The problem being your premise holds true if we rip the details that make it support your argument right out of your premise. If we instead say "A person who knows what s/he's doing on a machine can make it safer than one s/he's not familiar with." it becomes more obvious which is true and which is necessarily true. It doesn't really have anything to do with which OS they're running--it comes from the handicap of being unfamiliar with a platform.

FYI, RedHat, Mandriva, and SuSE all now have mechanisms by which updates can be automatically retrieved and installed. Probably Debian and a few others as well, but those are the four that stand out in my mind as having functionality equivalent to or exceeding "Windows Update" functionality. Linux is not lagging on this front but it appears that your knowledge of Linux might be. Heck, even stodgy old Slackware has two different projects that can do an automatic updates on a user's behalf.

I have to use Windows at the office, and I'm just not seeing that. Mozilla/Firefox updates itself, and the apps sold by Microsoft get updated through Windows Update, and that's about the extent of it.

If iptables is asking you to kick a cracker out of your system, then you have a serious problem because they're already in your system. The hundreds of "stray" UDP packets that are looking for trojans you don't have installed, and the hundreds of failed ssh connections genuinely don't warrant resulting in a message to your desktop asking you about them, or looking for a pat on the head.

I get the feeling you're trying to allude to ZoneAlarm here, and while ZA does do a reasonable job, the vast majority of the notifications it sends to a user are just a waste of time. Almost the only real purpose they serve is to make the user feel better about having spent $30 on it. Presenting a user with a dialog box to which only a complete lunatic would respond differently to isn't adding security--it's just coddling.

And let's be honest... Statistically speaking, no one does attacks manually anymore. Unless something's following a deny-by-default model, generally the only purpose a warning dialog to the user about whether or not to break a connection represents only one thing--a delay large enough for virtually any automated attack to have done it's dirty work, compromised the system, and have moved on to something else.

Okay, this paragraph has me thinking you're in the completely wrong area. This forum is about Linux security. Windows security doesn't exactly apply except as a poor comparison. Linux provides security tools for people who know what they're doing. Distributions also provide tools for people who don't know what they're doing, but generally, they just configure a default-deny policy. More importantly, since before 2000 nearly every Linux distribution out there has been setting up machines with a minimal number of services exposed to the network by default to begin with. This is a fundamentally more secure approach than SP2's firewalling, which came about much, much later. Services that aren't there don't need to be firewalled.

Linux's security is anything but illusory. ...and thanks to things like browsers that aren't correctly sandboxed, and mail user applications which have administrator rights (Outlook), someone who really, really wanted to almost could make Windows die tomorrow.

Do linux vendors hide vulnerabilities?

Do linux vendors wait a month before patching things?

Do linux vendors make their source available for anyone to audit and/or fix?

Do linux vendors file lawsuits against people who find bugs?

Do linux vendors properly give credit to people who find bugs?

Man, you must understand that the holes must have been there for the crackers to exploit them. Crackers don't create them. They don't even find them! They just take what some other security-conscious guy working at sysinternals.com found. The only thing that makes some sense in the popularity theory is that suddenly the new users of Linux approach it with a Windows mentality, which further proves my point that it all comes down to the security consciousness created by our use of some OS. What Microsoft does and has done is to create a full-featured system that they later patch to close holes. They never build with a security-minded approach from the ground up. This is what makes a difference between OS'es being more secure than others. Sadly, it's happening to Linux now when packs of new features that weren't carefully thought out. It's the case with the setuid() call. Check the manpage. This call drops privileges when a setuid program calls this function with the real ID of the user. Well, in Linux this call may fail if the new uid "brings process over it's NPROC rlimit". Meaning that all programs now must check if setuid() failed (which previously meant that the caller wasn't root, that is: with an effective UID of zero). I bring this example to prove my point that it is the mentality of untested featurism that may put holes on previously secure models. Linux is a new system that inherits the Unix model. It's not that Linux learnt from Windows mistakes. The two models are different.

The Windows security mentality implies only viruses as being malware. The truth is that "virus" is a marketing term that's used to name worms too. Unless users are taught what do they do and why they can do it, they will always be potential customers. Fortunately, most Linux still want the user to know better, so they learn a "new" model to know what "security" should mean to them. It won't be "evolution" if they skip this fact.

Actually, no. There are quite a number of people working on finding weaknesses in Windows on their own. You just don't hear about it because Microsoft almost never gives credit to these researchers. It's only to Microsoft's benefit that most of the guys skilled enough to do this actually "play ball" and typically won't release any exploit information to the general populace until after Microsoft has made a patch available. (It's a white hat thing.)

I'm relatively new to Linux but I have seen quite a few UNIX-like platforms and they are all more stable and safe than Windows. Ever wondered why? I believe there are two reasons for that:
1. UNIX is around for about 30 years or so. Security models have evolved all these years for these platforms and today they are stable and mature.
2. SECURITY IS A PROCESS NOT A STATE. If the admin is experienced then s/he will be looking all the time at the security lists and apply patches all the time. Now linux is open source which means people look at the code and find bugs ALL THE TIME but these are fixed immediately.

The real security risk is not on the kernel/base system but on the applications. Linux is not easily hacked but apache based Linux servers are defaced all the time.
To sum up Linux is evolving a lot faster than windows and that's what makes it more secure. Plus it is free which means it may not be always backwards compatible (see ipchains vs netfilter) but it also isn't stuck with some 1990's stupid ideas.
Finally have you ever wondered why experienced sysadmins pick up UNIX if they have the choice? Or what routes the packets that allows us to write are thoughts on this forum this very moment?

evilDagmar: did you even read that? I'm not saying Linux couldn't do auto-updates, but that Windows programs can; well actually the older ones might not, but it's your problem if you use such things. Every piece of "security software" I'm using has the ability to auto-update from the internet without user interaction.

Secondly, the iptables thing..oh man, you wrote a long story. If ZoneAlarm-like programs do bug you asking simple questions, keep in mind what was just said: security is not a state. I'd like to see your bullet-proof security configuration that keeps every threat away without ever interacting with you.

And then.
Hey, if the firewall (or some else program) would always 100% surely know what needs to be accepted and what not, we wouldn't need such apps since they'd be built-in. I like it more answering some questions than reconfiguring a huge script every time I need a small change for a moment.

Who said Linux is lagging? (and how do you define what knowledge is lagging and what's not; is it the years or decades?)

From LazyP: (good points, you had)
I'd see that a bit differently (just a bit, but still a bit); there are some 1990's stupid ideas still around in Linux (especially in it's applications).

Ah Security...
Windows is a black box. You don't know what's inside. If you trust Microsoft, you can feel secure. I don't and I wouldn't advise any business to trust it. I don't want to report anything to Microsoft and I don't want Microsoft to manage my data behind the door.
Openess is security. Linux belongs to you, you can see what it does to your data and that is what is making you or your business secure. You can encrypt your filesystem if you want, you can manage rights the way you want at any level, you can do anything you are free.
If there is a bug that may corrupt your data, you can fix it.
If there is a hole thta a hacker may exploit, you can fix it.

That's not the case of Windows. Don't trust Microsoft, don't store any confidential data in .doc format. Trust only yourself, that is the only way to be secure

Well, if you weren't saying that Linux can't do automatic updates, then you've fooled me and a lot of other people here. Why were you even bringing Windows up in the first place? This is a Linux Security forum.

I wrote a "long story" because information security is one of the things I do professionally, and I have a lot of knowledge and experience in this particular field. You were the one who brought up the subject of "how many times has iptables asked you whether or not you wish to kick a cracker out of your system?" Did you have a point to asking that?

As to my particular security stance, it's called a deny by default policy. It doesn't require interaction with me to keep bad people out. It keeps everyone who is not me out, and no, it really is not hard to do such a thing.

Your ability to surmise a needlessly complicated situation does not necessarily require the existance of any shortcoming in a given security tool.

...and not to upset you, but firewalls <I>do</I> know "100% surely" what needs to be accepted and what needs to be rejected. They're following the unambiguous instructions of whoever set up their policies.

If the administrator actually knew what they were doing, they wouldn't need a child's GUI to help them figure out what to block and what not to block in the policies they set.

You did. Either your entire post was comparing how Linux is "behind" Windows in the state of it's security, or it's time to admit you're just trolling by bringing up Windows (in a Linux-specific forum) in the first place and move on.

Didn't the thread starter ask how windows and linux security compare?

Some of the reasons a Linux system is more secure:

• Linux, being open source, allows more eyeballs to find and fix potential problems. This makes security fixes a proactive process rather than a reactive one.
• In Linux, users have limited access. You can do this in XP, but then many programs won't work.
• Process like an MTA or webserver are chrooted, and run in restricted shells.
• Windows uses RPC's for everything.
• Internet explorer has over a dozen unfixed exploits ( according to secundia). There are more that have partial workarounds that Microsoft will not fix.
• Windows allows a hacker's program to use a network port even if another program is already using it.
• Window's IIS server uses shared data space to make it operate faster.
• A file downloaded (or dropped) by the mail reader is executable if it's extension matches. In linux, you need to also set the 'x' bit before it will run.
• The registry in Windows is overly opaque. There are several places where malware can hide and start when the machine reboots.
• The average time for a fresh install of XP to be exploited is less than the time it takes to download SP2 to fix these design flaws. ( A catch 22 situation, if you don't have a NAT router to buy you more time. ).
• Windows will not work without ie explorer. IE explorer is even used for automatic upgrades (as a super user).

*chuckle* Okay, yeah, there is that, but by now I would have thought that by now everyone would recognize that as a Holy War topic, and especially not try to depict things as if Windows were the standard and Linux the aberration.

The fundamental difference is that Linux is built on the principle of least privledge*, and Windows is built the other way around. Windows expects to allow the user to do anything s/he wants, where Linux is rather particular about only allowing things which are explicitly needed. Especially with everyone and their brother using an account which is effectively Administrator (under XP and often under 2000 as well) this makes a lot of the mischief that happens under Win32 something that would never be able to happen under a unix-alike system.


* The Principle Of Least Privledge is an important information security concept. It boils down to "That which is not explicitly allowed is denied by default".

The topic.

Yes I did, and I do. Read.

Correct - I don't mind if you're having such a simple configuration where you can deny everything that's not your own professional usage, but some people do have more complex situations. Firewalls do know what needs to be accepted if you instruct it so. But for some people's use that just doesn't fit.

Nice. Try that in a server environment in some corporation.

What if the administrator just couldn't see to the future and know every possible needed thing? Situations change.

Nope. Just saying that Linux's security is not so overwhelmingly better than that of Windows, it depends on many things. You should know that since you claimed to be a professional.

The topic.

Yes I did, and I do. Read.

Correct - I don't mind if you're having such a simple configuration where you can deny everything that's not your own professional usage, but some people do have more complex situations. Firewalls do know what needs to be accepted if you instruct it so. But for some people's use that just doesn't fit.

Nice. Try that in a server environment in some corporation.

What if the administrator just couldn't see to the future and know every possible needed thing? Situations change.

Nope. Just saying that Linux's security is not so overwhelmingly better than that of Windows, it depends on many things. You should know that since you claimed to be a professional.

EDIT: I seem to have a very fast mouse-click or then this site is doing magic on me..I could swear I clicked the button just once. Well, sorry anyway for posting it twice.

I just read a newsletter (from a business magazine) where IE and the integration of IE in Windows was labeled the "biggest and most expensive mistake" ever made by Microsoft.

The summum being the release of Windows XP Home, where every user IS an "Administrator".
But then again, XP Home wasn't designed for networking and was over-simplified.

Not every user is "administrator", but if you want to install (and use most) programs then you do have to be.
The only difference between xp home and pro IS the networking is crippled in home (although there are ways to install pro dlls and divers to extend networking).
And that windows firewall (if you can even call it that) is the lamest pseudo security app ever and a bi**h to configure.

I'm just going on the basis of the default setup which no one ever bothers to change. You have to go fairly out of your way to create a non-administrator level account (with Home OR "Pro") and use it.

...and as has been implied, many apps are still pretty braind-dead about that and will expect regular access to magic administrator powers.