Open Source And Viruses [LWN.net]

Open Source And Viruses

Posted Jun 5, 2004 16:09 UTC (Sat) by rakoch (guest, #4666) [Link]

A malware writer for Linux has the choice of either relying only on the
presence of a Linux kernel, glibc and bash or going only after the
fraction of target systems that exhibits the hole in question. If, for
instance, you target OpenOffice you don't hit:
- Linux users that do not use any Office on Linux
- Linux users using KOffice, Gnome Office Apps, LyX, LaTeX
or other markup
- Linux users using MS Office via Wine

MacOS installations look pretty uniform compared to this. This is the
point: monocultures. It may be that Linux systems are slightly more
secure than MacOS but if so then the only reason is that Linux users are
generally more tech savvy and security concerned. Distributions targeting
the desktop market may remove security for ease of use. I heard that the
Lindows default user is root, for instance.

-Rudiger

Open Source And Viruses

Posted Jun 5, 2004 17:58 UTC (Sat) by piman (subscriber, #8957) [Link]

> I heard that the Lindows default user is root, for instance.

This has not been the case for over a year; please stop repeating it.

Open Source And Viruses

Posted Jun 5, 2004 19:42 UTC (Sat) by k8to (subscriber, #15413) [Link]

In all fairness, Lindows brought this on themselves with that decision. It was a mistake at many levels, but one of them was PR.

Open Source And Viruses

Posted Jun 6, 2004 12:37 UTC (Sun) by utidjian (subscriber, #444) [Link]

I think one of the major problems with Mac OS X is that the default user or machine owner is a member of group 'admin'. Take almost any given Mac OS X system and the primary user of that machine logs in with 'admin' user permissions. Sure they have the root user account disabled by default... but what use is that when the most common user that logs in has 'admin' user permissions?

The 'admin' user has permissions rwx on /Applications and /Library... stuff gets written to those folders willy-nilly with no questions asked. This permissions arrangement is set by design, for ease-of-use.

There are other security 'holes' in Mac OS X that are by design. The recent security patch (Security Update 2004-05-24) is a partial fix for the Help Viewer. This hole existed in Mac OS X since the beginning and Apple was made aware of the problem three months before the patch came out.

Another problem with Mac OS X is that there is no consistent method for installing and checking the authenticity of software. The only software installer that does PGP checks is SoftwareUpdate.app and only for system and security updates from Apple.

In my opinion, the only reasons Mac OS X has been relatively 'safe' from malware and viruses is that no one has taken an interest in it yet and its relatively low density.

-DU-...etc...

Open Source And Viruses

Posted Jun 10, 2004 8:02 UTC (Thu) by beejaybee (guest, #1581) [Link]

Yet.

My experience is that 90% of Windows users think _they_ are fully protected but that 90% of the others aren't. There's a straightforward explanation for this; it's called denial, and it's just as responsible for the problems Windows has with worms and viruses as the shoddiness of the product.

Fact of the matter is, defensive programming is neither perfect nor universal, even in the open source world. Don't let yourself be lulled into a false sense of security. If you can be hit, experience suggests that sooner or later you will be.