full-disclosure - RE: Linux (in)security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: lists at onryou.com (Cael Abal)
Subject: RE: Linux (in)security

>>Linux is the hands of someone with no interest or regard for security is the
>>same as Windows or any other OS in the hands of the same clueless
>>individual.  The main difference between the Linux and Unix variants (i.e.
>>BSD, Solaris, HP-UX) is that they have already learned their lesson regarded
>>buffer overflows and kernel hardening and allowed the user more control in
>>securing their systems.
> 
> This is repeated over and over again, but it is simply not entirely true. It
> may protect against script kiddies, but not against more sophisticated
> crackers. The following URL proves that:
> http://groups.google.com/groups?selm=20030525190037%2470c6%40gated-at.bofh.it
> 
> Both persons in this conversation have a Linux box which:
> 
> 1) Has the latest security patches installed and
> 2) Is only running the necessary services.
> 
> In other words, boxes that have ``been made secure by their users''.

Hi Peter,

You're investing a significant amount of time into convincing us that
linux boxes sitting on the internet (even when completely up to date and
reasonably locked down) aren't 100% secure.

Rest easy, each and every one of us knows this.

The point raised by others in this thread (which you seem to object to,
although you haven't really responded to) is that linux (operated by a
knowlegable user) is 'stronger' than a similar Microsoft box.

This, you should have realized immediately, is one of those
my-dad-can-beat-up-your-dad type arguments which really don't deserve a
response.

Cheers,

Cael