Live data from Hacker News

Is the Linux Desktop less secure than Windows 10? [pdf]

fosdem.org

141–150 of 190 posts

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#141

what Linux desktop?

I translated that to "the family of Linux Distro that aim to provide a desktop experience out of the box, e.g. ubuntu, mint, elementaryOS, pclinuxos, centos, zorin, manjaro, slackware, ...

Probably this list: http://distrowatch.com/search.php?category=Desktop

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#142
post #129

Earlier quoted context omitted.

You're ignoring that most Linux distros come with better defaults, i.e. no open ports. Reducing the attack surface is an important part in keeping the OS safe. Windows is remarkably bad in that regard.

Windows comes with its firewall turned on by default since XP SP2, most popular distros doesn't do that even today. Windows 10 doesn't even respond to ping by default (which is a pita).

Not sure about other distros but opensuse comes with a pretty strict firewall out of the box. My logic says that this is probably common practice for many general-use distros.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#144
post #35

Hmm. If i look at the slides, the article should be renamed "gstreamer, and some stuff browsers on all platforms do, are insecure"? Is it easier to change your media player on Linux, or to trust Microsoft? Say, does a default Windows install still enable 20 networked services that don't belong on a home computer and can be exploited without the user downloading anything?

This title is pure sensationalism. The written piece says clearly "security vulnerabilities in the GStreamer multimedia framework. A combination of the Chrome browser and GNOME-based desktops creates a particularly scary vulnerability.". Somehow this very specific combination inflated to become Desktop Linux. My default installation came with VLC, firefox and KDE. No gstreamer nor gnome installed, google products inc…

Baloo, KDE's indexing engine is apparently hit by the same vulnerability that hits Tracker (except they didn't fix it, according to the article). Also, are you sure Firefox and none of the KDE applications are using gstreamer for the backend (e.g. for HTML5 videos)?

I dislike this idea that the Linux desktop is all Gnome and systemd, too, but the situation is pretty disastrous. Things that have an X in them, from X11 to (especially...) XDG shouldn't be trusted too much...

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#146
post #39
post #7

Speaker here. As the slides may not tell the whole story (there should be a video soon), I covered this mostly also for LWN recently: https://lwn.net/Articles/708196/

Video? What happened to good old fashioned text? I can read 10x faster than you can talk...

Although this item falls on the borderline, it seems there are a lot of 10 minute videos, when a single image or paragraph will work.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#147

Earlier quoted context omitted.

"Since Trump"? The most recent rev to that law was last year. Obama didn't leave office until this one.

yup! Since trump[1]. As I said IIRC this feature has been introduced with the patriot act. At least out of US, privacy oriented online companies put forward that they are outside patriot act jurisdiction. [1]: https://www.engadget.com/2017/01/26/trump-signs-executive-or...

Ah, I see. That is a thing Trump did, but has no relationship with the "USA PATRIOT Act", hence my confusion.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#148
post #129

Earlier quoted context omitted.

Windows comes with its firewall turned on by default since XP SP2, most popular distros doesn't do that even today. Windows 10 doesn't even respond to ping by default (which is a pita).

Not sure about other distros but opensuse comes with a pretty strict firewall out of the box. My logic says that this is probably common practice for many general-use distros.

Ubuntu and debian does not. Well, they are installed and debian is enabled too (but defaults to allow all traffic).

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#149
post #129

Earlier quoted context omitted.

Windows comes with its firewall turned on by default since XP SP2, most popular distros doesn't do that even today. Windows 10 doesn't even respond to ping by default (which is a pita).

Not sure about other distros but opensuse comes with a pretty strict firewall out of the box. My logic says that this is probably common practice for many general-use distros.

openSUSE uses a password protected root account (shared secret), doesn't use ASLR and doesn't even run apparmor...
Post reply on HN