Security isn't all about the system it is about the people that administer it. And Linux is easier to customize and you can get more help for people by simply going to foruns and googling. That is the big advantage. Although it is also possible to have a secure Windows. I saw one in which every program had its own run as user and permissions set across the whole filesystem like any linux box, but I would bet the effort was far greater.

Windows got a bad fame mostly because of their early releases. Which were very, very bad. Now they are improving and have come a long way, but still they get some pretty bad mistakes, and every single one seems to fatal. Like all those RPC problems. I just can't forget the getadmin and other stuff which still works if slightly modified.

For example the big patch for winnuke that send a OOB packet was to filter the string in the widely distributed script, which of course allowed everyone else that had made their own script to keep nuking people. And I have the slight impression there are many more examples, as people don't feel any pleasure in losing their own exploits by informing Microsoft of it.

So my point is that Windows is an "as is product", easy to use and all that. Linux is what you want it to be. I use both. Windows for the user, linux for anything that has to be up and running.

Here is something to think about as well. Most Linux disto's try to be everything for everybody with their default installs. They include hundreds of applications webserver, file server, dns, mail etc. I only install what I need for the server to work and most advisories don't effect me. There is also the possibility to customize Linux for your security needs with tools like SELinux, grsecurity, openwall chroot etc... You can make linux as secure as you want, something that isn't possible with windows. It is secure by default by most standards but you can make it insanely secure if you want.

Yes, we can make a Linux system as secure as we want.

But the procedure with which you make it so secure it known to every, as we can download the whole code. Maybe, since hacking a linux based system isn't all about installing a hack-tool.exe as in windows, not everyone will be able to hack into a linux system.

After reading all the replies I feel that hacking a linux based system is difficult becasue not everyone understands the codes and the intricacies involved in it.

But if we have two systems, and hacking them is the prime target, then the one with open-source OS can be hacked easily as compared to MS windows.

But the procedure with which you make it so secure it known to every, as we can download the whole code.
This is also true of other open source projects including openBSD which is arguably on the most secure operating systems available. IMO the security of an operating system is strongly correlated with how much of a priority it is to that project. If it is a major focus, then the code and configurations are heavily reviewed and audited, whereas if it is less of a priority then there is a greater likelihood that bugs will make it through to the final release version. In theory, having an open source code allows anyone to review your code, so more reviewers == better likelihood that you'll catch bugs. With a closed source operating system, you are inherently trusting that organization to make sure that code is properly audited and tested. For years MS made the focus of their project integration and usability and they did a really excellent job at that, unfortunately it was often at the expense of security (those fundamental principles often compete). In recent years they've tried to make it more of a priority, but things like there failure to release a timely fix for the iframe vuln don't do much to make me feel otherwise.

After reading alal the replies I feel that hacking a linux based system is difficult becasue not everyone understands the codes and the intricacies involved in it.
If that was true though, then closed source operating systems should be even harder to attack because there is no code available and it's inner "machinations" are not well documented.

But if we have two systems, and hacking them is the prime target, then the one with open-source OS can be hacked easily as compared to MS windows.
So according to your theory openBSD should be more easy to hack MS Windows.

Hi, all

it was nice discussion that i come across

Thnx 2 all of u guys.

this http://www.securityfocus.com/ link also looks interesting

Frankly I don't have much idea about openBSD.

My point is only that, with source code avaiable, one might know as to how the security is actually provided and might hack into a system. The manner in which the highest security is provided by an admin in Linux is avaiable in the internet, but the manner in which how security is provided for MS-windows is not (or is that what I am assuming...)

Under these conditions, it appears to me that it will be easy to hack into a linux system.

PS: I myself am not a computers engineer to know much about how security is provided, or how one hacks. Maybe I need to read more about security before I can think at a higher level...

My understanding of the basic principles behind open-source security is that, for every bad guy looking at the source code of a particular server, firewall, or other network program trying to find exploitable vulnerability, there are 10 good guys with a better understanding & working knowledge of the code also discovering those vulnerabilities, fixing them, and using a system (like cvs or update-rpms' mirrors) to distribute them to users quickly. Also, I cannot believe that hacking into a properly configged linux box is as easy as shown in matrix reloaded, with nmap and some fictitious "sshnuke". Surely if one writes his netfilter rules carefully, runs servers that ae known to be secure, regularly updates his packages (using cron jobs if need be), monitors his logs and, if necessary, installs and updates some sort of network monitoring or intrusion detection system that he understands and knows how to config properly, then there should be no problems (to a reasonable probability, of course, nothing's 100% foolproof). That's why, I believe that the best way to security is to read documentation, & open source stuff has plenty of it.

Hi ashesh


its not the source code.. which can reveal the secrets..

the algorithms which are used for encryption should be more complex.. (i guess they r)



everybody knows all the standard encryption algorithms..

i say u one thing abt some MD5 algorithm, its just one way.. u cant guess at all.
suppose i have a db server and i do MD5 Hashing to ur password and store it in database,
and i tell u which algorithm or program i used for generating it, (but hey i wont give u the original input password ok :-) ) but still u wont be able to guess the password.
u may do trial and error method which doesnt come for that perview of encryption algorithm
unless and until u know the orignal password u wont be able to application because of this mechanisms.,..


you go through any data encryption related (cryptography) book. and all ur doubts ll be clear.
there is no meaning for the source code here.

all ur doubts ll be cleared then.
but till then u ll have this doubts in mind..

i got some work to finish else i could hv spend some time more here.


sorry

Frankly I don't have much idea about openBSD.
Well, their motto is "Only one remote hole in the default install, in more than 8 years." I think it's pretty clear that Microsoft cannot make the same claim. Note here that Linux cannot either, and even among the various Linux distros the number of vulnerabilities can widely vary even though they originate from the same code base (some projects make security more of a priority than others). So it's pretty clear that there is little correlation between whether a project is open source and the number of security vulnerabilities (I'd actually argue that there is a correlation but that it's slightly inverse/negative).

My point is only that, with source code available, one might know as to how the security is actually provided and might hack into a system....Under these conditions, it appears to me that it will be easy to hack into a linux system.
You are making one big assumption here, that both operating systems have the same number of bugs in them. The point of having an open source code is that you have many more people reviewing your code and should (in theory) be identifying and patching many more bugs before they are put into a release version or can be exploited. So while any hacker can download the source, there should be fewer bugs and any that are in the code should be harder to find (not because it's too hard to analyze source code, but because all the obvious bugs should be caught early).

PS: I myself am not a computers engineer to know much about how security is provided, or how one hacks. Maybe I need to read more about security before I can think at a higher level...
Clearly the real-world observations about the security of each OS would seem to contradict your theory about open source being less secure. So I think it needs some work, and I would be careful listening to zealots on any side (whether or not they are university professors in the US), but instead look at the facts and make an unbiased decision for yourself.

Yeah! I was so unworried about using open source OS until I had to convince some others friends into using Linux about a week ago when "is open source secure enough" issue came up.

I always read that open source is secure and beleived it! Afterall, I never had my Linux system rebooted due to some new virus for which I have not installed a patch.

Each time I format my windows, it takes atleast 2-3 hours to get the system ready for use.. what with the patches, service packs, and I have to install office software, acrobat reader, plotting software etc. And on top of that I have to reboot each software that is installed... But with linux, it has always been a one time process and that too in about 30-40 mins. And the best part is so many different flavors are avaiable for FREE!

I like Linux and am going to enjoy using it. So I better stop trying to convince others that Linux is more secure.

so to sum this thread up....

the licence the software is released on is irrelivent to security.

Open Source....
Linux is quite secure
Free/OpenBSD is insanely secure.

Closed Source....
Windows is a laughing stock
Solaris is Very Secure.

yeah i know recently solaris was made open source, but lets pretend its still last month or whatever.

Its been a while since i did statistics in college.... BUT, i seem to remember that any data that deviates by more than 2 x standard deviation from the normal / average / median / whatever is an outliar, and should be ignored when drawing a conclusion.

ive done no such statistics, but after microsoft software along with "i love you" "melissa" and "ms-blast" terrorised the internet on many many occasions, im willing to bet MS is well into outliar teritory.

oops... been spelling it wrong.. its an outlyer is it ? fek knows anyone ?

anyways as i was saying... eliminate the one off crazyness (ms windows) and Open source and closed source is quite secure... with possibly a slight positive correlation showing open to be sligtlh more secure.

and before i get ripped into.... yes i know... ive not collected any data, and i know blah blah some famous dead statistican spinning in grave, blah blah blah.

One quick note on the cracker changing the code and you using it. There are a few fix actions/work arounds in place. Most distros have "Official Mirrors" as well as the distros official download site, and all tend to use Md5sum checking to help you ensure that what you are downloading is the real deal. HOWEVER that is not to say a cracker couldn't '0wn3' one of the mirror servers/official download site and change the Md5sums for everything to match their own evil version.
But to hit on that topic I've never heard of a mirror or parent server getting '0wn3d'