Live data from Hacker News

Is the Linux Desktop less secure than Windows 10? [pdf]

fosdem.org

121–130 of 190 posts

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#121

Earlier quoted context omitted.

> Windows does it, too, I guess No, it generates thumbnails outside the main UI thread; sometimes it's a bit slow in so doing, but I've never seen it hang an Explorer window, regardless of file size or quantity. (Windows 7, but it would astonish me to learn that 10 displays a regression here.)

> No, it generates thumbnails outside the main UI thread; sometimes it's a bit slow in so doing, but I've never seen it hang an Explorer window, As an example of the contrary, I've seen misbehaving third party thumbnail-providers cause Windows explorer to crash entirely. Only way to "fix" it was to install the software which added the thumbnail-provider, or go into the folder via cmd.exe and rename the file you "knew…

If the third-party thumbnailer is implemented as a shared library (DLL) that Explorer is configured to load, then sure, a segfault or similar in the library will kill the whole process. Not sure how that's Microsoft's fault. Sure, there's an argument that loading a library is the wrong model, but there's a performance tradeoff, especially given Windows' relatively slow IPC capabilities. The real surprise here is that Linux manages to be comparably slow, but when you complicate a simple, fast IPC model with dbus and a million other middleware layers, I suppose it starts to make more sense.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#122
post #42

When this metadata indexing was introduced in gnome/kde many users complained, because it pegged their cpu and was really unasked for. But some felt that this was something the MacOSX had and therefore some developers felt it was a good default. I'm not convinced, partly because of the increased attack surface. The desktop environment itself is but a small part of the complete desktop. Some important differences betw…

I mean, competently implemented background indexing shouldn't be a security risk or a performance issue. Microsoft had those problems, too, when they introduced their own indexer with XP. Doing desktop support for slow XP boxes, you rapidly learned to disable the indexer first. But by roughly mid- to late Vista, it had ceased to be a general problem. (Maybe earlier; I had ceased to be closely involved with support by…

> I mean, competently implemented background indexing shouldn't be a security risk or a performance issue.

Except ofcourse in the 100% theoretical, never ever seen in the wild, case of bugs in file-format parsers. It's not like Linux's "file" or "strings"-utility[1] has had a local exploits in the past or anything.

Uhm... So yeah... About that....

Back in the real world, this is a very real attack vector. Especially when it runs in the background on a large batch of files, automatically and unasked for.

Note: I'm not saying I'm against indexing content for easier access and help locating files. I'm just saying that you can't simply dismiss it as a security-risk because it runs in the background.

[1] http://lcamtuf.blogspot.no/2014/10/psa-dont-run-strings-on-u...

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#123

Earlier quoted context omitted.

Take cash, buy computer at retailer...

Hope retailer has no CCTV. Hope town has no CCTV. Leave phone at home. It depends how deep your desire for annonimity is...

Don't post online either, unless you are able to alter your writing style often. Passed writings linked to your profile will be used to try to identify you.

It all depends on your threat model and how wanted you are as a target.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#124
post #60

Earlier quoted context omitted.

Showing dialogs is not a solution. Various studies have already shown users click any dialog which pops up without actually reading the dialog. Loads of browsers do download automatically. Making things inconvenient and delegating security decisions to the user isn't good enough. Make it convenient and secure! PS/Edit: Btw, under Windows 10 loads of things are indexed. It makes things very convenient. You use your pc…

'locate' is 35 years old. And has been available on linux desktops since 1991. Just saying.

I doubt very much my Slackware 2.0 copy had locate.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#125

Earlier quoted context omitted.

> No, it generates thumbnails outside the main UI thread; sometimes it's a bit slow in so doing, but I've never seen it hang an Explorer window, As an example of the contrary, I've seen misbehaving third party thumbnail-providers cause Windows explorer to crash entirely. Only way to "fix" it was to install the software which added the thumbnail-provider, or go into the folder via cmd.exe and rename the file you "knew…

If the third-party thumbnailer is implemented as a shared library (DLL) that Explorer is configured to load, then sure, a segfault or similar in the library will kill the whole process. Not sure how that's Microsoft's fault. Sure, there's an argument that loading a library is the wrong model, but there's a performance tradeoff, especially given Windows' relatively slow IPC capabilities. The real surprise here is that…

I'm not excusing the Linux implementation for being slow, which I agree it sometimes is (Hello Dropbox and my huge, flat "Camera uploads" folder...).

I'm just saying that I've seen bad things happen on Windows too. Not blaming Microsoft, just saying that in a typical end-user scenario with lots of randomly installed software, you will have Explorer break too.

Basically the grass is rotten everywhere :)

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#126
post #31

Given that piping curl in bash with sudo is considered acceptable, this is not surprising

Because the Windows method of downloading and double-clicking a binary is so much better?

A random exe file you download won't be running through sudo, you'll see elevation requests. The elevation request is ~very spooky~ unless the exe is codesigned by a reputable certificate issuer. W10 turns the whole screen red and sometimes warns you that the exe itself is actively unsafe.

Of course, end users will just click OK on the elevation request, but regardless, it's not a fair comparison. Downloading random exes off the internet is more like 'curl | bash' ('still bad' level) than 'curl | bash | sudo' ('are you insane?' classification)

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#127
post #60

Earlier quoted context omitted.

Showing dialogs is not a solution. Various studies have already shown users click any dialog which pops up without actually reading the dialog. Loads of browsers do download automatically. Making things inconvenient and delegating security decisions to the user isn't good enough. Make it convenient and secure! PS/Edit: Btw, under Windows 10 loads of things are indexed. It makes things very convenient. You use your pc…

'locate' is 35 years old. And has been available on linux desktops since 1991. Just saying.

Hasn't it been replaced by slocate, mlocate, tlocate or another variant since ?

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#128

Earlier quoted context omitted.

Because the Windows method of downloading and double-clicking a binary is so much better?

A random exe file you download won't be running through sudo, you'll see elevation requests. The elevation request is ~very spooky~ unless the exe is codesigned by a reputable certificate issuer. W10 turns the whole screen red and sometimes warns you that the exe itself is actively unsafe. Of course, end users will just click OK on the elevation request, but regardless, it's not a fair comparison. Downloading random…

So is your objection just that sudo isn't scary enough?

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#129
post #80

Earlier quoted context omitted.

Just because Windows goes down first doesn't mean that Linux is more secure. It only means that it doesn't have a high enough market share to meaningfully exploit for a return on investment. We should take the metric of "given a motivated party, how difficult would it be to exploit this machine" I have no doubt people are already sufficiently motivated to exploit Windows. But maybe only the NSA gives a shit about Lin…

You're ignoring that most Linux distros come with better defaults, i.e. no open ports. Reducing the attack surface is an important part in keeping the OS safe. Windows is remarkably bad in that regard.

Windows comes with its firewall turned on by default since XP SP2, most popular distros doesn't do that even today. Windows 10 doesn't even respond to ping by default (which is a pita).

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#130

Earlier quoted context omitted.

Hope retailer has no CCTV. Hope town has no CCTV. Leave phone at home. It depends how deep your desire for annonimity is...

Don't post online either, unless you are able to alter your writing style often. Passed writings linked to your profile will be used to try to identify you. It all depends on your threat model and how wanted you are as a target.

It helps to be multilingual :)
Post reply on HN