Linked by Thom Holwerda on Tue 10th Nov 2009 09:31 UTC
Windows Last week, security vendor Sophos published a blog post in which it said that Windows 7 was vulnerable to 8 our of 10 of the most common viruses. Microsoft has responded to these test results, which are a classic case of "scare 'm and they'll fall in line".
Thread beginning with comment 393950
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[7]: They deserve it
by tomcat on Wed 11th Nov 2009 03:51 UTC in reply to "RE[6]: They deserve it"
tomcat
Member since:
2006-01-06

Nevertheless, the argument that "Linux is not an attractive target" is utterly debunked by the number of Linux servers.


BS. Those servers are running a paltry number of services and are locked-down tighter than a nun's thighs. Those kinds of environments aren't as attractive as desktops because the cost of finding and exploiting a vulnerability is considerably more difficult.

Being closed source means that such applications are not auditable, but that does not mean they necessarily contain malware. They can still benefit from the secure delivery channel to end-users systems offered by package managers.


Again, it provides no independent means of auditing, which debunks your claim about package managers being safer. They're merely another distribution channel.

This is an incident where a GNU server was hacked. Broken in to. No system is invulnerable to a hack where a password is either guessed or illegally obtained. No malicious code was injected on to the server. No end users systems were compromised.


So much for your "secure" claim.

There is 11 million desktop Linux systems right there, in one small section of the market, in just one year.


And, naturally, ABI doesn't offer any details to back up its claims on what MIGHT happen in the future.

Reply Parent Score: 2

RE[8]: They deserve it
by lemur2 on Wed 11th Nov 2009 04:18 in reply to "RE[7]: They deserve it"
lemur2 Member since:
2007-02-17

"Nevertheless, the argument that "Linux is not an attractive target" is utterly debunked by the number of Linux servers.
BS. Those servers are running a paltry number of services and are locked-down tighter than a nun's thighs. Those kinds of environments aren't as attractive as desktops because the cost of finding and exploiting a vulnerability is considerably more difficult. "

Sigh! This depends ENTIRELY on what you mean by "attractive". For your meaning above, you are correct, but that is not what was meant by "attractive" in the original context of the argument.

In its original context, which was "Linux systems aren't attractive targets for malware" ... the word "attractive" actually means what might be gained by the balckhats by getting their malware onto the target systems. In that context, servers are a lot more attractive than desktops, as they generally hold a lot more valuable information.

"Being closed source means that such applications are not auditable, but that does not mean they necessarily contain malware. They can still benefit from the secure delivery channel to end-users systems offered by package managers.
Again, it provides no independent means of auditing, which debunks your claim about package managers being safer. They're merely another distribution channel. "

When you add closed-source repositories, yes, you kind-of have a point (I have made another post about this). They are indeed then merely another distribution channel ... a safer-than-anything-on-Windows distribution channel with an impeccable record to date.

"This is an incident where a GNU server was hacked. Broken in to. No system is invulnerable to a hack where a password is either guessed or illegally obtained. No malicious code was injected on to the server. No end users systems were compromised.
So much for your "secure" claim. "

How so? Elaborate please?

PS: No system is invulnerable to hacking via knowing the password. None at all.

However, if any attempt was made to put a malware binary onto a GNU repository server: it would show up in the server logs; it would be auditable that it had happend by comparison to source; and there would have been an enormous hoo-ha made over it.

Once again, the reality about repositories and package managers is ... impeccable record. Impeccable.

"There is 11 million desktop Linux systems right there, in one small section of the market, in just one year.
And, naturally, ABI doesn't offer any details to back up its claims on what MIGHT happen in the future. "

So? ABI's predictions for the future are based on what they measure in the real world today.

BTW: Dell says that it sells one third of netbooks with Linux:

http://blog.laptopmag.com/one-third-of-dell-inspiron-mini-9s-sold-r...

Edited 2009-11-11 04:26 UTC

Reply Parent Score: 2

RE[9]: They deserve it
by tomcat on Wed 11th Nov 2009 04:30 in reply to "RE[8]: They deserve it"
tomcat Member since:
2006-01-06

In its original context, which was "Linux systems aren't attractive targets for malware" ... the word "attractive" actually means what might be gained by the balckhats by getting their malware onto the target systems. In that context, servers are a lot more attractive than desktops, as they generally hold a lot more valuable information.


That is so NOT true. Desktops are far more attractive targets for malware now because (a) they're more readily exploitable, (b) blackhats can create and sell bot-nets composed of exploited desktop machines to spammers for a ton of cash, (c) desktops generally don't keep network logs (which makes covering their tracks easier). That said, if you can find a zero-day exploit in something like SSH or SSL or a popular network daemon running on a server, that's VERY attractive. But since it's so difficult to achieve, desktops are even more attractive, based on technical difficulty.

When you add closed-source repositories, yes, you kind-of have a point (I have made another post about this). They are indeed then merely another distribution channel ... a safer-than-anything-on-Windows distribution channel with an impeccable record to date.


But, again, this doesn't provide me (as a user) any reassurance that the closed-source software doesn't have a timebomb or, worse, some kind of exploitable problem.

How so? Elaborate please?


It's simple: Stop pretending that repositories are magical and "secure"; hence, packages aren't any more secure.

So? ABI's predictions for the future are based on what they measure in the real world today.


Show me numbers. For all we know, these numbers could have been cooked for a boutique customer. You guys should be familiar with this line of reasoning: You claim this about IDC and other "research" firms all the time regarding Microsoft and anyone else you oppose.

Dell says that it sells one third of netbooks with Linux


Right. Less than 5% of netbooks in the US. Nice.

Reply Parent Score: 2

RE[9]: They deserve it
by cb_osn on Wed 11th Nov 2009 05:07 in reply to "RE[8]: They deserve it"
cb_osn Member since:
2006-02-26

Once again, the reality about repositories and package managers is ... impeccable record. Impeccable.

Linux distributions tend to take a very proactive approach to security and they provide a safe environment as long as you follow the rules. But so does Windows. The difference is that the majority of Linux users tend to be technically competent while the inverse is true for Windows users. Linux users follow the rules, or at least, have enough knowledge to know how to break them properly.

These days, the security problem is a social one-- not a technical one. Take the ~90% share of Windows users and dump them all on Linux tomorrow and you'll see the same problems emerge in that environment. A good majority of these people will run any binary, click any button, enter any password, and happily copy/paste chmod +x whatever; ./whatever into a terminal if that's what it takes to make something happen.

From a technical point of view, the major operating systems are all practically equivalent when it comes to security. None of Linux, Windows or OS X are attractive targets. The user is the attractive target. The user is the attack vector.

Arguing anything else at this point indicates either intent to deceive or a severe lack of understanding.

Reply Parent Score: 2