Messages in this thread | | | Date | Fri, 13 Aug 1999 08:50:53 -0400 (EDT) | From | "Robert G. Brown" <> | Subject | Re: Gates of Hell |
| |
On Thu, 12 Aug 1999, Jonathan Masters wrote:
> Yep. I took the same attitude with him as I did with barclays bank and > threatened to sue him/her for discrimating between OSs in such a manner, I > mean winblows is crap everyone knows, and OK, so MacOS is *better*, but since > that microshark "loan" of millions to Apple, I will always view Apple and > microshaft as being too close so I find this kind of discrimination very bad > for everyone. BARCLAYS HAD THE NERVE to claim that > LINUX IS ***LESS*** SECURE THAN WINDOWS 95/98/NT - what an utter sh*tload of > crap. I mean, it made me laugh and I've still gotta decide if I'm gonna pursue > the case with Barclays.... (I *used* to like them too).
Well, let's be less knee-jerk biased about this. As far as the network is concerned, Win9X is nearly perfectly secure because they have an outgoing-only sort of network. Can one crack a Win9X box on the network? I doubt it -- even if one WANTS to login to it is impossible because it is brain dead at the network level, because it has no shells, and so forth. Macintoads are no better. So they're "secure" in that only the person logged into the console can do anything and it is difficult for a remote cracker to install a snooper or capture keystrokes or the like.
WinNT is a more reasonable complaint; it has a real network and is remote accessible and hence remote crackable. I'd guess that one can crack a networked NT box and install a keystroke/mouse snooper (or trapped version of Explorer) to trap that good old Barclay's password.
The difference is that linux has all source available, so all bugs are very rapidly found and exploits published. This is good and bad -- good in that if you religiously track the bugs and install patches you'll stay at least even with the bad guys, bad in that if you are a newbie or less conscientious, your system is probably approximately as secure as a gazebo. Parts of our network here at Duke are being portscanned by intruders literally daily; many of these are seeking well known services (like NFS) on well known operating systems (like linux) to try well known exploits that will slice into the attacked system as if its security layer weren't even there. Historically, ALL unices have had hole after hole uncovered in their daemons and services and binaries. It was only a year or three ago that a bug in syslogd was uncovered that gave open access to nearly every Unix system in the world, and sendmail was legendary up into the mid 8.X's. I keep my home linux system secure by simply turning off nearly all ports (and worrying about the two or three I leave open!). Newbies, however, often bring up their system with all sorts of daemons and services running and no idea how to manage them. Indeed, they not infrequently don't even know that they are running the services at all and don't even know what they do! They then use telnet or rlogin to login to remote sites a few times and type their passwd's in the clear on their LAN (which may be snooped) and the destination LAN (which may be snooped). All of this is an invitation to destruction.
In summary, is Barclay's being overconcerned? Possibly. At the very least, you should be able to sign something absolving them of all responsibility for an electronic theft from your accounts -- if you are willing to do this. Are they completely crazy? Absolutely not! They have no way of knowing if you are competent or incompetent as a systems manager of your linux box. In the latter case you could share your box with a dozen trolls and never know it. True, NT is little better, so they are being discriminatory, but perhaps this is where they are being foolish -- they probably shouldn't permit access from NT EITHER.
The question of how electronic commerce of all sorts will securely proceed in the future is an interesting one. These days, any successful cracker almost always has the opportunity (if they choose to use it) to become a thief or blackmailer. Booby trap netscape and sooner or later you'll get a credit card number. Perhaps you'll observe somebody cruising a gay website. Maybe you'll intercept email to a secret lover. Privacy is an important issue, and we assume our systems to be secure when they almost never really are. Well, on THIS list they probably are for the most part, but out there in userspace, especially now that linux is in box sets in ordinary stores being installed by the ignorant, I'm sure that they are not infrequently wide open.
rgb
Robert G. Brown http://www.phy.duke.edu/~rgb/ Duke University Dept. of Physics, Box 90305 Durham, N.C. 27708-0305 Phone: 1-919-660-2567 Fax: 919-660-2525 email:rgb@phy.duke.edu
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |