Message-ID: <200401190338.i0J3cRU20923@netsys.com>
From: mmarshall112 at comcast.net (Mike Marshall)
Subject: Religion... was RE: Re: January 15 is Personal Firewall Day, help the cause

Can we please just stop OS-based arguments?  And can we agree that all OSs
earn their places, rightfully?  Windows has earned very few security points
to date (and maybe none), but we can move toward securing this OS despite
its programming shortcomings.  Windows, and thankfully, linux isn't going
away any time soon.  Linux installs mostly secure by default, windows
installs insecure by default, but that doesn't mean people can't harden
either OS and make it more secure.

Personaly, I've run a large data center using both OSs (various versions)
securely for over 5 years.  I've developend and implemented windows and
linux hardening templates.  There are many ways to secure and harden both.
As many have pointed out, layers matter.

Mike

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of David F. Skoll
Sent: Sunday, January 18, 2004 7:12 PM
To: Wes Noonan
Cc: full-disclosure@...ts.netsys.com
Subject: RE: Religion... was RE: [Full-Disclosure] Re: January 15 is
Personal Firewall Day, help the cause

On Sun, 18 Jan 2004, Wes Noonan wrote:

> > On Sun, 18 Jan 2004, Wes Noonan wrote:
> > Why?  Name one virus for Linux that AV software would have protected 
> > against, that a noexec /tmp wouldn't have.

> Security isn't about protecting against old threats; it's about 
> protecting against new threats.

Exactly.  A/V software can only protect against *old* threats, because a
virus has to be in the signature database.  Mounting /tmp noexec can protect
against a wide class of threats (those threats that rely on writing a file
to the file system and then executing it.)

> If running virus protection has the potential to protect against new 
> threats,

But it doesn't.

> than it is worth running.

Therefore it isn't.

> If an IDS/IPS has the
> potential to protect against new threats, than it is worth running.

IDS itself cannot protect against anything; it can only detect unusual
activity.  (That doesn't make it worthless, of course.)  IPS systems may be
worthwhile depending on how many false-positives they issue.

> Security is about a total process, not a specific product or 
> application.

I agree.  But a particular product or application *can* lead to insecurity.

> > We're a 7-person shop with a budget of $0 for software.  I'd love to 
> > see a Microsoft shop with a similar software budget.

> I'd love you to show me a 700, 7000 or 70000 person shop that can say
that.

Wait a few years and get back to Roaring Penguin. :-)

Obviously, right now, I can't.  But there are plenty of large organizations
using free software; HP claims to have made $2.5 billion in Linux-related
sales.

It will happen.  The economics dictate it.  Companies that save money
because of lower licensing costs, lower license enforcement costs, and
(especially) lower costs to maintain secure networks, will succeed where
companies that have higher costs fail.

> You have to think about things like "what if David, who is the only 
> person who really knows our systems, leaves. Where does that leave us"?

That might have been true a couple of years ago, but there are plenty of
Linux experts now, as you noted.

> Microsoft is only un-securable for those who don't know how to secure 
> it

No.  The fundamental problem with Windows is the problem that lead to the
creation of the anti-virus industry: Encoding of metadata in filenames.
The fact that ".exe" on Windows means the same thing as turning on the
execute bit in UNIX has cost the world economy billions.  And it's
impossible to change this without fundamentally changing Windows.  (Even
this flaw isn't a Microsoft innovation; it was first revealed in 1987 in the
infamous CHRISTMA EXEC worm at IBM on the VM/370 system.)

This flaw, the readiness of a Windows system to enable execute permission
depending on the filename, makes every single Windows box a ticking time
bomb.  Someone just has to be clever enough to deposit an .exe on a system
and trick someone into running it.

The social engineering required to do the same on Linux is an insurmountable
hurdle; not only do you have to deposit the file, but you have to convince
someone to turn on the execute bit, which no Linux mail clients currently
do, and which the average office worker is unlikely to even know how to do.
(That's why I have a warm feeling when our sales people use Linux; they
don't know enough to be dangerous. :-))

> You claim, repeatedly, that Linux is so much easier to secure. I 
> believe that this is directly related to your level of expertise on 
> Linux. Similarly you claim, repeatedly, that Microsoft is impossible 
> to secure. I believe, similarly, that this claim is directly related 
> to your level of expertise on Microsoft.

No; it is related to the fundamental design flaw I mentioned above.

[...]

> Someone else pointed out that no OS is bug free, which is a truism. 
> The ability to harden a system, if one knows what they are doing, is 
> also a truism.

Are you claiming that all OS's have the same inherent security, and that all
can be hardened to the same extent?  If yes, then you're out of touch with
reality.  If no, then some OS's must be better than others, and I claim that
Linux, out of the box, is more secure than Windows, out of the box, and
furthermore, I claim that Linux is possible to secure to a greater extent
than Windows (especially with the NSA work now merged into Kernel 2.6.)

> The more and more you post, the more things like this you write, the 
> more clear it becomes that your position has little more than a 
> religious passion for Linux and a religious dislike of Microsoft 
> backing it with little other real substance.

It's easy to glibly dismiss my argument, but you don't address the facts.
Unless Microsoft has an economic incentive to improve security, it won't.
And the only economic incentive it could have is the potential loss of
market share.  And that can't happen without competition.  And competition,
in the consumer OS market place, cannot happen unless people are willing to
look at alternatives to Windows.

> Protestants, Catholics. Muslims, Jews. Penguinistas and Microsofties. 
> It isn't about securing our computers, it's about not using Microsoft. 
> It's an old, tired, pointless argument. :shrug:

You fail to refute it, because you cannot.

Regards,

David.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Powered by blists - more mailing lists