Given that piping curl in bash with sudo is considered acceptable, this is not surprising
Is the Linux Desktop less secure than Windows 10? [pdf]
31–40 of 190 posts
Re: Is the Linux Desktop less secure than Windows 10? [pdf]
#32Earlier quoted context omitted.
Yes, that does not exactly strike me as a rational stance to take. Are you actually more worried about Microsoft blackmailing you about those photos from 4 years ago?
Well, I'm worried about Microsoft knowing who I am . It's hard to get legitimate Windows installs that aren't linked to non-anonymous payment methods. Not impossible, but hard.
Take cash, buy computer at retailer...
Re: Is the Linux Desktop less secure than Windows 10? [pdf]
#33If anything, Linux may benefit from relatively varied installation states in security scheme (SELinux, Apparmor, etc.), libraries included, and desktop environment. It is perhaps bit harder to pull off one-size fit-all attacks.
Things like data at rest protection seems to work better on Linux; as far as I know, there aren't out of box solution for Pre-boot authentication for Windows, for instance.
Edit: To the latter point, it looks like BitLocker has the mode to allow that, if you have Professional/Enterprise with TPM...
Re: Is the Linux Desktop less secure than Windows 10? [pdf]
#34what Linux desktop?
Re: Is the Linux Desktop less secure than Windows 10? [pdf]
#35Hmm. If i look at the slides, the article should be renamed "gstreamer, and some stuff browsers on all platforms do, are insecure"?
Is it easier to change your media player on Linux, or to trust Microsoft?
Say, does a default Windows install still enable 20 networked services that don't belong on a home computer and can be exploited without the user downloading anything?
Re: Is the Linux Desktop less secure than Windows 10? [pdf]
#36I mean, the answer is unequivocally, without the slightest doubt, yes. The Linux Desktop is probably a good 5-10yrs behind Windows 10 in terms of defense-in-depth mitigations as well as exploits in common targets like file parsers etc etc. https://www.blackhat.com/docs/us-16/materials/us-16-Weston-W... is a good reference for all the stuff that Desktop Linux in 2017 is for the most part, missing
Windows does have better technical defenses but its attack surface is also much higher due to the thousands of deprecated but still supported older technologies for backward compatibility so I don't know, it's just different problems
Re: Is the Linux Desktop less secure than Windows 10? [pdf]
#37what Linux desktop?
My thoughts exactly.
Re: Is the Linux Desktop less secure than Windows 10? [pdf]
#38It is important to decouple distributions from Linux itself. Some distributions do not place security as their top-most priority, but rather ease of use.
Then, there is no "one" Linux desktop. You have different X servers, different window managers, different desktop environments...
In Windows there's only one of everything, the configuration is less flexible in terms of what things you can disable, and once something is vulnerable that's it.
e.g: Vulnerability in fonts being rendered on the kernel? What can you do about it exactly? Nothing but to wait for updates... but then the Flame malware installed itself via Windows Update. It's fantastic.
Re: Is the Linux Desktop less secure than Windows 10? [pdf]
#39Speaker here. As the slides may not tell the whole story (there should be a video soon), I covered this mostly also for LWN recently: https://lwn.net/Articles/708196/
Video? What happened to good old fashioned text? I can read 10x faster than you can talk...
Re: Is the Linux Desktop less secure than Windows 10? [pdf]
#40I mean, the answer is unequivocally, without the slightest doubt, yes. The Linux Desktop is probably a good 5-10yrs behind Windows 10 in terms of defense-in-depth mitigations as well as exploits in common targets like file parsers etc etc. https://www.blackhat.com/docs/us-16/materials/us-16-Weston-W... is a good reference for all the stuff that Desktop Linux in 2017 is for the most part, missing
The thing with the Linux Desktop is that you can selectively enable SELinux, use PaX etc. and have security comparable to, if not better, than Windows 10, plus the fact that Linux is a much more varied attack surface still applies. Or you can do nothing, in which case you're probably less secure.
This is exactly the problem. You can buy Windows 10 machine and if it becomes vulnerable it's Microsoft's fault and you would count on them to fix it immediately, push out the automatic update and go on with your life. If default Linux desktop is insecure then consumer is supposed to figure out what exactly is insecure, be expert in knowing the alternatives and how to replace everything. The question isn't whether Linux desktop can be made more secure but rather why isn't it secure by default?