Linked by David Adams on Mon 6th Oct 2003 19:34 UTC
Bugs & Viruses It's an oft-repeated maxim that one of the reasons that Windows operating systems are plagued by so many viruses, worms, and security exploits is because they are so popular. Extrapolating on this, many have remarked that if Linux, MacOS, or other OSes become more popular, they will attract the attention of virus writers. That may be true, but the increased attention will not necessarily yield the same quantity of viruses and other exploits, says a Register article. Update: Rebuttal article.
Permalink for comment
To read all comments associated with this story, please click here.
by Great Cthulhu on Tue 7th Oct 2003 04:44 UTC

Things like .scr files aren't actually executables in the same sense as .exe files. They are simply automatically passed on to appropriate handlers when "launched" from the shell.

Which, when you're a virus, amounts to pretty much the same thing.

Disassociate the handler from the file extension or change the file extension and the vulnerability disappears.

So you have to hack your system to make it more secure? Gee, that's one hell of a security model for Joe Sixpack and Grandma!

Meanwhile, in Linux (KMail at least), downloaded files cannot be executed straight from the mailer. The user has to make them executable first. Did you read the article?

An identical process happens under most other decent GUIs as well and is equally vulnerable.

Then again, there are a couple of decent GUIs, such as Gnome and KDE on *nix, where this process does not happen. Therefore, according to what you're saying, they are less vulnerable.

"Further, due to the strong separation between normal users and the privileged root user, our Linux user would have to be running as root to really do any damage to the system. He could damage his /home directory, but that's about it."

Whilst not factually incorrect, the underlying point is largely moot. Yes, a regular user can only damage their own files, however, this is being somewhat ignorant of the fact that on the typical system the user's files are the only ones they really care about. Not having any of your OS files touched while a virus merrily wipes out 30 gigs of MP3s and the thesis you've just spent 11 months writing is, at best, a pyrric victory.

Well one should expect that people who have important data on their hard drives keep CD-ROM backup of the most valuable stuff. I also regularly make backup of my files and settings in case my PC gets stolen.

The problem with the new wave of viruses is not so much losing one's files, though. In fact, what's the fun in destroying people's data - you won't even know about it. The main idea behind the nastier viruses of the last few years is to either turn Windows machines into DDoS zombies, or to slow down servers with self-replicating worms. Both of these endeavours - which are the real computer virus threats of the early 21st century, not losing your mp3s - usually require root or Administrative rights.

Administrator != root. Acquiring root privileges exposes a system much more than acquiring Administrator privileges. An Administrator *can't* do "anything he wants to the computer", a root user *can*.

Simply put, BS. Being an Administrator on a Windows system is practically the same as being root on a *nix system. Tell me what you can't do as an Administrator in Windows (well, except recompile your kernel, or course) that you can as root. Real important stuff, you know, something that would actually make your point relevant.

Using the system's HTML engine to render HTML in other applications *is* good design.

The problem is when the HTML engine has one of the worst security record and has been tightly integrated in the OS in order to shut out rival HTML engines. Or perhaps you weren't around when the whole Netscape/MS trial thing was going on?