On Wed, Jul 28, 2010 at 10:57 AM, Rashkae <span dir="ltr"><<a href="mailto:rashkae@tigershaunt.com">rashkae@tigershaunt.com</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div class="im">Insurance Squared Inc. wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
I don't think there's a need to get that specific.<br>
<br>
I have a linux desktop, had one for something like 5-10 years. I take no specific security precautions, run no virus scanner, and have never had an issue with external intrusions or compromises.<br>
<br>
Try the same thing with a windows desktop. My mother's computer was filthy with viruses and hacks until I got her on to linux. All I did was do a default install, give her the machine, and no further issues. My point was, linux desktops don't get compromised ever. Not rarely - ever. I've never had it happen, and nobody on this list even knows anybody that it's ever happened to. that's the point I was curious about - could it happen in some remote possibility? Apparently not.<br>
</blockquote>
<br></div>
I'm sorry, this is simply false. Very false. I've once been pwned by a worm. I'll freely admit, it was entirely my fault for not locking down a default Slackware install and not taking action to fix a well publicized vulnerability. </blockquote>
<div><br>You can also install Damn Vulnerable Linux<br><br><a href="http://www.damnvulnerablelinux.org/">http://www.damnvulnerablelinux.org/</a><br><br>Even Windows users are advised to run WGA and update often.<br><br>So your case is again a human factor one (failing to keep your system up to date).<br>
<br></div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">It was fascinating to see the hackers work, using the compiler toolchain on my system to build the rootkit on the fly and access the machine via an irc bot.... fun times. And more recently, we have the example of themes being downloaded with malware from <a href="http://gnome-look.org" target="_blank">gnome-look.org</a>; a perfect example of Windows style malware when you have users downloading and installing whatever they want with admin privilages from untrusted sources.<br>
</blockquote><div><br>If you have run a web site for any length of them, you will see there are probes all the time for vulnerabilities (e.g. phpmyadmin, various bulletin boards and forum software, various CMSs, awstats, as well as Windows specific probes for IIS and MS-SQL ..).<br>
<br>All these look for systems that are not updated and exploit wholes in them.<br> <br></div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
I believe Linux security to be far and away better than the traditional Windows model, but a direct comparison is unlikely to be useful. Linux security is greatly improved by two important factors that are, combined, probably better than any software design of modern OS's.<br>
<br>
1. Relative obscurity: If Linux requires more work to compromise and represents only 5% of of your potential target base, it makes little sense to invest in malware for Linux desktops, currently.<br></blockquote><div><br>
On the server, Linux is on par, if not more prevalent than Windows, and there are worms out there for both. But the success rate is more on Windows, e.g. Code Red, Nimda, ...etc.<br><br>Why?<br><br>The attacks target unpatched or poorly administered systems.<br>
<br></div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
2. Linux users are likely to be more tech savvy. So if Linux is on 1 - 5% of desktops, how many of those are likely to be a potential victim? half? less than a quarter?</blockquote><div><br>No longer the case with Ubuntu and the like ...<br>
<br>There is an icon you click and you are up to date. No need for command line to keep your system secure.<br></div></div>-- <br>Khalid M. Baheyeldin<br><a href="http://2bits.com">2bits.com</a>, Inc.<br><a href="http://2bits.com">http://2bits.com</a><br>
Drupal optimization, development, customization and consulting.<br>Simplicity is prerequisite for reliability. -- Edsger W.Dijkstra<br>Simplicity is the ultimate sophistication. -- Leonardo da Vinci<br>