UNIX Security: Don't Believe the Truth? 520
OSNews has an interesting editorial about security on UNIX-like systems. "One of the biggest reasons for many people to switch to a UNIX desktop, away from Windows, is security. It is fairly common knowledge that UNIX-like systems are more secure than Windows. Whether this is true or not will not be up for debate in this short editorial; I will simply assume UNIX-like systems are more secure, for the sake of argument. However, how much is that increased security really worth for an average home user, when you break it down? According to me, fairly little"
Re:Pointless (Score:3, Informative)
Re:I'll Field a Few Questions (Score:3, Informative)
He's just a kid (Score:4, Informative)
His 'OSNEWS' bio: http://www.osnews.com/editor.php?editors_id=11 [osnews.com]
I was doing systems programming on UNIX BSD 4.2 Tahoe when he was born.
I am surprised that his article was even published/posted, I can't really even see his argument or what point is he trying to make. Oh that's right he's a 'managing editor' WTF?
Back to work.
Re:Unix was a joke for years (Score:2, Informative)
Re:Backup (Score:5, Informative)
All that, of course, is ignoring practical differences in the security history of the platforms and common applications, as well as the lower profile of Linux in terms of automated threats. Direct attacks (ie, someone is specifically attacking you) are just as much of a threat, and many distros are vulnerable to attacks in an unpatched state. Linux is *not* a panacea against threats (and only idiots portray it as such), but it is a very different threat profile than a Windows machine.
I'm sorry, but spyware makes UNIX superior (Score:3, Informative)
reply to the author (Score:2, Informative)
I'm sure you're probably getting a ton of these emails, so I'll keep this (relatively) short:
It's incredibly naive of you to say that because *nix users have full access to their user space, they are no more secure than on a windows box. Consider, for a second, how malicious software propagates itself on a user's system: The most popular methods include memory resident programs, overwriting system files and libraries, and the unwanted installation of software invisible to the user.
On a standard windows box, those methods are trivial because the user runs in "root" space. On a standard *nix system, however, the user has no admin privileges whatsoever. So a malicious piece of software has much, much fewer options and means-of-entry in to the system to do its dirty work. Now, is a *nix box bulletproof? Certainly not. No one ever said it was. But by default, it's much harder to do real damage. The removal of the users coveted pictures, documents, etc has to be prompted by some piece of code. If it's much harder to implement that code on to the users machine, then yes, that machine is more secure. You're missing the bigger picture.
Not to mention "security by obscurity", which simply points to the fact that windows users make up 80%-90% of the market, so the authors of the malware tend to target windows machines because they're a more target-rich environment.
My point is, to simply say something like "acutally, no, unix is no more secure than windows" and not go in to any real, tangible detail borders on FUDD, and is exactly the type of press that potential coverts soak in.
Thanks for nothing,
Tim
That's not exactly correct (Score:5, Informative)
Re:Backup (Score:5, Informative)
I'm a fulltime Linux user (4 years on the desktop, 7 years otherwise, so no veteran, and no newbie either) and I'd never even consider using logging in as root for any activities that aren't associated with system administration. (guess where "Administrator" comes from) Typing in the root password to install software isn't something I'd call a nuisance or even mildly irritating.
The same thing is of course possible under Windows: Make your main login a 'Power User', or if you feel that's not safe enough, put it in a group with the same policies as the 'Users' group and slowly increase its permissions until you can work productively. (there are problems with debugging code and other niggles by default) Recent versions of Windows will prompt you for an Admin password for stuff your user isn't allowed to touch, although in some cases you have to explicitly right-click the link/executable and select 'run as'. I think there even are some utilities around to make the process even less painful.
If you're doing extensive admin stuff, you can also log in as an Admin explicitly of course, and since XP you can switch between users quite easily without logging out.
It always astounds me how incredibly adverse peoples' reactions are to this suggestion. Sure, it doesn't provide absolute security (ActiveX springs to mind) but that, together with frequent Windows Updates, an enabled WinXP SP2 firewall, and not using IE, I can't imagine you'll have a problem. You might be able to lose some data if you catch a virus, but you're very, very unlikely to bone your system. I do occasionally boot into Windows to play games (Cedega doesn't really work on ATI graphics cards) and I've never caught a virus or spyware, and I don't have an antivirus program installed, as they slow the system down to an infuriating degree IMO.
~phil
Windows NT and VMS are cousins (Score:3, Informative)
Re:It's not funny ... (Score:3, Informative)
That Old Thing Again? (Score:3, Informative)
Re:Backup (Score:2, Informative)
Anyone who has a computer.
For Windows,
Re:Backup (Score:5, Informative)
My point about all this is no amount of security or proper setup will prevent stupidity. Although this is a case where Linux/UNIX would suffer from the same problem. Social Engineering is still the greatest exploit out there, for any OS.
Re:Backup (Score:3, Informative)
Users of software suites called "operating systems" and "filesystems". An "executable image" is a file (generally on disk) that is (more or less) an image of the program's initial state when it is loaded into memory. Users who are less careful with wording than GP often call them "executable files" (even though not all executable files are executable images), .exe's (even though not all operating systems do magic by file extension), or just "programs".
It's called "Google". (Score:5, Informative)
That starts you off on shares and setting the time/date.
Do you want to know one of the coding practices lead to this problem?
http://blogs.msdn.com/aaron_margosis/ [msdn.com]
You might want to spend some time looking up Powerpoint 2003, too.
Re:Doesn't Matter So Long As It Works (Score:3, Informative)
If you get hacked you need to reinstall your OS, no matter what. There's no way to know that the hacker didn't compromise the OS and leave a backdoor for him to get in again later. Unless you've properly configured an intrusion detection system.
Re:Because it makes things work. (Score:4, Informative)
Ask and ye shall receive: Keith Brown's Hall of Shame [pluralsight.com].
Windows is only worth using (Score:3, Informative)
I repair many of desktop and notebook machines. Three last week - this is Monday and I already have two machines waiting for this week. This is not my main business - people only bring me machines after other people already tried and failed to fix them.
To fix a borked notebook PC and remove all spyware crap, takes 3 to 10 hours. Repairing a desktop takes 2 to 3 hours. The problem being that notebook PCs are slooooowwww, so the repeated scans take forever and Spyaxe and similar crapware requires multiple passes and multiple reboots with multiple scanners to remove. Consequently, I spend 10 to 20 hours per week removing crapware from Windows PCs.
In contrast, I never have to remove crapware from Linux PCs and notebooks - they just keep working - chalk up zero hours to Linux repairs. This means that in practice, Linux is infinitely more secure than Windows.
Nuff sed.
Re:Because it makes things work. (Score:4, Informative)
1. Click 'Start'.
2. Go to Settings > Control Panel (or click on 'Control Panel' if using the XP menu)
3. Double-click on 'User Accounts' and wait for applet to load.
4. Click on account name.
5. Click on 'Change Password' (or 'Create Password' if none is set)
6. Type in current password (only if 'Change Password' was selected), new password, and again to confirm. Also type in a hint.
7. It may ask if you want to make folders private. Choose yes or no.
8. Close window. Done.
See, that's strange, because all I do is hit CTRL + ALT + DEL, then click "Change Password". Enter the old, then the new twice and click "OK"
No need to complicate things overly. And no need to compare the O/S's. each has it's place.
I feel fairly comfortable with admining Windows.
Maybe we've just discovered why so many Windows systems have problems.
Comment removed (Score:3, Informative)
Are you on Drugs? Adios Mod Points... (Score:2, Informative)
The article, and most of the posters here, are missing an even more important point. There are very few viruses that just delete all your files anymore. The two major threats the PCs these days are spyware (a threat Linux has greater resistance to, because modifying plugins and such usually requires root permissions (with some exceptions, such as Firefox plugins - you're down to app level security there, on both platforms) and zombies to add your PC to a botnet, which Linux is more resistant to, again, because of not running as root. Yes, you have roughly the same level of resistance to "delete all your files" viruses, which are rare these days relative to the amount of "take over your machine as a botnet" viruses.
All that, of course, is ignoring practical differences in the security history of the platforms and common applications, as well as the lower profile of Linux in terms of automated threats. Direct attacks (ie, someone is specifically attacking you) are just as much of a threat, and many distros are vulnerable to attacks in an unpatched state. Linux is *not* a panacea against threats (and only idiots portray it as such), but it is a very different threat profile than a Windows machine.
[PARENTHETICALLY: I'm giving up Mod Points to reply to you because no one else seems to want to make this point...]
Every single thing you wrote would be true if you were to exchange the word "Windows" for the word "Linux" [and vice-versa].
In fact, Windows has a vastly, almost prohibitively more elegant security infrastructure than "Linux": File rights of "Full Control, Modify, Read & Execute, Read, Write," file attributes of "Read-Only, Archive, System, Hidden," very finely-grained ACL-based system security "Policies", a global Kerberos-based directory authentication scheme in Active Directory, etc etc etc.
"Linux" has rwx-rwx-rwx. That's it. [Now Linux combined with Novell Directory Services and a Novell File System would be an entirely different cup of tea, but that's a whole 'nother discussion. Although, I'd ask: Does Novell even have a "Policies" ACL-based security infrastructure for KDE or GNOME yet? Are they working on such a thing?]
The reason that "people" [the great unwashed masses of the bell curve ten or twenty or thirty IQ points below geniuses like yourself] don't use Windows security is because SECURE SYSTEMS ARE A PAIN IN THE ASS and no one wants to be bothered.
If Linux had 95% market share and you had retards surfing the web as "root" [just like the Windows retards surf the web as "Administrator"], then you'd be seeing the same damned thing with Linux that you see now with Windows.
Maybe even worse.
Re:Are you on Drugs? Adios Mod Points... (Score:5, Informative)
Complexity does not equal elegance. If you find yourself uttering something as foolish as "prohibitively more elegant", you've stumbled into that territory.
Indeed. It would appear that the world has moved on since you last looked at "Linux" in the 90s. POSIX 1003.1e/1003.2c access control lists: http://www.suse.de/~agruen/acl/linux-acls/online/ [www.suse.de]
Re:Windows NT and VMS are cousins (Score:1, Informative)
Cutler quit a year or two later when it was still in alpha and called OS2/NT. A full operating sytem supposed to be integrated and have more than just a kernel. It needs a shell, libraries, user mood access, and applications. WindowsNT had neither and is poor.
Scripting is a nightmare and its still not as terminal friendly as Unix or VMS. It was just a kernel with other things ported on top of it from single and cooperative multitasking environments klundged on.
Re:Are you on Drugs? Adios Mod Points... (Score:3, Informative)
That's simply false, unless for some stupid reason you're using an antiquated filesystem. There is full support for file-system level ACLs in Linux. For example, XFS [sgi.com] supports POSIX ACLs, and the SuSE folks include instructions on implementing POSIX ACLs in Linux (pdf) [www.suse.de] on a couple of different filesystems in their administration guide.
It's not like this is particularly new, either. It's just that you aren't forced to use ACLs, and by default they are configured to be overridden by the traditional mode bits (which, by the way, are surprisingly more powerful in the hands of an expert than many people realize).
Let's try to discuss actual shortfalls in Linux, rather than making them up out of ignorance, hm?
Re:Why Windows People Run as Admin (Score:3, Informative)
Well, let me begin by saying I am not just some random UNIX nut, but that I was actually an NT admin for years (although I am not one currently). But one point is that the NTFS permission and security concepts in NT5+ are sufficiently complicated that I am unable to explain them adequately here in a single post; I for one could spend a few thousand words just on the topic of standard permission groups, let alone dynamic permission inheritance. So that's at least part of it, permissions in NT are complicated, and can seemingly overlap or contradict each other at times. That makes it tricky at best to get a grasp on in the short run and a real handful to keep track of in the long run, especially to the uninitiated, and therefore ultimately difficult to implement properly. Another thing that works against the security and integrity of the system is the registry. It is a veritable snake pit of often inter-dependant, unintelligible and/or misleading values, much of it hashed or in hex. However, many popular programs require that a user have write access to the registry in order to store their settings. That opens up the question of whether the admin (assuming there is even an IT dept and we're not talking about typical home or SOHO users) will take the time to properly tune fine-grained registry permissions to allow the program(s) in question to function properly, or simply elevate the user's privileges to a higher level, therefore giving them R/W access to the entire registry. Usually the local permissions simply get elevated. In the home, people don't even think twice about giving themselves admin rights. "It's my computer, so I'm the administrator!" and all that.
With Unices, it's simply a given that users don't run as root. On most distros, attempting to log into X Windows as root you are greeted with a bright red screen and a warning message to the effect of "WTF do you think you are doing? You can break the system this way!" And software is written in a complimentary manner. User-specific settings are stored in the user's home, not in a registry or other obscure code dungeon. System wide settings are typically kept in /etc in the system's root, and are not editable by Joe or Jane Q. User. Once the system is up and going very little ever needs to be changed in a system wide manner anyway. If the situation should arise where a user needs to do something fairly often which requires elevated privileges, the user can be given sudo privs for that specific task, which typically requires the user to type their own password to execute. [I hope I'm making sense here, as I've had a very long day and quite a few distractions as I write this. ;-)] Also there is the fact that privileges are much more straight-forward in concept on a UNIX system, being simply read, write and execute. There are also only three categories of ownership in a UNIX system: owner, group, and everyone else. So while some security scenarios work out better (or at least easier, not involving the creation of special-purpose groups) with NTFS permissions, the vast, overwhelming majority are much simpler and more managable on Unices. As I think history shows, this makes for a much tighter ship.
-AT