3 ms·

I think the reason that Linuxes are considered secure is the behaviour that is encouraged amongst its users. With Windows, users are encouraged to install softw

I think the reason that Linuxes are considered secure is the behaviour that is encouraged amongst its users. With Windows, users are encouraged to install software from random internet sites and there's no central method of updating software (without installing some third party updater from a random internet site). Also, there's some design decisions made in Windows that lead to poor security. e.g. treating a file's extension differently, assigning it special meaning and then hiding it by default from the user.

calamari4065 3y ago
Reminds me of the driver update utilities for Windows which notionally did update all your drivers, but also updates all of your viruses.
- lostmsu 3y ago
  As opposed to running bash scripts from the Internet.
  - ndsipa_pomu 3y ago
    Well that behaviour is generally discouraged and whenever I do so, I give some due consideration to how much I trust the website. I can also eyeball what the script is doing which is more practical than disassembling some binary although it's common for the script to download a binary. Also, a lot of "install" scripts will set your system up with the software repository, so you use the standard system updates to also keep that software updated.
    - lostmsu 3y ago
      Great! I don't install driver autoupdaters from random sites either, so either subject is not an issue or your counterargument is invalid.
      - ndsipa_pomu 3y ago
        It's extremely common for Windows users to download and install malware, but very rare for Linux users to do the same, so I don't really understand your point.
  - calamari4065 3y ago
    You can read those scripts, you know. If you have a passing understanding of bash, it's pretty easy to understand what a script is doing and ensure it's not malicious. Can you do that with a compiled executable?
    - lostmsu 3y ago
      You are comparing behavior of people who can read scripts with the behavior of people who consider random 3rd party driver updaters a good idea. What user can do doesn't matter. It matters what they actually do.
      - ndsipa_pomu 3y ago
        > It matters what they actually do Yes, and Windows users often install stuff from 3rd party websites whilst it's comparatively rare for Linux users.
        lostmsu 3y ago
        > comparatively rare This would need some substantiation. I personally had not seen many setups that did not require 3rd party websites.
        ndsipa_pomu 3y ago
        Sorry, I have no numbers for that. However, typical Linux distributions include an incredible amount of software in their repositories, so it's usually only proprietary software that requires installation outside of the OS tools.
      - calamari4065 3y ago
        No, you are making that assertion. I brought up the driver thing as a joke, but you're the one that turned it into this inane whataboutism Almost all windows applications are distributed as compiled binaries. Even very advanced users would find it difficult to audit most apps. Bash scripts are in plain text, and idiomatic enough that it can be read by anyone with a passing familiarity with bash. Which is the very large majority of Linux users. The script very clearly states what it does, and if it doesn't, you shouldn't run it. Driver updaters are nearly universally malware, and the common advice has always been to avoid them as such. Similarly, running random bash scripts from the internet without even looking is discouraged in the same way. Mystery binaries are much more dangerous than a script because you can't audit them, but the same advice is given for both: don't. If what the user can do matters less than what they actually do, then Windows is the most insecure operating system by a very large margin. Windows users install malware at rates order of magnitude higher than any other system. Linux may as well have zero vulnerabilities compared to the shit that Windows users will blindly install. You're right, it's stupid to compare these situations. So why are you doing it?
darksim905 3y ago
I dislike this trope of knocking Windows because of no central method of updating software. Windows software by the very nature has automatic updates, just like Mac, for each application that is installed and well supported (usually). Most applications will check for updates on launch and/or periodically. You could use a third party utility but that just increases the chance of break-age depending on what gets updated. And on a Corporate/Enterprise Environment, all of these points are moot with centralized repositories. The core point is moot in so many ways and shows a lack of understanding of the ecosystem. The file extension bit is sort of silly as well, as, it's what made Windows as user-friendly and wide spread as it is today. Better that than treating everything as a file and allowing anything to be piped anywhere. I think the bigger point is the ethos behind the Operating System(s) and the opaque nature of Windows that causes these downstream effects.
- ndsipa_pomu 3y ago
  > The file extension bit is sort of silly as well, as, it's what made Windows as user-friendly and wide spread as it is today I don't think that showing a file extension is massively confusing to people if they were always shown them. The problem is that there were real problems with a file extension looking like e.g. a picture, but instead had an executable extension e.g. image.jpg.exe
- lelanthran 3y ago
  > The file extension bit is sort of silly as well, as, it's what made Windows as user-friendly and wide spread as it is today. Are you sure? To me it looks like Windows got popular in spite of glaring security decisions, not because of them.
sander1095 3y ago
Windows has had `winget` as a central package manager for a while now. It works great!
- ndsipa_pomu 3y ago
  Thanks - this is the first that I'm hearing about it, though I don't use Windows that often. Do many third parties use it?
- iscream26 3y ago
  I wouldn't be that enthusiastic about it. Best I can say is that it is not terrible. In simplified terms, all it does is download exe files from URL addresses that it gets from yaml metadata files, and then silently executes them; which in turn means that it leaves all of the installer's checkboxes unmodified, cluttering your desktop with icons in the process. On top of that, Windows Terminal has been failing to update on my machine as of late. I don't think this should be the standard for a first-party package manager, but I'd say it's par for the course for Microsoft. It's also worth noting that all of Winget's code was initially taken from AppGet, without much recognition.[1] Apparently Microsoft cared just enough about that detail to mention the project they forked in passing, as part of a list of third-party package manager projects for Windows.[2] This is why, IMO, you should always first consider a copyleft license for an open source project. [1] https://www.theverge.com/2020/5/28/21272964/microsoft-winget-windows-package-manager-appget-copied https://www.theverge.com/2020/5/28/21272964/microsoft-winget... [2] https://devblogs.microsoft.com/commandline/windows-package-manager-preview/ https://devblogs.microsoft.com/commandline/windows-package-m... EDIT: fixed vertical spacing.

calamari4065 3y ago

Reminds me of the driver update utilities for Windows which notionally did update all your drivers, but also updates all of your viruses.

lostmsu 3y ago
As opposed to running bash scripts from the Internet.
- ndsipa_pomu 3y ago
  Well that behaviour is generally discouraged and whenever I do so, I give some due consideration to how much I trust the website. I can also eyeball what the script is doing which is more practical than disassembling some binary although it's common for the script to download a binary. Also, a lot of "install" scripts will set your system up with the software repository, so you use the standard system updates to also keep that software updated.
  - lostmsu 3y ago
    Great! I don't install driver autoupdaters from random sites either, so either subject is not an issue or your counterargument is invalid.
    - ndsipa_pomu 3y ago
      It's extremely common for Windows users to download and install malware, but very rare for Linux users to do the same, so I don't really understand your point.
- calamari4065 3y ago
  You can read those scripts, you know. If you have a passing understanding of bash, it's pretty easy to understand what a script is doing and ensure it's not malicious. Can you do that with a compiled executable?
  - lostmsu 3y ago
    You are comparing behavior of people who can read scripts with the behavior of people who consider random 3rd party driver updaters a good idea. What user can do doesn't matter. It matters what they actually do.
    - ndsipa_pomu 3y ago
      > It matters what they actually do Yes, and Windows users often install stuff from 3rd party websites whilst it's comparatively rare for Linux users.
      - lostmsu 3y ago
        > comparatively rare This would need some substantiation. I personally had not seen many setups that did not require 3rd party websites.
        ndsipa_pomu 3y ago
        Sorry, I have no numbers for that. However, typical Linux distributions include an incredible amount of software in their repositories, so it's usually only proprietary software that requires installation outside of the OS tools.
    - calamari4065 3y ago
      No, you are making that assertion. I brought up the driver thing as a joke, but you're the one that turned it into this inane whataboutism Almost all windows applications are distributed as compiled binaries. Even very advanced users would find it difficult to audit most apps. Bash scripts are in plain text, and idiomatic enough that it can be read by anyone with a passing familiarity with bash. Which is the very large majority of Linux users. The script very clearly states what it does, and if it doesn't, you shouldn't run it. Driver updaters are nearly universally malware, and the common advice has always been to avoid them as such. Similarly, running random bash scripts from the internet without even looking is discouraged in the same way. Mystery binaries are much more dangerous than a script because you can't audit them, but the same advice is given for both: don't. If what the user can do matters less than what they actually do, then Windows is the most insecure operating system by a very large margin. Windows users install malware at rates order of magnitude higher than any other system. Linux may as well have zero vulnerabilities compared to the shit that Windows users will blindly install. You're right, it's stupid to compare these situations. So why are you doing it?

darksim905 3y ago

I dislike this trope of knocking Windows because of no central method of updating software. Windows software by the very nature has automatic updates, just like Mac, for each application that is installed and well supported (usually). Most applications will check for updates on launch and/or periodically. You could use a third party utility but that just increases the chance of break-age depending on what gets updated. And on a Corporate/Enterprise Environment, all of these points are moot with centralized repositories. The core point is moot in so many ways and shows a lack of understanding of the ecosystem. The file extension bit is sort of silly as well, as, it's what made Windows as user-friendly and wide spread as it is today. Better that than treating everything as a file and allowing anything to be piped anywhere. I think the bigger point is the ethos behind the Operating System(s) and the opaque nature of Windows that causes these downstream effects.

ndsipa_pomu 3y ago
> The file extension bit is sort of silly as well, as, it's what made Windows as user-friendly and wide spread as it is today I don't think that showing a file extension is massively confusing to people if they were always shown them. The problem is that there were real problems with a file extension looking like e.g. a picture, but instead had an executable extension e.g. image.jpg.exe
lelanthran 3y ago
> The file extension bit is sort of silly as well, as, it's what made Windows as user-friendly and wide spread as it is today. Are you sure? To me it looks like Windows got popular in spite of glaring security decisions, not because of them.

sander1095 3y ago

Windows has had `winget` as a central package manager for a while now. It works great!

ndsipa_pomu 3y ago
Thanks - this is the first that I'm hearing about it, though I don't use Windows that often. Do many third parties use it?
iscream26 3y ago
I wouldn't be that enthusiastic about it. Best I can say is that it is not terrible. In simplified terms, all it does is download exe files from URL addresses that it gets from yaml metadata files, and then silently executes them; which in turn means that it leaves all of the installer's checkboxes unmodified, cluttering your desktop with icons in the process. On top of that, Windows Terminal has been failing to update on my machine as of late. I don't think this should be the standard for a first-party package manager, but I'd say it's par for the course for Microsoft. It's also worth noting that all of Winget's code was initially taken from AppGet, without much recognition.[1] Apparently Microsoft cared just enough about that detail to mention the project they forked in passing, as part of a list of third-party package manager projects for Windows.[2] This is why, IMO, you should always first consider a copyleft license for an open source project. [1] https://www.theverge.com/2020/5/28/21272964/microsoft-winget-windows-package-manager-appget-copied https://www.theverge.com/2020/5/28/21272964/microsoft-winget... [2] https://devblogs.microsoft.com/commandline/windows-package-manager-preview/ https://devblogs.microsoft.com/commandline/windows-package-m... EDIT: fixed vertical spacing.