2 ms·

If there is one place to monitor on Windows, that's a slight advantage. But, it wouldn't take many edits to that one place to cause permanent damage to the sys

If there is one place to monitor on Windows, that's a slight advantage. But, it wouldn't take many edits to that one place to cause permanent damage to the system (i.e. programs are now screwed up, you have to reinstall Windows; good luck). Maybe it is harder to notice a breach on Unix, but it is also correspondingly unlikely that the breach will affect all programs and make the system unusable. The closest thing to the frailty of the registry would be something like hacking /etc/ld.so.conf on a Unix system.

tptacek 18y ago
I think the problem with this logic is that you're thinking about filenames and not credentials. There's one place to go to cripple a Windows box (a parallel filesystem), and there's one set of credentials you need to cripple a Unix box (the capability to write /etc, or /usr/share, or /usr/local/mysql, or ~/Library, or...).
- makecheck 18y ago
  I admit to not knowing how the Windows registry's various parts are protected. But individual files/directories can be protected separately on Unix-like systems (whether they are is another question). If the Unix root user is not enabled, especially for remote access, and assuming you don't have access to the physical device, then it's a question of which Unix accounts and groups you do have access to. Also, technically directory write permission is all that's needed to compromise a Unix file, so all files in the same directory are equally vulnerable. (Even this assumes base permissions and not ACLs, etc.)
  - tptacek 18y ago
    First, taking OSX as an example desktop Unix (desktop Linux has the same problem), if you own my UID, you also own my ~/Library, and thus my account and arbitrary code execution under my credentials. Second, the registry is privileged the same way; write access to one part of the registry doesn't give you write access to all of it. Third, it is notoriously hard to keep permissions straight on configuration files, especially when you're trying to manage multiple roles (for MySQL, qmail, and root, for instance). So most people screw it up. But I mean, I don't think this is a huge problem. I just think I can knock down a lot of arguments about how the Win32 registry is an abomination. There's a lot not to like about it, but it isn't crazy.

tptacek 18y ago

I think the problem with this logic is that you're thinking about filenames and not credentials. There's one place to go to cripple a Windows box (a parallel filesystem), and there's one set of credentials you need to cripple a Unix box (the capability to write /etc, or /usr/share, or /usr/local/mysql, or ~/Library, or...).

makecheck 18y ago
I admit to not knowing how the Windows registry's various parts are protected. But individual files/directories can be protected separately on Unix-like systems (whether they are is another question). If the Unix root user is not enabled, especially for remote access, and assuming you don't have access to the physical device, then it's a question of which Unix accounts and groups you do have access to. Also, technically directory write permission is all that's needed to compromise a Unix file, so all files in the same directory are equally vulnerable. (Even this assumes base permissions and not ACLs, etc.)
- tptacek 18y ago
  First, taking OSX as an example desktop Unix (desktop Linux has the same problem), if you own my UID, you also own my ~/Library, and thus my account and arbitrary code execution under my credentials. Second, the registry is privileged the same way; write access to one part of the registry doesn't give you write access to all of it. Third, it is notoriously hard to keep permissions straight on configuration files, especially when you're trying to manage multiple roles (for MySQL, qmail, and root, for instance). So most people screw it up. But I mean, I don't think this is a huge problem. I just think I can knock down a lot of arguments about how the Win32 registry is an abomination. There's a lot not to like about it, but it isn't crazy.