Linked by Thom Holwerda on Tue 10th Nov 2009 09:31 UTC
Windows Last week, security vendor Sophos published a blog post in which it said that Windows 7 was vulnerable to 8 our of 10 of the most common viruses. Microsoft has responded to these test results, which are a classic case of "scare 'm and they'll fall in line".
Thread beginning with comment 393942
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[5]: They deserve it
by tomcat on Wed 11th Nov 2009 01:34 UTC in reply to "RE[4]: They deserve it"
tomcat
Member since:
2006-01-06

Firstly, Linux has significant market share in areas where it is an attractive target ... servers for example.


Sigh. Linux server != Linux desktop. Servers are locked-down far more than desktops. You can't extrapolate one from the other. Apples and oranges. Once you start opening up ports to run things like BitTorrent, web browsers, etc, the attack vectors become multiplicative.

Secondly, in Linux the "paradigm" for installing new software is not to download & run stuff from some random website, but rather to use a package manager.


Um, that works fine if you only run open source software, but there are MANY cases where no open source application exists for what you want to do. So, what does a user do? Fail? I don't think so.

I have never heard of a single case, ever, of an end-user's system being compromised with malware through installing software using a package manager.


So what. There have been cases where repositories have been compromised. Only dumb luck prevented you from getting screwed by a malicious attack.

http://www.eweek.com/c/a/Security/Security-Web-Digest-Major-Open-So...

Amongst many millions of Linux users, there has got to be the odd stupid one here and there you would think.


Millions? Talk about overly optimistic...

Edited 2009-11-11 01:36 UTC

Reply Parent Score: 2

RE[6]: They deserve it
by lemur2 on Wed 11th Nov 2009 01:57 in reply to "RE[5]: They deserve it"
lemur2 Member since:
2007-02-17

"Firstly, Linux has significant market share in areas where it is an attractive target ... servers for example.
Sigh. Linux server != Linux desktop. Servers are locked-down far more than desktops. You can't extrapolate one from the other. Apples and oranges. Once you start opening up ports to run things like BitTorrent, web browsers, etc, the attack vectors become multiplicative. "

Nevertheless, the argument that "Linux is not an attractive target" is utterly debunked by the number of Linux servers.

"Secondly, in Linux the "paradigm" for installing new software is not to download & run stuff from some random website, but rather to use a package manager.
Um, that works fine if you only run open source software, but there are MANY cases where no open source application exists for what you want to do. So, what does a user do? Fail? I don't think so. "

No, you just don't think.

The package managers and repositories do not require that applications they contain be open source. There are binary-only repositories which allow for distribution of closed-source applications via package managers.

Being closed source means that such applications are not auditable, but that does not mean they necessarily contain malware. They can still benefit from the secure delivery channel to end-users systems offered by package managers.

As an example, Adobe's flash player for Ubuntu is deliverd by package managers. Ubuntu has a "third party repository" to provide for just this kind of distribution.

https://help.ubuntu.com/community/Repositories/Ubuntu#Third-Party~*~...
"The "Third-Party Software" tab is where you will be able to add the Canonical Partner Repositories. You will see two Canonical Partner repositories listed - one for applications and another for source code (src). The partner repositories offer access to proprietary and closed-source software and are not enabled by default. Users must specifically enable these 'partner' repositories. Select "Close" and "Reload" to save and update the database if you chose to add either or both of them."

"I have never heard of a single case, ever, of an end-user's system being compromised with malware through installing software using a package manager.
So what. There have been cases where repositories have been compromised. Only dumb luck prevented you from getting screwed by a malicious attack. http://www.eweek.com/c/a/Security/Security-Web-Digest-Major-Open-So... "

This is an incident where a GNU server was hacked. Broken in to. No system is invulnerable to a hack where a password is either guessed or illegally obtained. No malicious code was injected on to the server. No end users systems were compromised.

"Amongst many millions of Linux users, there has got to be the odd stupid one here and there you would think.
Millions? Talk about overly optimistic... "

Pfft.

http://www.desktoplinux.com/news/NS5114054156.html
"Eric Lai quotes ABI analyst Jeff Orr as saying that the study shows that 32 percent (about 11 million netbooks) of this year's netbook shipments will be used with a Linux-based operating system. "

There is 11 million desktop Linux systems right there, in one small section of the market, in just one year.

The fact that for thousands of packages, for many, many millions of users, over many years, the one incident that you came up with resulted in no end-users systems being compromised rather proves the point, doesn't it, about the relative security of Linux desktop software distribution compared to Windows?

Thankyou for illustrating it so nicely.

Edited 2009-11-11 02:05 UTC

Reply Parent Score: 1

RE[7]: They deserve it
by tomcat on Wed 11th Nov 2009 03:51 in reply to "RE[6]: They deserve it"
tomcat Member since:
2006-01-06

Nevertheless, the argument that "Linux is not an attractive target" is utterly debunked by the number of Linux servers.


BS. Those servers are running a paltry number of services and are locked-down tighter than a nun's thighs. Those kinds of environments aren't as attractive as desktops because the cost of finding and exploiting a vulnerability is considerably more difficult.

Being closed source means that such applications are not auditable, but that does not mean they necessarily contain malware. They can still benefit from the secure delivery channel to end-users systems offered by package managers.


Again, it provides no independent means of auditing, which debunks your claim about package managers being safer. They're merely another distribution channel.

This is an incident where a GNU server was hacked. Broken in to. No system is invulnerable to a hack where a password is either guessed or illegally obtained. No malicious code was injected on to the server. No end users systems were compromised.


So much for your "secure" claim.

There is 11 million desktop Linux systems right there, in one small section of the market, in just one year.


And, naturally, ABI doesn't offer any details to back up its claims on what MIGHT happen in the future.

Reply Parent Score: 2

RE[6]: They deserve it
by lemur2 on Wed 11th Nov 2009 02:24 in reply to "RE[5]: They deserve it"
lemur2 Member since:
2007-02-17

there are MANY cases where no open source application exists for what you want to do.


Just on this ... this is also an oft-touted claim, but it has no credibility without justification.

Games is one area where this perhaps has some semblance of validity, but if you want to play games why not just buy a games console?

As for other, real-world actual desktop applications ... I'd like to hear of one with wide adoption (say over 80% of desktop users would run applications of that kind) where one couldn't get good software for Linux to achieve that end.

I'm talking email clients, browsers, Office suites, editors, collection managers etc, etc ... exactly what kind of software do you imagine one can't you get for Linux?

Edited 2009-11-11 02:27 UTC

Reply Parent Score: 2

RE[7]: They deserve it
by cb_osn on Wed 11th Nov 2009 03:54 in reply to "RE[6]: They deserve it"
cb_osn Member since:
2006-02-26

Games is one area where this perhaps has some semblance of validity, but if you want to play games why not just buy a games console?

Way off topic, but this is rather ironic coming from you considering that one of the main advantages to PC gaming is that developers often release tools/SDKs that allow you to modify their games and share your work with others. Whereas consoles are about as locked down and DRM ridden as you can get.

I've seen this line of reasoning often enough to learn that supporting DRM and impenetrable devices, particularly for gaming, is just fine for some in the Free Software crowd as long as it serves to devalue one of the true advantages that Windows has over Linux.

Reply Parent Score: 2

RE[7]: They deserve it
by tomcat on Wed 11th Nov 2009 04:09 in reply to "RE[6]: They deserve it"
tomcat Member since:
2006-01-06

Just on this ... this is also an oft-touted claim, but it has no credibility without justification.


Well, allow me to retort...

Games is one area where this perhaps has some semblance of validity, but if you want to play games why not just buy a games console?


Ah, yes. That old familiar kneejerk response from a Linux fanboy upon discovering Use-Cases that they can't handle: Criticize the user. Nice. How's that working for you? Converting lots of "dumb, ignorant users" with that approach?

As for other, real-world actual desktop applications ... I'd like to hear of one with wide adoption (say over 80% of desktop users would run applications of that kind) where one couldn't get good
software for Linux to achieve that end.


Um, sorry, but you don't get to narrow the scenarios to some arbitrary percentage of users in order to deflect the damage. Users have all kinds of different needs -- and in fact, needs that are already being met by OS X and Windows -- so you're going to have to try harder to pretend all they need is a web browser and an Office suite.

I'm talking email clients, browsers, Office suites, editors, collection managers etc, etc ... exactly what kind of software do you imagine one can't you get for Linux?


Mac/Windows............Linux
Photoshop.................GIMP (crap)
Quicken.....................Zilch
Autocad.....................Zilch
PageMaker.................Zilch
Visio........................Zilch
Access......................Zilch
AfterEffects................Zilch
3DStudio MAX...............Zilch
A zillion vertical apps...Zilch

Edited 2009-11-11 04:19 UTC

Reply Parent Score: 3

RE[7]: They deserve it
by vaughancoveny on Wed 11th Nov 2009 11:00 in reply to "RE[6]: They deserve it"
vaughancoveny Member since:
2007-12-26

As for other, real-world actual desktop applications ... I'd like to hear of one with wide adoption (say over 80% of desktop users would run applications of that kind) where one couldn't get good software for Linux to achieve that end.


This is quite unfair because many of those applications exist already. What u say following this quote is unattributable to tangible uses.

I would like to see back-of-book Indexing
software for Linux.
Macrex runs on another Unix, but is really for geeks, not Indexers. Cindex is the best, runs on Windows, uses a database creation layout.
There are many Open Source books.

This software is not for geeks, there are Indexing courses around the world; cheapest in United States.

Edited 2009-11-11 11:11 UTC

Reply Parent Score: 1