Find the answer to your Linux question:
Results 1 to 7 of 7
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Linux Newbie Darl's Avatar
    Join Date
    Oct 2003

    Linux (un)Security?

    So, in another forum, I ended up in a little conversation with a fellow on Linux vs. Windows. Some of his comments rustled me up a little, I tried not to degenerate the conversation into a troll or flame, but some of his comments seemed strange. So far things are very civil.
    Here ya be:
    Windows users are generally stupid. A good windows user is well able to secure his box.
    I would have been more delicate, but, yes, he had a point.
    Linux is probably really the less secure OS, but generally people who use it are pretty intelligent. They know what to get what to configure, etc. Those who don't know what they are doing should consider Linux the most insecure OS EVER. Too many options for the average person who will find ways to put so many holes up they will be owned and become a pawn of those who want to do massive DOS attacks around the world.
    Emphasis mine.
    I took issue with the statement that linux is the most insecure OS ever. I mentioned that, sure, if one installs server utils and improperly configured (or didn't configure at all) the software, then, yes, you have a very unsecure computer. But, I protested, out-of-box, Linux is far more secure than any Windows OS (assuming fully updated windows & fully updated Linux). He countered with:
    Then answer me why most DOS attacks are done by unsecured Linux boxes?
    Which I've honestly never heard before. Maybe it's true -maybe not. I really don't know. I asked him to post a link, and that's where things sit now. But some other things that bristled me:
    So the biggest problem with Linux? Any version of it I've seen doesn't include even basic support for the newest hardware.
    Arg! Of course, later I found out he was trying to install Quake3 and the nVidia drivers were giving him problems. That is understandable. I pointed out most hardware is supported, and acknowledged newer video cards can be a problem.
    He ends with this:
    That's why I think Linux as of now is a failure. In the future I hope it does better. I want it to do better because I don't like windows. But right now it pretty much sucks.
    All in all, a somewhat frustrating conversation, especially because I still consider myself a Linux newb. Any comments? suggestions?
    To me, saying Linux is the most unsecure OS is like saying Windows is not user-friendly. But maybe I'm wrong....

    edit: I prefer using the term unsecure over insecure, as insecure has connotations that come with it (as in `Linux has some socially awkward tendancies'). The prefix un- makes unsecure more definite in meaning (such as unhappy = not happy; unknowlingly = acted without knowledge; unsecure = not secure).

  2. #2
    GNU/Linux is as secure as you want it to be.. Take his dos attack claim.. I can somewhat understand to that because its a lot of 14 year olds who set up a improperly configured shell server on high speed connections, and that is irresistible to any script kiddie.

    Lets take trustix as an example.. Their distro (based off Red hat IIRC) doesnt have any services enabled after the install. You have to enable them yourself. Now I think that's a good idea because most new users don't know what eg. sshd or apache is and won't turn it off in fear of screwing something up (yes, I'm very generalising now) so its just there doing no good except for inviting the script kiddies. I think thats a good rule that every distro should follow.

    I can't really talk about windows because I stopped using it at windows 98, but I remember then it was way bad. Normal users could do anything, delete system critical files, tamper with the register and doing general headache stuff.

    And because he's to stupid to figure out how to install something so simple as the nvidia drivers, he really shouldn't turn into a ''anti-linux'' troll. If had taken about 5 minutes and actually read that cute little manual, he could have installed just as easy as anyone else.

  3. #3
    Linux Guru
    Join Date
    Apr 2003
    London, UK
    In no particular order...

    His claim about the linux machines being used as part of DDOS attacks... Yes, some linux machines do get 0wn3d and used in DDOS attacks. If anything I would say his statement about Linux machines being used MORE is untrue, but it would entirely depend on the attacker, and the attackers style.

    Some blackhats would prefer only a few select systems with a large amount of bandwidth at their disposal, eg, universities with SGI's, IRIX, BSD boxes connected to 155Mb internet backbones. You would only need a few of these to do a lot of damage. However, becuase these machines *generally* are prized posessions, in a working environment, they are *generally* well looked after by people with a fair bit of experience. - This puts these machines out of the reach of a lot of blackhats/lamers - ie, there is no auto-root exploit on packet storm, meaning these pricks sure as hell dont have a chance of rooting the box.

    So, the majority of these lamer / less-er skilled "blackhats" end up using windows boxes (IMO) for their DDOS attacks. Why? becuase it is easy to find unpatched windows boxes on the internet - there (currently) is more of them if your looking in the right places (read: IP Ranges used by DSL/Cable ISP's). On these IP ranges, typically for home use, you have a lot of people who know f-all about computers, let alone security, and yes, most of these people use windows. Hence my theory that most DDOS agents are windows boxes. If you can get a trojan with DDOS capabilities installed on enough machines with, lets say 512kb bandwidth, collectivly you have an effective DDOS network.

    With regards to most secure OS...
    No OS is completly secure. If he thinks otherwise.... educate him

    People say "Oh, Look, OpenBSD is secure, because by default they dont turn on many / any? services". So are you saying OpenBSD machines dont get rooted? Of course they do. Why? User Error / User Incompetence.

    Im not going to say any more on the issue of most secure os, as i think that sums it up nicely.

    New hardware...
    So this guy downloads and installs Linux. Now he finds out he needs a driver for his video card. Is this really such a big deal? If i need a driver for a piece of hardware, i do 2 things: 1) Google. 2) Visit the manufacturers website. After locating the driver, it is normally a case of reading any installation instructions that came with the driver, and googling for Howto / tutorials if still stuck. Even after that, if i need help, I will ask on a forum like this one.

    In the case of this guy, if he had done this, he would have overcome the driver issue and been up and running in less than an hour (and learnt a lot in the process). That whole scenario and his inability to solve / seek help for simple problems says more about him personally than it does about Linux...

    Generally speaking, im not keen on Linux Vs Windows discussions, as they easily get out of hand (and i hate seeing all those Windows users in the wrong ), but sometimes a light discussion is good.

  4. $spacer_open
  5. #4
    Linux Guru sarumont's Avatar
    Join Date
    Apr 2003
    Well...I really can't say much more than what J said except to expand on the fact that security always, no matter the OS, comes down to the user. Install the newest OpenBSD and WinXP SP1 and I'd be willing to bet that, before settings are tampered with, the BSD box is more secure. But who does that? Each box is as individual as the owner. If they are lazy or incompetant, it's a good be their box will reflect that.

    And if someone is stupid and ignorant, then you can bet money (and win!) that they'll be vulnerable somehow...which is why we should have computing licenses. "You must have an IQ of 110+ to operate a PC. If not, use a typewriter."
    "Time is an illusion. Lunchtime, doubly so."
    ~Douglas Adams, The Hitchhiker's Guide to the Galaxy

  6. #5
    Linux Engineer Giro's Avatar
    Join Date
    Jul 2003
    Yep one more here who agrees its not OS its user if you read alot of posts like this on the forum you always get the same answer.

  7. #6

    just a thought

    I definatly agree that everyones computers are done differently, they are indeed as individual as the person they belong to.
    Computer liscences....... were do I sign up my parents for the typewriter.

  8. #7
    Linux Guru techieMoe's Avatar
    Join Date
    Aug 2004
    This is a very old thread and I see no reason to resurrect it. Locked.
    Registered Linux user #270181

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts