Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is the Linux Desktop less secure than Windows 10? [pdf]

fosdem.org

Post reply on HN
Print view View original

81–90 of 190 posts

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#81

Post by AsyncAwait »

sytelus wrote: post #76
AsyncAwait wrote: post #55

Earlier quoted context omitted.

> you would count on them to fix it immediately, push out the automatic update and go on with your life. Not only do you get security updates for your distro with the vast majority of Linux distros, but you also get it for all your 3rd party software, using the same system mechanism. They may not push the updates automatically, (you can of course set it that way), but some of us still want to be in control of what ge…

The 3rd party software is huge problem, actually. When you do apt-get or install using Ubuntu App Store it gives a false sense of security to novice user that things are safe. This is even more problematic because there are so many things one needs to download on default desktop to be on par with default Windows. The File Manager UI, for example, lacks too many features and user must investigate alternatives and eith…

> it gives a false sense of security

Why is getting the latest security updates giving a false sense of security exactly?

> The File Manager UI, for example, lacks too many features and user must investigate alternatives and either assume that everything is all right or deeply examine security vulnerabilities for each available option. Same goes for basic things like text editor or calculator and so on.

This is where you're being unfair, the notion that the default file manager is not good enough is subjective, it is plenty good for most people.

(Finder for macOS also lacks many features, yet many people never bother with alternatives).

Moreover, if you do need to find a replacement, if it is in the official repos, it probably means it is popular enough to be solid.

As for things like an editor,, are you telling me that Notepad is more featured than gedit?

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#82

Post by yAnonymous »

dijit wrote: post #80
belorn wrote: post #46

Earlier quoted context omitted.

Security without a threat assessment is not very meaningful. If we are comparing a default linux desktop installation and a default windows installation, what would the test setup look like? Let say we had two such machines and gave them each a reachable ip address and let the first test just be them running unattended until unwanted software got in. In the second experiment we had the same machines go to random webs…

Just because Windows goes down first doesn't mean that Linux is more secure. It only means that it doesn't have a high enough market share to meaningfully exploit for a return on investment. We should take the metric of "given a motivated party, how difficult would it be to exploit this machine" I have no doubt people are already sufficiently motivated to exploit Windows. But maybe only the NSA gives a shit about Lin…

You're ignoring that most Linux distros come with better defaults, i.e. no open ports. Reducing the attack surface is an important part in keeping the OS safe. Windows is remarkably bad in that regard.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#83

Post by andai »

r3bl wrote: post #26

Ironically, I didn't pay attention to the "[pdf]" part of the title, and as soon as I clicked the link, the PDF file got downloaded. I have a pretty strict AppArmor profile for Evince (AKA Document Viewer on GNOME-based DEs), so I thought that automatically downloading PDFs and opening them in Evince instead of in the web browser would be safer. I didn't even thought about this kind of attack surface.

Apparently, the code for parsing PDFs has grown larger than the linux kernel. That's quite an attack surface!

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#84

Post by majewsky »

dijit wrote: post #80
belorn wrote: post #46

Earlier quoted context omitted.

Security without a threat assessment is not very meaningful. If we are comparing a default linux desktop installation and a default windows installation, what would the test setup look like? Let say we had two such machines and gave them each a reachable ip address and let the first test just be them running unattended until unwanted software got in. In the second experiment we had the same machines go to random webs…

Just because Windows goes down first doesn't mean that Linux is more secure. It only means that it doesn't have a high enough market share to meaningfully exploit for a return on investment. We should take the metric of "given a motivated party, how difficult would it be to exploit this machine" I have no doubt people are already sufficiently motivated to exploit Windows. But maybe only the NSA gives a shit about Lin…

You're disregarding the difference between being more secure theoretically versus in practice.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#85

Post by majewsky »

MohammadLee wrote: post #57
xpaulbettsx wrote: post #6

I mean, the answer is unequivocally, without the slightest doubt, yes. The Linux Desktop is probably a good 5-10yrs behind Windows 10 in terms of defense-in-depth mitigations as well as exploits in common targets like file parsers etc etc. https://www.blackhat.com/docs/us-16/materials/us-16-Weston-W... is a good reference for all the stuff that Desktop Linux in 2017 is for the most part, missing

Now imagine what a Linux distribution could achieve with the same budget...

Realistically, about the same. Many of the problems with Windows are rooted in being developed by a huge corporation with as much budget and manpower as it has.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#86

Post by gjjrfcbugxbhf »

godzillabrennus wrote: post #32
mirimir wrote: post #29

Earlier quoted context omitted.

Well, I'm worried about Microsoft knowing who I am . It's hard to get legitimate Windows installs that aren't linked to non-anonymous payment methods. Not impossible, but hard.

Take cash, buy computer at retailer...

Hope retailer has no CCTV. Hope town has no CCTV. Leave phone at home.

It depends how deep your desire for annonimity is...

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#87

Post by gjjrfcbugxbhf »

bkor wrote: post #60
xorcist wrote: post #42

When this metadata indexing was introduced in gnome/kde many users complained, because it pegged their cpu and was really unasked for. But some felt that this was something the MacOSX had and therefore some developers felt it was a good default. I'm not convinced, partly because of the increased attack surface. The desktop environment itself is but a small part of the complete desktop. Some important differences betw…

Showing dialogs is not a solution. Various studies have already shown users click any dialog which pops up without actually reading the dialog. Loads of browsers do download automatically. Making things inconvenient and delegating security decisions to the user isn't good enough. Make it convenient and secure! PS/Edit: Btw, under Windows 10 loads of things are indexed. It makes things very convenient. You use your pc…

Indexing for search - it depends upon what you use your computer for. Some of us want to do stuff with our processors and memory and get very annoyed when the OS decides to use resources we were hoping would be used for our programs...

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#88

Post by piyush_soni »

MohammadLee wrote: post #57
xpaulbettsx wrote: post #6

I mean, the answer is unequivocally, without the slightest doubt, yes. The Linux Desktop is probably a good 5-10yrs behind Windows 10 in terms of defense-in-depth mitigations as well as exploits in common targets like file parsers etc etc. https://www.blackhat.com/docs/us-16/materials/us-16-Weston-W... is a good reference for all the stuff that Desktop Linux in 2017 is for the most part, missing

Now imagine what a Linux distribution could achieve with the same budget...

Well, that can't be used as an excuse for not being secure by default.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#89

Post by notalaser »

deckiedan wrote: post #21
vocworker wrote: post #15

Earlier quoted context omitted.

Sure, extremely motivated individuals or governments might do that. But I'd still rate a distribution by it's default security settings. Being secure by default is important if you are shipping to thousands of users.

Fedora comes with SELinux enabled by default, and is working towards more interesting sandboxing stuff for the future too.

Unfortunately, while SELinux itself is good, the tooling around it has to be the most atrocious, useless steaming pile of thrash in this niche. From setroubleshootd randomly deciding to eat up 100% of CPU time (and no one being able to explain exactly what it does) to the endless fun of figuring out what policycoreutils-python & friends do and how, actually doing something useful with it is somewhere between "painful" and "frustrating". If Microsoft had published something like this, they'd have been the laughing stock of the whole Linux community.

I don't know anyone in my immediate circle of peers - not even people who use SELinux on servers or in products that they develop - who doesn't disable SELinux on their desktop. They're not idiots, either, nor re-booted Windows programmers that the IoT and DevOps craze has thrown into the Linux world, many of us have been using Linux since back when there was no E in RHEL.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#90

Post by Accacin »

digi_owl wrote: post #67
nimish wrote: post #31

Given that piping curl in bash with sudo is considered acceptable, this is not surprising

Outside of architecture astronautical web development (usually done on a Mac while sipping some kind of coffee and milk blend) no it is not acceptable one bit.

I mean, even to install Rust they give you a command to do this. So no, it's not just web dev.
Post reply on HN