Hmmm...okay....let assume that 2 low blow joe install an operating system.

1st low blow joe install "Windows XP" no SP1 or SP2 since he's a bloody newbie...also all the setting are on default.

2nd low joe blow install "Fedora 1 Linux" no patch....all setting on default. Meaning...Service are not up yet like MySQL, Apache, Sendmail, etc.

In this instance....the Linux will be hacked here is thru ssh script kiddie...and the only thing that this can be prevented is that he/she only disable this service...since he/she would be only interested in using his/her surfing his default web brower Mozilla.

While on the other hand Mr. Low Joe Blow which uses Windows XP and when finally he/she surfs the net he/she has only a window of 3-4 minutes to be infected by Sasser, RPC Vulnerabilities, MyDoom, etc without even knowing which and how this vulnerabilties will be disabled.

The solution to windows is to patch....while Linux can be patched or disabled. Also in Windows, the patched ones will be continued on patching other stuff since the patched that they issued affected the other stuff and become vulnerable too. Until finally you have to upgrade again another version of Windows.

I have a friend that maintain a web server....a newbie (noob) on Linux but does know how to developed a web page using Microsoft Frontpage. You won't believe that a senior admin linux set him up a Web Server Linux using RH 7.3 unpatched/not upgraded for almost 4 years and currently, he doesn't have a single problem and currently online.

I cry bullcrap!

An unpatched webserver running RH73 would be busted in a matter of minutes of when it became a target, and since there are many automated scanners for seveal of the many holes that would exist in such a server, that wouldn't take long.

I'll have to flag this story for the steaming pile of BS that it is ...

Ah...a crap ey....

Here is the site:

(ignore....move along....there nothing to see here...)

you can do a netcraft on this....its RH 7.3 Valhala I think.

Before you say crap...think before you say anything.

I'm really not trying to be inflamitory here, but just because *you* can't make windows do something doesn't mean it's not possible. It's pretty clear from your statements above that you've never met anyone who is really good with Windows.

Really though, most of the things you say about *both* systems really show an ignorance of operating systems in general, and are basically just "linux fanboy" talking points (which doesn't make them correct, btw).

Not that I in anyway condone running unpatch servers, but the honeynet project put out a white paper on data they collected and of all the RH systems they tested, ironically the unpatched RH7.3 system was the longest surviving system at over 9 months. Though to be fair, 3/4of the 7.3 boxes were hacked and there was clearly a correlation with the older the box, the more likely it was to be compromised. It's a good read and was surprising how long an unpatched box would last:

http://project.honeynet.org/papers/t...life-linux.pdf

On a related note if you look at the data, linux survivability has actually increased over the last 3 years in spite of the fact that it's user base has expanded, which would seem to refute the concept of the OP.

I had Windows XP sp1 at home, it have been working 2.5 years wuthout any virus or spyware (I have no antivirus, but firewall, correct settings and patch it (OS) often)

>> I don't really care all that much to tell you the truth.

Good. I don't care that you don't.

>> If you think windows is more secure than use it.

At what point did I say anything about using windows myself? I'm a *NIX old timer.

>> I used it for years all the spyware, viruses, and that fact that
>> simple browsing has a devistating effect. That shouldn't be
>> so. I've been is linux for three years now and never had a
>> penetration of my box. Not one. So I'll let my personal
>> experience with the two be the judge.

That wouldn't be so if you didn't run your windows computer as administrator all the time. You don't run your Linux computer as root all the time do you? Why not? The same thing applies to any OS out there.

>> By the way what facts did I say that weren't true. I know
>> there was some opinion in there but the fact are true.

You obviously have a problem with the difference between fact and opinion ...

>> About the complicated registry,

Opinion (Even though I share the same opinion, it doesn't make it a fact)

>> service's that can't be terminated,

The number of the services that actually need to run on a single "home user's" machine is very small, and most of them *can* be disabled ...

Even if they couldn't though -- There obviously are services that can't be killed on a *NIX machine too ... Try killing off all your getty processes sometime. Or how about init. Or even (g|x|k)dm ... Gasp! The ?dm family even open network sockets!

>> things listening on open tcp and udp ports,

See above

>> 3 user accounts that you don't control, etc.

Ever cracked open /etc/passwd? There are *plenty* of system accounts on *NIX machines... Watch your cron logs. There are *plenty* of things going on under the hood of a *NIX machine that you don't see unless you go looking. Winders in no different. You can find out what all the things running on your host are for and what they do if you just know where to look (or who to ask).

>> all true.

I guess, if you hold your head just right...

This thread is quickly turning into the same tired discussion that threads like this always turn into which is basically "Linux vs Windows" ... It's been argued to death. Who cares?

That's just because the source code for the OS is available in your town library

j/k

Although I can't really speak for another user, I do not believe that sigsegv thinks Windows is all that secure. I think he was just reacting to a story which is the epitome of what not to do. It is not smart, or wise, to run an unpatched system that is four years old. Sigsegv was reacting to this in the same manner that we would cry bulls**t if a Windows user were to say their Win98 box never crashed or had a virus when they browsed all sorts of websites and never patched it or ran a virus check since they got it.

Just because his gut reaction was "against" Linux does not mean he is a Windows nut. It would be my same reaction to the story... an older box (which has never been hardened or patched) is just asking for trouble.

If I am wrong in my judgement of what sigsegv meant, I am sure he'll let us know.

I think we'd both agree that an anonymous host like the honeynet put together just hanging out in "cyberland" is a bit different than a "known" server (even a low traffic one).

I should hope so ... The older distros were absolutely hideous from a "secure by default" standpoint.

I'm spending too much time on here ... frob23 is starting to see the methods in my madness, and coming to know my mannerisms.

Hiya frob23