What If All the World Ran Linux? | Hacker News Reader

What If All the World Ran Linux?

networkworld.com

15 pointsGarbage20 comments

His entire blog post is based on the assumption that linux wouldn't have as much malware - however keep in mind that the greatest risk to a system is the user themselves. It doesn't matter how hardened the system is or how many protection schemes are built in, if you have a pop up telling the user "ENTER YOUR ROOT PASSWORD AND WIN $$$ NOW!" eventually someone is going to do it.

At some point users will cry out for a system that doesn't require a password to install stuff, and someone will react to provide that product to the market.

Remember that there's a lot more to computer security than computers.

I don't know many dudes name Katherine.

Personally, I tend to use "he" if I'm going to tear apart a poorly written or researched tech article, because using "she" might call attention to the gender of the author which might be misinterpreted as an ad hominem. In fields where there isn't a large mismatch between the number of men and women, I'd check the name and use "he" or "she" depending on my guess as to which is more likely based on the name.

> "ENTER YOUR ROOT PASSWORD AND WIN $$$ NOW!" eventually someone is going to do it.

None of my Linux boxes has a root password.

"ENTER THE PASSWORD THAT LETS YOU DO STUFF AND WIN $$$ NOW"

You do understand your plan is getting less and less likely to work, right? If it doesn't work on Macs why would it fare better on Linux?

Are you saying there's no malware for Macs?

While I understand there is some malware that runs on OSX (as there are on Linux and even on *BSD), it's nowhere near what could be considered a huge problem.

I never saw one, BTW.

Agreed, though there's still something to be said about strong default settings.

And there's a huge difference between something asking for a password than something installing something drive-by without any notification whatsoever. From a social engineering perspective, it's a lot harder to get someone to enter a password than it is to get them to simply click on something.

Yes, there'd still be malware because of stupid users, but there'd be a lot less of it.

this is where package management is great. The user that will enter their root password to win $$$ is also the user who is way less likely to open up a config file and add an untrusted repo. Not to mention the benefit of automatic software updates. The iphone appstore has already trained users to use what is essentially a package management system (without the option to add other repos).

Once the program has sudo privileges, it can pretty much add a pirate repo (or replace an official one), changing crypto keys and so on...

OTOH, Linux users don't google program names and download executables they run as admins from the first hit they get.

No need for root password, user privileges are fine for typical malware.

On most popular systems, $HOME is mounted without noexec, and programs are not isolated from writing everywhere in $HOME. Then all the malware have to is to alias sudo to itself (or hijack it with SUDO_ASKPASS, huh) and wait.

It should be noted, though, that GNU/Linux is one step ahead — when those holes will be exploited in the wild, distro builders will start putting browsers in sandboxes, enabling AppArmor/SELinux/... by default, perventing from running executables from $HOME and whatever would be required. Everything is here, just disabled for users' convenience, trading less security for more usability.

Uh, in fact, the malware is already here. Just take a peek at /var/log/auth.log (or wherever you're getting sshd messages). Unless you've set up denyhosts or something alike, you'll see lots of attempts to log in with various typical usernames and passwords. And somewhere in the world, those attempts surely succeed.

Original article: http://www.pcworld.com/businesscenter/article/214596/what_if...

And HN discussion:

http://news.ycombinator.com/item?id=2032776

I'm beginning to see Linux as simple a broad open platform that is very customizable to individual needs. The idea of the spanning, generally somewhat similar but incompatible enough to be a nuisance, problematic because you have to install it on your own in virtually all cases, desktop Linux is a dying breed. I say this as a sole user of desktop Linux for nearly ten years (currently typing in CrunchBang, a Debian respin).

Why? The places where Linux has slowly started to spin are independent ecosystems each spun from Linux. This has slowly been becoming the case in the mobile sphere. But the mobile OSs that are winning are not the ones that are much codeshared with desktop Linux like Maemo, but those that exist in independent ecosystems like webOS and Android, not to mention the open source devices like Kindles and Tom Toms that you never think about the OS on.

Even the main Linux distros for desktops and similar x86 devices are beginning to separate. Ubuntu is looking at alternatives to the X server. Chrome OS has the possibility to make inroads which is not a traditional distro in any sense. Linux as a kernel is becoming something diverse that can be respun to many different uses.

Used to, the Linux landscape was fairly consistent. Mobile devices that ran the Linux kernel were using much of the same code and software as the desktop Linux distros. For example, Dillo was a web browser used on Linux ports to mobile devices and the desktop. I had mobile Linux devices in the past that ran Pidgin.

"Windows tends to be associated with a lot of unplanned downtime"

I would say that Windows is more associated with the need to have a lot of planned downtime.

I think both situations happen with a much higher frequency than competing platforms.

What part of Linux' greater immunity to malware comes from the more logical permissions, and the more free-form naming?

By that, I mean that "executable" comes from a permission, not from an "extension", and that "extensions" in Linux are really just naming conventions.

I also note that every one not leveraged to the hilt into Microsoft technology acknowledges the effect of the Windows monoculture.

Indeed. If Joe Clueless downloads a program and double clicks it, it won't run.

If the user is so clueless as to download malware, he probably won't be able to chmod it into executableness.

I like how the first point is essentially that the diversity of Linux would make it hard for malware writers because of the differences between distributions, and the last point seems to assume that the diversity is NOT a problem to writing Linux software.

Reply on news.ycombinator.com