RE: Hypothetical design question

["Alun Jones" <alun () texis com>]

> -----Original Message-----
> From: Crispin Cowan [mailto:[EMAIL PROTECTED] 
> Sent: Tuesday, February 03, 2004 6:52 PM
>
> I'm sorry, but that just flies in the face of facts.
>
> Viruses are a problem endemic to exactly three platforms: 
> DOS, Windows, and Macintosh, and no others. Why is that? 
> Because viruses thrive in an environment where:
>
> *     documents are executable
> *     document viewers run with too much privilege

I'd add a few more bullets:

* users / admins are not well educated in what they are doing.
* there's some point to be had in infecting the user-base.

> On DOS, "documents are executable" was mostly an issue with 
> floppy disks. On Windows, it became true first in MS Office 
> documents, and then when Outlook became the prevelant mail 
> client and it started executing attached scripts. On 
> Macintosh, it was a similar story with floppies and MS 
> Office, but now is going away with OS X.

On any application that has an exploitable buffer overflow bug, documents
are executable.  I see many of these on various other operating systems that
you haven't mentioned.

> Evidence: consider Linux. 3% of the global desktop market, 
> means there is something like 1 million to 2 million Linux 
> desktop users out there. They are very strongly connected via 
> e-mail mailing lists. Prototype viruses for Linux have been 
> known and demonstrated at least seven years ago. If viruses 
> were going to thrive on Linux, they would have done it by 
> now, and they have not.

You talk about Linux as if it is a single platform.  AFAIK, it runs on
multiple different processors, in multiple different versions, with
different options compiled in at different places.  Windows, Mac and DOS, by
comparison, each offer a smaller number of possible arrangements.

> So all the hand-wringing about the global nature of the virus 
> problem being everywhere is bunk. Viruses are 100% 
> Microsoft's fault. They only exist in non-trivial volume on 
> platforms where Microsoft Office has a dominant share.

Is there something _technical_ that Linux offers, that Windows does not,
that makes it immune from viruses?  If not, then the answer must be that the
prevalence of viruses on Windows, and their near-absence on Linux must be
due to non-technical reasons (such as the overwhelming prevalence of Windows
systems, and of dumb users on those systems).

The latest viruses show that you don't have to automatically execute
attachments - you don't even have to make attachments execute after a
single-click - to distribute a virus.  I'm beginning to think that if you
wrote a virus that required users to copy the code into a text file and run
a compiler on it, it would get propagated by some users.

> Now this may change: if the Linux market becomes fully 
> bug-compliant with Microsoft, and starts deploying mail 
> clients (such as Evolution) and applications (such as 
> OpenOffice) that are eager to execute untrusted scripts, then 
> Linux will become a host for viruses too. But it depends on 
> the Linux market repeating Microsoft's critical mistakes., 
> and I do not mean buggy software.

I'll certainly agree with you that single-click opening of attachments
removes much of the "oh, that's a stupid idea" gap that slows viral
distribution, but I don't see that Linux has anything technical to offer
over Windows in virus prevention.

It offers _societal_ benefits, sure - as you noted, most applications don't
execute untrusted scripts; but also as you noted, that is not prevented, and
all it requires is for someone to produce a wildly popular application that
does this, and the game is over.

Another societal benefit is that Linux users are used to running as
non-admins.  Too many Windows applications require admin privileges.  Why
should I be an administrator to file my taxes?  I shouldn't, so I complain
to the author of that application.  "Fat lot of good that'll do you", you
might cry - and probably you're right, but I do have to try.  After all, ten
years ago, when everyone was telling me "Windows isn't stable enough to run
a server on", I started writing servers for Windows, and now I have Windows
servers that run for hours at a time (haha - joke).  If you don't ask for
improvements, you don't get them.

You've said nothing that actually contradicted my argument, and you've said
much that supports it.

Alun.
~~~~
-- 
Texas Imperial Software   | Find us at http://www.wftpd.com or email
1602 Harvest Moon Place   | [EMAIL PROTECTED]
Cedar Park TX 78613-1419  | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(512)258-9858 | Try our NEW client software, WFTPD Explorer.