Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is the Linux Desktop less secure than Windows 10? [pdf]

fosdem.org

Post reply on HN
Print view View original

101–110 of 190 posts

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#101

Post by throwanem »

xorcist wrote: post #42

When this metadata indexing was introduced in gnome/kde many users complained, because it pegged their cpu and was really unasked for. But some felt that this was something the MacOSX had and therefore some developers felt it was a good default. I'm not convinced, partly because of the increased attack surface. The desktop environment itself is but a small part of the complete desktop. Some important differences betw…

I mean, competently implemented background indexing shouldn't be a security risk or a performance issue.

Microsoft had those problems, too, when they introduced their own indexer with XP. Doing desktop support for slow XP boxes, you rapidly learned to disable the indexer first. But by roughly mid- to late Vista, it had ceased to be a general problem. (Maybe earlier; I had ceased to be closely involved with support by then.)

The other thing about an indexer like this is that you need it well integrated into the UI to get the benefit. macOS has Spotlight, which is excellent. Windows has Start search, which is OK for programs if you don't misspell the name, and tolerable for documents if you use the MS default home directory structure. I haven't used desktop Linux since Ubuntu 8 or so, so I don't know what it has, but if it is indeed a Spotlight-like experience they're shooting for, file indexing is just the start.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#102

Post by throwaway1023 »

SwellJoe wrote: post #41

It's interesting that the problems are all with things that I actively dislike about the modern Linux desktop. I mean, I guess it's OK that it creates thumbnails of images...but, the tendency to grind away for seconds whenever opening a big folder (Windows does it, too, I guess) is just annoying. I end up using command line most of the time for file management tasks because it's too slow and cumbersome to use the UI.…

Just a small comment on why the desktop environment might need to parse such a file: How about sorting music files according to their real length? Many desktop environments support such a feature, and users like those features, too.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#103

Post by aomix »

I've read the OpenBSD developers poke fun at Linux by saying the same thing. During the 2000/XP time frame security became a serious threat to Microsoft's market dominance. Since then Windows has kept up with the best security practices and technologies better than most. It's very impressive considering I can still run Windows 2000 binaries on Windows 10.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#104

Post by throwanem »

DanBC wrote: post #100
throwanem wrote: post #96

Earlier quoted context omitted.

> Windows does it, too, I guess No, it generates thumbnails outside the main UI thread; sometimes it's a bit slow in so doing, but I've never seen it hang an Explorer window, regardless of file size or quantity. (Windows 7, but it would astonish me to learn that 10 displays a regression here.)

It's pretty well known. There are several workarounds. One is to optimise view for general, not images or video or sound. Another is to "reset your folders" http://superuser.com/questions/1097394/windows-10-download-f...

There's a suggestion that that has less to do with inherent issues and more with wanting to display more information than can be obtained from whatever the Windows API calls stat(2). An indexer can actually help a great deal here, but I don't know if that's actually the issue - I should be getting a work-issued Windows 10 box pretty soon here, and look forward to experimenting for myself.

That said, even the slowness under discussion doesn't actually hang the UI thread. That's something you have to be pretty special to get so badly wrong, in this day and age where even web devs are learning better than to do expensive work in the main thread, and have the tools available to avoid doing so.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#106

Post by unhammer »

thatcat wrote: post #14
AsyncAwait wrote: post #12

Earlier quoted context omitted.

The thing with the Linux Desktop is that you can selectively enable SELinux, use PaX etc. and have security comparable to, if not better, than Windows 10, plus the fact that Linux is a much more varied attack surface still applies. Or you can do nothing, in which case you're probably less secure.

Where's a good place to get a general guide on every day desktop use of SELinux, PaX, etc?

One of the slides also mentioned at what point each distro introduced ASLR (ie. it might be worth upgrading your Ubuntu to 16.10 if you're on an older one)

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#108

Post by MohammadLee »

majewsky wrote: post #85
MohammadLee wrote: post #57

Earlier quoted context omitted.

Now imagine what a Linux distribution could achieve with the same budget...

Realistically, about the same. Many of the problems with Windows are rooted in being developed by a huge corporation with as much budget and manpower as it has.

I get your point, but I meant that the open source community works because it can leverage on the work from each other. The achievements would be multiplied by the potential reach.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#109

Post by belorn »

dijit wrote: post #80
belorn wrote: post #46

Earlier quoted context omitted.

Security without a threat assessment is not very meaningful. If we are comparing a default linux desktop installation and a default windows installation, what would the test setup look like? Let say we had two such machines and gave them each a reachable ip address and let the first test just be them running unattended until unwanted software got in. In the second experiment we had the same machines go to random webs…

Just because Windows goes down first doesn't mean that Linux is more secure. It only means that it doesn't have a high enough market share to meaningfully exploit for a return on investment. We should take the metric of "given a motivated party, how difficult would it be to exploit this machine" I have no doubt people are already sufficiently motivated to exploit Windows. But maybe only the NSA gives a shit about Lin…

Security without threat assessment is meaningless because security is about preventing a negative outcome. If the environment is perfectly safe then no security is needed, and if the environment is infinitely hostile then no amount of security will prevent a negative outcome.

Example: Being in an armored car in a war zone is still more risky than riding a bike in a peaceful country side, even if the bike has significant less security than an armored car. The Advice then is not to tell people in war zones to get bikes, nor is it to tell people to get rid of bikes in favor of armored cars. Security needs to match the need, which depends on the threat level.

In my above post I included "targeted attack" as the fourth test, named by security theory as an attack by a motivated party towards a specific resource. If a motivated party wants to attack a specific resource, then the defender needs to raise security above that of general security. Many government agencies have policies based on such threats, and neither a default Windows 10 or default Linux distribution would qualify for such environment. SELinux however was designed for that threat level and is thus common in military organizations, banks, and similar high risk environments.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#110

Post by c3833174 »

throwanem wrote: post #96
SwellJoe wrote: post #41

It's interesting that the problems are all with things that I actively dislike about the modern Linux desktop. I mean, I guess it's OK that it creates thumbnails of images...but, the tendency to grind away for seconds whenever opening a big folder (Windows does it, too, I guess) is just annoying. I end up using command line most of the time for file management tasks because it's too slow and cumbersome to use the UI.…

> Windows does it, too, I guess No, it generates thumbnails outside the main UI thread; sometimes it's a bit slow in so doing, but I've never seen it hang an Explorer window, regardless of file size or quantity. (Windows 7, but it would astonish me to learn that 10 displays a regression here.)

That's not the problem, most DE file managers use an external process too (via dbus), but it's still slow, even on an SSD or when the cache has alredy been generated.

They're also buggy, XFCEs thumbnailer thumblerd (also used in LXDE and probably others) used to have memory leaks when it encountered video files with unknown codecs, newer versions re-scan the entire cache every time you delete/move a directory, making quite a bit of disk IO.

I've found simpler file managers like rox-filer, pcmanfm to be much faster at thumbnailing.

Post reply on HN