OSNews

Honestly I don't care about this nonsense, because much like politics both sides are just putting numbers out that benefit them.

Microsoft is at the unfortunate disadvantage of having everything developed under one roof, so all bugs are summed up under Microsoft Windows errors, expect for anything not included by the OS in the default install. However that leaves IIS, Network Stack, Communication Stack, IO, and anything else you can think of even drivers.

Linux on the other hand seems to benefit from not under one roof reporting. Because after all Linux is just the Kernal and if we had to compare Kernel to Kernel I am sure the numbers would be about even for bugs and vulnerabilities. However when you combine such systems as Apache, and the Linux networking, communication, and IO stacks you run in to a similar amount of vulnerabilities.

The point is that neither OS is secure when running but a person who doesn't know what they are doing. And I do believe that hackers specifically target Microsoft because they always know a core set of components are going to be on the system. And I do believe that Linux is more secure in the sense the combination of programs is usually haphazardly put together. Meaning that a hacker cannot figure out what is on the system to exploit. However with popular brands like Ubuntu I believe this trend is going to change.

Apple is already starting to see this with their Mac brand.

It is quite the opposite. Linux Distributions ship with lots of userspace programs including a wide range of different genres, from office suite to games.

Most times measurements are made all bugs "in Fedora" are counted contrairy to all bugs "in Windows XY".

Secondly, this "everything is insecure, it only depends on your numbers" myth is what MS tried to tell the public with their advertising ("Windows is more secure") and their paid-for studies for years. With quite success: They knew nobody would buy their "Windows is more secure" shit. But by flooding the market with these claims, they achieved the "nobody knows what's more secure" claim to be accepted.

The truth is, it's right that number counting is not that relevant. Just look how Windows systems are set-up compared to Linux systems. How every Windows machine wastes ressources for virus scanning etc. and still you had these massive worms. People seem to be very fast at forgetting things in this industry. And then you look at the architectures of Unix systems and Windows systems. It's true that Windows got more secure in the latest years which is a very good thing and longly overdue. But still there are massive problems inherented by backwards compatibility. The Windows security model grew very complex compared to Unix/Linux. It's far more easier to find holes in a complex system which is full of intended (because of the backwards compatibility) corner cases etc.

Edited 2008-07-20 16:15 UTC

The truth is that this is not a technology problem. Windows is targeted because it makes good business sense to target windows over Linux and Mac OS X, and I would venture to say that none of the reasoning for targeting windows is because of security.

http://blogs.zdnet.com/security/?p=135

Bot networks equal big money today. So which would you rather focus your efforts on, in a constantly changing environment, the 10% that amount to Linux + Mac, or the 90% that amount to windows machines.

It is similar to starting a coffee shop, where do you think you are going to get a better wide range of consumers. NY City, NY or Elmira, NY? It is obvious, as a business decision to start you business in NY City. There are more potential customers, their is more money, and you have a better chance of doing well.

I am really getting tired of this argument, because it is obviously a business problem and not a technology problem. But you guys are fighting it almost like somebody asked you to whip them out and measure for biggest.

I just don't get all this arguing, I approach all operating systems as being insecure, and it forces me to protect my self in more reliable ways. In fact I have it down to such a science that I don't even run anti-virus on my Windows Vista x64 anymore, and I have been virus free for almost 2 years now.

All my mail goes through Gmail, which is scanned. I don't install any software that doesn't come from a trusted vendor. And I am running x64 which is outside of the current target of Trojan writers, because they tend to focus efforts on the mass market of Windows XP and Windows Vista 32-bit.

Plus if what you are saying is true about hackers going after insecure operating systems, Mac OS 1-9 would have been swamped with viruses.

I also never had virus problems with Windows although I don't use it since 2002.

Still if you followed the history of the industry in the last 10 years you found many technical aspects which _indeed_ made a difference in this issue. I would also claim that Windows, but much more than that Internet Explorer, even made this big malware industry possible and that without those products we would have a different security culture today.

If you just have a look at ActiveX, its design and then its outcome, you will see that it stands for itself, it is a big security nightmare which other platforms just never had.


I see a platform which was very insecure und vulnerable for over 10 years. It was outstanding in that regards. And _apart_ from that it was also the market dominating one. You can say this is history, but things didn't change as much as you might think. For example recently a worm spread which infects WMA files -- simple audio files! And it makes WMP to download itself. This is the same lesson MS did not learn a 1000 times before.

What I want to point out is that neither of those (security from hell, market dominance) could have the same impact alone. It's an issue which is both technical and non-technical. At the early stages almost no hacker wrote exploits for financial reasons. How much you can earn with that was found later, in fact after a very long time. It would have been much easier to build a botnet in 2000 than today, still in 2000 nobody was talking about botnets. Your marketshare argument holds truth but it doesn't make so much sense historically. Indeed there are other (technical!) reasons why Windows was always the main target, at least if you measure that by success. Do you really think in 2000 it wouldn't be much more funny to break into some big webservers instead of attacking your neighbor?

And apart from that, I am not fighting anything or anyone. Or could you point me out?

Edited 2008-07-20 20:29 UTC

From what you posted shows that you did not read the article, or if you did, you did not understand it.

I have to tell you my experience with Windows XP.

At home I use Linux, at work I have to use Windows. I once transfered a file via USB-stick from a company laptop to the laptop of a customer.
two weeks after that I plugged in this same USB stick into my desktop computer at work.

I opened Windows Explorer, clicked on the drive letter, and BAM - a virus warning popped up.

I removed the USB stick, took it home and plugged it in, and found an autorun.inf file in the stick's root directory. I only did not get the virus into my work computer because the virus software caught it. The next virus might not get caught.

The company I work for is VERY security conscious but this might be something they overlooked.
Why on earth is the DEFAULT setting on Microsoft XP (installed one year ago) to AUTOSTART stuff from any pluggable device. That is plainly insane, and I do not know one single Linux distribution which autostarts anything from a pluggable device. I had NO chance to see what I was starting before Windows started the thing itself.

There is no doubt that Windows is securable, you can do it. But by default, it is MUCH less secure than any Linux I know of, which in turn means that most installations will stay this way.

You have to manually break into a Linux system, a worm or virus does not get far, simply because the user action required for execution of a program is much less easy to get than with Windows. With Windows, an executable just needs the .exe (or several other) extension, in Linux you have to make the file executable first, and if this is doen as a user, the virus can not spread across the whole filesystem, but stays in the users are. It cannot modify a system file to keep itself from showing up in the filesystem.

It sounds like you're just trying to flop the article's meaning around and take its points from the exact opposite point of view that they were meant to be taken. Yay... what fun.

That said, the article wasn't that great compared to some I've read on the topic, I admit--but seriously, quit trying to take it out of context. The article was about security--NOT your own problems with lack of commercial software. Keep using Windows if you need that software, who cares, but the entire point of the article was clearly security. Don't know where you pulled a commercial software argument from, but I would guess you're sitting on it right now.

Anyway, here's an article I like on the subject. Much more in-depth and interesting.

http://www.theregister.co.uk/security/security_report_windows_vs_li...

Article which is pointed by that article is heavily outdated and part of those information were approximate.

Plus, statistics are heavily outdated, expecially when considering that in 2004 Windows2003 was about 1 year old.

That's not a very good (and updated) source of information.

If the articles points are that easy to reverse, then maybe that's a good indication that the original article was nothing more than an exercise in presenting widely-known facts with a particular spin?



What warranted that assumption? The OP makes no statement indicating that he considers the situation to be *his* problem, or even *a* problem in general.

"It sounds like you're just trying to flop the article's meaning around and take its points from the exact opposite point of view that they were meant to be taken. Yay... what fun."

Just pointing out that some of the things that [this article claims...] makes Linux more secure make it less useful on the desktop - which is where virii are more likely to be found (because most require some user interaction). Less useful OS suffers from less virii - hold the front page...

"The article was about security--NOT your own problems with lack of commercial software."

Not a problem for me - not sure where you pulled that argument...

"Keep using Windows if you need that software"

I use Mac OS X at home and Windows XP at work - if it's any of your businesss. :-)

"but the entire point of the article was clearly security."

And as I said, not a point I thought it made very well. The arguments it used to can actually arguably be called *problems* with the platform, not security advantages. I wish the article *had* been about security.

Like all Vista users by default

Yer, and it's taken them umpteen years to get to that point. Even then, like XP before it, there is some software and things you have to do under an administrator because of that legacy.

This is a valid point, but it doesn't change the fact that

1) Given typical Linux and Windows installs and usage patterns, Windows is way more vulnerable

2) More malicious software exist for Windows than Linux in the first place, at least by a factor of 10000:1

YOu forgot this very important one

3) Windows executes a file based on its file extension and is therefore immediately executable. Unix files have to be made executable. UAC in Vista may make the user think about it but its still a big big design flaw having a file executable based on its file extension.

If you're talking about Windows XP, then I'd agree with you. But not with Vista. User accounts don't run as 'admin' by default under Vista, and privileged operations require explicit user approval (UAC).



Again, it depends on whether you're talking about Windows XP or Vista. Vista has effectively shut down the attack vectors which targeted XP, and malware authors have been forced into moving up the food chain to target applications such as Adobe Acrobat, Google Desktop, etc. This is actually a good thing. It means that Windows OS security has gotten demonstrably better.

1) Given typical Linux and Windows installs and usage patterns, Windows is way more vulnerable

So it's a configuration issue, not a technical issue, and *other* than default configuration Windows is as secure as Linux?

If not, what are the *technical* reasons Linux is more secure.

2) More malicious software exist for Windows than Linux in the first place, at least by a factor of 10000:1

Which probably mirrors the usage patterns of the two operating systems on the desktop. Linux is more secure because on the desktop it is so insignificant that no-one writes malware targeting it? Again not a technical reason, more of a failing...

The problem is applications written are designed for a user to run as an 'administrator' in Windows.

The biggest problem is Microsoft is going to have to work with the vendors to write applications to work with all of their functions as a regular user.


I have been using Red Hat since 6.0 Professional version they had back in 1999 or 2000. However it has taken me many of years to really get a good understanding of how a Linux distro actually works. I am still learning new skills on a weekly basis.

The design of a Linux based distro is more secure in the fact you do not run as root. You can modify the sudoers file to allow 'sudo' access however you can set it to require a password.

I do not think Windows will be able to overcome the problems with applications requiring administrator access until they enforce the applications coders to code it correctly.

"The design of a Linux based distro is more secure in the fact you do not run as root. You can modify the sudoers file to allow 'sudo' access however you can set it to require a password.

I do not think Windows will be able to overcome the problems with applications requiring administrator access until they enforce the applications coders to code it correctly."

It's not the design of Windows that is at fault, it is the defaults. They should have been changed a long time ago, and UAC is the first step. It's not going to happen over night, because MS unfortunately values backward compatibility too much.

I've been running Windows as a normal user since NT, and it may be tricky sometimes, some times it can be a real PITA, but there hasn't been too much I haven't been able to get working.

Wow. Every time I seriously try to lock down XP, I give up. It's a losing battle. I install XP, and create an Admin account myself, as it requires. Go through the install, switch the log in window to the classic one so I can also select Administrator. Try to change my (admin-level) user account it forced me to create to a Limited User.

"Sorry, you must have at least one other Administrator account to change this one to a Limited User" [paraphrased]

What? Then what the hell is the administrator account aptly-named "Administrator" there for? Looks? Whatever. So I created another admin-level account, named "Admin," and was finally able to change my account created during install to a limited user. After finally making it this far, I find out that I'm able to send system files that I shouldn't even be able to touch to the recycle bin, but when I want to undo that or restore them, access denied--log in as an admin to do that. WTF?

I won't bother going in-depth on all the problems running programs I had as a limited user, but I saw such ridiculous things as Winamp not able to "uninstall" plug-ins. Why? They're just .dlls located in C:\Program Files\Winamp... off-limits. If there were a "home" directory concept in Windows, each user could add and remove their own plug-ins, but no. I understand why this is, but it all boils to single-user design decisions which should be stuck in the past and each program storing all of its files in its own directory... yet... they're still dragging Windows down.

It was after this XP test install that I decided to finally re-partition my hard drive and re-install my Linux-distro-of-choice on it by itself (previously set as the default of a dual-boot setup). Needless to say, after install, I was running everything I wanted as a normal user, with root locked away for system changes, with no stupid WTF moments like XP's you-can-delete-but-not-restore crap.

Edited 2008-07-20 05:01 UTC

Hmm, I think that "downgrading" own account from administrator to limited is not the correct way to go, and actually agree that you shouldn't be able to do it.

The simple answer to your predicament is logon as Administrator, change your account from administrator to limited, and then you will only have Administrator and your account (as limited) to log on. I've done that tens of times.

"Sorry, you must have at least one other Administrator account to change this one to a Limited User" [paraphrased]"

Of course it says that, you need ONE administrator account. You just create your own user as a normal user, not administrator, do not downgrade it. Do all your installs as the "real " administrator, then use your "normal" account for day to day stuff. Runas is there if you need it.

There is a home directory concept for per user data, it is called AppData. You should have sent the winamp guys a nasty email explaining to them the insanity of not developing software in a least priviledged environment, and asking them to please use what has been considered best practice for almost a decade now.

The way to work around badly written software is to grant your user write access to the folder that you need to write to. Yeah, it sucks and is messy, but it is way better then the alternative. I can't even imagine running windows as an admin all the time.

Edited 2008-07-20 22:51 UTC

How about right-clicking and selecting Run As (not a great workaround)?

I agree its annoying that Windows 5.x forces you to create at least one other administrator level account in addition to the hidden Administrator account which IMO should stay hidden!

As far as plug-ins, that's a problem by the developers of Winamp, creating a system-wide program and allowing plug-in writers to wrap their binaries in installable executables, same thing with a lot of games.

Windows has a home directory - c:\documents and settings...

The problems that you describe are down to crappy programming from 3rd party software vendors. Nothing more, and nothing less.

Dave

"If there were a "home" directory concept in Windows"

There is. If Winamp doesn't use it then that is its failing not the OS's.

Unfortunately that isn't helped by the fact that even Microsoft's own software isn't written well as to allow the smooth running in a limited user capacity. Run Office 2003 on Windows Vista and you'll see what I mean.

At the end of the day, software companies will take leadership from the operating system vendor; if the operating system vendor isn't interested in making their own software use the new API's or update their software to the new security model - why should other vendors go through all the hoops?

It reminds me very much of the complaints that no big names are using the new API's in Windows like WPF and WCF. When Microsoft's own operating system has applications bundled with it, which don't use WPF/WCF (which CAN be called from native code - they DON'T need to re-write it in managed code) then how can they expect third parties to make that investment if they're not willing to do it themselves?

Please don't encourage other vendors to take their lead from the OS vendor in this instance, particularly in respsect of security.

This particular OS vendor has a back-door into the OS such that it can be changed ("updated" is the euphemism they use) regardless of the settings or wishes of the owners of the machine on which it is running.

This OS vendor also makes an add-on after thought scanner product in the hopes of detecting breaches after they have already got in, but the scanner provided by the vendor is amongst the worst products available.

"Run Office 2003 on Windows Vista and you'll see what I mean."

Ummm..........I know several people doing that without any problems. Can to give some details on what you're referring to?

If someone were to describe such a thing but for Linux not Windows, you would be amongst the first to jump all over such an observation with a claim that Linux wasn't usable by average users.

Is there a quick way to switch user under Windows in a window, such as sudo or su ?

Is there a quick way to switch user under Windows in a window, such as sudo or su ?

I think runas is what you are looking for

Edited 2008-07-20 12:39 UTC

Backwards binary compatibility to the death is what I do not understand about Microsoft.

With virtualisation technology everywhere it would be easy to make a completely new, mean and lean operating system without much backwards compatibility, and run the old XP inside a virtual machine. If the new system is requested to start an old application, it can do this automatically and transparently.

Then they would be free to put really good security in place.

I agree, to a point. The over all affect of that is a clean windows install, with a broken, virus infected VM running inside it.

Good security practices have to be included from the start, including the hypothetical VM, otherwise, the problem is not fixed, just hidden.

Wrong problem. That was true of Windows XP, but not Vista. Users don't run as 'administrator' by default, in Vista.

Unless you want to game online and the ani-cheat software forces you to run as admin or you can't game.

I'm sure people can come up with more scenarios.

Would be nice if third party people would better integrate their software with least privilege in mind.

Most users just click OK anyway

the same users will put their passwords in linux when a sudo prompt appears...

Edited 2008-07-21 14:47 UTC

You do realize that there's a significant difference between clicking a button and providing a password, right?

There is absolutely NO difference for a user that doesn't understand the implications of the choice, either way. Cut loose an uneducated user on Ubuntu, and you're going to see them entering their password, without regard for the consequences. The only thing that will prevent this problem is education. It isn't a UI problem.

Edited 2008-07-22 01:27 UTC

Saywhatnow? It reduces that vector, it does not remove it.

Clearly you are a little confused, and your post shows you have not used a Distro like Ubuntu.

Sudo always DEMANDS a password before it will allow a command to run, so I do not know where you got the idea it did not use one.

The old idea is that it is secure because no-one is using Linux is also a load of balls, there are millions of internet servers running Linux. If I wanted to write a virus, I would write one that would take out the infrastructure of the internet, rather than hose up some basement dwelling internet poke players/porn junkies pc.

The quote you gave, "The old adage of security through obscurity will no longer apply.", I hope you are aware that the "security through obscurity" idea was put about by Microsoft, when people were looking access to the Windows source code to try and make it as secure as Linux, Microsoft told them, that because the source code is not out in the open, Joe Public could not search for vulnerabilities, so it was in essence security through obscurity.

Now, instead of spouting off crap, actually download and TRY a Linux distro. Until you do so, your opinions are not valid and your post on Linux and Linux security are useless.

'Dude' I do use Kubuntu on a daily basis on several Servers. I use Xubuntu on my laptops. None have sudo enabled.
I have come upon many Ububtu systems where the user demanded that it was 'Setup like Windows' and the password requirement for sudo was removed.
I was also using an EEEPC earlier today for the first time. It also had no password requirement for using sudo. I don't know if that was the default or not so I can't comment on that.
If it is that easy to remove the requirement for a sudo password then I have to say that it is a security hole big enough to drive a Routemaster through.
I'm of the 'old school' linux user (Since Slackware 1.1, Unix since 1984) who believes in passwords and long ones at that for all critical accounts.
But hey, FOSS is all about choice. You can run your system OOTB or with (from my experience it is quite widespread) sudo passwords disabled if you want to. All I'm saying is that it is all too easy to disable sudo passwords and it could be a major security problem to targetted malware.

I don't disagree with your take on this, but a small correction is in order. For every terminal session that you have active, you only have to give sudo your password once. Any sudo commands you run after that will not ask for your password again until you close your terminal session and open a new one.

Good point, but it's actually time-based from your last use of sudo. You can decrease the time limit if worried.

Yeah, your Linux Boxes.

Do they say Starting Windows
when you turn them on ?
Your post shows complete ignorance of Linux and especially Sudo.

Sudo will ask for a password when you enter the first command. Then it will stay active, ONLY in that instance. If you want another Sudo instance, you need to type in the password.

Here is a great gaping security hole.
Personally, I think using 'sudo' without a password is plain crazy and actually go that on step further on all my Linux boxes and disable it completely.

This is something I totally agree with. sudo without a password is essentially the same as running as root. Any virus/malware/hacker etc can do anything they want on your *buntu installation as long as they can run sudo. It might be user-friendly..but it sure as hell ain't secure.

When I was using Gentoo I configured sudo to require password for everything except a few predefined commands, and I'm glad that Mandriva does also require password when you're trying to use sudo.

Dude, Ubuntu's sudo requires a password - the user's password - before doing anything.

https://help.ubuntu.com/community/Sudoers

Have you ever used Ubuntu, as the posters before me would say?

# Uncomment to allow members of group sudo to not need a password
# %sudo ALL=NOPASSWD: ALL

As you can see, it's commented out, so by default it DOES require a password.

It still requires a password, so it's not gaping in my opinion...

Are you saying that 95% of Ubuntu users use sudo without a password???? What are you smoking? You're showing your ignorance on this subject.

Edited 2008-07-21 13:26 UTC