full-disclosure - [inbox] Re: RE: Linux (in)security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <015101c3999c$6ae75800$1e2ea8c0@LUFKIN.DPSOL.COM>
From: purdy at tecman.com (Curt Purdy)
Subject: [inbox] Re: RE: Linux (in)security

> >> http://www.linuxunlimited.com/why-linux.htm
> >> ``Properly configured and maintained, Linux is one of the
> >> most secure operating systems available today.''
> >
> > The key words here are "properly configured".
>
> Well, once "properly configured", pretty much _any_ operating
> system would
> make it to the top 0.01% of the most secure boxes in the
> world.
<snip>

I hardily disagree.  When you have inherently more secure code in OS's like
*NIX and Netware, as evidenced by the paltry number of patches required by
those OS's (1 in Netware vs. 38 for Windows in the same period)it doesn't
matter how well you configure Windows, it will still be vulnerable, waiting
for a compromise of the next discovered hole.  The reason for this is
fundamental in the design.  From the use of a registry (which corrupts with
time, finally requiring re-installation) to the fact that no single human
being knows all the source code for Windows, much less audits it, is the
difference between MS and the rest.

This is the reason open-source is inherently more secure.  First, people can
actually audit it for security (you think IBM recommended Linux without
going over every single line of code?)  Second, everyone can see the code
and contribute fixes when they see a potential problem, not after a
vulnerability has developed and been discovered.  True Netware is
closed-source but the engineering is superb and it does only what it needs
to do, be a network OS.

People have the wrong idea when they say "Windows vulns are more researched
and discovered because it so prevalent.  Without a total re-architecture and
re-write of Windows code, if and when (hopefully) Windows OS's become a
minority, they will still be getting the vast majority of discovered and
exploited holes. Lay a dollar to a dime on that.

Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA
Information Security Engineer
DP Solutions

----------------------------------------

If you spend more on coffee than on IT security, you will be hacked.
What's more, you deserve to be hacked.
-- White House cybersecurity adviser Richard Clarke