Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: linux security  (Read 4360 times)

0 Members and 1 Guest are viewing this topic.

joy division

  • Guest
linux security
« on: December 26, 2011, 10:51:43 PM »
Why is Linux more secure than Windows ?  There are a couple of different reasons that I've read about such as the code being open source, allowing security holes to be found/patched quicker, and because being logged in you're only logged in as a user without admin privileges, making malicious code more difficult to run.. I think I interpreted that correctly but I'm not sure.  But if any could shed some light on this it would be appreciated.

Imlright

  • Guest
Re: linux security
« Reply #1 on: December 27, 2011, 08:05:54 AM »
Yes you are correct in your assumption of how linux is more secure.
Also linux isn't as widely used as Windows and therefore isn't targeted as often.
As I understand it there isn't any viruses in the wild at this time.

I have been using linux full time for the past 4 years and haven't had any problems.

Hope this helps !

BC_Programmer


    Mastermind
  • Typing is no substitute for thinking.
  • Thanked: 1140
    • Yes
    • Yes
    • BC-Programming.com
  • Certifications: List
  • Computer: Specs
  • Experience: Beginner
  • OS: Windows 11
Re: linux security
« Reply #2 on: December 27, 2011, 01:52:19 PM »
Why is Linux more secure than Windows ?
It's not.
I was trying to dereference Null Pointers before it was cool.

joy division

  • Guest
Re: linux security
« Reply #3 on: December 27, 2011, 03:00:37 PM »
It's not.

Well, when I said "secure" I wasn't talking about security in a broad sense, only referring to its potential to get infected with a virus.

When I read discussions about Windows being infected I see remarks like,"thank god for linux"..  Which compels me to wonder why Linux it thought to be more secure and so I go find discussions on it.  The primary reasons for this belief seem to be primarily based on the two features of Linux that I gave.  But if you could expand on your statement, that would be appreciated..  :)

 
« Last Edit: December 27, 2011, 03:39:24 PM by joy division »

BC_Programmer


    Mastermind
  • Typing is no substitute for thinking.
  • Thanked: 1140
    • Yes
    • Yes
    • BC-Programming.com
  • Certifications: List
  • Computer: Specs
  • Experience: Beginner
  • OS: Windows 11
Re: linux security
« Reply #4 on: December 27, 2011, 09:08:24 PM »
Well, when I said "secure" I wasn't talking about security in a broad sense, only referring to its potential to get infected with a virus.

When I read discussions about Windows being infected I see remarks like,"thank god for linux"..  Which compels me to wonder why Linux it thought to be more secure and so I go find discussions on it.  The primary reasons for this belief seem to be primarily based on the two features of Linux that I gave.  But if you could expand on your statement, that would be appreciated..  :)

 

OK.

Let's take the first fallacy- that Linux is more secure because it's open source.

Let's think about that for a moment. The reason cited is basically that more people will be looking at the code, so bugs/issues are more likely to get fixed. But that doesn't really make a whole lot of sense, since most code, even in an open source project, has to go through a review process before it's merged into the main repository/build. More to the point, very few- to the point where I would go so far as to say no- people actually just sit around and browse the source for Open Source projects. the very idea is absurd. I'm a Linux user, I've used Slackware, Mint, Ubuntu (ech), Fedora and Arch, and you know how many times I've looked at the source? zero. Same for every single application I've run that is Open Source. Zero. The fact is, the only think an OS or piece of software being Open Source does is encourage developers to close bugs and issues, and basically say "fix it yourself" to the people reporting them.

Additionally, it assumes that those people who are browsing the source code are only interested in fixing problems, and not exploiting them, which is equally absurd. There are no doubt just as many unknown flaws in Red hat or CentOS as there are in Windows, the fact is that the Open Source nature makes it easier to find these flaws- like, for example, the backdoor into any red hat system that was in the OS for nearly 5 years. Obviously, somebody added that in, and who knows who it was, or whether they exploited the loophole they added in those 5 years before somebody stumbled upon it and reported it. That is an important point as well, since it was actually a user of the system that found this backdoor by accident, not one of the fictitious thousand-eyes that are supposedly poring over the source code.

As to the second notation:

"and because being logged in you're only logged in as a user without admin privileges, making malicious code more difficult to run"

Vista/7 no longer default to logging the user in with admin privileges. It might, if UAC is disabled, I think. But I wonder why Linux advocates can't seem to complain enough about UAC and yet have no problem with the graphical sudo/gksudo etc implementations, which are pretty much exactly the same (except they always prompt for a password, whereas the UAC prompt, depending on account settings, merely asks for confirmation).

What it comes down to is that Linux is more "secure" from malware simply because it's not a target of malware. If you had to choose to run your piece of malware on a system that had over 80% coverage, or one with less than 3% market penetration, I think the common-sense choice would be the first one.
d
The fact is, regardless of the system, if you want it to be "secure" you are going to have to make changes to the default configuration, and those things you add and change, later on. The only possible exception I can see being FreeBSD and openBSD, which come fairly locked down.

However, you can't use a locked down box. you need to access the net, run applications, etc. So far, I've not seen any real protections on this linux machine I am using now (Mint 10) to prevent me from running malware beyond what windows provides. Of course because there is so little malware written that will run on linux (probably because writing software for linux is like trying to use a bow and arrow to hit a moving target while wearing goggles covered in ketchup, which is why so few games are available for it*), the chances of getting infected are slim to none. Of course with careful browsing on any OS your chances are slim to none, but let's not cloud the issue with facts.

Other weird sayings that piss me off:

"Linux is good for programmers"

No. It's not. that's so stupid. people who say this obviously haven't had to write non-trivial applications for Linux. It's a bloody nightmare. It's a nightmare just getting half the programs you download to compile properly. Because god forbid they ever give you binaries to make installing their software easy. no, It's ./configure this, and make install this and check the pre-requisites that. And then when the ./configure shell script bombs trying to find all the requirements the error message doesn't tell you anything about what you need. "you need the package from python? but I just ran "apt-get install python" to make sure you had them. Then you search online to discover, OH IT was SO OBVIOUS that I needed to install python-dev rather than the normal peasant version of python. Basically, it's only for masochistic programmers. or programmers that keep all their code so that it doesn't import from any other library. I've also noticed that a lot of Linux desktop app programmers have never touched Windows development and yet still claim Linux is easier. As if they even have a barometer to measure.



I was trying to dereference Null Pointers before it was cool.

joy division

  • Guest
Re: linux security
« Reply #5 on: December 27, 2011, 09:57:23 PM »
Thanks for sharing those points.

Would you say there are some Distros of Linux that are more popular/used than other Distros...and would those more popular ones get more attention or "eyes" as to finding security holes?  I'd think if there are going to be eyes gazing on Linux source code it would be a distro that is more commonly used, obviously to improve it's usability and security.

BC_Programmer


    Mastermind
  • Typing is no substitute for thinking.
  • Thanked: 1140
    • Yes
    • Yes
    • BC-Programming.com
  • Certifications: List
  • Computer: Specs
  • Experience: Beginner
  • OS: Windows 11
Re: linux security
« Reply #6 on: December 27, 2011, 10:16:19 PM »
Thanks for sharing those points.

Would you say there are some Distros of Linux that are more popular/used than other Distros...and would those more popular ones get more attention or "eyes" as to finding security holes?  I'd think if there are going to be eyes gazing on Linux source code it would be a distro that is more commonly used, obviously to improve it's usability and security.

You missed my point- even if more people were looking at the source code, that doesn't mean that they are:

1. knowledgeable enough to find and identify flaws
2. Capable of finding a way to fix it
3. willing to fix flaws
4. able to fix flaws

That last one is important. contributing to the code-base of most Open Source projects is bound in red tape and politics. If any one of the lead developers doesn't like your "coding style" or your user handle, or anything, they'll just veto it. It doesn't matter if the pull request was for a segment of code you wrote to fix a gaping security hole. Open Source is about hubris first, and functionality second about 80% of the time. But that is all pointless, because like  I said, nobody goes and browses the source to- anything.

Quote
I'd think if there are going to be eyes gazing on Linux source code it would be a distro that is more commonly used, obviously to improve it's usability and security.
Except there is no reason to say their cause is "obvious"- there is no reason to conclude that the source won't be perused to look for security holes to exploit, rather than fix, just as compiled closed-source application have their innards prodded via dissassembers and reverse-engineering for that purpose.
I was trying to dereference Null Pointers before it was cool.

joy division

  • Guest
Re: linux security
« Reply #7 on: December 27, 2011, 11:00:03 PM »
Quote
You missed my point-


sorry

When I read the chatting about Linux it sounds good on the surface but you bring up some convicting points. 

I picked a good place to ask this question it seems.. thx

rece



    Beginner
    • Experience: Familiar
    • OS: Linux variant
    Re: linux security
    « Reply #8 on: January 10, 2012, 03:39:11 PM »
    you can use clam antivirus and also get a firewall on linux it helps! look it up and see how it will work.