Microsoft Claims Linux Security a Myth 901
black hole sun writes "Microsoft bigwig Nick McGrath claims that Linux security is highly exaggerated, and that the open source development model is 'fundamentally flawed.' The gist of his argument appears to be his claim of lack of accountability among distributors, coupled with generic statements short on facts. 'Who is accountable for the security of the Linux kernel? Does Red Hat, for example, take responsibility? It cannot, as it does not produce the Linux kernel. It produces one distribution of Linux.' He goes on to say that 'Linux is not ready for mission-critical computing. There are fundamental things missing,' pointing out the lack of a development environment and no single 'sign-on system' giving reference to Microsoft's foundering .Net passport program." I guess Linux can only aspire to the greatness of Windows when it has such secure applications as Outlook and Internet Explorer. Historically those have been proven to be of a caliber all their own.
*COUGH* sendmail *COUGH* (Score:4, Insightful)
Questions?
Re:*COUGH* sendmail *COUGH* (Score:3)
Re:*COUGH* sendmail *COUGH* (Score:4, Insightful)
Re:*COUGH* sendmail *COUGH* (Score:4, Interesting)
Red Hat and now Fedora Core, for example, still ship with sendmail. I don't recall if FC3 had other mailer daemons as an option or not but sendmail was the default mailer.
Also, *nix does not only mean Linux. As far as I know, most other *nixes still come with sendmail rather than something else. Sure, you can replace them with postfix or qmail or whatever you want, but by default, it's sendmail. (Have qmail or postfix been ported to Windows yet? Wouldn't surprise me ...)
As far as I know, sendmail is still the most popular mail daemon out there, even more popular than Exchange.
As for `twenty years of buffer overflows', sendmail has a tricky job to do. It's a complicated program, extremely customizable, and a network daemon to boot. And twenty two years old! (That alone says something.)
Certain aspects of it's architecture (especially it's monolithicity) suggested that a rewrite may provide a more secure and faster product, and out of this came smail, qmail, postfix, exim and others. But sendmail is still the standard, and it's still under development. It's been quite some time since I've heard of a buffer overflow for sendmail ... (lat se
Re:*COUGH* sendmail *COUGH* (Score:5, Informative)
A lot of things have changed since 2001, yes? It's 2005 now, correct? Qmail is in the process of overtaking Sendmail, and for good reason.
Re:*COUGH* sendmail *COUGH* (Score:5, Insightful)
sendmail counts: 54,800
windows counts: 193,000
now we know that windows hasn't been around nearly as long as sendmail, and yet it has nearly FOUR times the buffer overflow matches.
now let's do -
Internet Explorer: 349,000
Outlook Express: 57,700
Outlook Express has been in use for under 8 years and has 300 more matches for buffer overflow than sendmail.
according to your logic for deducing how secure something is, I'd still pick sendmail over anything microsoft makes.
Re:*COUGH* sendmail *COUGH* (Score:5, Insightful)
Sendmail is still the standard-bearing monster that everyone loves to hate. Mostly, I think because of the fact that everyone *knows* it. Even two years ago, it was still required on many Linux job apps.
Secondly, never underestimate the number of legacy systems out there. I have sendmail running on at least two of my legacy systems. Of course they only function as an MTA and don't actually listen on any exposed address.... Of course qmail is on my production systems.
Here is the issue. Open source or proprietary software re: security? Security a matter of design rather than something revealed by a simple litmus test. Open source and proprietary software can be secure or insecure. But the way we find this is by discussing the structure of the program and determining whether it is resistant to attack and fails gracefully without exposing the rest of the system. This is easier with open source software.
Oh, and anyone who trusts whatever Microsoft has to say re: security is going to get what is comming to them.
Re:*COUGH* sendmail *COUGH* (Score:3, Interesting)
And this is what I find puzzling about Microsoft. Th
Profitable Insecurity (Score:5, Insightful)
Re:Profitable Insecurity (Score:4, Insightful)
Re:Profitable Insecurity (Score:5, Interesting)
I think that this is present in the minds of program managers at Microsoft to some extent and has been an issue that has needed to be dealt with. But it is not the only one, nor is it the most glaring.
Microsoft suffers from an inferiority complex when it comes to performance and computing. So often the design compromises which occur in the name of performance are more damaging than the ones which happen in the name of cutting costs and making release schedules. This is speaking as a former insider.
For example, early NT systems (through 3.x) used a microkernel architecture with the drivers running in ring 1 on Intel and ring 0 on alpha. GDI.exe was a user-mode program.
Well, it was decided that NT 3.x did not perform well enough, so when NT4 was designed, the essential elements of the microkernel architecture were abandoned in favor of a system where the drivers and GDI ran in ring 0. In other words, the though that stability and security were not marketable but performance was and so chose performance over the other two.
Then the TUX webserver came out, I looked at the architecture, and my first thought was "I am NOT running network services as part of my kernel! I don't want those l33t h4x0rz exploiting Ring 0!" I even pointed this out in several discussions regarding the competitive landscape at Microsoft. In general the technicians, support managers, etc. all agreed with me. But not the program managers whose job it was to steer Windows development, because parts of IIS6 run in kernel mode. Again, compromising security and stability for performance (just as TUX does). Again this decision was made to counter Linux publicity re: performance rather than to try to offer a compelling alternative.
In other words, Microsoft still is not really driven by making secure software. Or at least it wasn't when I worked there (up until shortly after Server 2003 launched). Instead, they have a whach-a-mole marketing attitude where their new products must beat their competitors' in terms of publicity based on whatever market fad is happenig at the time.
So these words are a threat but seem to indicate that they are really worried about Linux and all the free publicity that they are getting.
But when was the last time anyone trusted Microsoft re: security anyway?
Re:Profitable Insecurity (Score:3)
I actually don't think so, having worked there. Yes, the outward attitude might change and it has, but the corporate culture is not focused on security, and neither is the product develop
Re:Profitable Insecurity (Score:5, Interesting)
Aside from the politics which were eay over the top in my opinion, I had a few family issues that could not be adequately addressed while I worked there. Now that my year has passed and I am no longer bound by any non-compete clauses, I can be a little freer with who I am and what I am doing now.
BTW, for those that do work at Microsoft, I was deeply involved in competitive discussions which lead to:
1) Pop3 server bundled with Windows Server 2003 (so that the SMTP/POP3 server combination can compete with Sendmail).
2) The decision to take Services for UNIX to Linuxworld was based on my suggestion though I had no power or leverage to make it happen (and others carried the torch).
3) I was the first to my knowledge to suggest the bundling of SFU with Windows Server. I made many other suggestions but I feel that it would be unwise to mention any which have not been announced either way due to NDA's.
After I left Microsoft, I began to develop a set of software tools designed to help complete the Linux software stack (and just simple utilities to make my life easier). I began a software consulting business which helps people make the most of Linux and Windows.
To tell you the truth, there are pieces missing from the Linux software stack. ANyone who tells you otherwise does not deal with the range of customers necessary to see it but it si there and includes a lot of vertically targetted software for small businesses and line of business software. Most of the software in these markets is not very mature and will take time to develop. So Linux is not for everyone in every capacity but it is getting there.
On the other hand, Windows security is a horrible myth. Windows will never be as securable as Linux is. There are fundamental problems in its design and I have no problem saying this.
Now I did not say that Windows is less secure than Linux, only that it is less securable. If you really want to, you can configure your Linux system to be less secure than Windows 95. It is not that easy to do but it can be done. On the other hand, it will be next to impossible to achieve the same securability on Windows that you have on Linux without breaking a lot of important crap.
Re:Profitable Insecurity (Score:4, Insightful)
When I look at the relative security of a software package, the questions I ask (going back to design) are:
1) How exposed is this to attack? How necessary is that exposure?
2) If it is compromised, how deep is the compromise?
Now, the inclusion of http.sys affects question 2 in the following way:
If a compromise occurs in http.sys (which is directly exposed to the network), then the exposure level is deeper than any usermode program running as any user. I.e. the fact that the exploit occurs in the kernel (ring 0) means that the system is fundamentally compromised in a way that it would not be if it were in usermode (ring 1 or 4 usually depending on the processor architecture).
There have been no explots to date in either http.sys or TUX but that does not mean that they are secure by design. More likely, they have not been directly targetted yet due to people sensibly not running them.
Re:*COUGH* sendmail *COUGH* (Score:4, Interesting)
It's entirely possible that middle-management at MS doesn't have (or doesn't want) the type of directional control they need to get their workers to produce something that is "good".
The Upper Management/Directors/Execs/Chiefs have clearly shown themselves to be the puppeteers of the great MS show. We get laughable quotes like this new one every few weeks from these characters (literally and figuratively). And it's humorous in an, "I can't believe that you believe that" kind of way while being truely pathetic.
It's a pretty common theme among large companies, however. The people that steer the metaphorical ship don't have any real idea of what goes on at the lower levels of their organization. Nor would they want to. If we run with this metaphor, they don't really want to know how the engine produces power or the detailed physics behind why a rudder turned 15 degrees one way turns the ship at a certain rate. It doesn't help that they're typically shielded/buffered from reality by some butt-kissers looking to get a bigger slice of the pie.
Everyone from the bottom up to middle management (workers, their managers, and the managers' bosses) is where the real work is done at most companies. The directional control is usually handed down from on high by the execs, and it's up to the workers to get make it happen. The ones at the lower levels the ones with the greatest sense of reality, and can head off problems before they're really problems. It's only when the executives start meddling around the real work that things start becoming ugly.
This exact scenario is the case where I work right now. We're not an IT company, specifically, but we do rely heavily on IT to get our work done. As an IT worker, I'm forced to see the inefficiency, bureaucracy, and sheer stupidity of doing things as we currently are. This is a result of decisions from 3 levels higher in the corporate food-chain than the real worker. At some point in the past, the company needed a direction regarding a rather large software project. What we got was a level of detail that should have been left up to the workers. It wasn't as much WHAT to do that got us in this mess as the HOW that was mandated. As a result, things got much worse...
We now have many non-technical managers leading teams of VERY technical people. Decisions that determine IT's direction within the company are now made by people that have no place in IT at all, much less managing IT staff and making decisions about technology.
Things are starting to change here as the clued-in technical managers and staff realize what happened, so there is hope. But I suspect MS is caught up in the same type of situation where specifics are being decided by people that have no expertise on the matter. It would certainly explain things, anyway.
Re:*COUGH* sendmail *COUGH* (Score:5, Insightful)
Indeed (Score:5, Insightful)
Care to elaborate? Just what part of the software stack is missing?
Re:Indeed (Score:4, Funny)
The bit that lets Firefox adds new suid root system calls to Linux via
Re:Indeed (Score:4, Funny)
Care to elaborate? Just what part of the software stack is missing?
The bit that lets Firefox adds new suid root system calls to Linux via .xpi files disguised as links to FREE BOOBIES.
Your link to FREE BOOBIES doesn't work. could you post again using the HTML tags.
Re:Indeed (Score:3, Interesting)
Gee, kids these days...
Re:Indeed (Score:5, Funny)
Re:Indeed (Score:5, Funny)
The entire .NET Framework is missing from the Linux kernel!!! My Visual Basic kernel modules won't even compile under Linux.
Re:Indeed (Score:5, Insightful)
Here, MS is starting out with claims that don't have a thing to do with reality. They're stating nothing more than equivalents to 'what if's. Making a reasonable sounding argument that in the absence of proof sounds like it could have some backing behind it.
When MS says "The biggest challenge we need to face centres on the myth and reality. There are lots of myths out there as to what Linux can do. One myth we see is that Linux is more secure than Windows." it's just an outright lie. It sounds like he's taking the position of a firm stand against a very real problem. "the open source development process creates fundamental security problems." furthers it, by attempting to put an explanation on just what's wrong with Linux.
It's theorising, and it's the kind of logic a bunch of guys down the pub will bullshit on about for hours, talking about cars or government or whatever, things they really don't know about, but can sound knowledgeable about.
Sounding knowledgeable doesn't stand up to Reality though.
Microsoft's comments about Linux security in the face of the passing of their least secure year is the equivalent of them arguing that drink driving is actually safer, by stating "Alcohol slows you down. It would make you drive slower, therefore be safer. You'd be less likely to do anything silly cos you'd be trying to concentrate harder on driving well". On the surface to someone who knows no difference, it sounds like an argument that has merit.
But again, The Real World jumps up and gets in the road, and that's where real security issues for MS exist, and not in their false construct of marketingspeak.
Re:Indeed (Score:5, Insightful)
This reminds of the guy in the Bush administration that said something to the effect that "reality-based people" don't have any effect in the "real" world - just all those "faith-based people" in the administration.
Which is actually true. Even Seymour Hersh said it on the Daily Show interview I just watched a few minutes ago - that regardless of what he writes, or the NYT writes or anybody else - the administration is going to do whatever they want - including invading Iran and getting hundreds of thousands more people killed.
And that's true about Microsoft and anything Microsoft says - it's all going to be total bullshit and deliberate lies and that's the caliber of the people working there - but they're going to do it anyway.
Time to ignore them and just get on with it. As Abbie Hoffman once said, "Do Your Own Thing and Only Your Own Thing".
Or as William Burroughs said, "Never let the critic teach you the cloth" (as they say in bullfighting).
Re:Indeed (Score:4, Insightful)
Who is accountable for the safety of drinking water? Does Evian, for example, take responsibility? It cannot, as it does not produce water. It packages one distribution of water.
Re:Indeed (Score:5, Funny)
Re:Indeed (Score:4, Funny)
That's why water is not ready for mission-critical drinking
Hence the need for Microsoft's new .WET architecture to solve these problems.
forcing it's employees to only drink Jack Daniel's Tennessee Whiskey since 1984
Truly, this explains so much.
Re:Indeed (Score:3)
Yes, Evian does take responsibility. As the producer of the food product - namely, bottled water - it is held responsible for its quality and safety to the consumer by the Food and Drug Administration.
But hey - way to go trying to make a lame analogy. And by the way, raising your hands and saying "who knows who is responsible" an
Re:Indeed (Score:3, Insightful)
Red Hat takes reponsibility for their distro in the same way Evian takes reponsibility for the safety of the water they sell. But neither take responsibility for all instances of the raw materials they package and sell.
Re:Indeed (Score:3, Insightful)
Re:Indeed (Score:5, Insightful)
At least as much as Microsoft does for Windows, anyway.
Re:Indeed (Score:5, Interesting)
Re:Indeed (Score:5, Insightful)
DRM.
Re:Indeed (Score:5, Insightful)
Microsoft isnt responsible for the security of windows either!
Re:Indeed (Score:5, Insightful)
They can make accountability an issue right after they start taking the blame for virii and worms, and reimburse business for all the expense and inconvenience Windows holes cause.
Re:Indeed (Score:3, Funny)
Anti-virus scanners and spyware removal tools... ;)
Re:Indeed (Score:5, Insightful)
accountability != security
When one of those 60,000 viruses, etc, attacks your Windows box, you know exactly who is accountable for the security hole: Microsoft.
But what good has that done any of us? I still see the worms trying to infect my system daily (fortunately I run Apache on FreeBSD, not IIS on Windows). When I visit my relatives with Windows boxes, I have to clean up hundreds of pieces of spyware and adware. Knowing who to point your finger at doesn't stop the thousands (or whatever) of compromised machines from constantly spamming us.
Not to mention M$'s latest announcements limiting security updates to only non-pirated copies. That's a tough call. On the one hand, the pirates get what they deserve; they didn't buy the product, so they are not entitled to support. That's fine.
The problem is that its not just the pirates who are penalized. Having thousands of unpatched Windows machines is bad for everyone. The worms and viruses don't care if its a legal copy or not. They'll infect and add the pirate machines into the spam-cluster. Who is accountable for those, now that MS has washed that one off their hands? I still say Microsoft.
Re:MS Development tools pwn everyone (Score:4, Insightful)
I'm actually serious, you were moderated informative but I am really wondering where the superiority of the MS tools come from..?
Re:MS Development tools pwn everyone (Score:3, Insightful)
I'm presuming this is some sort of weird troll, moderated "informative" for some odd reason (seriously moderator, "informative"? What derf?)
Seriously, if you think the Microsoft development tools are far superior to anything [kde.org] else [borland.com] in [eclipse.org] the [activestate.com] world [macromedia.com], then I can only presume you've never used anything else in the world :).
Why I spit on M$ programming skills (Score:5, Interesting)
Around 1989, I had to use whatever Visual Studio was called then. In the debugger, while stepping thru some C code, I accidentally stepped into strcmp or some other function for which the source code was not available. It dropped into assembler mode, quite fine, just a matter of stepping until it exited back to C code. Except it then displayed the C debug screen without first clearing the assembler debug screen. Lots of pieces left over, register displays, hex codes for instructions, etc. Almost unreadable. It gradually cleared itself up as I continued to use it.
Around 2002, I had to use Visual Studio for some small project. You can click on an API and it automatically adds skeleton code to source files. It leaves those windows open, and I did not want so many windows open at once, so I tried to close them. Nothing under any menu I could see, but the X in the corner worked. Next time I used the skeleton code inserter, it complained that the file had been modified by an external program.
Now I suppose I was doing things the non-M$ way. There is probably some perfectly normal way of getting rid of excess windows. Maybe I should have iconized them instead, but that clutters up the task bar. I found two other similar bugs within the first half hour of using the beast.
These are the kind of bugs that anyone using the program would stumble across very quickly. How can the M$ deveopers take any pride in releasing such buggy code? How can they stand to even use such crap software? Is it so crappy that they don't use it themselves?
I have no respect for M$ programming skills.
Missed the point (Score:3, Insightful)
As for you having inserted skeleton code without problems, that also is not the point. No doubt you have had some kind of training on it. I had to jump into it and use it the
Really? (Score:5, Interesting)
I've heard this from several corners. Sometimes, even from people I trust a bit. I still don't get it. I don't live in the MS world, so I don't have much of a reason to experiment, but I am honestly interested in what makes them so great.
I hear about the "tool tip" style reference checking, auto-library chain analysis, etc. The first would annoy the shit out of me, and the second I get from my make file (or ant, depending on what I'm building).
C# seems to be a slight step up over Java, but nowhere near enough to incur the cost of switching platforms. (I say this as someone who develops and maintains production apps in Java, and hates the language.)
As a sysadmin-cum-developer-cum-business-guy, I do everything in vi, make/ant, cscope, and custom tools using primitives like sed, awk, grep, perl, svn, RT, image-magick, [custom mailing list manager], etc (yeah, perl can replace sed and awk. I mean to, some day...). I think I have everything I need, but I'd love to hear about how it could be done better.
So, please, do tell- what makes MS dev tools so great? I'm really curious.
Your point.... (Score:3, Insightful)
They were primarily trying to make claims about the lack of security in Linux based on missing components, plus a lack of accountability for bug fixes.
You're addressing an issue of availability of software applications for both platforms.
I do agree with you though. Linux is still pretty much an OS that's best used by application developers or as a server platform of some sort. The attemp
Not A Myth, Just Not Inherent (Score:5, Insightful)
OTOH, you don't have such dumbass tricks ass tying your browser right to the OS or ActiveX, so you make spyware and whatnot less of a factor.
On yet another hand, however, you have the problem of moron users running sendmail daemons that listen for connections from the Internet and other stupid things. Plus, Linux has security holes. If stupid people don't patch them just like they don't path winders, what good is the security?
Again: You can protect the stupid people from the world if you want, but you can't protect them from themselves.
Re:Not A Myth, Just Not Inherent (Score:5, Insightful)
With the coming of the Internet, all that changed. Windows needs to be secure enough to prevent web-based attacks, such as through badly created web application frameworks like ActiveX, as well as prevent attacks on vulnerabilities in the networking function of the OS. Stuff like using a restricted user mode, frequent updates, using a secure browser, etc. are necessary to stop such attacks.
A Windows computer is probably as secure as a Linux machine if adequate measures are taken: antivirus programs, firewalls (generally included in the former), secure passwords, not running as Admin and most importantly, frequent updates.
All this is new stuff that people have to learn. Atleast if you use Linux, somewhere down the line you *have* to learn the basics of stuff like this (I've found "rm -rf" is the best tool for teaching people to NEVER run as root!). With Windows, you can remain painfully oblivious to the most basic security techniques because the OS will *let* you - and your computer becomes the next hub for Joe Spamboss.
Hopefully, SP2 will improve things - I've found the firewall a real PITA, particularly on university-administered computers, but atleast it makes people a little more aware and careful.
I don't think branding everybody as "stupid" is the way to go about it. They're not stupid, they're just not aware. And I blame Microsoft as their enabler, atleast for these last few years.
Re:Not A Myth, Just Not Inherent (Score:3, Insightful)
Pffft, right. I'm as geeky as they come but I want my system to be secure without me having to think about it. I got code running through my head all day long, the last thing I need to think about is whether or not my system in secure. I do want my system to be secure and protect me though. The OS needs to do that for me because I don't want to care about that stuff.
Re:Not A Myth, Just Not Inherent (Score:4, Informative)
For now, yes, but as SELinux, or RSBAC, or any of the Mandatory Access Control, role based systems gain popularity in mainstream Linux (and SELinux, for now, seems to be the best candidate on the popularity front), the ability for idiot users to run bad code goes down massively.
Yes, in theory an idiot user could run bad code, but under a well implemented SELinux policy, while the code may run, it wouldn't actually have rights to do much of anything. At worst it might be able to fill up the home partition with useless data, or something along those lines, but spam bots and zombies and mass mailing viruses would be a far more difficult task to write indeed. A sufficiently smart idiot could grant the process the rights to do what it wants, but really...
Yes, such a system is not a cure all. People can still do bad things to themselves, and no matter how well you build it, there's always an idiot who can break it. It does, however, significantly raise the security bar on what it is easy to trick a user into doing.
Jedidiah
Re:Not A Myth, Just Not Inherent (Score:3, Interesting)
Rather the reverse I would say. You can't protect stupid people from the world. Too many of them to protect. One can only protect onesself from the stupid people. Which is why I install firewalls, AV, programs and update patches. Depending of Microsoft to do it for you just is asking for someone to exploit you.
Re:Not A Myth, Just Not Inherent (Score:3, Insightful)
NO! This is fiction. Let's look at the history:
1. Blaster - all you have to do is hook up an unfirewalled system to the Internet and you got it. Up until recently, all Windows systems were unprotected until patches were downloaded from the 'net which required... you guessed it! connection to the Internet.
2. SQLslammer - all you have to do is have SQLserver running on your machine and connected unfirewalled to the Internet. The biggest problem i
Re:Not A Myth, Just Not Inherent (Score:3, Insightful)
That's only partly true. The vast majority of the problem with Windows is that it demands that its users do stupid things, and frequently does stupid things automatically on the user's behalf -- usually without giving any indication that it's doing those stupid things.
Writing malware for Linux is no different from writing malware for Windows, except for one crucial detail: Windows will automatically install and run the malware, while Linux requires
Re:You mean... (Score:3, Informative)
HTH
David
Re:You mean... (Score:4, Informative)
Set-uid works by changing the user ID of the program to that of its' owner; thus a program like passwd (which must have root privledges to write to the password/shadow file) has suid. Scripts which use suid have a few particular security concerns; since they inherit the PATH environment variable (and a few other particulars) from their calling user, you want to ALWAYS use the full path to commands. Thus, your script should look like:
and:since a user adding a malicious insmod or rmmod to their path could gain privledges. (There are other, more subtle, security issues with suid, but this is the easiest to understand.)Nevertheless, having a suid script is far preferable to idiots logging in as root for ordinary work!What that guy is smoking? (Score:4, Funny)
He has a point, you know (Score:3, Interesting)
So, he's right, but he's also wrong in that Red Hat is no responsible for Linux kernal security, but they are responsible for getting patches out for issues discovered.
In other news... (Score:5, Funny)
Re:In other news... (Score:5, Informative)
Its as if some hotshot in his BMW 745i got a Yugo to tow him because some snow was on the ground.
:'o(
Linux Security vs Microsoft AntiSecurity (Score:5, Interesting)
Re:Linux Security vs Microsoft AntiSecurity (Score:4, Insightful)
*nod* Judging from the number of ssh attempted login scans, there are a fair number of comprimised Linux boxes out there. :-(
I'm starting to get really annoyed with Open Source people patting themselves on the back over security when stuff like that last thing where the people tried to get someone responsible for Linux kernel development to accept a security related patch, and ended up having to get an article on Slashdot before it happened.
Security doesn't just magically happen. The Open Source development model is the only way to go if you want real security, but it actually requires effort on the part of maintainers to make it happen.
Re: Linux Security vs Microsoft AntiSecurity (Score:3, Insightful)
> I'm starting to get really annoyed with Open Source people patting themselves on the back over security when stuff like that last thing where the people tried to get someone responsible for Linux kernel development to accept a security related patch, and ended up having to get an article on Slashdot before it happened.
Hey - maybe if Slashdot carried an article about Windows security problems now and then, they would get fixed too!
Re:Linux Security vs Microsoft AntiSecurity (Score:5, Interesting)
There's another important point that I haven't seen anyone mention: There's an important difference between exploitable design flaws and exploitable implementation flaws. When implementation flaws are exploited, those flaws can usually be fixed without removing essential functionality upon which legitimate users may have come to depend. When design flaws are exploited, the design must be changed to correct those flaws, and to do this, is often necessary to frustrate the legitimate expectations of real customers.
I've seen a number of people repeat the naive argument that when there are more Linux users, we will have the same problems with viruses that Windows users have. This argument only makes sense if we ignore MicroSoft's irresponsibility in the design of their software. MicroSoft has knowingly and repeatedly committed to designs that are fundamentally flawed. These design flaws include things like adding powerful, general purpose programming languages and macro languages for applications like word processors, and then adding automatic processing of these files in Mail User Agents. Keep in mind that during the '80s, MicroSoft, along with the rest of the computer industry, faced repeated hoaxes of email viruses, and had to offer again and again to customers the explanation that email could not carry viruses because it did not carry executable content. When MicroSoft made the decision to add automatic handling of executable content to their email systems, they could not have been ignorant of the fact that easy proliferation of viruses would be a consequence of their decision.
MicroSoft has generally been reluctant to fix the design flaws in their software, because they are committed to some level of backward compatibility. Of course, responsible designs, up front, might have made this commitment less problematic. The result has been a florishing industry for anti-virus software. We now go to third party vendors to make up for the poor quality of MicroSoft software and for their unwillingness to take responsibility for their own mistakes.
My experience with widely used Linux software is that the stuff that becomes popular is usually designed much more thoughtfully that is typical of MicroSoft's products. Serious security design flaws are denounced quickly, and perhaps more rudely than is really required. While the vetting process for Linux based software is far from perfect, it has clearly been much more successful than MicroSoft's persistent irresponsibility. I regularly follow email lists about security flaws in Unix/Linux systems, and the vast majority of those flaws are implementation flaws rather than design flaws. The flaws for Linux in particular are quickly address, and patches are released. While I'm aware of virus scanners that run on Unix and Linux systems, to me they seem focussed on scanning email and files for Windows viruses. There are Unix and Linux based because Unix/Linux machines are often file servers and email gateways for Windows systems, and not because there is any problem with viruses that attack Unix/Linux systems.
Finally, Linux developers have not been required to cover for their perjury in the courts and have not been nearly so tempted to violate that maxim of software development that every Computer Science student learns in school: Software should be modular. It should be divided into separate modules, where each module does its job. The interfaces between modules should be clean and simple. Applications should not ever be integrated into the core of operating system. A consequence of rational design in the Unix/Linux world is that software upgrades are far less problematic. I routinely tell my Linux systems to go grab all the relevent updates at SuSE's web site and apply them automatically, and while I have face occasional, minor problems, I have never once had a serious problem with any such update. Every Windows administrator knows that each new update carries with it a substantial risk of rendering his systems inoperab
Well..yeah..he would say this (Score:5, Insightful)
Now, him saying that Redhat can't improve the kernel is simple BS, and could either be a fundamental lack of understanding on his part, or just a flat out lie. Given his position, I'm guessing it's a lie. Redhat ( as have most distributers ) patches the kernel with it's own magic, and will often update it on it's own.
Cliff notes: MS marketting with head in sand. News at 11.
Re:Well..yeah..he would say this (Score:3, Insightful)
Re:Well..yeah..he would say this (Score:5, Insightful)
If they were genuinely accountable, they'd be bankrupt.
I have to say, this is a pet peeve of mine - pretending to take responsibility when there is, in fact, no responsibility taken is just plain wrong.
D
Re:Well..yeah..he would say this (Score:5, Informative)
1. Accountability means you can point your finger at me and I'll say "yep, my bad."
2. Responsibility means I then have to fix it.
3. Liability means that you then get to take my wallet.
$0.02,
ptd
Excellent marketing (Score:5, Interesting)
Ho-hum (Score:5, Insightful)
I will never forget -- seeing as how it happened only on 19 December just gone -- about my broadband installation. Not wanting to rock the boat nor confuse the cable installer guy, I rebooted into XP just prior to his arrival. He hooked my old beater celery up with DHCP and I surfed for about ten minutes. I thanked him and he left.
So I figured I'd do the decent thing and do the security updates.
Eight hours later, I cleaned off the last of the spyware, adware, malware horseshit.
To Nick McGrath: Fuck off and die, you wanker. How much you want to bet your router at home runs a Linux variant for firewalling purposes?
Red hat does take responsibility though (Score:5, Informative)
Who is accountable for Windows? (Score:5, Insightful)
LIMITATION ON REMEDIES; NO CONSEQUENTIAL
OR OTHER DAMAGES. Your exclusive remedy for any breach
of this Limited Warranty is as set forth below. Except
for any refund elected by Microsoft, YOU ARE NOT ENTITLED
TO ANY DAMAGES, INCLUDING BUT NOT
LIMITED TO CONSEQUENTIAL DAMAGES, if
the Product does not meet Microsoft's Limited Warranty,
So, are we believe that if Windows crashes my data, that I can hold Microsoft accountable?
At least with Linux I have access to the source code, and can hire programmers to scratch my itches for me. Somehow, I don't think microsoft would give out source code if they went under.
Not a technical argument (Score:5, Insightful)
Microsoft at least is the clear and sole owner of its product. Though any single customer's ability to make it responsible for product deficiencies is slight at best, a statement of "we're here and responsible for our stuff" is superficially reassuring.
Superficial... (Score:3, Informative)
Re:Not a technical argument (Score:4, Interesting)
"we're here and responsible for our stuff"
but phrased a little differently, what they're really saying is that in all the world there's only one company that has sufficient faith in Microsoft OS software that they're willing to be responsible for it (and if you read the EULA they're not responsible anyway). In contrast Linux has many companies who are all sufficiently confident in Linux that they're willing to stand up and actually take responsibility for it. Why are they so confident? Because they know that even if a problem is found they can fix it themselves and provide that fix to their customers.
Personally I'd be more willing to trust the system that has lots of companies wanting to step up and offer to be responsible. If I wanted accountability I'd pay one those comanies to be responsible for any issues, rather than Microsoft, standing alone, claiming they are responsible "sort of, in a way, maybe".
Jedidiah.
Re:Not a technical argument (Score:3, Insightful)
Microsoft's products are just tools we use to run the business and if the tool's broken it is *MY* job to ensure we get it fixed - 'getting it fixed' in this case might be to refer to the manufacturer (ie: M$) to see whether they have fixed it and if
Microsoft takes responsibility for Windows Bugs? (Score:5, Insightful)
Let's keep the bias out of the submission.. (Score:4, Insightful)
I guess Linux can only aspire to the greatness of Windows when it has such secure applications as Outlook and Internet Explorer. Historically those have been proven to be of a caliber all their own.
This is true, I will agree.. in my humble opinion. Let's save the editorializing for the comments. This is 'News for Nerds' - this sort of snide comment has a place in an Op/Ed page, but certainly not the 'front page' of a news site. I suppose there are divergent ideas of what Slashdot really is, but I think that endeavouring to be unbiased would be great.
I'm not meaning to troll or to be 'flamebait' here, just to point out a disturbing trend I've noticed in biased story submissions.
Re:Let's keep the bias out of the submission.. (Score:5, Interesting)
I tend to agree that there is a trend problem, though it isn't the mere presence of editorializing; that's always been there. It's the breathtaking inanity of the editorials of late, both from submitters and the editors. One good way of measuring the information value of a piece of information is the extent to which it is a surprise; I see a surprising editorial comment about once a week now (like "this wasn't really Microsoft's fault, you have to blame the user for giving his password out to a stranger"), the rest are total Slash-think that can and have had Perl scripts written to replace them. ("Go away, or I shall replace you with a very small shell script.")
The only thing maintaining Slashdot's reputation is Slashdot's reputation, and that's a formula for a dangerous and sudden collapse. Were I economically dependant on Slashdot, that would concern me.
But this particular editorial does have the virtue of being almost empirically true. Microsoft, as the current owner of the least secure software in common use, just isn't in a position to be criticizing others about security. Evidentally, whatever things they are trumpeting about themselves must not be important, because they are clearly not being reflected in actual results. Something that, if provided, most IT managers will prefer even over the ever-popular empty platitudes, and most IT managers are hardly able to ignore the results of Microsoft security.
This totally makes sense. (Score:5, Interesting)
Unfortunately, part of marketing, especially when your product is getting negative publicity, is pointing out perceived flaws in competing products. I believe the term often used is FUD, and it's nothing new or unique to MS. Heck, it's pretty much how GWB won a second term.
When it comes to this sort of thing, they have a wide lattitude of opinions they can express, especially when there is no Linux, Inc. to sue them for slander. The Linux community, however, has been quite good at spreading the word about MS badness; they're just trying to do the reverse because their feelings are hurt.
Re:This totally makes sense. (Score:3, Insightful)
Just personal experience (Score:5, Insightful)
Spyware:
Windows: I run a spyware checker every week or two, and it almost consistently finds new spyware.
Linux: Is there a spyware checker for linux? Does there need to be? I know that my Linux box runs consistently fast, and has no search bars.
Edge: Linux
Default Habits:
Windows: The Windows XP install, by default, seems to create an Administrator account with no password, no User account, and no suggestion that there should be a user account. Also, there's many services that are on by default, that really shouldn't be.
Linux: All linux distros I've used require a root password, and strongly emphasize that root is not to be used for day-to-day computing. Depending on the distro, most unnecessary services are off by default.
Edge: Linux
Updating:
Windows: Use an insecure browser, tied to the OS itself, to browse to Windows Update, wherein the system is updated. Note that these updates have a nasty habit of breaking things, and this does not update third-party software which may be vulnerable.
Linux: sudo apt-get update; sudo apt-get OR upgrade
sudo emerge sync; sudo emerge --update world
Edge: Linux
Do I need to go on?
A bird in the hand is worth two in the bush. (Score:5, Insightful)
but i'd rather have a more secure system now, which lacks in development stringency, then a provenly unsafe system which can prove exactly when, why and how their bugs came into the system...
microsoft is just far too lax concerning their outward security policy (like not caring about the blatant RC4 exploit). their "patch day" with all those patches that never quite close the exploits is just a farce!
well, gnu/linux with all its applications has had a bad streak of exploits as well recently and i would strongly recommend a stricter development process, but if i were microsoft i'd definitely tone down on the linux-is-insecure-and-lacks-accountability bashing and instead invest some serious effort in making my own product look a little more convincing and less like the bug-ridden security hole that it is!
jethr0
In other news... (Score:5, Funny)
Mike Tyson accused Michael Jordan of being "violent and out of control."
And Richard Simmons accused Charlton Heston of being "way too gay."
Development Environment? (Score:5, Insightful)
Yes, what a good point. There are multiple DE's for linux. This is a bad thing, because it means developers have a choice. There should only be one piece of software for each category, and it should be manufactured by Microsoft. Choice is bad, people!
Re:Development Environment? (Score:3, Insightful)
I agree with you that multiple options for development environments are good, I'm just not sure that's what he was implying.
Hm (Score:5, Insightful)
Why, of course he does. That's his job.
In other stories, water's wet, sky is blue and women have secrets. More news at 10!
Does he mean "desktop environment?" (Score:3, Interesting)
If so, isn't a huge advantage of using ANY *nix in production that you don't have to have the overhead of running a graphical desktop environment if you don't need to?
The question is (Score:3, Interesting)
If Firefox becomes the great white hope for secure browsing on the Internet and the other one where it incorporates calendaring into Thunderbird has as much success as Firefox is getting(can't remember the name for the life of me), could this in itself slow Linux adoption? Windows has improved stability-wise over the last couple of years by leaps and bounds and supposedly they are looking at making it more secure (but I am not holding my breath too much).
Just a thought.
Let the flames begin! (Score:3, Informative)
Now, on to the point. If someone comes out and says: "the default Linux kernel released by most distributions is not secure." I'll say 'hell yes'. Note that this is not what TFA states, it is a much broader screed against open source in general.
The problem is that if Microsoft wanted to launch a rational attack on Linux's security they would also be attacking their own products. I'm not even talking about the differences between open and closed source here, I'm talking about the ways that Linux and Windows both are susceptible to security issues. Right now most default Linux distributions put out kernels and user-space utilities in a system that assumes every piece of software has to be perfect to ensure security! (especially anything running as root) Windows is basically the same way. Once a hole gets found, it is easily possible to hijack and entire system.
Now, at this point the arguments between Linux and Windows invariably devolve along the lines of: Linux gives you the source code so you can find the bugs yourself or Windows runs too many services and that's why its not secure. On the windows side we get arguments about how you 'can't trust unsigned open-source code!' (which actually does have some merit if you don't check source signatures you grab from some random mirror, but does not really speak to the OSS development model). The problem is that these arguments are more about which system is easier to band-aid than which system is innately more secure.
Let's really look at default Linux vs. Windows. Both have admin and user accounts, both follow a similar model of discretionary access controls, both can be hacked remotely although windows tends to get hit more because it runs too many standardized services.
The point of this very long rant is that Linux does indeed have security problems that are not of a nature much different than Windows. I would say the better track record of Linux so far is NOT due to it being open-source; that does help finding bugs, but plenty of Windows bugs are found and fixed before the Windows boxes are hacked. Instead it's because Linux (with some exceptions) does not install a bunch of stuff by default, Linux systems are not as homogeneous as Windows systems (software monoculture time), and Linux admins have historically been better than Windows admins (this is definitely something that will be subject to change in the next few years).
So is there a solution? Well, nothing is ever going to be perfect, but systems like SELinux and GRSec are big improvements because instead of saying "the whole system is perfect" they instead say "components in this system will be compromised, how to we isolate and protect it?"
There's a problem though, these systems require old-time Linux users to deal with new restrictions they might not want to deal with. I promise you that SELinux policies that work great on a production webserver would drive you insane on a development box, but you need to protect both machines, a hacker will target both.
I'll save my rant on Microsoft's security for when this story gets duped, it's another mess entirely. Just MS is foobarred should not be an excuse for not looking to find and fix problems in Linux.
Who is accountable for the security of the Windows (Score:5, Insightful)
Er... and who is accountable for the Security for Windows?
Microsoft?
Internet-swiss-cheese-security-Exlorer Microsoft?
And will Microsoft take responsiblity for their security holes? Will they pay for the damages caused by crashes and exploits for their buggy software?
Maybe if they get their software quality up to a reasonable level they can START asking questions, but as long as they are as bad as now, they better keep their mouths shut, or they'll have to stuff their own feet in them.
Lack of what? (Score:5, Insightful)
This is a terrible article! (Score:3, Insightful)
Aside from the fact that there are no references to back up any of the claims that this McGrath fellow is making (I'd even settle for a research firm that was paid-off by Microsoft!), the 'author' of this article wrote a grand total of FIVE sentences. All five of those sentences paraphrase something else that McGrath says. The rest of the article simply quotes McGrath straight.
There's no discussion of the points, no consideration of other factors, and as far as I can tell, no fact-checking. There is simply no journalism happening here. I know I can simply move on, but it irritates me to know that some CIO out there (probably mine) will take this all in without a second-thought.
The shortcomings of the Windows OS are OBVIOUS to anyone who has to admin these systems in a real production environment, and even more apparent to those of us who have the pleasure of also running other [openbsd.org] systems [apple.com]. Just imagine what Windows might be like if they spent half of their propaganda budget on fixing the freaking software.
Microsoft Argument == Creationism (Score:5, Interesting)
As we all know, Open Source Software development is structurally similar to the scientific method and evolution in terms of how "new things" are created by the these systems. Similarly, what Microsoft is claiming is that software can't be created well "at random" through emergent means (we know that's a crock) but needs "the Hand of an intelligent Creator" to control everything (Microsoft == God, apparently). Ergo: Microsoft is claiming that only "Creationist Software" is good software - "Evolutionary Software" is evil software.
I think this could be useful angle of attack against Microsoft FUD: they are advocating creationism and faith-based solutions to computer science.
related articles (Score:3, Informative)
RELATED ARTICLES
* Microsoft to axe Windows 2000 security upgrades
* Microsoft enhances SQL 2005 security
* Viruses plague half of UK Windows users
* Linux fights off hackers
* Busy day for Linux administrators
* Industry giants offer Linux consumer boost
* Windows open to critical vulnerabilities
Heh, Heh. Yeah (Score:3, Funny)
I only have to wrap myself up in the warm and protective arms of a Microsoft EULA to feel the shielding umbrella of accountability.
McGrath slays me.
In business, this is a legitimate question (Score:5, Interesting)
In making a business decision, it's unlikely for anyone to take responsibility. The larger the business, the smaller the likelyhood. It's not an issue of cowardice; the risks simply don't outweigh the rewards.
So, the question "who do you blame" is a legitimate question. System fails, Clients sue company, company pays clients, insurance company pays company; insurance company sues vendor.
In business, those who take chances are the people who create the great successes and the great failures. These people exist. They are not the norm.
"Nobody ever got fired for buying IBM." The point is not that this is true. The point is that people say (or said) this. They're saying that if you're working for someone and you want to keep your job, you make the safe decision.
Who is accountable for Windows? (Score:5, Insightful)
And who, pray tell, is accountable for the thousands of holes that have left Windows users open to viruses, trojans, and other malicious uses of their hardware? Billions of dollars in money throw into the toilet fixing the results of nonexistant to pathetic securty in Windows, with an EULA that specifically absolves Microsoft of all blame if anything goes wrong using their software, and they have the gall to claim that they are accountable for Windows?
Should I be submitting my bills to Microsoft instead of my clients when their poorly designed, poorly implemented software causes them to need my services for hours on end, making them unable to do work, let alone pay my fees?
What about WinX? (Score:4, Funny)
new Microsoft user agreement? (Score:4, Funny)
I applaud Microsoft's recognition of the importance of accountability. I look forward to reading Microsoft's revised license agreement, in which Microsoft will presumably accept liability for consequential damages resulting from security flaws of Microsoft products.
Microsoft are you Accountable? (Score:5, Insightful)
And it automatically installed a spyware application. No YES/NO dialogues just installed it. After that I saw attempts at outbound port 6667 to various external servers.
Now I do manage servers that hold financial data, and servers with ERP software that run the company.
I ask you, Microsoft, can you be held accountable if our company melts down should malicious spyware enter the system with their authors intending to corrupt our backups and bring everything down?
Will you pay us the millions that we lose as we lose our customers?
Will you as a result of such a catastrophe give us an OS that does NOT allow such breaches of security?
I understand IE in Windows 2003 is more secured, and we should never browse for anything on the server itself... etc. However Windows2003 has not been matured enough to bring out the bugs while Windows2000 has issues even after SP4, and after Microsoft will cease to provide bugfixes for it.
We replaced our firewall with OpenBSD. We simple cannot find a reason to upgrade it from the 3.4 version, since the older version is so secure. Hell yeah we've had attacks of all kinds, to almost all ports, syn cookies even ddos type attacks that slowed the Internet connection, but we're still up, and without ever having an issue for over two years of OpenBSD operation.
Coming back to Linux, which is also a UNIX clone, and which has more eyeballs on it, and more companies taking responsibility for it, tell me, should I pay for a crappy OS with someone behind it you can point fingers to, or a nice OS with no person behind it simply because youll never have to point fingers?
responsibility (Score:4, Insightful)
If Microsoft is so concerned about responsibility for security flaws, why is it that they don't offer indemnification for users hurt by their software?
Mission Critical (Score:4, Informative)
In general, I agree with him on this (I have not RTFA yet). Nor is Windows, of course, but that's taken for granted. Of course, it depends how critical your mission is. "Mission-Critical" is one of these phrases which is bandied around, but let's consider what it means....
"The mission depends on this system".
That still does not define the extent to which the mission depends on it - 80%? 90%? 100%? Nobody offers 100% availability, if that's what you're referring to.
The phrase also ignores the mission involved. For NASA, the Mission might be to send a man to Mars and back, but what if my "mission" is to run a website which expects to get 3 hits a month with a 60% expectation of success? An Atari could cope with that - my mobile phone could probably cope with that!
Taking the phrase in the way it's normally meant (running systems which are responsible for a significant amount of the user's business, and the failure of which would cause significant disruption of the business process and/or profit), then the whole discussion still depends entirely on the "mission" involved.
What tradeoffs is the mission prepared to make for uptime, for example? Serving read-only webpages, I care little for data integrity (I've been serving the same data for years, I've got it on tape, CD, DVD, onsite and offsite), and only care about uptime.
If I'm running a database which is updated many times a minute, then uptime still matters to me, but I also need to know which transactions have been fully processed, and which have failed (given Failure Scenario N, which may or may not have been predictable). That is much more difficult.
Re:Is he serious (Score:3, Insightful)
It just sounds silly to those who know. But it does work in most cases...