Slashdot Mirror
Ask Slashdot: Why Not Linux For Security?
An anonymous reader writes "In Friday's story about IBM's ban on Cloud storage there was much agreement, such as: 'My company deals with financial services. We are not allowed to access Dropbox either.' So why isn't Linux the first choice for all financial services? I don't know any lawyers, financial advisers, banks, etc., that don't use Windows. I switched to Linux in 2005 — I'm well aware that it's not perfect. But the compromises have been so trivial compared to the complete relief from dealing with Windows security failings. Even if we set aside responsibility and liability, business already do spend a lot of money and time on trying to secure Windows, and cleaning up after it. Linux/Unix should already be a first choice for the business world, yet it's barely even known of. It doesn't make sense. Please discuss; this could use some real insight. And let's at least try to make the flames +5 funny."
The thing people like a lot of the times is that microsoft offers support, they have it stuck in their head that if you spend money on it, it must be better than a free alternative. Pretty simple really but that's human nature in this day and age, we are programed for it from commercials on tv to radio to Target and Walmart.
This has been discussed ad nauseum here over the last decade.
One big reason why things are the way they are, is that corporate types want somebody to blame when things go pear-shaped. There's not many linux companies of enough size to handle that. Just RedHat and SuSe.
Another reason is yes, the apps. The simply *must* have MS Access and integration with the whole Office suite. Anything that doesn't have this is likely a non-starter.
C|N>K
If you've got things to do, learning how to operate a Linux system is low on the priorities. If people start finding hiccups because of the differences between Linux and Windows they'll rapidly complain to tech. support, who will soon fold under the pressure of people not being able to meet their commitments due to not understanding their workstations.
Linux isn't the top dog because it's 'more secure' than Windows, it's not the top dog because it's not as well known as Windows. I see more people using Mac in the workplace now, and with the popularity spike in BYOD I would suggest that if Linux were to become more user friendly, Linux would be slowly be adopted anyway.
We should remember that >60% of servers run Linux, versus Windows.
If I were a too busy to be bothered executive, my high level opinion of the hobbyist operating system would be that it's bound to be full of backdoors put in by the coders. What's worse, is when those backdoors cause my golden parachute producing institution serious financial harm, there's nobody to sue. At least if Microsoft were to do something dastardly, there's a few billion in assets to get the lawyers worked up over.
2001 called, they want their "get the facts" back....
C|N>K
Funny, where I work we still use XP which is still the same rotting mess it was 10 years ago, the only difference is that it is wrapped in so much duct tape and so much time, effort and expense has been invested in it that the infosec people treat Linux and OSX as the same steaming pile of shit and it is really hard to break them free of it.
The difference between Canada and the USA is that in Canada healthcare is a right and gun ownership is a privilege.
One of the parts of the otherwise totally asinine "Zen and the Art of Motorcycle Maintenance" that actually did stick with me was the story about some little part of a motorcycle that can be replaced with just a little piece of tin can if it breaks, and in some ways it even works better if you do. But, in the auto parts store it costs $15. The point is this guy's friend would never consider using a piece of tin can on his bike, and would always buy the expensive part every time because he's the kind of guy that associates paying for something with quality. You could never convince him that a free alternative to anything could be better, because then why would anyone ever pay for it? And since there's these successful and widely popular companies selling the widget for lots of money and making a killing, they must be doing something right that can't be offered anywhere else. Having dealt with enough executive types that make decisions like these for large companies, they are almost universally this type of person. It's not that free can't be better, it's just out of their comfort zones. Really, I think it stems from faith in capitalism. Windows is it because its the big one that everyone uses, and that means everything to some people (unfortunately).
Additionally, Linux distribution security generally isn't much better than modern Windows.
Marketing efforts aside, reality disagrees.
The share of Windows malware increased to 99.6%. Classic Windows program files dropped 0.3% proportionately, but the increase in .NET programs compensated for this
loss.
In the first half of 2011, the lion share of malware was once again written for Windows systems.
Only one in two hundred and fifty malware programs is not a Windows program file. The proportion of classic Windows program files (Win32) continues to drop. However, .NET programs (MSIL) compensate for this loss of 0.3% and the overall share of Windows malware programs is on the rise.
1 Win32 1.218.138 97,8 %
2 MSIL 21.736 1,7 %
3 WebScripts 3.123 0,3 %
4 Scripts 832 0,1 %
5 Mobile 803 0,1 %
6 Java 313
7 *ix 233
8 NSIS 131
http://www.gdatasoftware.co.uk/uploads/media/G_Data_MalwareReport_H1_2011_EN.pdf
Note that the 6% of Apple Macs infested are included in that "*ix 233" figure.
"I've got more toys than Teruhisa Kitahara."
Office, plus things like Visio and MS Project. And I don't care how much someone argues, Dia is nowhere near a good a product to date as Visio. And there is nothing in the Linux world that even compares to MS Project. There are some apps with 'project' in the name that might even look a little like MS Project, but nothing that can compete. ERD tools are another thing. Yes there are a bunch that run on Linux, but even a mid to low price Windows offering like Toad Data Modeller is head and shoulders above anything you can find for Linux. And the multitude of financials software out there runs on Windows not Linux.
Software vendors simply don't want to deal with the GPL if it means there is any chance that they will have to give away the code they spent hundreds of thousands, if not millions of dollars to develop. You will find them occasionally making software that will also run on OSX, but again the license there won't force them to give away anything. And I know there is the LGPL, but it still has GPL in the name which rightly scares the vendors. And with the way some of the more rabid FOSS people are, vendors don't want the worry of a v4 of the GPL and/or something that deletes the LGPL, etc. Unless vendors can be guaranteed to make money on their investment they won't write top level code for Linux, and without top level apps, people won't use it... except for programmers who have made tons of decent apps to work on the platform they code entereprise apps for (not the client apps that the bosses use).
-- I ignore anonymous replies to my comments and postings.
No, you're wrong. Every single day I get updates. The "bug" I submitted to the patch for in Linux? It was patched in 2 weeks. The "bug" I submitted the whitepaper and proof of concept code under "responsible disclosure" to MS? It's been 2 years, and some of my unsavory friends who worked on the bug with me are now exploiting it. UPDATEs, FASTER. Linux wins.
I've worked for some of the largest banks in the world, and:
1.) They use craploads of Linux.
2.) They're going to stop using Windows.
3.) They'll never use dropbox.
Detail:
1.) They use craploads of Linux.
Just about every bank has declared Linux to be the future for application services, with a few exceptions for specific applications. Accounting will stay mainframe for a very long time, Collaboration will remain MSExchange for a very long time, Sharepoint probably as well, and rinky-dink one-off applications may still run only on Windows servers, but only if those apps come from software shops built by math/business/commerce geeks (algo stuff, etc.). Most databases, report generation, records keeping, document management, webbanking backends, and other banking stuff will continue their current trend of UNIX-to-Linux. Some banks are 20% along their UNIX-to-Linux projects, some are at 80%, but I don't know any that aren't on that road.
I think you were talking about desktops, though, not the datacenters and server farms. That's a very superficial way to look at banking computing. Banks do not use Windows machines to do banking, they use Windows machines as desktops for running Exchange, and Office, and banks are thrilled that they can *also* use those same pieces of hardware as dumbterms for people to SSH/Telnet to some banking applications and also access the newer applications through the browser. But, if it wasn't for Exchange and Office, they wouldn't use Windows, they'd use Linux thin clients. I actually know one bank that's trying to migrate people to Google Apps for just this reason, but it's really hard, because bankers really do love office/exchange.
2.) They're going to stop using Windows.
But they're not going to go to Linux. The banks are all calling it "BYOD" for "Bring Your Own Device." Bankers really, really, really want to use Mac desktops and iPads and Android phones and ditch Windows -- but there's no way they'll switch to Linux on the desktop unless that Linux is called Android. So, the banks are currently running well-funded projects to replace all their Windows-desktop-only applications with web-based apps that'll work from any browser, and also throwing lots of money at companies like Good Technology to be able to get iPads and Android Tablets in to the workplace.
Microsoft is trying to use Office360 or WTF it's called so that they can still sell stuff to banks that have ditched Windows on the desktop, but there's going to be lots of turmoil over the next 5-10 years as that progresses. Windows on the desktop in banks is effectively dead already -- I know 3 banks that have decided to stick with XP on the desktop instead of upgrading to Win7 because the Win7 upgrade costs are better spent in moving faster to this better future.
3.) They'll never use dropbox.
Banks are required to log everything, and logging everything you upload to dropbox and everyone that downloads it and all of that crap is so expensive that you should find out what the approved tools are for doing what you want to do. Most banks will allow SFTP/SCP between trusted endpoints if the right people sign the right forms. In my experience, dropbox is only ever requested in banks by someone that wants to break the law and is too stupid to know what law they'd be breaking.
Dropbox blocking is not something IT decided to do, it's something the lawyers required IT to do, and it has nothing to do with "security" in the way that there are "security" differences between operating systems. It has to do with the kind of security you have in the lobby that would ask questions if you started walking out the door with canvas bags that have dollar signs on them. If the banks allowed dropbox, naughty employees would copy documents to home that their daytrader spouses would use for insider trading (seen that more than once).
"A system error has occurred."
"The service terminated unexpectedly."
"Please contact your network administrator."
Linux failures leave me checking log and config files.
Windows failures leave me tearing my hair and screaming "I *am* the administrator! Tell me what the bloody problem is!!!!!" at the screen.