Linked by Thom Holwerda on Tue 10th Nov 2009 09:31 UTC
Windows Last week, security vendor Sophos published a blog post in which it said that Windows 7 was vulnerable to 8 our of 10 of the most common viruses. Microsoft has responded to these test results, which are a classic case of "scare 'm and they'll fall in line".
Permalink for comment 393944
To read all comments associated with this story, please click here.
RE[6]: They deserve it
by lemur2 on Wed 11th Nov 2009 01:57 UTC in reply to "RE[5]: They deserve it"
Member since:

"Firstly, Linux has significant market share in areas where it is an attractive target ... servers for example.
Sigh. Linux server != Linux desktop. Servers are locked-down far more than desktops. You can't extrapolate one from the other. Apples and oranges. Once you start opening up ports to run things like BitTorrent, web browsers, etc, the attack vectors become multiplicative. "

Nevertheless, the argument that "Linux is not an attractive target" is utterly debunked by the number of Linux servers.

"Secondly, in Linux the "paradigm" for installing new software is not to download & run stuff from some random website, but rather to use a package manager.
Um, that works fine if you only run open source software, but there are MANY cases where no open source application exists for what you want to do. So, what does a user do? Fail? I don't think so. "

No, you just don't think.

The package managers and repositories do not require that applications they contain be open source. There are binary-only repositories which allow for distribution of closed-source applications via package managers.

Being closed source means that such applications are not auditable, but that does not mean they necessarily contain malware. They can still benefit from the secure delivery channel to end-users systems offered by package managers.

As an example, Adobe's flash player for Ubuntu is deliverd by package managers. Ubuntu has a "third party repository" to provide for just this kind of distribution.*~...
"The "Third-Party Software" tab is where you will be able to add the Canonical Partner Repositories. You will see two Canonical Partner repositories listed - one for applications and another for source code (src). The partner repositories offer access to proprietary and closed-source software and are not enabled by default. Users must specifically enable these 'partner' repositories. Select "Close" and "Reload" to save and update the database if you chose to add either or both of them."

"I have never heard of a single case, ever, of an end-user's system being compromised with malware through installing software using a package manager.
So what. There have been cases where repositories have been compromised. Only dumb luck prevented you from getting screwed by a malicious attack. "

This is an incident where a GNU server was hacked. Broken in to. No system is invulnerable to a hack where a password is either guessed or illegally obtained. No malicious code was injected on to the server. No end users systems were compromised.

"Amongst many millions of Linux users, there has got to be the odd stupid one here and there you would think.
Millions? Talk about overly optimistic... "

"Eric Lai quotes ABI analyst Jeff Orr as saying that the study shows that 32 percent (about 11 million netbooks) of this year's netbook shipments will be used with a Linux-based operating system. "

There is 11 million desktop Linux systems right there, in one small section of the market, in just one year.

The fact that for thousands of packages, for many, many millions of users, over many years, the one incident that you came up with resulted in no end-users systems being compromised rather proves the point, doesn't it, about the relative security of Linux desktop software distribution compared to Windows?

Thankyou for illustrating it so nicely.

Edited 2009-11-11 02:05 UTC

Reply Parent Score: 1