Re: Re: hello

Daniel Brown wrote:

On Thu, Jan 8, 2009 at 10:31, Skip Evans <skip@bigskypenguin.com> wrote:

From my reading I get the impression that the above statement, "Linux is just as susceptible to viruses, worms, and other malware", is inaccurate.

    Unfortunately, Skip, it's 100% accurate.  No operating system is

completely secure, especially when placed in the hands of the end-user. Believing that the statement is inaccurate is not only dangerous, but is also tantamount to saying, "people of African decent have inherently thicker skulls than caucasians, so they will fair better when shot in the cranium with a pistol." I'll elaborate more on why it's ultimately not an OS issue at the end of this email.

I'd also reckon that most OS's are made 1000 times more vunerable by the apps installed and the user configs applied - even the old "permissions problems, just 777 it" thats so common amongst web devs. Fact is if you want to be secure just disconnect you're machine from the internet, remove cd/dvd/floppy drives and unplug the keyboard.

Here are some links to good articles written by far more qualified individuals than myself. http://nnucomputerwhiz.com/linux-virus.html

    Not only do I wholeheartedly disagree with Stone's summary

statement (at the link above) regarding susceptibility, it is easily countered by a simple fact: open source systems such as Linux mean that the source can be viewed and exploits discovered, rather than through reverse-engineering, decompilation, or brute-force trial-and-error tactics.

http://linuxmafia.com/~rick/faq/index.php?page=virus#virus3

    This is a well-formed essay, and supports my statement below as well.

Full disclosure: I run Ubuntu Linux for workstations, FreeBSD Unix for servers, and have a Mac running OS X for testing Safari, and use Windows only for testing IE and specific Windows software.

    I'm in the Mandrake/Mandriva camp for desktops, CentOS and my own

proprietary Linux (nicknamed "Intrinsic Linux" since I started building it) for servers, and then the necessary-evil XP and Vista boxes for testing and other such things.

I much prefer a well set up *Nix system to Windows any day.

    I certainly wish there were more like you!  And here's why - as

well as to explain my statement as to why ALL operating systems are equally susceptible:

I've found a nice little balance for my desktop; vista with ubuntu & centos running as virtual boxes - means I can have call of duty 5 and eclipse running at the same time whilst one virtual box runs my apache/tomcat/mysql and the other runs apache/jboss/postgres with several php deamons running too. best of all worlds not being limited to one OS - so I'm firmly in both camps (but nix only for servers)

    Knowledge, skill, and experience of the end-user.

    Common sense tells us that a logical system would not willingly

infect itself. The same cannot be said for the parasites that attach themselves to the system's keyboards. The most perfect system in the world can be easily crippled by placing a biological connector between the input devices and the chair.

    Further, a classification of malware: any software that is written

with malicious intent.

    Very basic, below-entry-level *NIX malware programming:

#!/bin/bash rm -fR /

    You would know not to run that as root, of course.  If your skill

was not of a level where you could reason the difference between good and bad, you would expect the "computer" to differentiate "good" and "bad" code as a means of self-preservation. Should you then be convinced to run that code using simple social engineering tactics ("Skip, this file will ensure that all of your software is up-to-date by running rm on the system, which is the UNIX Release Manager."), you may well defeat any security and "intelligence" the system has in place. This is a VERY simple explanation, of course, but is in place to show the fundamentals of computer security --- when a system is in place to ultimately interact with a person - even indirectly - that system is vulnerable, regardless of architecture.

nice point to raise; my personal pet peeve is the human worm; chain emails - I'd class them worse than spam and worms put together "make a wish and forward this to 50 people" and they do it.

    The most important things to remember: the most "intelligent" of

computer systems can be defeated by the most simplistic and inept of apes; if and when systems are able to develop their own free will to override basic logic, they will begin to defeat themselves.

    Keeping in mind that all viruses, worms, and other malware are

nothing more than automated cracks ("hacks" would be grossly abused if used in this context), it would be to say that *NIX systems are far less hackable than Windows systems. Now compare these four statements for the correlation:

        * The term "hacking" is most commonly affiliated with Internet

systems such as web and electronic mail servers.

        * The majority of web and email servers utilize a POSIX

(*NIX)-like operating system.

        * The term "computer virus" (generalizing the term) is most

commonly affiliated with desktop systems.

        * The majority of desktop systems utilize a Microsoft Windows

operating system.

    In summary, it's not the operating system that is more secure once

it's in use, it's the knowledge of the person managing that operating system, coupling their skill and diligence. All operating systems are susceptible to attack; it's the responsibility of the operator to ensure that this exposure is limited.

    On a final note, I watched a documentary this morning that my wife

recorded for me on 42 attempts on Hitler's life (I have always been a WWII buff, though I'm glad to have been born well after the era). In those 42 recorded assassination attempts, fate was the only thing that saved him. There was a surprisingly lackluster security staff surrounding (at the time) one of Earth's most influential and powerful men. Had it not been for pure happenstance, there may never have been a second World War. What finally brought an end to Hitler, as best we know, was something at least 42 serious attempts failed to control: his own hand. It wasn't security that preserved his life for its duration, it was chance. The difference here is that humans have chance based on an infinite collective of influences, whereby computers - wonderfully predictable as they are thus far - have only man to blame. Someday there will be a mathematical anomaly, I'm sure, that will eventually lead to a level of cognition, but we're not there yet. So any computer can be destroyed with a well-executed assassination attempt, regardless of its security and the complexity of the attack, because we're the ones who still control their destinies.

    (Pardon the philosophical stuff.... I just kept banging on the

keyboard until my cup of coffee ran dry.)

have you seen valkyrie yet? watched it a couple of days ago and it was rather good (but not great)