure security! (especially anything running as root) Windows is basically the same way. Once a hole gets found, it is easily possible to hijack and entire system.
Now, at this point the arguments between Linux and Windows invariably devolve along the lines of: Linux gives you the source code so you can find the bugs yourself or Windows runs too many services and that's why its not secure. On the windows side we get arguments about how you 'can't trust unsigned open-source code!' (which actually does have some merit if you don't check source signatures you grab from some random mirror, but does not really speak to the OSS development model). The problem is that these arguments are more about which system is easier to band-aid than which system is innately more secure.
Let's really look at default Linux vs. Windows. Both have admin and user accounts, both follow a similar model of discretionary access controls, both can be hacked remotely although windows tends to get hit more because it runs too many standardized services.
The point of this very long rant is that Linux does indeed have security problems that are not of a nature much different than Windows. I would say the better track record of Linux so far is NOT due to it being open-source; that does help finding bugs, but plenty of Windows bugs are found and fixed before the Windows boxes are hacked. Instead it's because Linux (with some exceptions) does not install a bunch of stuff by default, Linux systems are not as homogeneous as Windows systems (software monoculture time), and Linux admins have historically been better than Windows admins (this is definitely something that will be subject to change in the next few years).
So is there a solution? Well, nothing is ever going to be perfect, but systems like SELinux and GRSec are big improvements because instead of saying "the whole system is perfect" they instead say "components in this system will be compromised, how to we isolate and protect it?"
There's a problem though, these systems require old-time Linux users to deal with new restrictions they might not want to deal with. I promise you that SELinux policies that work great on a production webserver would drive you insane on a development box, but you need to protect both machines, a hacker will target both.
I'll save my rant on Microsoft's security for when this story gets duped, it's another mess entirely. Just MS is foobarred should not be an excuse for not looking to find and fix problems in Linux.
AntiFA: An abbreviation for Anti First Amendment.
Who is accountable for the security of the Linux kernel? Does Red Hat, for example, take responsibility?
Er... and who is accountable for the Security for Windows?
Microsoft?
Internet-swiss-cheese-security-Exlorer Microsoft?
And will Microsoft take responsiblity for their security holes? Will they pay for the damages caused by crashes and exploits for their buggy software?
Maybe if they get their software quality up to a reasonable level they can START asking questions, but as long as they are as bad as now, they better keep their mouths shut, or they'll have to stuff their own feet in them.
+++ MELON MELON MELON +++ Out of Cheese Error +++ redo from start +++
This "lack of accountability" argument is bullshit. Why does Microsoft have an EULA for its software? To cover their asses so they can't be held accountable for damages caused by their shitty software. When was the last time Microsoft was taken to court over losses due to poor software? If they could be held accountable, they'd get sued right out of business!
-kidlinux.
I'm actually serious, you were moderated informative but I am really wondering where the superiority of the MS tools come from..?
We've always been at war with Eurasia.
Aside from the fact that there are no references to back up any of the claims that this McGrath fellow is making (I'd even settle for a research firm that was paid-off by Microsoft!), the 'author' of this article wrote a grand total of FIVE sentences. All five of those sentences paraphrase something else that McGrath says. The rest of the article simply quotes McGrath straight.
There's no discussion of the points, no consideration of other factors, and as far as I can tell, no fact-checking. There is simply no journalism happening here. I know I can simply move on, but it irritates me to know that some CIO out there (probably mine) will take this all in without a second-thought.
The shortcomings of the Windows OS are OBVIOUS to anyone who has to admin these systems in a real production environment, and even more apparent to those of us who have the pleasure of also running other systems. Just imagine what Windows might be like if they spent half of their propaganda budget on fixing the freaking software.
I'm presuming this is some sort of weird troll, moderated "informative" for some odd reason (seriously moderator, "informative"? What derf?)
Seriously, if you think the Microsoft development tools are far superior to anything else in the world, then I can only presume you've never used anything else in the world :).
As we all know, Open Source Software development is structurally similar to the scientific method and evolution in terms of how "new things" are created by the these systems. Similarly, what Microsoft is claiming is that software can't be created well "at random" through emergent means (we know that's a crock) but needs "the Hand of an intelligent Creator" to control everything (Microsoft == God, apparently). Ergo: Microsoft is claiming that only "Creationist Software" is good software - "Evolutionary Software" is evil software.
I think this could be useful angle of attack against Microsoft FUD: they are advocating creationism and faith-based solutions to computer science.
I like the related articles at the bottom of the page.
RELATED ARTICLES
* Microsoft to axe Windows 2000 security upgrades
* Microsoft enhances SQL 2005 security
* Viruses plague half of UK Windows users
* Linux fights off hackers
* Busy day for Linux administrators
* Industry giants offer Linux consumer boost
* Windows open to critical vulnerabilities
You're on the right track, but that still wouldn't cut it, due to the crackability of this kind of solution, setuid has no effect on scripts, you'd have to write a small c program to do it, or use sudo, which is much better all round.
HTH
David
Ask 8 slackers a question, get 10 awnsers (a citation, but I can't remember from who)
I am generally a UNIX programmer, but I have also used custom operating systems. Only twice have I had to use M$ tools. Both times I have found obnoxious stupidities that led me to the conclusion that M$ does not use their own tools in any reasonable fashion.
Around 1989, I had to use whatever Visual Studio was called then. In the debugger, while stepping thru some C code, I accidentally stepped into strcmp or some other function for which the source code was not available. It dropped into assembler mode, quite fine, just a matter of stepping until it exited back to C code. Except it then displayed the C debug screen without first clearing the assembler debug screen. Lots of pieces left over, register displays, hex codes for instructions, etc. Almost unreadable. It gradually cleared itself up as I continued to use it.
Around 2002, I had to use Visual Studio for some small project. You can click on an API and it automatically adds skeleton code to source files. It leaves those windows open, and I did not want so many windows open at once, so I tried to close them. Nothing under any menu I could see, but the X in the corner worked. Next time I used the skeleton code inserter, it complained that the file had been modified by an external program.
Now I suppose I was doing things the non-M$ way. There is probably some perfectly normal way of getting rid of excess windows. Maybe I should have iconized them instead, but that clutters up the task bar. I found two other similar bugs within the first half hour of using the beast.
These are the kind of bugs that anyone using the program would stumble across very quickly. How can the M$ deveopers take any pride in releasing such buggy code? How can they stand to even use such crap software? Is it so crappy that they don't use it themselves?
I have no respect for M$ programming skills.
Infuriate left and right
I only have to wrap myself up in the warm and protective arms of a Microsoft EULA to feel the shielding umbrella of accountability.
McGrath slays me.
Set-uid works by changing the user ID of the program to that of its' owner; thus a program like passwd (which must have root privledges to write to the password/shadow file) has suid. Scripts which use suid have a few particular security concerns; since they inherit the PATH environment variable (and a few other particulars) from their calling user, you want to ALWAYS use the full path to commands. Thus, your script should look like:
and:since a user adding a malicious insmod or rmmod to their path could gain privledges. (There are other, more subtle, security issues with suid, but this is the easiest to understand.)Nevertheless, having a suid script is far preferable to idiots logging in as root for ordinary work!Do you like Japanese imports?
The post was not meant as a troll, only to answer the usual anti-MS ./ BS. Certainly they cost money, and free software has that clear advantage, duh. As a language guy, having written many compilers, I am quite impressed by the pragmatic design of the C# language. It is greatness. Also, I personally don't want to write another line of DB access code; the fact that these tasks are automated, integrated, and yet flexible is one of the strengths of MS tools. All the fancy dialogs and wizards simply generate code that actually works, unlike something like Rose, that has to be tweaked to death. Yet, that code can be modified for flexibility; it isn't just a black box. Also, in MS, exceptions actually work, and I don't have to go back to the 80's technology of setjmp/longjmp. Templates work, and have for nearly a decade, and they compile down in very cleverly optimal ways. Typed collections rock. Duplicate-on-write strings rock. Some folks even write templates in such a way as to get better, more optimal code than without them. The debugger is truly integrated and just works. I can traverse the most god-awful data structures live without it crapping out on me the way Mac/GNU tools do. etc.
Six score characters.
Brevity being wit's soul
I have enough space.
I've heard this from several corners. Sometimes, even from people I trust a bit. I still don't get it. I don't live in the MS world, so I don't have much of a reason to experiment, but I am honestly interested in what makes them so great.
I hear about the "tool tip" style reference checking, auto-library chain analysis, etc. The first would annoy the shit out of me, and the second I get from my make file (or ant, depending on what I'm building).
C# seems to be a slight step up over Java, but nowhere near enough to incur the cost of switching platforms. (I say this as someone who develops and maintains production apps in Java, and hates the language.)
As a sysadmin-cum-developer-cum-business-guy, I do everything in vi, make/ant, cscope, and custom tools using primitives like sed, awk, grep, perl, svn, RT, image-magick, [custom mailing list manager], etc (yeah, perl can replace sed and awk. I mean to, some day...). I think I have everything I need, but I'd love to hear about how it could be done better.
So, please, do tell- what makes MS dev tools so great? I'm really curious.
I forget what 8 was for.
I hate to burst his bubble about single sign on, but on my network we have single sign on to every service on the domain that you have permission to access once you have authenticated to the domain at your workstation, whether your workstation is windows or linux. Services are provided by windows, 4-5 different linux distros, and aix servers and are things like ftp, ssh, file sharing, concurrent versioning systems (not just cvs) and the like. This is accomplished with samba, ldap, nss, kerberos, sasl, ssh, proftpd, winbind, and possibly a few other pieces I'm forgetting at this moment. Unfortunately this was a pain to get it all working on both the windows and unix sides but it does work flawlessly. Well almost flawlessly - the windows boxes don't have ssh servers running. I don't know what he means by single development environment but if he means an ide he can keep his little tools like the visual studio hack. Unix annd unix-like systems give you the ability to use your whole operating system as your development environment.
Because the way they do it at MS, they're raking in about $40B:y. Good security would cost them more money than just talking about it. They're smart enough to know how to turn insecurity into a marketing triumph, without paying the cost.
--
make install -not war
It doesn't matter what the state of UNIX IDEs was in 1989. The point is they released shoddy code which they must have known was shoddy. Whether IDE or not, it was shoddy, the developers themselves surely must have been using it all the time every day, they could not have avoided noticing it was shoddy, and they released it anyway.
As for you having inserted skeleton code without problems, that also is not the point. No doubt you have had some kind of training on it. I had to jump into it and use it the best I could. It is supposed to be intuitive, is it not? It wasn't. Clicking the X is supposed to close the window, right? Should not the IDE have known that it had closed its own window?
I found three repeatable bugs within half an hour of just stumbling around trying to figure out how it worked for some little pissant project. Are their QA people so jaded they can't find these problems? Are their development teams so rigid in their practices that they never stumbled across these bugs themselves?
If the development teams can't be bothered to fix their own dog food, either they eat something else, or they have extreme tolerance for crap. It does not bode well for their work on projects they don't use as much, which is just about everything else.
It all speaks of shoddy practices from one end to the other. That's the point.
Infuriate left and right
Your point still stands, yes - but I think it's sort of off-topic from the intent of Microsoft's original statements.
They were primarily trying to make claims about the lack of security in Linux based on missing components, plus a lack of accountability for bug fixes.
You're addressing an issue of availability of software applications for both platforms.
I do agree with you though. Linux is still pretty much an OS that's best used by application developers or as a server platform of some sort. The attempts to "hammer it into shape" as a general-use desktop environment are still "half-baked", and that's largely due to a lack of variety of applications to run on it.
After all, you can have the most elegant, powerful operating system on the planet - but if nobody writes apps to run on it, what good is it?
People can (and in the case of Windows, certainly DO) put up with a lot of problems and deficiencies in an OS as long as it allows them to use the software apps they want/need to run. Linux is sorely lacking in the games dept., the music editing/creation dept., and in some aspects of graphics design and editing. It also comes up a little short for people needing to do accounting work. (Peachtree for Linux? Quickbooks for Linux? DAC Easy Accounting for Linux, even? Perhaps a version of M.Y.O.B. for Linux? Nope.... none of 'em. And accountants like standardization. Even if you write a cool new accounting package for Linux - you better at least support imports/exports to some of these Windows packages or it won't gain much traction.)
In making a business decision, it's unlikely for anyone to take responsibility. The larger the business, the smaller the likelyhood. It's not an issue of cowardice; the risks simply don't outweigh the rewards.
So, the question "who do you blame" is a legitimate question. System fails, Clients sue company, company pays clients, insurance company pays company; insurance company sues vendor.
In business, those who take chances are the people who create the great successes and the great failures. These people exist. They are not the norm.
"Nobody ever got fired for buying IBM." The point is not that this is true. The point is that people say (or said) this. They're saying that if you're working for someone and you want to keep your job, you make the safe decision.
"Reality is that which, when you stop believing in it, it doesn't go away." - Philip K. Dick
Most folks have the take that Microsoft McGrath is throwing bricks from the glass house. But let me take a different view. Does Red Hat take responsibility? And the answer is, yes, or else. Because since you can get a Linux kernel from many sources any distributor that behaves irresponsibly (or insensitively) will lose the business end of their business, and, poof, they're gone. And this concept extends beyond the kernel to other aspects of doing business.
A few of us (call me a semi-pro minus or hobbyist plus) left the RedHat tent with the way they handled the transition from 9.0 -> Fedora, and, in retrospect, I'm happier and it seems from the financial results that RedHat is happier.
Now McGrath's comments are not meant to be part of a serious debate about how us users may get the most safe, seamless, fuss-free, and satisfactory experience with the kit we own, but are the equivalent to the flip side of preaching to the choir, which I suggest is reminding the congregation of damnation should they even think of leaving the church. Remember the Flintstones, how much of the "technology" was powered by a purposed, humiliated animal who would look up and say to the audience, "It's a living." I suppose it is.
'Who is accountable for the security of the Linux kernel? Does Red Hat, for example, take responsibility? It cannot, as it does not produce the Linux kernel. It produces one distribution of Linux.'
And who, pray tell, is accountable for the thousands of holes that have left Windows users open to viruses, trojans, and other malicious uses of their hardware? Billions of dollars in money throw into the toilet fixing the results of nonexistant to pathetic securty in Windows, with an EULA that specifically absolves Microsoft of all blame if anything goes wrong using their software, and they have the gall to claim that they are accountable for Windows?
Should I be submitting my bills to Microsoft instead of my clients when their poorly designed, poorly implemented software causes them to need my services for hours on end, making them unable to do work, let alone pay my fees?
Who is accountable for the security of the Linux kernel?
And Microsoft takes the blame for their OS's security, but they are hardly ever held accountable for it.
Why is Microsoft complaining about security liablity of Linux when they're writing and selling a desktop for it?
So essentially Microsoft is back to taking the approach that if they close their eyes tight enough, everything will be OK?
'Super-Linux' Cluster Declared Third-Fastest Computer On Earth
fastest computer system in the US
NCSA Linux Cluster Among Fastest Computers in the World
Two Linux clusters on Top 10 list of fastest computers
If someone says he and his monkey have nothing to hide, they almost certainly do.
"In Microsoft's world customers are confidant that we take responsibility. They know that they will get their upgrades and patches."
.NET? The thing microsoft keeps promoting their pants off at? The base that requires you to download some stupid runtime, where using 1.0 versions of software on the 1.1 runtime will cause calculation errors because it adds decimals suddenly to calculations when the program was never written to handle that etc.. ?
They also no it's not fixed in a day, like it is in the opensource community, it's sometimes fixed after months and months of waiting
"There a myth in the market that there are hundreds of thousands of people writing code for the Linux kernel. This is not the case; the number is hundreds, not thousands,"
don't play with words, people say "linux" as in various distributions of linux, not specifically the kernel.
"There are very few of the improvements that come through the wider community. There are more skilled developers writing for the Microsoft platform than for open source."
I wounder how they made this demographic.
"A lot of the percentage growth figures mask the fact that Linux is coming from a very small base. There are more Unix servers than Linux servers in the UK. There are more Windows servers than Linux servers in the UK."
what the hell, there are huge data centers of linux servers which have more computers than the entire of london, and the "a lot" of percentage growth figures come from stuff that Microsoft has sponsored and possibly rigged?
"Most customers look for more than just a product from their vendors. They need a solution that comes with the appropriate levels of support and service. This is where Linux is becoming more challenged as people expect more from Linux."
All buisness linux distributions provide better support for their products and integration with 3rd party products hell of alot better than microsoft's support does.
"Linux is not ready for mission-critical computing. There are fundamental things missing. For example, there is no single development environment for Linux as there is for Microsoft, neither is there a single sign-on system."
Linux is used in mission critical computing in routers, broadcasting, millitary etc.. and there is one standardised development system for linux called LSB (linux standard base). As for windows.. Where is it and what is called?
Change is certain; progress is not obligatory.
The gist of his argument appears to be his claim of lack of accountability among distributors,
:D Okay, now we all are convinced how superior Microsoft products are :D My world changed from ground up after reading this sentence, really :D These guys really have to be working hard to make such arguments :)
Mmkay, M$'s could be held accountable for Windows' lackings in security and loads of holes and bugs in their software. But it doesn't change anything, does it. Don't start cleaning somebody else's porch until yours is the biggest mess.
Who is accountable for the security of the Linux kernel? Does Red Hat, for example, take responsibility? It cannot, as it does not produce the Linux kernel. It produces one distribution of Linux.
Yet, even redhat has provided countless app. and security fixes over the years. And, for the record, accountable for the security of the Linux kernel ? Well, that is a question, isn't it. Didn't know that was such a problem even M$ cares about. Oh, and by the way, who can be held accountable for the nt series kernel (about which nobody can have a clue what it contains) ? No, don't mention any names please, my prayers already contain a quite long list of names.
Linux is not ready for mission-critical computing. There are fundamental things missing. For example, there is no single development environment for Linux as there is for Microsoft, neither is there a single sign-on system.
I need to take my pills to stop my laughing spasms. Okay, let's educate ourselves. For one, would be a good homework assingment for some student to find out what o.s.'s were used in the first let's say 10 years of computer controlled systems which could be labeled mission critical. Then, Kylix and Kdevelop are both fully R&D envorinments (I deliberately don't mention "smaller" stuff) from hello world to gui development all integrated. Then regarding Passport thing, that's really awkward to reference, since everybody and the neighbor's dog is dumping it all over the place it being good for nothing useful on this earth.
There a myth in the market that there are hundreds of thousands of people writing code for the Linux kernel. This is not the case; the number is hundreds, not thousands
There are very few of the improvements that come through the wider community. There are more skilled developers writing for the Microsoft platform than for open source
Now that's it. When you don't know anything else to do, go offend openly every developer who dares to do FOSS work.
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
Who is accountable for the security of the Linux kernel? Does Red Hat, for example, take responsibility?
I applaud Microsoft's recognition of the importance of accountability. I look forward to reading Microsoft's revised license agreement, in which Microsoft will presumably accept liability for consequential damages resulting from security flaws of Microsoft products.
I entered the address of a website, it wasnt a particularly nasty site, just something resulting from a google search.
And it automatically installed a spyware application. No YES/NO dialogues just installed it. After that I saw attempts at outbound port 6667 to various external servers.
Now I do manage servers that hold financial data, and servers with ERP software that run the company.
I ask you, Microsoft, can you be held accountable if our company melts down should malicious spyware enter the system with their authors intending to corrupt our backups and bring everything down?
Will you pay us the millions that we lose as we lose our customers?
Will you as a result of such a catastrophe give us an OS that does NOT allow such breaches of security?
I understand IE in Windows 2003 is more secured, and we should never browse for anything on the server itself... etc. However Windows2003 has not been matured enough to bring out the bugs while Windows2000 has issues even after SP4, and after Microsoft will cease to provide bugfixes for it.
We replaced our firewall with OpenBSD. We simple cannot find a reason to upgrade it from the 3.4 version, since the older version is so secure. Hell yeah we've had attacks of all kinds, to almost all ports, syn cookies even ddos type attacks that slowed the Internet connection, but we're still up, and without ever having an issue for over two years of OpenBSD operation.
Coming back to Linux, which is also a UNIX clone, and which has more eyeballs on it, and more companies taking responsibility for it, tell me, should I pay for a crappy OS with someone behind it you can point fingers to, or a nice OS with no person behind it simply because youll never have to point fingers?
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
And yes, C# is (a) pretty cool, and (b) different from C++. That's why we have Mono :-). As for debugging, I don't do that much (usually stack traces are enough), and my "IDE" is kwrite and a command line, but KDevelop, Eclipse, and many others do indeed have integrated debugging - if it craps out, file a bug report, don't just bitch on Slashdot.
With vim, I have tab expansion for method calls, but only when I want it - not some distracting thing that tries to second guess me. I have syntax highlighting, brace balancing, way better keyboard navigation (at the cost of being warped into the vi world, but that was done to me years ago). Method variants are a function of tab expansion. Pop up crap would distract me from what I'm doing. And arcane as it may be, s/(.*)re?gex$/somethingelse($1)/g is extremely powerful. My fingers just work that way, and I'm only 32. Don't get me started on the cool things one can do with ex commands.(god, did I just say I'm *only* 32?)
I suspect this is an old-school-new-school thing. I don't like IM, either - email me or go away. If I don't know how the object is called, I need to read the public declaration, or I have no business writing code against that interface.If assisted coding actually didn't become a distraction, and actually inferred intent, I might take the time to learn it. But now I'm just being grouchy. Thanks for the explanation of what you like. I know I'm a little bit purist; I didn't use the syntax highlighting for quite a while, because it (a) didn't work in edge cases well, and (b) well, can't you indent properly? What's the problem?
Maybe developing that way is be faster, but I do think I understand, and can troubleshoot, things better with my coding suite and style. So I'm still not swayed.
And I'll hit you with my cane, whippersnapper, if you bug me while I'm feeding the ducks.
I forget what 8 was for.
If Microsoft is so concerned about responsibility for security flaws, why is it that they don't offer indemnification for users hurt by their software?
But reading the EULA, MS clearly states that they are not responsilble. I expect WindowsUpdate to change my system through patches, but I don't expect upgrades. I'm still running Win2kPro on my tri-boot system (Debian and Gentoo.) I KNOW that I will not get my UPGRADE to XP. I also hated hearing MS discuss XP SP2, and calling it an "upgrade." Also, I am CONFIDANT that MS would not take responsibility for data loss. ~ FUD
so it is hundreds of hundreds, then?
My guess is that only a "handful" of MS employees work on windows' micro-kernel as well. Though it might be true that there are more developers writing for the MS platform, this is because it is the world's most widely used OS. He's done a bait-and-swtich almost... Discussing the kernel development and relating it to the wide base of application software?
He uses the word "myth" quite often here. So let us look at a few select definitions of the noun:
* a traditional story accepted as history; serves to explain the world view of a people
* A popular belief or story that has become associated with a person, institution, or occurrence, especially one considered to illustrate a cultural ideal
So a myth doesn't necessarily mean make-believe. We could interpret his quote to have meant this : "The world-view and cultural IDEALS of Linux have made themselves a concrete REALITY over the past year!"
Well, uh... DUH! If you expect more out of something, that something will be more challenged to perform. Water is wet. The Pope is Catholic. If I expect my automobile to drive 200 mph, the manufacturer will have a bigger challenge designing it. Go figure.
OK, I'll admit, I'm not a software guy. But aren't these unrelated statements? ie, What does a development environment have to do with mission-critical computing??
The Linux Desktop (and kernel?) may have certain things missing, that's a given. That doesn't mean that it isn't ready for SOME mission critical computing. I'd be more inclined to use a kernel/OS that allows inspection of it's source for any mission-critical apps. Ask NASA why the Mars rovers are using Linux instead of Windows.
FUD FUD FUD, is all I got out of the article.
Please explain where I'm incorrect here. I admit that I'm not as knowledgable on some of these points as many of you, and would prefer to know why/how I might be incorrect.
It's all about what OTHER PEOPLE should do to make YOUR life easier.
Looking up a name in a list is TOO HARD for YOU!
There should be a link on kernel.org so YOU can send something to some OTHER PERSON who will spend the time and effort to determine what it is and who's responsible for that and then make sure it gets to that person.Not obvious? It's where you go to get the source for the latest kernel.
I can't write patches for the kernel and even I can find it.Right. It's all about how to make YOUR life easier by having OTHER PEOPLE do it for you.
Rather than you spending 20 seconds to find the email addresses, you expect someone else to be able to read the patches, find out who maintains that subsystem and get the patches to that person.No. The fact is that many hundreds of people manage to get patches submitted in the current structure.
Yet there was one example of one person who couldn't understand that structure...
So the whole structure is wrong and has to be replaced.
Rather, it seems that that one person has a problem and your "solution" would only make MORE work for someone(s) who had to be the single point of failure (do you know that term) for processing patches.
The current system has so many ways to get a patch submitted that even the dumbest individual will eventually stumble across one. As was shown with your example.
Why switch from such a distributed, de-centralized system to one with a single point of failure?
Just to make life easier for the dumb people? I don't think so.
"The Linux community has its security head in the sand. Linux isn't secure. It is just that it is only run by a few computer literate people who know how to keep their insecure systems safe."
And most of us also use the system for work, school and play. We know more about computing and the threats to our systems than most windows users because the system is teaching us. You don't learn how things work with a mouse. You learn them by breaking the system, messing with it, building software and installing from source code. The best security in the world is learning and reacting to the real world. By sheilding us from it Microsoft has insulated us not from the threats of the world but from the tools to protect ourselves and educate ourselves about the system.
To say that Microsoft or linux is better for security is a red herring in either case. I like the basic simplicity of the *NIX model. My stuff works. My systems do what I want.
bob@Osprey:~>
The article mentions single sign on as being an issue under Linux.
Single sign on is the ability to have a user log on to the network fron a centralizaed authentication server and not prompt them for credentials when they access applications servers.
In Windows speak, that's not Passport, that's AD and AD aware apps.
In Linux, it's pam_krb5 when you log on, and kerberized apps.
* Evolution / Dovecot
* Firefox / Apache HTTPd
* CVS (client and server)
* SVN (client and server)
etc.
This meme refuses to die. It sounds credible that more usage would lead to a more attractive target for malware but ignores other factors like:
An excellent article refuting this meme, which doesn't even mention ActiveX, can be found here:
http://www.theregister.co.uk/2003/10/06/linux_vs_Here's my opinion, with references to support it.
Only a criminal monopoly(1), with no consideration of their customer's interests, could embed into their web browser "application" (2) the security sink-hole of ActiveX vulnerabilities(3) to achieve vendor lock-in(4). This has resulted in the mess that is "security" in Microsoft(R) Windows(R) today.
References:
Transmitting energy without a license.
In general, I agree with him on this (I have not RTFA yet). Nor is Windows, of course, but that's taken for granted. Of course, it depends how critical your mission is. "Mission-Critical" is one of these phrases which is bandied around, but let's consider what it means....
"The mission depends on this system".
That still does not define the extent to which the mission depends on it - 80%? 90%? 100%? Nobody offers 100% availability, if that's what you're referring to.
The phrase also ignores the mission involved. For NASA, the Mission might be to send a man to Mars and back, but what if my "mission" is to run a website which expects to get 3 hits a month with a 60% expectation of success? An Atari could cope with that - my mobile phone could probably cope with that!
Taking the phrase in the way it's normally meant (running systems which are responsible for a significant amount of the user's business, and the failure of which would cause significant disruption of the business process and/or profit), then the whole discussion still depends entirely on the "mission" involved.
What tradeoffs is the mission prepared to make for uptime, for example? Serving read-only webpages, I care little for data integrity (I've been serving the same data for years, I've got it on tape, CD, DVD, onsite and offsite), and only care about uptime.
If I'm running a database which is updated many times a minute, then uptime still matters to me, but I also need to know which transactions have been fully processed, and which have failed (given Failure Scenario N, which may or may not have been predictable). That is much more difficult.
Author, Shell Scripting : Expert Re
So, you clicked a link called Free Boobies, explicitely on the .nl domain where porn is look at differently (so safesearch works differently) and you expected it to be safe?
This sig is the express property of someone.
I haven't read a sillier comment than those of Microsoft on open source software, and Especially Linux. Simply put, open source software, is the biggest invention ever.
Linux security is highly exaggerated
Windows security is too complicated to be taken seriously. On Unix, you have user, group and public security bits. It is a simple model, yet proven enough for all tasks. On Windows, you may have ACLs based on time, on type of access, inheritable security attributes, etc etc, but Windows is still the most vulnerable O/S by the long shot.
and that the open source development model is 'fundamentally flawed.'
Thanks to open source software, there are thousands of programs to use for every possible task, the scientific knowledge on computers spreads around much faster, it helps low economies ride the computer revolution bandwagon, it helps children in poor countries get in touch with computers...imagine a world without open source software! computers would not be as widespread as they are now.
'Who is accountable for the security of the Linux kernel?'
Who is accountable for the security of Windows, given that the installation disclaimer says that Microsoft has no responsibility whatsoever on the effects of working with their O/S?
Furthermore, OSS does not need accountability: if your app does not run and does stupid things, people will not run it, your reputation will be hurt, and you will be forced afterwards to do a better job.
'Linux is not ready for mission-critical computing.
Last time I heard, the US army plans on replacing Lynx and other real-time O/Ses with Linux on their radar and defense systems. How's that for 'mission-critical'? I know several companies that produce defense applications for Linux. And Linux is actually better for this kind of software, because the source code can be audited by these companies at no charge.
the lack of a development environment
They couldn't have made a funnier and more absurd statement. Hey MS, does GCC ring a bell? it comes with every Linux distro, remember? what's the development environment of Windows out of the box? none. There is none. MS users have to spend another $300 on getting the MS Visual Studio.
and no single 'sign-on system' giving reference to Microsoft's foundering .Net passport program.
A single sign-on system is actually unimportant. I have registered myself at many many sites, but since the browser remembers my password, I don't even sign on. Furthermore, wasn't there a story about the .NET passport system security having been hacked for a week or so? and hackers having access to ALL of users' data?
I guess Linux can only aspire to the greatness of Windows
What greatness? Win32 is the single most badly-designed API, right after MFC. Microsoft actually needed to develop a whole new platform in order to get it right. There is simply no architecture behind Win32. It is a random accumulation of functions over time, with many semantic problems, no clear separation between concepts (for example, asynchronous sockets are implemented through the win32 message queue).
As for the plethora of software, it was a matter of economics that Windows has so much software: the hardware platform that it run on was the cheapest (and the dumbest!), the available functionality was OK (but second to best), and more importanly, Microsoft let Windows spread by don't caring about piracy!
And what can one say about their flagship products? Internet Explorer is full of security problems, Outlook too, Word 2003 has become a bitch to use from so much bloat, .NET has 2 million layers of abstraction and a couple of thousands of classes that it happens not to fit exactly to your problems...
Microsoft is also responsible for giving C/C++ a bad name; their software practices are truly evil. They changed some of
You make valid points and much of it is a matter of opinion anyway. I will address only the matter of ACLs.
It is true that a typical Linux installation doesn't have ACLs. However ACLs do not make a system more secure. On the contrary. Try administering dozens of nested directories with dozens of different permissions (some granted, some revoked, depending on their relative order), users, nested groups, owners, attributes, some inherited, some not.
It is a nightmare. Often it is impossible to fit it in one's head. It is too easy to get it wrong by accident. I have on more than one occasion.
By comparison Unix permissions seem really primitive, however they are really easy to comprehend and verify, especially for people who have more important work than administering their systems.
A major security lapse in Windows is the lack of the SUID bit. It is extremely difficult to allow a regular user to execute a trusted piece of code - one has to resort to IPC and write mountains of code - that is why few people do it.
The net result of all this is - it is simply more technically difficult to write secure software for Windows.
Technical brilliance doesn't sell software. (see VHS vs Beta). Marketing sells software.
He is talking to the people out there who are buying MS software, or who have already bought MS software. These statements are about selling software.
These comments are not directed at technical people, their accuracy is irrelevant.
The first rule of marketing: ***its all marketing***. Everything you do and say and deliver is focused on getting s/w out the door and revenue in the door. Everything else is secondary, and that includes quality, truth, bugs.
If the customers want security, give something to make them think they have it. Which is why MS have never really needed security till now (and maybe not even now). And they still dont, not *really*. If MS *really really* needed security or they would lose market share - you can bet they would have darn good security.
I suggest you ready "Crossing the Chasm" or "Inside the Tornado". Get the early adopters on board, the move product as fast as you can and ignore the customer.