Even more interesting is that the "hacker" is comparing Microsoft to Adobe and Apple. Adobe is an *applications* vendor, which has no bearing on the OS security discussion.
Most "exploits" don't happen because of failings in "OS security".
Apple has engineered a far more secure product from the ground up, [...]
OSX wasn't "engineered by Apple" from the ground up. They bought NeXSTEP, replaced its display system and GUI, and called it MacOS.
Which are professionally managed and monitored. Why would you target them, when you can target the (typically) very UNprofessionally managed and monitored client machines, which have access to everything that matters on those central systems.
Obligatory car analogy: would you try and steal the locked car kept in a brightly lit garage with a guard watching it 24x7, or would you try and steal the unlocked car parked in a dark back alley on the edge of town that's only driven a few times a week ?
The reality is, more than anything this tired "people hack windows boxes because they can win more" response pretends to suggest, that UNIX is phenominally more secure on a basic, fundamental, architectural level than Windows.
In what way ?
Out of the box, I can trust an app on a RHEL os.
What about the users ? Most security breaches come from users, not from software flaws or bugs.
Out of the box, I can't even plug a windows machine in to a network without being behind a firewall. I've literally seen, with my own eyes, windows machines get compromised in less than 20 minutes of being online. Sure sure, sample sizes and all that...except, I've also managed hundreds of unix machines at a time without any concerns on them.
Plug a comparably configured and aged RHEL machine, unprotected, on the 'net and it's going to get cracked as well.
There needs to be an expectation of privacy regarding recordings of people in public places. There is a huge difference between being seen vs. having one's every public move recorded, indexed and archived.
The word you're after here is anonymity, not privacy.
Windows has a reasonably well designed (VMS based) kernel, with a lot of legacy cruft on top of it... Most of this stuff MS have added on top of the original vms-derived kernel have significantly weakened the intended security model... things like the networking protocols (google for the windows auth model is broken), the password hashing algorithms, the presence of multiple versions of various apis...
As opposed to UNIX, which has been having "cruft" heaped upon it since the day it was conceived !?
Some of the security features are implemented in userland and are trivial to bypass, one example being the function to "disable" the command prompt.
I'm not sure what you're talking about, but I can't imagine it being seriously considered a security barrier by anyone.
It also has an extremely complicated security model which is very much overkill for the vast majority of cases, and results in people simply ignoring it.
So by your logic Windows 95 is better than UNIX because it has a simpler security model ?
Not to mention all the additional complexity designed to work around the design flaws without breaking compatibility, like the transparent path/registry redirection thats designed to allow poorly written apps to think theyre able to write to arbitrary locations without actually letting them do so... The first principle of security is KEEP IT SIMPLE... The more complicated you make things, the harder it is to keep it secure. On the other hand, windows has always been extremely complex, and this seems to be by design to make it difficult to clone - after all, ms were not at all happy that dos got cloned.
Or maybe it's just that complex problems demand complex solutions.
Email and mobile phones are no more efficient for the office worker at his or her desk than a land line. A mobile phone is actually LESS efficient at my desk; the reception in my building is horrible.
Nice non-sequitur. You could have made it a better one, however, by using jobs like janitors or school teachers.
Yes, but you're not going to put those programs on EVERYONE'S desk, just the users that need them. SAS costs $750 per user, and my company uses it, but not every damned employee has a copy of it, only a few. And a hundred bucks per year for every user in your organization just to send email is absurdly expensive, and anybody who would outfit everyone in their organization who only needs email with it is insane.
Seems a lot of insane people are running massively profitable companies then. A hundred bucks a year per employee is nothing. It probably represents about a tenth of a percent of how much the average worker costs the company to employ.
Not every business is in the Fortune 500, and if you haven't noticed, there's an incredible pressure to make the price of your product go down in order to be competetitive. Most small businesses would be insane to use this, and almost all businesses would be insane to buy a copy for every employee.
So every company using Exchange (or Notes, I suppose) is insane ?
You don't burn money unless you are really, really cold. Ask your users if they would like to pay $5/pay period more for health insurance - I bet they'll gripe... and that's the kind of money you are talking about here.
And it's damn near irrelevant to any company of a size big enough for Exchange to be useful, that isn't in dire financial trouble.
Employee smoke breaks and water cooler gossip would cost a company more every year than their Exchange CALs.
$100-$200 per user is super expensive compared to $0 per user.
Except that's generally not an option.
Have 200 employees, just for the exchange licesnse we are talking over $20,000 a year.
Which is not even close to a lot of money for a company of 200 employees (or, if it is, they probably won't be in business for long).
Not to mention the proprietary x.500 Active Directory, Outlook seats, Windows licenses, Anti-Virus, Intrustion Detection, Spyware detection, etc... Not to mention the other long term costs of being locked into a proprietary Microsoft environment. Vendor lock-in will cost you dearly in the end.
Yet the vast majority of companies managed to make billions of dollars while being "locked in".
No, Intelligent Design is looking at our current theories and finding that they don't always answer our questions. For example, to some, evolution does not explain what ID proponents call irreducible complexity.
Yes, it does. More accurately, no-one has yet come up with a genuine example of "Irreducible Complexity".
My main problem with the teaching of evolution is the attempt to actually ban the discussion of any criticism of the theory.
I'm not aware of any such attempts. Do you have some links ?
Yes, I understand that such criticism could lead to the discussion of religion in the classroom*, but if you are going to ban discussion based on the possibility of that discussion moving to a discussion about religion, then all discussion should banned and anything can have a religion underpinning.
Why would a _scientific_ criticism of Evolution, ever lead to a religious discussion ? Would you expect a criticism of Gravity or Newton's Laws of Motion, to lead to a religious discussion ?
If there actually was a real alternative to Evolution, I'm sure scientists and teachers would be happy to include it. However, there isn't.
Yes, but lacking some kind of magical knowledge they lack gnosis, leading to agnostic atheism. Agnosticism comments on one's epistemological position. It doesn't have anything to do with the stance one takes regarding the existence of a particular entity.
The label attached is irrelevant. Either you're prepared to accept - sans evidence, solely on faith - the idea of a supernatural cosmic puppetmaster, or you're not. Agnostics fit into the former category, Atheists into the latter.
As I said, due to scientists being - at least ostensibly - evidence-driven, I would expect most of them to fall into the atheist camp, since there is no evidence. Though I suspect many that really are atheist are identified as "strong agnostic" (or "agnostic atheism", as you put it), because they'd be prepared to accept the existence of god(s) if evidence of same existed.
Apache is more popular than the Windows web server, yet gets hacked less, which completely debunks the idea that being a market leader is the only reason Microsoft products are so shockingly vulnerable to attacks.
Even it were true (and it isn't), it doesn't demonstrate anything of the sort.
OS X is a GUI shell on a BSD layer on a Mach engine. Like any flavor of *nix, it was designed from the ground up to live safely in networked, multi-user environments.
Just like Windows NT, you mean ?
It's an order of magnitude harder to hack than a Windows box, because of superior design. This has been demonstrated over and over for nearly a decade now, yet the MS fanboys continue with the silly drumbeat that Macs are only enjoying security via obscurity.
Please detail the "superior design". You might also want to comment on how OSX has consistently lost out to Windows (and everything else) in contests like pwn2own.
You can run as a normal user on *nix and mac and use sudo to perform "dangerous" operations. Windows XP has no such thing, and UAC on Vista is worthless.
Windows NT has had an 'su' equivalent - runas - since its inception, either as a "Powertoy", or built-in.
I've been running Windows (NT4, 2000, XP, Vista, 7) as a regular user since 1996.
People managed to check email, schedule tasks and appointments, manage contacts and keep notes before Outlook came on the scene. There may no good one-stop alternative, but maybe that's not such a bad thing. Outlook is a bloated monster that, if running on its own, uses a horrible flat file database, and if running on a network, uses Exchange, which, when it works is great, but as anyone who has to debug it when it goes nuts knows, can be an absolute nightmare.
Sure. People used to communicate before email and mobile phones as well - that doesn't mean they did it as efficiently.
Outlook-Exchange is absurdly expensive [...]
If you seriously think Outlook+Exchange is "absurdly expensive", then you've little experience out in the real world.
Exchange might cost a piddling $100-$200 per user over 3 years. There's no shortage of professional software packages that cost over $10,000 *per user*, to say nothing of things like Oracle that cost ca. $40k per CPU socket. Heck, smoking breaks probably cost the typical employer more per year than their Exchange environment.
In context, Exchange (or, indeed, pretty much all Microsoft software) is not expensive.
For us its pure economics. With limited budgets and the need to expand, we're between a rock and a hard place, and if it means moving to a somewhat less convenient web-based mail/scheduling system, well, that's just the way it will be.
If your employer can't afford Exchange CALs, you've got much, much bigger things to be worried about.
I thought we were talking about working exploits. Things that work. Of course there are thousands of exploits. They are found, they are fixed, they are forgotten. Unlike Windows. Having an exploit doesn't get you into a box, after all.
Windows exploits are fixed regularly and frequently.
Whatever. You guys keep trotting out the tired argument that it's all about market share. Linux' market share keeps growing, but the malware market share for Linux remains near zero.
It's primarily about user demographic, infection rates and consequences. "Market share" is just a simpler way of capturing those things. Most "exploits" do not leverage unpatched software bugs or flaws.
Yep, really. Or, at least, as frequently as your stereotype is also true. You do realise the majority of widely-used open source code is written by the same kinds of people writing closed source code, right ? People being paid to do it by companies like Red Hat ?
With the merger of the 9x line with the NT line in 2k, we got, security-wise, the worst of both worlds.
There was no "merger" outside of the marketing department. The security model of NT remains the same today as it was at its release (albeit with a few UI tweaks like UAC). Your premise is broken. Broken third party applications are not something that the OS or OS vendor can control.
The rest of your post essentially boils down to what I've always said - you can't secure a system where an ignorant user has full control.
There are little geeky dweebs living in their mother's basements all over this world, who would LOVE TO HAVE BRAGGING RIGHTS. Just being known as "The guy who reliable hacked Linux" would be a wet dream come true for them.
Most of the time it isn't the OS being "hacked", it's the user.
And, they haven't done it yet.
Yes they have. There are/have been hundreds - thousands - of exploits for Linux and Linux software. The difference isn't the existence or non-existence of exploits, it's the user demographic. This is particularly true today when most "exploits" are social engineering, not software flaws or bugs.
This is false. Windows NT was built from the ground up as a "multi-user, multi-tasking environment". With a design superior to the traditional UNIX security model.
2. I argued back in the DOS era that it was possible to stop most malware. My partner and I wrote a three-tiered system: (1), an "innoculator" that did integrity checking on "injected" executables; (2) a behavior blocker that literally patched the DOS kernel (deep inside!), but which granted a pass to any executable that passed a CRC test of an injected file, thus preventing false alarms; (3), an MBR with self-checking boot code. At the time (mid-80's), I could not find a virus that could get around it and infect the system.
How does your system prevent end users willingly infecting themselves (probably 90% of contemporary malware infections). How is the CRC whitelist both protected from modification, but also kept current ?
The malware landscape today is vastly different to it was then.
Slashdot Mirror
Even more interesting is that the "hacker" is comparing Microsoft to Adobe and Apple. Adobe is an *applications* vendor, which has no bearing on the OS security discussion.
Most "exploits" don't happen because of failings in "OS security".
Apple has engineered a far more secure product from the ground up, [...]
OSX wasn't "engineered by Apple" from the ground up. They bought NeXSTEP, replaced its display system and GUI, and called it MacOS.
Am I to gather from this that the hackers are granted access to the machines? That isn't very realistic...
It's absolutely realistic. The vast majority of users are more than happy to do whatever it takes to see the dancing bunnies.
Hmm, I must've missed MS beating out OpenBSD for security.
It's easy to be secure when you don't do anything.
But...Linux far out numbers windows in the server room.
Evidence ?
The money is on UNIX systems.
Which are professionally managed and monitored. Why would you target them, when you can target the (typically) very UNprofessionally managed and monitored client machines, which have access to everything that matters on those central systems.
Obligatory car analogy: would you try and steal the locked car kept in a brightly lit garage with a guard watching it 24x7, or would you try and steal the unlocked car parked in a dark back alley on the edge of town that's only driven a few times a week ?
The reality is, more than anything this tired "people hack windows boxes because they can win more" response pretends to suggest, that UNIX is phenominally more secure on a basic, fundamental, architectural level than Windows.
In what way ?
Out of the box, I can trust an app on a RHEL os.
What about the users ? Most security breaches come from users, not from software flaws or bugs.
Out of the box, I can't even plug a windows machine in to a network without being behind a firewall. I've literally seen, with my own eyes, windows machines get compromised in less than 20 minutes of being online. Sure sure, sample sizes and all that...except, I've also managed hundreds of unix machines at a time without any concerns on them.
Plug a comparably configured and aged RHEL machine, unprotected, on the 'net and it's going to get cracked as well.
There needs to be an expectation of privacy regarding recordings of people in public places. There is a huge difference between being seen vs. having one's every public move recorded, indexed and archived.
The word you're after here is anonymity, not privacy.
Unfortunately, Nobody like's the concept of "ship now, fix later" [...]
Huh ? Aren't the OSS people constantly telling us it's the best release model evar ?
Windows has a reasonably well designed (VMS based) kernel, with a lot of legacy cruft on top of it... Most of this stuff MS have added on top of the original vms-derived kernel have significantly weakened the intended security model... things like the networking protocols (google for the windows auth model is broken), the password hashing algorithms, the presence of multiple versions of various apis...
As opposed to UNIX, which has been having "cruft" heaped upon it since the day it was conceived !?
Some of the security features are implemented in userland and are trivial to bypass, one example being the function to "disable" the command prompt.
I'm not sure what you're talking about, but I can't imagine it being seriously considered a security barrier by anyone.
It also has an extremely complicated security model which is very much overkill for the vast majority of cases, and results in people simply ignoring it.
So by your logic Windows 95 is better than UNIX because it has a simpler security model ?
Not to mention all the additional complexity designed to work around the design flaws without breaking compatibility, like the transparent path/registry redirection thats designed to allow poorly written apps to think theyre able to write to arbitrary locations without actually letting them do so... The first principle of security is KEEP IT SIMPLE... The more complicated you make things, the harder it is to keep it secure. On the other hand, windows has always been extremely complex, and this seems to be by design to make it difficult to clone - after all, ms were not at all happy that dos got cloned.
Or maybe it's just that complex problems demand complex solutions.
Email and mobile phones are no more efficient for the office worker at his or her desk than a land line. A mobile phone is actually LESS efficient at my desk; the reception in my building is horrible.
Nice non-sequitur. You could have made it a better one, however, by using jobs like janitors or school teachers.
Yes, but you're not going to put those programs on EVERYONE'S desk, just the users that need them. SAS costs $750 per user, and my company uses it, but not every damned employee has a copy of it, only a few. And a hundred bucks per year for every user in your organization just to send email is absurdly expensive, and anybody who would outfit everyone in their organization who only needs email with it is insane.
Seems a lot of insane people are running massively profitable companies then. A hundred bucks a year per employee is nothing. It probably represents about a tenth of a percent of how much the average worker costs the company to employ.
Not every business is in the Fortune 500, and if you haven't noticed, there's an incredible pressure to make the price of your product go down in order to be competetitive. Most small businesses would be insane to use this, and almost all businesses would be insane to buy a copy for every employee.
So every company using Exchange (or Notes, I suppose) is insane ?
$100-200 is expensive if it is unnecessary.
I never suggested otherwise.
You don't burn money unless you are really, really cold. Ask your users if they would like to pay $5/pay period more for health insurance - I bet they'll gripe... and that's the kind of money you are talking about here.
And it's damn near irrelevant to any company of a size big enough for Exchange to be useful, that isn't in dire financial trouble.
Employee smoke breaks and water cooler gossip would cost a company more every year than their Exchange CALs.
$100-$200 per user is super expensive compared to $0 per user.
Except that's generally not an option.
Have 200 employees, just for the exchange licesnse we are talking over $20,000 a year.
Which is not even close to a lot of money for a company of 200 employees (or, if it is, they probably won't be in business for long).
Not to mention the proprietary x.500 Active Directory, Outlook seats, Windows licenses, Anti-Virus, Intrustion Detection, Spyware detection, etc... Not to mention the other long term costs of being locked into a proprietary Microsoft environment. Vendor lock-in will cost you dearly in the end.
Yet the vast majority of companies managed to make billions of dollars while being "locked in".
No, Intelligent Design is looking at our current theories and finding that they don't always answer our questions. For example, to some, evolution does not explain what ID proponents call irreducible complexity.
Yes, it does. More accurately, no-one has yet come up with a genuine example of "Irreducible Complexity".
Then the questions naturally lean toward "How does he do it?" and "How often does it happen? Every ten years?" and more unanswerable questions, etc.
I think a better question would be "why is he still so bad at it after millions of years of practice".
My main problem with the teaching of evolution is the attempt to actually ban the discussion of any criticism of the theory.
I'm not aware of any such attempts. Do you have some links ?
Yes, I understand that such criticism could lead to the discussion of religion in the classroom*, but if you are going to ban discussion based on the possibility of that discussion moving to a discussion about religion, then all discussion should banned and anything can have a religion underpinning.
Why would a _scientific_ criticism of Evolution, ever lead to a religious discussion ? Would you expect a criticism of Gravity or Newton's Laws of Motion, to lead to a religious discussion ?
If there actually was a real alternative to Evolution, I'm sure scientists and teachers would be happy to include it. However, there isn't.
Yes, but lacking some kind of magical knowledge they lack gnosis, leading to agnostic atheism. Agnosticism comments on one's epistemological position. It doesn't have anything to do with the stance one takes regarding the existence of a particular entity.
The label attached is irrelevant. Either you're prepared to accept - sans evidence, solely on faith - the idea of a supernatural cosmic puppetmaster, or you're not. Agnostics fit into the former category, Atheists into the latter.
As I said, due to scientists being - at least ostensibly - evidence-driven, I would expect most of them to fall into the atheist camp, since there is no evidence. Though I suspect many that really are atheist are identified as "strong agnostic" (or "agnostic atheism", as you put it), because they'd be prepared to accept the existence of god(s) if evidence of same existed.
Apache is more popular than the Windows web server, yet gets hacked less, which completely debunks the idea that being a market leader is the only reason Microsoft products are so shockingly vulnerable to attacks.
Even it were true (and it isn't), it doesn't demonstrate anything of the sort.
OS X is a GUI shell on a BSD layer on a Mach engine. Like any flavor of *nix, it was designed from the ground up to live safely in networked, multi-user environments.
Just like Windows NT, you mean ?
It's an order of magnitude harder to hack than a Windows box, because of superior design. This has been demonstrated over and over for nearly a decade now, yet the MS fanboys continue with the silly drumbeat that Macs are only enjoying security via obscurity.
Please detail the "superior design". You might also want to comment on how OSX has consistently lost out to Windows (and everything else) in contests like pwn2own.
Corporations choose what makes sense to increase their bottom line. To that end, they think Linux makes sense.
By your logic, the vast majority of them still think that Windows "makes sense".
You can run as a normal user on *nix and mac and use sudo to perform "dangerous" operations. Windows XP has no such thing, and UAC on Vista is worthless.
Windows NT has had an 'su' equivalent - runas - since its inception, either as a "Powertoy", or built-in.
I've been running Windows (NT4, 2000, XP, Vista, 7) as a regular user since 1996.
People managed to check email, schedule tasks and appointments, manage contacts and keep notes before Outlook came on the scene. There may no good one-stop alternative, but maybe that's not such a bad thing. Outlook is a bloated monster that, if running on its own, uses a horrible flat file database, and if running on a network, uses Exchange, which, when it works is great, but as anyone who has to debug it when it goes nuts knows, can be an absolute nightmare.
Sure. People used to communicate before email and mobile phones as well - that doesn't mean they did it as efficiently.
Outlook-Exchange is absurdly expensive [...]
If you seriously think Outlook+Exchange is "absurdly expensive", then you've little experience out in the real world.
Exchange might cost a piddling $100-$200 per user over 3 years. There's no shortage of professional software packages that cost over $10,000 *per user*, to say nothing of things like Oracle that cost ca. $40k per CPU socket. Heck, smoking breaks probably cost the typical employer more per year than their Exchange environment.
In context, Exchange (or, indeed, pretty much all Microsoft software) is not expensive.
For us its pure economics. With limited budgets and the need to expand, we're between a rock and a hard place, and if it means moving to a somewhat less convenient web-based mail/scheduling system, well, that's just the way it will be.
If your employer can't afford Exchange CALs, you've got much, much bigger things to be worried about.
I thought we were talking about working exploits. Things that work. Of course there are thousands of exploits. They are found, they are fixed, they are forgotten. Unlike Windows. Having an exploit doesn't get you into a box, after all.
Windows exploits are fixed regularly and frequently.
Whatever. You guys keep trotting out the tired argument that it's all about market share. Linux' market share keeps growing, but the malware market share for Linux remains near zero.
It's primarily about user demographic, infection rates and consequences. "Market share" is just a simpler way of capturing those things. Most "exploits" do not leverage unpatched software bugs or flaws.
Nope not really.
Yep, really. Or, at least, as frequently as your stereotype is also true. You do realise the majority of widely-used open source code is written by the same kinds of people writing closed source code, right ? People being paid to do it by companies like Red Hat ?
With the merger of the 9x line with the NT line in 2k, we got, security-wise, the worst of both worlds.
There was no "merger" outside of the marketing department. The security model of NT remains the same today as it was at its release (albeit with a few UI tweaks like UAC). Your premise is broken. Broken third party applications are not something that the OS or OS vendor can control.
The rest of your post essentially boils down to what I've always said - you can't secure a system where an ignorant user has full control.
There are little geeky dweebs living in their mother's basements all over this world, who would LOVE TO HAVE BRAGGING RIGHTS. Just being known as "The guy who reliable hacked Linux" would be a wet dream come true for them.
Most of the time it isn't the OS being "hacked", it's the user.
And, they haven't done it yet.
Yes they have. There are/have been hundreds - thousands - of exploits for Linux and Linux software. The difference isn't the existence or non-existence of exploits, it's the user demographic. This is particularly true today when most "exploits" are social engineering, not software flaws or bugs.
With closed source -- you are trusting what? An obscure programmer who is under a deadline to push something out the door??
As opposed to an obscure programmer who has no interest in fixing a problem because it's boring ?
This is false. Windows NT was built from the ground up as a "multi-user, multi-tasking environment". With a design superior to the traditional UNIX security model.
2. I argued back in the DOS era that it was possible to stop most malware. My partner and I wrote a three-tiered system: (1), an "innoculator" that did integrity checking on "injected" executables; (2) a behavior blocker that literally patched the DOS kernel (deep inside!), but which granted a pass to any executable that passed a CRC test of an injected file, thus preventing false alarms; (3), an MBR with self-checking boot code. At the time (mid-80's), I could not find a virus that could get around it and infect the system.
How does your system prevent end users willingly infecting themselves (probably 90% of contemporary malware infections). How is the CRC whitelist both protected from modification, but also kept current ?
The malware landscape today is vastly different to it was then.