6:49 p.m.
Replies interwoven:
On 9/5/06, Timothy Murphy <tim(a)birdsnest.maths.tcd.ie> wrote:
Tod Merley wrote:
> It is my hope that we detach our feelings about our OSs and attend to
> their need for security.
### THE FOLLOWING IS NOT MINE!!!! ####
>From my experience, the probability of a Linux system being
compromised
is almost negligible compared with the same for a Windows system.
###########################
This may be, as you suggest, because hackers target Windows systems.
But that doesn't alter the fact that Linux systems are much safer
in the real world.
Is that really true?? How do we know?? "Bot" makers love this
attitude! It keeps them alive!!!
--
Timothy Murphy
e-mail (<80k only): tim /at/ birdsnest.maths.tcd.ie
tel: +353-86-2336090, +353-1-2842366
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
5:37 a.m.
Timothy Murphy:
> This may be, as you suggest, because hackers target Windows
systems.
> But that doesn't alter the fact that Linux systems are much safer
> in the real world.
Tod Merley:
Is that really true?? How do we know?? "Bot" makers love
this
attitude! It keeps them alive!!!
Please do remember the separation between OS and applications. I've
seen Windows, with no extra applications installed, get stuffed up
merely by being on a network. The usual example for a Linux hack is
through a server application (e.g. a webserver), where the hack is the
server (which is applicable whether the server runs on Linux or
Windows).
--
(Currently running FC4, occasionally trying FC5.)
Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.
7:51 a.m.
On Wed, 2006-09-06 at 05:37, Tim wrote:
Timothy Murphy:
>> This may be, as you suggest, because hackers target Windows systems.
>> But that doesn't alter the fact that Linux systems are much safer
>> in the real world.
Tod Merley:
> Is that really true?? How do we know?? "Bot" makers love this
> attitude! It keeps them alive!!!
Please do remember the separation between OS and applications. I've
seen Windows, with no extra applications installed, get stuffed up
merely by being on a network. The usual example for a Linux hack is
through a server application (e.g. a webserver), where the hack is the
server (which is applicable whether the server runs on Linux or
Windows).
Or - scripted password guessing for ssh logins. You can claim
that ssh isn't part of the OS, but it is generally installed
in most distributions.
--
Les Mikesell
lesmikesell(a)gmail.com
9:38 a.m.
On 06/09/06, Les Mikesell <lesmikesell(a)gmail.com> wrote:
On Wed, 2006-09-06 at 05:37, Tim wrote:
>
> Please do remember the separation between OS and applications. I've
> seen Windows, with no extra applications installed, get stuffed up
> merely by being on a network. The usual example for a Linux hack is
> through a server application (e.g. a webserver), where the hack is the
> server (which is applicable whether the server runs on Linux or
> Windows).
Or - scripted password guessing for ssh logins. You can claim
that ssh isn't part of the OS, but it is generally installed
in most distributions.
And generally firewalled by default on Fedora. (In fact I may
remember having to turn it on in FC5, not 100% sure though).
--
imalone
11:51 a.m.
On Tue, Sep 05, 2006 at 16:49:55 -0700,
Tod Merley <todbot88(a)gmail.com> wrote:
Is that really true?? How do we know?? "Bot" makers love this
attitude! It keeps them alive!!!
Linux systems aren't immune from being hacked. Local root exploits are
fairly common and those combined with a remotely accessible application
being hacked can get your system owned by someone else.
Also in the unix world we have been better about separating data from code
and for using simpler programs for handling untrusted data. But this is
starting to change. Graphical desktops are confusing running code with
looking at data. People are having their mail readers call a web browser
to handle displaying of html parts of email messages without specific
user intervention. The difference is that in the Windows world they don't
even think this is a problem. We are at least discussing things, but the
future isn't looking good.
I think that replacing Windows with Linux on normal people's desktops isn't
going to put that big of a dent in the number of bots unless we can also
change people's habits at the same time; which seems unlikely.
I think to make a dent in bots, we need to get ISPs to get hard nosed with
their customers whose machines are hosting them. Apparently at this time
it must be cheaper to eat the network costs and compaint headaches rather
than annoy paying customers by cutting them off or spending a lot of support
time to help people repeatedly clean up their machines. Unless something
changes the relative costs involved, the situation will continue like it
is now. Unfortunately as a side effect of this is that it makes blacklisting
spam sources by IP address a lot more difficult.
5:11 p.m.
I read an article on the web a while back (sorry, don't have the URL
and therefore cannot vouch for it's authenticity or accuracy). It
compared network vulnerabilities of Windows systems and Linux systems
both patched & unpatched. They connected the systems to the web and
noted that the various unpatched flavours of Windows OS were all
compromised in short order (within hours or less I believe) whereas
the unpatched Linux flavours remained uncompromised.
However when properly patched both Windows and Linux flavours all
remained uncompromised over a period of a month.
Of course add the human factor and any OS is vulnerable. And the more
services you have running, the more potential vulnerabilities may
exist on any OS. I was under the impression that the tests dealt with
systems in a laboratory environment (were not used during the course
of the test other than patching and checking for compromise and such).
I qualify this because I know some will no doubt jump in and say how
this system or that system was compromised despite being patched. Or
the OS itself was not compromised but rather a service running in the
OS, or whatever.
The short and sweet is both Linux and Windows systems have the ability
to be fairly secure in a networked environment (i.e. Internet). The
largest influencing factor being the human factor. Security and
usability are typically at the opposit end of the spectrum. If
implementing of a particular security measure is too difficult for the
average user, or inhibits usability too much, it will inevitably fail
to provide the degree of security it was designed to offer.
Jacques B.
7:49 p.m.
Bruno Wolff III wrote:
I think that replacing Windows with Linux on normal people's
desktops isn't
going to put that big of a dent in the number of bots unless we can also
change people's habits at the same time; which seems unlikely.
I agree that users need to change their habits. One problem is running
as an Administrator in windows. Users should run as restricted users,
and learn why they should or shouldn't do certain things. I think a big
part of the security problem is lack of education.
--
Michael Yep
Development / Technical Operations
RemoteLink, Inc.
800-362-9446 x164
GPG Key 0x126439D9
8:39 p.m.
On Wed, 2006-09-06 at 19:49 -0500, Michael Yep wrote:
Users should run as restricted users
When I was running Window NT, I did that, and it
worked great, but when I "upgraded" to XP I found
it was totally impossible to do anything and eventually
gave up trying and just made my "normal" user
an administrator.
A lot like trying to do anything useful
with selinux cranked all the way up :-).
1:51 a.m.
On Thursday 07 September 2006 02:39, Tom Horsley wrote:
On Wed, 2006-09-06 at 19:49 -0500, Michael Yep wrote:
> Users should run as restricted users
When I was running Window NT, I did that, and it
worked great, but when I "upgraded" to XP I found
it was totally impossible to do anything and eventually
gave up trying and just made my "normal" user
an administrator.
Agreed - W2K allowed other, more configurable statuses with limited rights.
A lot like trying to do anything useful
with selinux cranked all the way up :-).
I advised my family to buy XP Pro rather than Home, thinking this would make
the difference, but it doesn't. There's still only User, totally
locked-down, and Administrator, totally open.
I've been told that it's possible to force XP to allow limited rights as in
W2K, but no-one has told me how to do it, and I haven't discovered it.
Anne
2:12 a.m.
On Thu, 2006-09-07 at 07:51 +0100, Anne Wilson wrote:
I advised my family to buy XP Pro rather than Home, thinking this would make
the difference, but it doesn't. There's still only User, totally
locked-down, and Administrator, totally open.
I've been told that it's possible to force XP to allow limited rights as in
W2K, but no-one has told me how to do it, and I haven't discovered it.
You will want to be careful if you want to use only accounts with
restricted rights. Some applications will only work as Administrator,
and if your user's computer needs to join a NT or Active Directory
domain, sometimes you need to assign Administrator rights to a normal
user so that things like Antivirus updates or patches can be pushed to
them when they logon.
With Windows systems, there is nothing quite like having technicians or
engineers on-call 24/7. And a set of spare laptops/desktops just in
case.
--
Pascal Chong
email: chongym(a)cymulacrum.net
web: http://cymulacrum.net
pgp: http://cymulacrum.net/pgp/cymulacrum.asc
"La science ne connaît pas de frontière parce que la connaissance
appartient à l’humanité. et que c’est la flamme qui illumine le monde."
-- Louis Pasteur
3:13 a.m.
On Thursday 07 September 2006 08:12, Chong Yu Meng wrote:
On Thu, 2006-09-07 at 07:51 +0100, Anne Wilson wrote:
> I advised my family to buy XP Pro rather than Home, thinking this would
> make the difference, but it doesn't. There's still only User, totally
> locked-down, and Administrator, totally open.
>
> I've been told that it's possible to force XP to allow limited rights as
> in W2K, but no-one has told me how to do it, and I haven't discovered it.
You will want to be careful if you want to use only accounts with
restricted rights. Some applications will only work as Administrator,
and if your user's computer needs to join a NT or Active Directory
domain, sometimes you need to assign Administrator rights to a normal
user so that things like Antivirus updates or patches can be pushed to
them when they logon.
With Windows systems, there is nothing quite like having technicians or
engineers on-call 24/7. And a set of spare laptops/desktops just in
case.
<sigh> Since that's not an option on a home LAN I have to rely on trying to
educate them to the risks and setting up firewalling as best I can. So far,
though, we have kept reasonably clean, over a period of 10 or more years. Of
course I make sure that they use Mozilla or Firefox rather than IE, and
Mozilla Mail rather than OE. That enormously reduces the risk. I also make
sure that they have a good AV product running and properly configured as well
as automatic updates of signatures.
By now, this is OT. Sorry
Anne
3:54 a.m.
At 02:39 07/09/2006, you wrote:
On Wed, 2006-09-06 at 19:49 -0500, Michael Yep wrote:
> Users should run as restricted users
When I was running Window NT, I did that, and it
worked great, but when I "upgraded" to XP I found
it was totally impossible to do anything and eventually
gave up trying and just made my "normal" user
an administrator.
I've got the same problem here (at work). Unfortunately like many
others I have to use XP. Also unfortunately I need to use old
software, which probably pre-dates windows 98. It works OK most of
the time, but won't work at all in the "normal" user mode so I have
to permanently work as an administrator.
The important difference is, I think, that until XP (in my experience
which excludes NT) windows has always been totally insecure (which
isn't saying that XP is totally secure) whilst Unix/Linux has always
been secure by default. So applications for windows have
traditionally been written to run in an insecure environment and
generations of computer users don't have the first clue about
security. Which as we've seen in recent years is a recipe for disaster.
So, if we the Linux community can manage to persuade computer users
to switch from windows to Linux we've then got a problem with people
who don't understand security. If they've always run windows in
supervisor mode then they'll just run Linux as root user because they
don't know or understand the reasons why that is A BAD THING.
It all boils down to education. If a Linux user can manage to turn a
windows user away from the Dark Side then that's very good. But with
that power comes responsibility - the responsibility to educate new
users to run the operating system correctly and safely.
Would it be a good idea for FC to incorporate a "nag screen" that
pops up with a security lecture if the system is logged in as root
for longer than, say, 20 minutes at a time? Or is used to run desktop
applications such as Open Office or The GIMP?
Dave F
2:06 p.m.
Replies Interwoven:
On 9/7/06, David Fletcher <fc(a)fletchersweb.net> wrote:
At 02:39 07/09/2006, you wrote:
>On Wed, 2006-09-06 at 19:49 -0500, Michael Yep wrote:
> > Users should run as restricted users
>
So, if we the Linux community can manage to persuade computer users
to switch from windows to Linux we've then got a problem with people
who don't understand security. If they've always run windows in
supervisor mode then they'll just run Linux as root user because they
don't know or understand the reasons why that is A BAD THING.
I think it goes beyond this and is in process as we speak! We enjoy
not being the flagship here. If I were the richest man in the world,
I would need a lot of security. He is (one of them) and he does. So
if we become more like him (have more people using our OS) we also
inherit the need for more security - we will be more of a target!!
We do appear to be a bit more popular - may God help us!
It all boils down to education. If a Linux user can manage to turn a
windows user away from the Dark Side then that's very good. But with
that power comes responsibility - the responsibility to educate new
users to run the operating system correctly and safely.
What I would like to see is:
1. Education for the developers. Secure code, I am suspicious,
happens when you know how to build it.
2. Evaluation of the "new" and "old" code. I would love to see some
"security testing and evaluation" teams out there. Sort of an
organized "gauntlet" we could put our code through to make it more
secure in an iterative process.
3. Certification (sort of a UL label or something) of code thus processed.
4. A way to solve the "zero day" problem. As soon as you make the
vulnerability public hostile people start writing attacks! We need to
be able to find vulnerabilities, make and release a patch, and then
make the vulnerability public.
Dave F
May we find a way!
Tod
2:08 p.m.
On Wed, 2006-09-06 at 21:39 -0400, Tom Horsley wrote:
On Wed, 2006-09-06 at 19:49 -0500, Michael Yep wrote:
> Users should run as restricted users
When I was running Window NT, I did that, and it
worked great, but when I "upgraded" to XP I found
it was totally impossible to do anything and eventually
gave up trying and just made my "normal" user
an administrator.
A lot like trying to do anything useful
with selinux cranked all the way up :-).
That is not really true we have over 800 Win XP machines on our campus
where users can only run as non-administrators (not counting the 2000
student computers)
The only problem is that some software providers like Intuit will only
allow there programs be run as a privileged user.
--
Aaron Konstam <akonstam(a)sbcglobal.net>
3:08 p.m.
On Thursday 07 September 2006 15:08, Aaron Konstam wrote:
On Wed, 2006-09-06 at 21:39 -0400, Tom Horsley wrote:
> On Wed, 2006-09-06 at 19:49 -0500, Michael Yep wrote:
> > Users should run as restricted users
>
> When I was running Window NT, I did that, and it
> worked great, but when I "upgraded" to XP I found
> it was totally impossible to do anything and eventually
> gave up trying and just made my "normal" user
> an administrator.
>
> A lot like trying to do anything useful
> with selinux cranked all the way up :-).
That is not really true we have over 800 Win XP machines on our campus
where users can only run as non-administrators (not counting the 2000
student computers)
The only problem is that some software providers like Intuit will only
allow there programs be run as a privileged user.
Intuit can be total jerks in that regard.
--
Aaron Konstam <akonstam(a)sbcglobal.net>
--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Yahoo.com and AOL/TW attorneys please note, additions to the above
message by Gene Heskett are:
Copyright 2006 by Maurice Eugene Heskett, all rights reserved.
5:11 p.m.
On Thu, 2006-09-07 at 16:08 -0400, Gene Heskett wrote:
Intuit can be total jerks in that regard.
For that matter, so can Microsoft. I might have been
able to run as an ordinary user if I had also been
willing to upgrade all my other software to XP
compatible versions, but not wanting to do that,
I found running as administrator the only thing to do.
8:31 p.m.
On Thursday 07 September 2006 03:11 pm, Tom Horsley wrote:
On Thu, 2006-09-07 at 16:08 -0400, Gene Heskett wrote:
> Intuit can be total jerks in that regard.
For that matter, so can Microsoft. I might have been
able to run as an ordinary user if I had also been
willing to upgrade all my other software to XP
compatible versions, but not wanting to do that,
I found running as administrator the only thing to do.
It's all about the money
:-(
2:44 p.m.
Grumpy_Penguin wrote:
On Thursday 07 September 2006 03:11 pm, Tom Horsley wrote:
>On Thu, 2006-09-07 at 16:08 -0400, Gene Heskett wrote:
>
It's all about the money :-(
This article emphasizes that so greatly. :)
Quickest Patch Ever
http://www.wired.com/news/columns/0,71738-0.html?tw=rss.index
If you really want to see Microsoft scramble to patch a hole in its
software, don't look to vulnerabilities that impact countless Internet
Explorer users or give intruders control of thousands of Windows
machines. Just crack Redmond's DRM.
--
Robin Laing
6440
days inactive
6443
days old
17 comments
15 participants
participants (15)
-
Aaron Konstam -
Anne Wilson -
Bruno Wolff III -
Chong Yu Meng -
David Fletcher -
Gene Heskett -
Grumpy -
Ian Malone -
Jacques B. -
Les Mikesell -
Michael Yep -
Robin Laing -
Tim -
Tod Merley -
Tom Horsley