4 ms·

Linux isn't any better. Take any Debian based os download a .deb and double click it. It's executable by default, opens up in something like Eddie and just ask

Linux isn't any better. Take any Debian based os download a .deb and double click it. It's executable by default, opens up in something like Eddie and just asks for a password. Nothing about Linux is really more secure than windows other than the fact it is a small target.

SR2Z 3y ago
Knowing the root password for a machine is meant to grant you full control over that machine... You literally just described an .exe or .msi.
belter 3y ago
You are aware that users are not privileged by default in Linux? While historically in Windows...at least until UAC and Windows 2008... Not sure what the example proves. The simple fact you can compile your kernel, have a strong model with Linux SE, it's just another ballpark. Besides the fundamental aspect that Microsoft are telemetry kleptomaniacs, one OS assumes the user machine does not belong to the user, and Microsoft knows better. Linux assumes it's your machine and nobody else. You can have your own hardened and lighter Linux kernel, with less surface exposure, while with Windows you start with whatever version version of Cortana Microsoft would like to push that week on it's users...Plus all the other unnecessary components that create an almost infinite opportunity of attack vectors. Naturally for Linux, the open source code, makes for a more transparent process, even if I don't subscribe to the idea that more eyes on the code, correlates directly to higher safety.
ivlad 3y ago
.deb is not executable. It’s an “ar” archive (see https://manpages.debian.org/buster/dpkg-dev/deb.5.en.html https://manpages.debian.org/buster/dpkg-dev/deb.5.en.html for more details) containing a few other archives - for files and metadata. The fact that deb extension is associated with an application (I don’t know what Eddie is) does not make deb executable. It’s like Winzip opening a zip archive on double click in Windows: yes, the file is opened, but no untrusted code has been run (assuming, Winzip is installed already and is considered trusted). Linux is more secure because it has a much smaller attach surface. Even from the kernel interaction perspective, the number of syscalls in Linux is much smaller than in Windows, they are in a way more primitive and easier to audit. But the biggest distinguisher is lack of DCE (or MS) RPC - in Windows it’s ubiquitous, available both locally and sometimes over the network with various ways to access it (named pipes over SMB, DCE over TCP/IP, even over NetBEUI, over HTTP in some cases) which makes it hard to secure (Windows firewall is very complex as a result). Finally, Windows Carrie’s enormous amount of legacy and Microsoft is not interested in fixing it (they would rather push you to “cloud”). Combination of code complexity and large attack surface makes Windows less secure that competition (although Pottering seems to be working on fixing it).
- Aleklart 3y ago
  It is like self extracting winzip archive, because of maintainer scripts.
  - efreak 3y ago
    Self extracting archives don't require scripts or other functionality to work. They have a decompressor built-in. This is why they're _self_-extracting and not just archives.

SR2Z 3y ago

Knowing the root password for a machine is meant to grant you full control over that machine... You literally just described an .exe or .msi.

belter 3y ago

You are aware that users are not privileged by default in Linux? While historically in Windows...at least until UAC and Windows 2008... Not sure what the example proves. The simple fact you can compile your kernel, have a strong model with Linux SE, it's just another ballpark. Besides the fundamental aspect that Microsoft are telemetry kleptomaniacs, one OS assumes the user machine does not belong to the user, and Microsoft knows better. Linux assumes it's your machine and nobody else. You can have your own hardened and lighter Linux kernel, with less surface exposure, while with Windows you start with whatever version version of Cortana Microsoft would like to push that week on it's users...Plus all the other unnecessary components that create an almost infinite opportunity of attack vectors. Naturally for Linux, the open source code, makes for a more transparent process, even if I don't subscribe to the idea that more eyes on the code, correlates directly to higher safety.

ivlad 3y ago

.deb is not executable. It’s an “ar” archive (see https://manpages.debian.org/buster/dpkg-dev/deb.5.en.html https://manpages.debian.org/buster/dpkg-dev/deb.5.en.html for more details) containing a few other archives - for files and metadata. The fact that deb extension is associated with an application (I don’t know what Eddie is) does not make deb executable. It’s like Winzip opening a zip archive on double click in Windows: yes, the file is opened, but no untrusted code has been run (assuming, Winzip is installed already and is considered trusted). Linux is more secure because it has a much smaller attach surface. Even from the kernel interaction perspective, the number of syscalls in Linux is much smaller than in Windows, they are in a way more primitive and easier to audit. But the biggest distinguisher is lack of DCE (or MS) RPC - in Windows it’s ubiquitous, available both locally and sometimes over the network with various ways to access it (named pipes over SMB, DCE over TCP/IP, even over NetBEUI, over HTTP in some cases) which makes it hard to secure (Windows firewall is very complex as a result). Finally, Windows Carrie’s enormous amount of legacy and Microsoft is not interested in fixing it (they would rather push you to “cloud”). Combination of code complexity and large attack surface makes Windows less secure that competition (although Pottering seems to be working on fixing it).

Aleklart 3y ago
It is like self extracting winzip archive, because of maintainer scripts.
- efreak 3y ago
  Self extracting archives don't require scripts or other functionality to work. They have a decompressor built-in. This is why they're _self_-extracting and not just archives.