Re: [Full-Disclosure] RE: Linux (in)security

From: Peter Busser (peter_at_adamantix.org)
Date: 10/22/03

  • Next message: Arcturus: "RE: [Full-Disclosure] RE: Linux (in)security" 
    To: full-disclosure@lists.netsys.com
Date: Wed, 22 Oct 2003 21:55:40 +0200

    Hi!

    > I have never heard of a Linux vendor saying that Linux is "secure out of the
    > box." Maybe Openwall or Engarde Linux, but most distos need to be made
    > secure by the user.

    More than enough people assert that Linux is secure. Just enter "Linux is
    secure" in Google and you see what I mean:

    http://www.linuxunlimited.com/why-linux.htm
    ``Properly configured and maintained, Linux is one of the most secure operating
      systems available today.''

    http://www.faqs.org/docs/linux_intro/sect_01_04.html
    ``The security model used in Linux is based on the UNIX idea of security, which
      is known to be robust and of proven quality. But Linux is not only fit for
      use as a fort against enemy attacks from the Internet: it will adapt equally
      to other situations, utilizing the same high standards for security. Your
      development machine or control station will be as secure as your firewall.''

    Note: The UNIX idea of security: You can trust users, especially the
    administrator (root).

    http://www.usermode.org/docs/whatslinux.html
     
    http://news.zdnet.co.uk/software/linuxunix/0,39020390,2075966,00.htm
    ``Linux is as secure as you can make a computer,''
    ``First of all, Unix [on which Linux is based] is the paradigm that the
      computer is the network, so Linux is secure from the ground up.''

    http://www.suse.co.uk/uk/company/schools/***.pdf
    ``As a desktop operating system Linux is secure, stable and easy to use.''
    (SuSE is a vendor BTW)

    http://www.bio-itworld.com/news/022503_report2077.html
    ``The certification is "additional validation" that Linux is secure, ...''

    The list goes on and on and on.

    > Linux is the hands of someone with no interest or regard for security is the
    > same as Windows or any other OS in the hands of the same clueless
    > individual. The main difference between the Linux and Unix variants (i.e.
    > BSD, Solaris, HP-UX) is that they have already learned their lesson regarded
    > buffer overflows and kernel hardening and allowed the user more control in
    > securing their systems.

    This is repeated over and over again, but it is simply not entirely true. It
    may protect against script kiddies, but not against more sophisticated
    crackers. The following URL proves that:
    http://groups.google.com/groups?selm=20030525190037%2470c6%40gated-at.bofh.it

    Both persons in this conversation have a Linux box which:

    1) Has the latest security patches installed and
    2) Is only running the necessary services.

    In other words, boxes that have ``been made secure by their users''.

    > M$ has not, and that is unfortunate.

    Flaws in other products do not make Linux more secure.

    Groetjes,
    Peter Busser 

    -- 
The Adamantix Project
Taking trustworthy software out of the labs, and into the real world
http://www.adamantix.org/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: Arcturus: "RE: [Full-Disclosure] RE: Linux (in)security"