Shlomi Fish
Sat, 14 May 2005 22:43:00 -0700
On Sunday 15 May 2005 03:47, Michael Vasiliev wrote:
> On Friday May 13 2005 15:42, Shlomi Fish wrote:
> > > > Actually, a default install of Fedora took several months to break
> > > > into. As opposed to less than 20 minutes for Windows.
> > >
> > > Could you please provide the source for that claim? I remember an
> > > anecdotial honeypots research in recent years done to test that. But
> > > there they actually have made the installation less secure than the
> > > default (bad passowrds, extra services available).
> >
> > I heard of the 20 minutes of Windows from two different sources. I found
> > the Linux one on LWN.net IIRC. (or Slashdot?)
> >
> > BTW, the Fedora system wasn't updated with timely updates, which makes it
> > even more impressive.
>
> OK, this is just not true. The fact that windows boxes mooning the whole
> Net get hacked in number of minutes represent only the sole fact that
> hackers love the windows boxes more. Why? Let's look on that from cracker's
> point of view:
>
Wrong. There have been worms, hacking attempts, etc. for Linux. However,
generally Linux distributions don't introduce a remotely exploitable security
hole until a much larger time after their release.
> 1) Majority of windows users are bereft of gorm.
> [snipped].
All of these are reasons why computer intruders may prefer Windows, not why
Linux is as equally less secure. Since Linux has a substantial amount of
market share of the Net. (and hey, even a small amount is enough, to wreak
havoc), then someone would have exploited this market share by now.
> There is almost no difference in how the default install of windows or
> non-hardened linux is hard to break. Any default install is weak, even with
> latest updates, and cannot withstand brainstorming by a team of crackers.
On what evidence do you base this fact? Windows without the updates is so
brain-damagly non-secure that any Meta-Spolitable script kiddie can
infeltrate it. Linux, OTOH, will require more creativity, code inspection and
finding a zero-day bug. I'm positive of it. Don't know if it improved in
Win2003 or Longhorn. We'll have to see.
Regards,
Shlomi Fish
---------------------------------------------------------------------
Shlomi Fish [EMAIL PROTECTED]
Homepage: http://www.shlomifish.org/
Tcl is LISP on drugs. Using strings instead of S-expressions for closures
is Evil with one of those gigantic E's you can find at the beginning of
paragraphs.
=================================================================
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]