Nice article! Thanks for sharing.

I'm glad you liked it. I liked it too.

I think the criticism the author made of Ubuntu made a lot of sense, and I say that as an Ubuntu user. In any case, the whole security vs. popularity issue is one which I run into IRL discussions quite often, and the article seemed (to me at least) to provide some fresh, interesting perspective.

Hi,

As you pointed out, it does provide an interesting perspective on several issues. If you think about it, in a logical way that is, then the 'bigger' Ubuntu becomes the more attention it might draw. And the more attention drawn to it, in a bad way, the more security holes will be found and exploited until fixed.

Thank God the whole open source community is behind Linux and that it doesn't depend on a 'limited' number of developers to solve the issues. Imagine what would happen if we only got security patches once a month like with 'the other OS'

Kind regards,

Eric

I really liked the points he made regarding the security ramifications of Ubuntu's increasing user base, not so much from the "bigger target" perspective (which I believe is more complicated than what it seems), but rather from the challenges which are introduced into the development cycle:

Yes, very interesting article, it really makes you think. Thank you for sharing!

One of the first things that came to my mind was Canonical's, what I would call a religious devotion, to a 6 month development cycle. I too am an Ubuntu user and have been so since about the release of Gutsy Gibbon a few years back. Since that time there have been 6 major releases, the latest of which appears to be a significant overhaul of the core application. While I am pleased that this has brought a massive increase in hardware compatibility and the vast majority of the system "just works" I can't help but wonder if this trend isn't towards the distributions detriment.

It seems that Ubuntu could very well become the product that brings Linux to the masses, especially in regards to ease of use and ease of installation. I myself have even considered recommending it over Windows to some less than computer literate relatives, largely because of the reduced propensity for malware and viruses and with the latest release think it has reached the point of being easy enough for them to use.

This brings me to another point that the article has made me wonder. What degree does the end user play in the level of security of the OS? Because the OS makes it easier to do something stupid, does it mean that the OS is less secure? Similarly, does having a large, potentially inexperienced user base, create security vulnerabilities for other, more sophisticated users such as those running server type applications?

In the last year or so, I have noticed a dramatic increase in the amount of interest in running ones own server, especially email, file sharing, and web servers. So far there seems to be a high degree of 'tolerance' towards this both from the community and from the ISP perspective. Clearly if one is going to run a server, one has the responsibility to secure it. What is the future of this trend and what does it mean for in terms of 'security' for everyone?

1 members found this post helpful.

FWIW, I too share concerns over their release schedule. Generally speaking, I think it does more harm than good (I'm a big fan of the alternative "it's ready when it's ready" approach taken by other distros). That said, I'm looking at it purely from a security and QA point of view, while Canonical surely must consider other factors that I'm not aware of.

IMHO, the user is key. He/she is almost always the weakest link in the security chain, and the greater the damage that the system (the information system as a whole, not just the OS) allows him/her to do by means of "something stupid", the greater the vulnerability. An understanding on the user's behalf of what constitutes risky behavior can curtail a significant chunk of the threat (as long as he/she is able and willing to cooperate), while mitigating the vulnerability will require addressing the underlying problem. Needless to say, an educated user will have no positive effect on the threat he/she poses with regards to intentional attacks.

I think it increases the threat, but not the vulnerability. That is, assuming you're referring to the Internet in general. If you're referring to the risk levels of a specific system only, OTOH, then I would say that the training/experience of the user base should indeed be factored in when assessing vulnerability. Social engineering attacks come to mind as one of many fitting examples.