Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is the Linux Desktop less secure than Windows 10? [pdf]

fosdem.org

Post reply on HN
Print view View original

41–50 of 190 posts

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#41

Post by SwellJoe »

It's interesting that the problems are all with things that I actively dislike about the modern Linux desktop. I mean, I guess it's OK that it creates thumbnails of images...but, the tendency to grind away for seconds whenever opening a big folder (Windows does it, too, I guess) is just annoying. I end up using command line most of the time for file management tasks because it's too slow and cumbersome to use the UI.

Also, it seems to be file types that would never be automatically parsed on Windows or Mac. I mean...a Nintendo music file? Why on earth would the desktop environment need to do that? (And, I say this as someone that composes chiptunes and enjoys listening to them, but I don't need my desktop environment to grok them).

And, I guess I like that Linux does things out of the box that Windows and Mac need third party apps for (much less so, today, but still a factor I notice when I reboot into Windows). But, maybe this is overkill?

And, yes, I think it's clear that Microsoft made a significant investment in security a decade or so ago, and it has paid off massively. Windows is remarkably more secure, stable, and reliable than it was a decade ago. I still prefer Linux, but the case for Linux over Windows is nowhere near as compelling and clear cut as it once was.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#42

Post by xorcist »

When this metadata indexing was introduced in gnome/kde many users complained, because it pegged their cpu and was really unasked for. But some felt that this was something the MacOSX had and therefore some developers felt it was a good default. I'm not convinced, partly because of the increased attack surface.

The desktop environment itself is but a small part of the complete desktop. Some important differences between those specific desktops are are: 1) Clicking a file both runs the code and opens the file, and difference is hidden from the user. 2) Mail clients start pretty much any software automatically to open attachments. 3) Office software runs code embedded in documents with just a user prompt. 4) A lot of plugins are active by default. Flash and ActiveX used to be, but this is better now. 5) Code is run automatically on removable media insertion. 6) Users download software from random web pages instead of vetted archives.

These things are not technical but behavioral in nature and make desktops ownable. I hope the Linux desktop never emulates them. Web browsers have gotten so much better but one simple thing they could is stop downloading things automatically. That save dialog won't scare anyone, and users will stop having lots and lots of unknown files in their download directory.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#44

Post by davidp »

nottorp wrote: post #39
hannob wrote: post #7

Speaker here. As the slides may not tell the whole story (there should be a video soon), I covered this mostly also for LWN recently: https://lwn.net/Articles/708196/

Video? What happened to good old fashioned text? I can read 10x faster than you can talk...

Yeah, screw that guy for offering free quality content in video form, AND the nicely written text piece you just asked for.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#45

Post by mijoharas »

CJefferson wrote: post #4

I believe in sandboxing, I hope it gets better and easier to use. I work on several C programs. I wish for the day when we have an easy to use, cross platform method of setting up a small set of open files at the start of a program, then be able to say "No more file access, no more network connections". I know this hides a whole bunch of complication, which is why it's hard and why there are so many ways to do it --…

I used to be part of a team writing a large C++ application with lua bindings. We had two lua environments, and you can specify the exact libraries available to lua, so we'd start up a lua environment without a filesystem or network once we were set up.

Just thought it was an interesting approach I'd share.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#46

Post by belorn »

xpaulbettsx wrote: post #6

I mean, the answer is unequivocally, without the slightest doubt, yes. The Linux Desktop is probably a good 5-10yrs behind Windows 10 in terms of defense-in-depth mitigations as well as exploits in common targets like file parsers etc etc. https://www.blackhat.com/docs/us-16/materials/us-16-Weston-W... is a good reference for all the stuff that Desktop Linux in 2017 is for the most part, missing

Security without a threat assessment is not very meaningful. If we are comparing a default linux desktop installation and a default windows installation, what would the test setup look like?

Let say we had two such machines and gave them each a reachable ip address and let the first test just be them running unattended until unwanted software got in.

In the second experiment we had the same machines go to random websites (top 1k), clicking randomly, using the default web browser.

In the third, we let them click and run attachment from email spam.

In the fourth and final experiment, we hire pen testers to target the machines explicitly.

With the same conviction that xpaulbettsx wrote, I have no doubt that the first 3 tests would show Windows 10 going down first. The amount of threats that targets window user is just order of magnitude more than those targeting linux users. The fourth test might give different results, but users who want to defend against targeted attack are generally advised to use extra security tools to defend themselves.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#47

Post by therealmarv »

nottorp wrote: post #35

Hmm. If i look at the slides, the article should be renamed "gstreamer, and some stuff browsers on all platforms do, are insecure"? Is it easier to change your media player on Linux, or to trust Microsoft? Say, does a default Windows install still enable 20 networked services that don't belong on a home computer and can be exploited without the user downloading anything?

Nevertheless, the architecture is flawed. And not all Linux users know how to do that!

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#48

Post by 21 »

nottorp wrote: post #35

Hmm. If i look at the slides, the article should be renamed "gstreamer, and some stuff browsers on all platforms do, are insecure"? Is it easier to change your media player on Linux, or to trust Microsoft? Say, does a default Windows install still enable 20 networked services that don't belong on a home computer and can be exploited without the user downloading anything?

To answer the second question, no. A fresh install of Windows connected to the Internet will not be infected automatically (of course, assuming no new 0-day)

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#49

Post by AimHere »

simonh wrote: post #30
serf wrote: post #27

Earlier quoted context omitted.

No, but i'd be worried about a government with power to control Microsoft using such information in a negative way. Basically this scenario comes to mind : a) A power change occurs within a government. This power change facilitates the changing of laws. b) A corporation with massive stores of information about individuals is within this government. c) New government doesn't like X people because they aren't Y people.…

But surely almost all of the above, while theoretically a possible future issue in the USA, is day-to-day reality in Russia and China already.

Presumably the commenter is physically out of reach of the Russian and Chinese governments, and being the victim of regime change in the US is more likely than being invaded by the other two.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#50

Post by 21 »

unsignedint wrote: post #33

If anything, Linux may benefit from relatively varied installation states in security scheme (SELinux, Apparmor, etc.), libraries included, and desktop environment. It is perhaps bit harder to pull off one-size fit-all attacks. Things like data at rest protection seems to work better on Linux; as far as I know, there aren't out of box solution for Pre-boot authentication for Windows, for instance. Edit: To the latter…

Bitlocker supports pre-boot auth even without TPM (but then you are exposed to the evil-maid attack).
Post reply on HN