Re: [inbox] Re: [Full-Disclosure] CyberInsecurity: The cost of Monopoly

From: Frank Knobbe (frank_at_knobbe.us)
Date: 09/30/03

  • Next message: Rodrigo Barbosa: "Re: [inbox] Re: [Full-Disclosure] CyberInsecurity: The cost of Monopoly" 
    To: Rodrigo Barbosa <rodrigob@suespammers.org>
Date: Mon, 29 Sep 2003 19:27:51 -0500

    On Mon, 2003-09-29 at 17:24, Rodrigo Barbosa wrote:
    > My whole point is: I do think Windows is insecure, but one cannot blame
    > Windows alone. There are many, many server still vulnerable to CodeRed,
    > and that, these days, is mostly a fault of the server admin.

    Don't shift blame to the admins. There are good admins on Windows, and
    good admins on Unix. There are also bad admins on Windows and bad admins
    on Unix. There are still CodeRed vulnerable machines around, and there
    are probably still bind or lpr vulnerable machines out there.

    In both cases, Windows and Unix, the role of the admin is important. But
    take the admin out of picture for the moment and just compare Unix to
    Windows from an architectural point of view. Let's even overlook those
    default setups (like IIS wide open, or a dozen daemons that don't need
    to be running). Just from an architectural point of view, I claim
    Windows is more vulnerable just due to the immense complexity.

    I only have experience with some Linux and some BSDs. I can't speak for
    AIX, Solaris, HPUX, and whatever else, but I doubt they are as complex
    as Windows these days.

    Don't get me wrong, I liked Windows (up until a couple years ago when
    the blatant privacy violations and increasing amount of bugs/patches
    made me decide to drop it). I'm just saying that so you know that I'm
    not a native Windows basher. But I argue that NT 4 for example is more
    secure than Windows 2000 (I actually believe that. I was running an NT 4
    box with IIS 3 for 4 years on the Internet without any incidents.... But
    I credit IIS 3 for it :)

    Anyhow. Windows these days is less secure because it is bloated with
    code. Yes, good admins can easily secure it. But that still doesn't get
    rid of the inherent code-bloat based insecurity.
    (I could also argue that BSD is more secure than Linux when you take the
    admin out of the picture. Just compare Linux's etc-hell to BSD's. But I
    don't really want to alienate too many.... oh darn, too late...)

    Complexity is security's worst enemy. Being it in network design,
    application design, operating systems, or airplanes.

    Regards,
    Frank

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Rodrigo Barbosa: "Re: [inbox] Re: [Full-Disclosure] CyberInsecurity: The cost of Monopoly"

    Relevant Pages

    • Re: Any Way to Run Windows 2000 From Read-Only CD?
      ... Your point regarding infecting the computer during runtime when the disk is ... Now, regarding UNIX versus Windows, I try to have a balanced view. ... administrator can isolate those and secure them. ...
      (microsoft.public.windows.server.security)
    • Re: Unix vs. Windows Security
      ... and b) security will mean Internet security. ... There are some core issues at the heart of the UNIX vs. Windows security ... Neither were ever designed to be secure. ...
      (comp.security.misc)
    • Re: Determine if open(2) created or opened?
      ... > simple!= secure. ... that the source of many of Windows' problems can be attributed to it's ... This myth is exactly why the UNIX community is just sitting on their ... You can switch security contexts within a thread ...
      (comp.unix.programmer)
    • Re: Unix vs. Windows for Security
      ... maintain in a secure environment. ... security problems. ... > Unix is a multiuser operating system, so out of the box it is far from ... > don't have that multiuser shell ability on Windows you have on Unix. ...
      (comp.security.unix)
    • Re: Unix vs. Windows for Security
      ... > Unix is a multiuser operating system, so out of the box it is far from ... > Windows comes with nothing basically. ... So unless you take the proper steps to secure Unix it will be ...
      (comp.security.unix)