|
Albert Holguin wrote: Go write some code
Maybe I should write some that will stop hackers from pwning Linux servers on regular basis.
The only reason why desktop Linux is not targeted by 'commercial' virus creators in such rate is because it has so little market share fragmented in so many distros and mostly used by tech savvy people so it's not worth the effort. Suggesting that is the reason why Linux is more secure the Windows is what's called security through obscurity.
On the other hand if you're target of government surveillance, well look for yourself how secure you are by using Linux[^]. Also things like heartbleed.
Critical OpenSSL bug allows attackers to impersonate any trusted server[^]. Will you look at that! Just while I was typing this message to you, perfect time to illustrate my point.
modified 9-Jul-15 14:49pm.
|
|
|
|
|
While I agree that today's Windows (v7 and later) is on par with Linux from a security POV, I'd ask who you believe is responsible for fixing the critical OpenSSL bug you referenced?
The Linux distro? A 3rd party? Or nobody - let the end-user suffer?
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
Mike Mullikin wrote: The Linux distro? A 3rd party? Or nobody - let the end-user suffer?
Don't know, but that was not my point anyway. My point is that "use Linux" as a single solution to all security problems with modern operating systems is silly and dangerous.
|
|
|
|
|
Nobody said it was a fix all. It's ultimately up to the user to be safe.
|
|
|
|
|
So your answer to road safety would be drive a truck?
|
|
|
|
|
Mladen Janković wrote: mostly used by tech savvy people so it's not worth the effort.
Imagine that...
|
|
|
|
|
Albert Holguin wrote: Imagine that...
Imagine what? That something complicated will be used mostly by professionals?
|
|
|
|
|
Marc Clifton wrote: Why do viruses exist? Because of bugs in the operating systems and applications that we do pay for
Sometimes.
Years ago I got ahold of the source code for a virus called the I Love You Virus[^]
Aside from the silly email stuff, it essentially was 3 pages of VB code that deleted whatever it could from the Windows folder and all subfolders under it.
No 'bug' allowed that. Some deviant came up with this and wrote it.
If it's not broken, fix it until it is
|
|
|
|
|
Kevin Marois wrote: it essentially was 3 pages of VB code that deleted whatever it could from the Windows folder and all subfolders under it.
Kevin Marois wrote: No 'bug' allowed that.
You don't think an OS should protect against uninitiated code execution and file deletion?
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
Sure. It's just that it's not possible.
There's always someone smarter. And any attempt to protect can always be overcome.
If it's not broken, fix it until it is
|
|
|
|
|
Kevin Marois wrote: There's always someone smarter. And any attempt to protect can always be overcome.
But the same applies to the anti-virus products.
From the end-user POV the OS should be secure and its the OS supplier who should bear the burden of making it so. The current 3rd party arrangement seems very flawed.
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
Do you make your software virus proof?
If it's not broken, fix it until it is
|
|
|
|
|
To the best of my ability - but most of the responsibility lies with the OS and browser since they're doing the low level stuff.
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
And someone better will defeat it... But that's your fault, right?
By your logic, YOU should have put more time and expense into defeating all viruses that might attach your software.
If we as developers tried that, the cost of our apps would skyrocket and the app side would be exponentially huge, and it would never be done.
If it's not broken, fix it until it is
|
|
|
|
|
Kevin Marois wrote: If we as developers tried that, the cost of our apps would skyrocket and the app side would be exponentially huge, and it would never be done.
Which is why we rely on the OS and its API's to be secure. 
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
"If we as developers" includes OS providers. They do have some level of protection in there, but they cant stop everything and if they tried the already over-priced Windows would never be purchased.
If it's not broken, fix it until it is
|
|
|
|
|
Kevin Marois wrote: If we as developers" includes OS providers. They do have some level of protection in there, but they cant stop everything
Of course but you seem to be suggesting that only a rudimentary level of security is OK and we should rely on 3rd party anti-virus developers to do the hard stuff.
If the AV folks can do it - why not the OS developers?
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
Kevin Marois wrote: By your logic, YOU should have put more time and expense into defeating all viruses that might attach your software
The answer to that is obviously no, but as a developer, I don't think it's unreasonable to be expected to at least try to mitigate potential issues when you design your apps. That's why, after all, threat modeling tools exist. They're not just for OS designers.
It starts with not requiring the user to run as an admin, not saving passwords in plaintext--those sorts of things. You're not entirely absolved from any responsibility just because there's an anti-virus running that's trying to protect the user from himself.
|
|
|
|
|
So then where do you draw the line separating "uninitiated code execution and file deletion" from "legitimate code execution and file deletion?"
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
|
|
|
|
|
That's the $64,000 question. Today Linux distros, OS X and Windows all have slightly different answers but all of them provide pretty good security. All are more secure today than they were 10 years ago or even last year.
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
This is the reason it's unreasonable to try to code around it.
Who decides who can and cannot delete files?
If it's not broken, fix it until it is
|
|
|
|
|
Kevin Marois wrote: it's unreasonable to try to code around it.
 Do you prefer the "Wild West" days of DOS where any attachment in an e-mail could wipe your HD? Just because it's difficult doesn't make it unreasonable.
Kevin Marois wrote: Who decides who can and cannot delete files?
Notifying the user and asking permission / requiring a password is where they usually end up. Windows has things like User Account Control, Firewall and Drive Encryption. OS X has GateKeeper (App signing), Encryption and Firewall.
Contrary to popular belief, nobody owes you anything.
|
|
|
|
|
Kevin Marois wrote: Who decides who can and cannot delete files?
Ultimately, Access Control Lists, and they generally work as designed.
|
|
|
|
|
Mike Mullikin wrote: You don't think an OS should protect against uninitiated code execution and file deletion?
No! No, I don't. Unless you know how to implement mind reading capabilities and embed it into OS, anything you do regarding this 'issue' will be more of an annoyance then actual solution.
|
|
|
|
|
Mladen Janković wrote: No! No, I don't.
 You would prefer that an e-mail attachment or some script in a web page could (without your permission or knowledge) modify / delete files on your computer?
Contrary to popular belief, nobody owes you anything.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
