4 ms·

His entire blog post is based on the assumption that linux wouldn't have as much malware - however keep in mind that the greatest risk to a system is the user t

• angrycoder 16y ago
  I don't know many dudes name Katherine.
  • tzs 16y ago
    Personally, I tend to use "he" if I'm going to tear apart a poorly written or researched tech article, because using "she" might call attention to the gender of the author which might be misinterpreted as an ad hominem. In fields where there isn't a large mismatch between the number of men and women, I'd check the name and use "he" or "she" depending on my guess as to which is more likely based on the name.
• rbanffy 16y ago
  > "ENTER YOUR ROOT PASSWORD AND WIN $$$ NOW!" eventually someone is going to do it. None of my Linux boxes has a root password.
  • tedunangst 16y ago
    "ENTER THE PASSWORD THAT LETS YOU DO STUFF AND WIN $$$ NOW"
    • rbanffy 16y ago
      You do understand your plan is getting less and less likely to work, right? If it doesn't work on Macs why would it fare better on Linux?
      • tedunangst 16y ago
        Are you saying there's no malware for Macs?
        • rbanffy 16y ago
          While I understand there is some malware that runs on OSX (as there are on Linux and even on *BSD), it's nowhere near what could be considered a huge problem. I never saw one, BTW.
• htsh 16y ago
  Agreed, though there's still something to be said about strong default settings. And there's a huge difference between something asking for a password than something installing something drive-by without any notification whatsoever. From a social engineering perspective, it's a lot harder to get someone to enter a password than it is to get them to simply click on something. Yes, there'd still be malware because of stupid users, but there'd be a lot less of it.
• Homunculiheaded 16y ago
  this is where package management is great. The user that will enter their root password to win $$$ is also the user who is way less likely to open up a config file and add an untrusted repo. Not to mention the benefit of automatic software updates. The iphone appstore has already trained users to use what is essentially a package management system (without the option to add other repos).
  • rbanffy 16y ago
    Once the program has sudo privileges, it can pretty much add a pirate repo (or replace an official one), changing crypto keys and so on... OTOH, Linux users don't google program names and download executables they run as admins from the first hit they get.
• drdaeman 16y ago
  No need for root password, user privileges are fine for typical malware. On most popular systems, $HOME is mounted without noexec, and programs are not isolated from writing everywhere in $HOME. Then all the malware have to is to alias sudo to itself (or hijack it with SUDO_ASKPASS, huh) and wait. It should be noted, though, that GNU/Linux is one step ahead — when those holes will be exploited in the wild, distro builders will start putting browsers in sandboxes, enabling AppArmor/SELinux/... by default, perventing from running executables from $HOME and whatever would be required. Everything is here, just disabled for users' convenience, trading less security for more usability. Uh, in fact, the malware is already here. Just take a peek at /var/log/auth.log (or wherever you're getting sshd messages). Unless you've set up denyhosts or something alike, you'll see lots of attempts to log in with various typical usernames and passwords. And somewhere in the world, those attempts surely succeed.