Full Disclosure mailing list archives
RE: Religion... was RE: Re: January 15 is Personal Firewall Day, help the cause
From: "Mike Marshall" <mmarshall112 () comcast net>
Date: Sun, 18 Jan 2004 22:38:24 -0500
Can we please just stop OS-based arguments? And can we agree that all OSs earn their places, rightfully? Windows has earned very few security points to date (and maybe none), but we can move toward securing this OS despite its programming shortcomings. Windows, and thankfully, linux isn't going away any time soon. Linux installs mostly secure by default, windows installs insecure by default, but that doesn't mean people can't harden either OS and make it more secure. Personaly, I've run a large data center using both OSs (various versions) securely for over 5 years. I've developend and implemented windows and linux hardening templates. There are many ways to secure and harden both. As many have pointed out, layers matter. Mike -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of David F. Skoll Sent: Sunday, January 18, 2004 7:12 PM To: Wes Noonan Cc: full-disclosure () lists netsys com Subject: RE: Religion... was RE: [Full-disclosure] Re: January 15 is Personal Firewall Day, help the cause On Sun, 18 Jan 2004, Wes Noonan wrote:
On Sun, 18 Jan 2004, Wes Noonan wrote: Why? Name one virus for Linux that AV software would have protected against, that a noexec /tmp wouldn't have.
Security isn't about protecting against old threats; it's about protecting against new threats.
Exactly. A/V software can only protect against *old* threats, because a virus has to be in the signature database. Mounting /tmp noexec can protect against a wide class of threats (those threats that rely on writing a file to the file system and then executing it.)
If running virus protection has the potential to protect against new threats,
But it doesn't.
than it is worth running.
Therefore it isn't.
If an IDS/IPS has the potential to protect against new threats, than it is worth running.
IDS itself cannot protect against anything; it can only detect unusual activity. (That doesn't make it worthless, of course.) IPS systems may be worthwhile depending on how many false-positives they issue.
Security is about a total process, not a specific product or application.
I agree. But a particular product or application *can* lead to insecurity.
We're a 7-person shop with a budget of $0 for software. I'd love to see a Microsoft shop with a similar software budget.
I'd love you to show me a 700, 7000 or 70000 person shop that can say
that. Wait a few years and get back to Roaring Penguin. :-) Obviously, right now, I can't. But there are plenty of large organizations using free software; HP claims to have made $2.5 billion in Linux-related sales. It will happen. The economics dictate it. Companies that save money because of lower licensing costs, lower license enforcement costs, and (especially) lower costs to maintain secure networks, will succeed where companies that have higher costs fail.
You have to think about things like "what if David, who is the only person who really knows our systems, leaves. Where does that leave us"?
That might have been true a couple of years ago, but there are plenty of Linux experts now, as you noted.
Microsoft is only un-securable for those who don't know how to secure it
No. The fundamental problem with Windows is the problem that lead to the creation of the anti-virus industry: Encoding of metadata in filenames. The fact that ".exe" on Windows means the same thing as turning on the execute bit in UNIX has cost the world economy billions. And it's impossible to change this without fundamentally changing Windows. (Even this flaw isn't a Microsoft innovation; it was first revealed in 1987 in the infamous CHRISTMA EXEC worm at IBM on the VM/370 system.) This flaw, the readiness of a Windows system to enable execute permission depending on the filename, makes every single Windows box a ticking time bomb. Someone just has to be clever enough to deposit an .exe on a system and trick someone into running it. The social engineering required to do the same on Linux is an insurmountable hurdle; not only do you have to deposit the file, but you have to convince someone to turn on the execute bit, which no Linux mail clients currently do, and which the average office worker is unlikely to even know how to do. (That's why I have a warm feeling when our sales people use Linux; they don't know enough to be dangerous. :-))
You claim, repeatedly, that Linux is so much easier to secure. I believe that this is directly related to your level of expertise on Linux. Similarly you claim, repeatedly, that Microsoft is impossible to secure. I believe, similarly, that this claim is directly related to your level of expertise on Microsoft.
No; it is related to the fundamental design flaw I mentioned above. [...]
Someone else pointed out that no OS is bug free, which is a truism. The ability to harden a system, if one knows what they are doing, is also a truism.
Are you claiming that all OS's have the same inherent security, and that all can be hardened to the same extent? If yes, then you're out of touch with reality. If no, then some OS's must be better than others, and I claim that Linux, out of the box, is more secure than Windows, out of the box, and furthermore, I claim that Linux is possible to secure to a greater extent than Windows (especially with the NSA work now merged into Kernel 2.6.)
The more and more you post, the more things like this you write, the more clear it becomes that your position has little more than a religious passion for Linux and a religious dislike of Microsoft backing it with little other real substance.
It's easy to glibly dismiss my argument, but you don't address the facts. Unless Microsoft has an economic incentive to improve security, it won't. And the only economic incentive it could have is the potential loss of market share. And that can't happen without competition. And competition, in the consumer OS market place, cannot happen unless people are willing to look at alternatives to Windows.
Protestants, Catholics. Muslims, Jews. Penguinistas and Microsofties. It isn't about securing our computers, it's about not using Microsoft. It's an old, tired, pointless argument. :shrug:
You fail to refute it, because you cannot. Regards, David. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Religion... was RE: Re: January 15 is Personal Firewall Day, help the cause, (continued)
- RE: Religion... was RE: Re: January 15 is Personal Firewall Day, help the cause Wes Noonan (Jan 18)
- RE: Religion... was RE: Re: January 15 is Personal Firewall Day, help the cause David F. Skoll (Jan 18)
- RE: Religion... was RE: Re: January 15 is Personal Firewall Day, help the cause Wes Noonan (Jan 18)
- RE: Religion... was RE: Re: January 15 is Personal Firewall Day, help the cause David F. Skoll (Jan 18)
- RE: Religion... was RE: Re: January 15 is Personal Firewall Day, help the cause Wes Noonan (Jan 18)
- RE: Religion... was RE: Re: January 15 is Personal Firewall Day, help the cause David F. Skoll (Jan 18)
- RE: Religion... was RE: Re: January 15 is Personal Firewall Day, help the cause Wes Noonan (Jan 18)
- Re: Religion... was RE: Re: January 15 is Personal Firewall Day, help the cause Jim Race (Jan 18)
- Re: Religion... was RE: Re: January 15 is Personal Firewall Day, help the cause David F. Skoll (Jan 18)
- RE: Religion... was RE: Re: January 15 is Personal Firewall Day, help the cause Bill Royds (Jan 18)
- RE: Religion... was RE: Re: January 15 is Personal Firewall Day, help the cause Mike Marshall (Jan 18)
- Re: Symantec AntiVirus and AOL Joshua Levitsky (Jan 18)
- Re: Re: January 15 is Personal Firewall Day, help the cause Martin Mačok (Jan 19)
- Re: Re: January 15 is Personal Firewall Day, help the cause Valdis . Kletnieks (Jan 19)
- Re: Re: January 15 is Personal Firewall Day, help the cause Michal Zalewski (Jan 19)
- Re: Re: January 15 is Personal Firewall Day, help the cause Valdis . Kletnieks (Jan 19)
- Re: Re: January 15 is Personal Firewall Day, help the cause Michal Zalewski (Jan 19)
- Re: linux noexec (Re: January 15 is Personal Firewall Day) Martin Mačok (Jan 20)
- Re: Re: January 15 is Personal Firewall Day, help the cause Mary Landesman (Jan 16)
- Re: Re: January 15 is Personal Firewall Day, help the cause David F. Skoll (Jan 16)
- Re: Re: January 15 is Personal Firewall Day, help the cause jan . muenther (Jan 16)