RE: [inbox] Re: [Full-Disclosure] RE: Linux (in)security

From: Curt Purdy (purdy_at_tecman.com)
Date: 10/23/03

  • Next message: Richard M. Smith: "[Full-Disclosure] AOL fixes the Windows Messenger Service popup spam problem" 
    To: "'Michal Zalewski'" <lcamtuf@ghettot.org>
Date: Thu, 23 Oct 2003 14:32:37 -0500

    > >> http://www.linuxunlimited.com/why-linux.htm
    > >> ``Properly configured and maintained, Linux is one of the
    > >> most secure operating systems available today.''
    > >
    > > The key words here are "properly configured".
    >
    > Well, once "properly configured", pretty much _any_ operating
    > system would
    > make it to the top 0.01% of the most secure boxes in the
    > world.
    <snip>

    I hardily disagree. When you have inherently more secure code in OS's like
    *NIX and Netware, as evidenced by the paltry number of patches required by
    those OS's (1 in Netware vs. 38 for Windows in the same period)it doesn't
    matter how well you configure Windows, it will still be vulnerable, waiting
    for a compromise of the next discovered hole. The reason for this is
    fundamental in the design. From the use of a registry (which corrupts with
    time, finally requiring re-installation) to the fact that no single human
    being knows all the source code for Windows, much less audits it, is the
    difference between MS and the rest.

    This is the reason open-source is inherently more secure. First, people can
    actually audit it for security (you think IBM recommended Linux without
    going over every single line of code?) Second, everyone can see the code
    and contribute fixes when they see a potential problem, not after a
    vulnerability has developed and been discovered. True Netware is
    closed-source but the engineering is superb and it does only what it needs
    to do, be a network OS.

    People have the wrong idea when they say "Windows vulns are more researched
    and discovered because it so prevalent. Without a total re-architecture and
    re-write of Windows code, if and when (hopefully) Windows OS's become a
    minority, they will still be getting the vast majority of discovered and
    exploited holes. Lay a dollar to a dime on that.

    Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA
    Information Security Engineer
    DP Solutions

    ----------------------------------------

    If you spend more on coffee than on IT security, you will be hacked.
    What's more, you deserve to be hacked.
    -- White House cybersecurity adviser Richard Clarke

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Richard M. Smith: "[Full-Disclosure] AOL fixes the Windows Messenger Service popup spam problem"

    Relevant Pages

    • Re: Windows Is Now More Secure Than Linux
      ... >OpenSSL is compiled into just about every 'secure' application in the Unix ... You know, a lot of people see me as a "Windows defender", mainly because I pop ... The solution, if there is one, to security problems, is to choose a supplier ...
      (comp.security.misc)
    • RE: [inbox] Re: [Full-Disclosure] RE: Linux (in)security
      ... When you have inherently more secure code in OS's ... "Windows" includes all the applications that come with Windows, ... Which is why they release security advisories for things like kernel ... This is why wu-ftpd keeps having new vulns discovered every year, ...
      (Full-Disclosure)
    • Close browser window & open another
      ... Windows Integrated Security is being used. ... When a MIS Tech is at another employees pc, and they log into the secure ... Do I need to have the browser close, and open up another browser window? ...
      (microsoft.public.vsnet.general)
    • Re: Is it really true that NTFS is secure?
      ... though getting Snort to alert just on interesting events on a Windows server ... Other things to do to look for the source of the hacking and secure your ... on Prof full time now and I am battling security it seems every hour. ... though I'm not sure this has to do with NTFS. ...
      (microsoft.public.security)
    • RE: [inbox] Re: [Full-Disclosure] Training & Certifications
      ... rebooting a Windows ... Netware, ... rebooting fixes the problem they had. ... Information Security Engineer ...
      (Full-Disclosure)
    Loading