Full Disclosure mailing list archives
Re: RE: Linux (in)security
From: Peter Busser <peter () adamantix org>
Date: Wed, 22 Oct 2003 21:55:40 +0200
Hi!
I have never heard of a Linux vendor saying that Linux is "secure out of the box." Maybe Openwall or Engarde Linux, but most distos need to be made secure by the user.
More than enough people assert that Linux is secure. Just enter "Linux is secure" in Google and you see what I mean: http://www.linuxunlimited.com/why-linux.htm ``Properly configured and maintained, Linux is one of the most secure operating systems available today.'' http://www.faqs.org/docs/linux_intro/sect_01_04.html ``The security model used in Linux is based on the UNIX idea of security, which is known to be robust and of proven quality. But Linux is not only fit for use as a fort against enemy attacks from the Internet: it will adapt equally to other situations, utilizing the same high standards for security. Your development machine or control station will be as secure as your firewall.'' Note: The UNIX idea of security: You can trust users, especially the administrator (root). http://www.usermode.org/docs/whatslinux.html http://news.zdnet.co.uk/software/linuxunix/0,39020390,2075966,00.htm ``Linux is as secure as you can make a computer,'' ``First of all, Unix [on which Linux is based] is the paradigm that the computer is the network, so Linux is secure from the ground up.'' http://www.suse.co.uk/uk/company/schools/sheet.pdf ``As a desktop operating system Linux is secure, stable and easy to use.'' (SuSE is a vendor BTW) http://www.bio-itworld.com/news/022503_report2077.html ``The certification is "additional validation" that Linux is secure, ...'' The list goes on and on and on.
Linux is the hands of someone with no interest or regard for security is the same as Windows or any other OS in the hands of the same clueless individual. The main difference between the Linux and Unix variants (i.e. BSD, Solaris, HP-UX) is that they have already learned their lesson regarded buffer overflows and kernel hardening and allowed the user more control in securing their systems.
This is repeated over and over again, but it is simply not entirely true. It may protect against script kiddies, but not against more sophisticated crackers. The following URL proves that: http://groups.google.com/groups?selm=20030525190037%2470c6%40gated-at.bofh.it Both persons in this conversation have a Linux box which: 1) Has the latest security patches installed and 2) Is only running the necessary services. In other words, boxes that have ``been made secure by their users''.
M$ has not, and that is unfortunate.
Flaws in other products do not make Linux more secure. Groetjes, Peter Busser -- The Adamantix Project Taking trustworthy software out of the labs, and into the real world http://www.adamantix.org/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Linux (in)security Schmehl, Paul L (Oct 22)
- Re: RE: Linux (in)security Thomas Binder (Oct 22)
- RE: RE: Linux (in)security Edward W. Ray (Oct 22)
- RE: RE: Linux (in)security Arcturus (Oct 22)
- Re: RE: Linux (in)security Jeremiah Cornelius (Oct 22)
- Re: RE: Linux (in)security Mr. Rufus Faloofus (Oct 22)
- Re: RE: Linux (in)security Peter Busser (Oct 22)
- Re: RE: Linux (in)security Cael Abal (Oct 22)
- Re: RE: Linux (in)security Peter Busser (Oct 23)
- RE: RE: Linux (in)security Edward W. Ray (Oct 22)
- RE: [inbox] Re: RE: Linux (in)security Curt Purdy (Oct 22)
- RE: [inbox] Re: RE: Linux (in)security Michal Zalewski (Oct 22)
- RE: [inbox] Re: RE: Linux (in)security Ron DuFresne (Oct 23)
- RE: [inbox] Re: RE: Linux (in)security Curt Purdy (Oct 23)
- RE: [inbox] Re: RE: Linux (in)security Michal Zalewski (Oct 23)
- RE: [inbox] Re: RE: Linux (in)security Ron DuFresne (Oct 23)
- Re: [inbox] Re: RE: Linux (in)security William Warren (Oct 23)
- Re: [inbox] Re: RE: Linux (in)security Ron DuFresne (Oct 24)
- Re: RE: Linux (in)security Thomas Binder (Oct 22)