Careful with Firefox

[Mystic]

Well, 95% of desktop computer users in the world use Windows because Windows has the software and hardware support that people need. I need and like my Epson photo printer, and my Epson scanner. I prefer Epson over other brands. Microsoft and Epson do not tell me I have to make my operating system work for me. They don't tell me I need to write driver software for my printer and my scanner. Microsoft and Epson make their software and hardware work for me.

As for Sophos, they did say that 1 of the 10 myths was that Firefox was the most secure browser. But they also said that regardless what web browser a person was using, it was possible to be attacked by driveby downloads. And at the Secunia website I see good evaluation regardless of operating system.

If everybody switched to the Mac the Mac would become a target.

If everybody switched to Linux then Linux would become a target.

According to some of the best information available today Windows 7 is a much more secure operating system then Windows was in the past.

Perhaps Linux, Unix, BSD, Mac and Windows users need to unite against the real enemies-the people who are attacking innocent people on the internet.

Do you think I really care what operating system I use? As long as the computer operating system I am using gets the job done for me I don't care who makes it or what it is called.

It is all technology. Not religion. The best technology wins in the end.

If Linux is so great why is Linux losing the desktop war? Linux is fine for servers and various specialized purposes. Heck, I use Linux operating systems myself. Linux has never made it as the desktop operating system of choice because Linux does not meet the needs of people. Linux does not meet their software and hardware needs.

 

[Garak]

Originally Posted By: Mystic
Well, 95% of desktop computer users in the world use Windows because Windows has the software and hardware support that people need. I need and like my Epson photo printer, and my Epson scanner. I prefer Epson over other brands. Microsoft and Epson do not tell me I have to make my operating system work for me. They don't tell me I need to write driver software for my printer and my scanner. Microsoft and Epson make their software and hardware work for me.


Most hardware support in Linux is built into the kernel, as it should be. That's the way it was done in the beginning, and that's the way many of Microsoft's competitors have done it over the years. Microsoft did it, too. Considering how bloated Windows is and was, you'd think that more things would have been handled directly by the OS, without downloading drivers and whatnot. My last Linux install involved zero driver downloads and no reboots. Try that with Windows. You'll strike out on both counts.

For hardware support in general, not every piece of hardware works with Windows, particularly Vista and 7, even those that are supposed to work. As for Epson, they don't get my business because they choose not to support Linux. You say it's great that Windows and Epson work together without much of a fuss. Windows and Epson don't ask us to make the hardware work with the OS. Well, Epson asks us to make it work with Linux. Epson chooses not to release source code, and that's their right. It's my right to not buy their product, and I exercise that right.

Originally Posted By: Mystic
As for Sophos, they did say that 1 of the 10 myths was that Firefox was the most secure browser. But they also said that regardless what web browser a person was using, it was possible to be attacked by driveby downloads.


Not in Linux.

Originally Posted By: Mystic
If everybody switched to the Mac the Mac would become a target.

If everybody switched to Linux then Linux would become a target.


Nonsense. For one, *nix operating systems are inherently more secure, since they don't let software do whatever it chooses anywhere in the system. Mission critical files and directories are absolutely off limits to them. Secondly, the server market is dominated by Linux. Why are they not attacked with malware and viruses? After all, wouldn't that be the best way to go about it? Instead, all we see are DDOS type attacks. Third, there are no Linux viruses in the wild, period.

Microsoft and various security companies can talk all they want. The fact of the matter is that virtually every security breach out there is a Microsoft only issue, and will remain that way until Microsoft changes its security policies.

The last Linux kernel update with respect to security I came across had to do with physical computer security. Microsoft has too much catching up to do with virtual and software security to worry about physical security.

Originally Posted By: Mystic
According to some of the best information available today Windows 7 is a much more secure operating system then Windows was in the past.


That's certainly true. They accomplished that by doing something that *nix systems have done for many years - enforce privileges. However, as long as Windows allows software to play with the registry for any reason, that security hole will always be there.

Originally Posted By: Mystic
Perhaps Linux, Unix, BSD, Mac and Windows users need to unite against the real enemies-the people who are attacking innocent people on the internet.


Linux, BSD, Unix, and Mac don't face the same threat issues. That's why there aren't a glut of security products available for those products. Linux only uses antivirus software when the machine is being used as a mail server, to protect Windows machines from themselves.

As for phishing attacks, social engineering, and things like Firefox add-ons, the OS isn't going to save you, except in unique circumstances. If, say, a Firefox add-on is designed to steal passwords, well, that's a problem. If it's designed to attack the operating system, that's only going to be a problem with Windows. Linux will not let an add-on play with the critical files, end of story.

Originally Posted By: Mystic
Do you think I really care what operating system I use? As long as the computer operating system I am using gets the job done for me I don't care who makes it or what it is called.


Well, Windows doesn't do the job for me, at least not adequately. Also, don't convolute needs with wants. Linux does all that I need and all that I want. Most people out there could do everything they need in Linux. Of course, they can't run Photoshop. They can't run the $60 disposable printer they bought at Walmart. They can't run Norton or Spybot (not that they need to). They can't play the latest games.

Unless one is using a niche software package (and they do exist for Linux, too) and/or plays a lot of games, there is no need for Windows. The best thing society could do for computer security is pull the internet connection off of every Windows box. Problem solved.

 

[simple_gifts]

I have never seen a commercial grade firewall product built on Windows. They are built on linux or bsd variants. "The market" has chosen what they feel to be a better bet when building a device to mitigate security issues and none of them have chosen Windows.

Quote:

The best technology wins in the end.


No truer words have been uttered in the security appliance realm.

 

[javacontour]

*nix is MORE secure, but to think they are immune to threats is naive thinking.

Many holes have been found in services such as FTP, SSH, HTTP servers.

How long did SENDMAIL just accept mail from anyone?

I get alerts all the time for issues in Solaris. We write patches for Solaris and publish them periodically. Those patches include security fixes.

I agree, the *nix framework is a solid framework upon which one can build a more secure platform. However, even *nix boxes can be OwN3d

 

[OVERKILL]

Originally Posted By: javacontour
*nix is MORE secure, but to think they are immune to threats is naive thinking.

Many holes have been found in services such as FTP, SSH, HTTP servers.

How long did SENDMAIL just accept mail from anyone?

I get alerts all the time for issues in Solaris. We write patches for Solaris and publish them periodically. Those patches include security fixes.

I agree, the *nix framework is a solid framework upon which one can build a more secure platform. However, even *nix boxes can be OwN3d


The difference between *nix and Windows can be summed up in a single sentence:

The experience of Unix is the ability to compute securely, whilst the ability to compute securely has never been part of the Windows experience.

Unix, and the family of *nix variants were designed from the ground up to provide a secure operating platform. Usability for that platform has been steadily improving, but due to how the platform is designed, it will never be as "friendly" as Windows.

Windows was designed from the ground-up to provide a friendly user experience. Security wasn't even a consideration in the beginning. As the computing world advanced, Windows has had security "patched upon it", but it was never part of the fundamental framework. A quick glance back at Windows 98 is a very clear indicator of that. Don't know the password? Click Cancel to login anyways! LOL! With the adoption of the NT kernel into the mainstream OS products and the 9x kernel phased out with the switch to Windows XP (Windows 2000 was not targeted at consumers, though had originally intended to be), moderate security over previous windows products was attained. But you are still dealing with an operating designed around the "experience".

And this explains the user-base, market share, and why the application of these products differ so greatly.

 

[Garak]

Originally Posted By: javacontour
*nix is MORE secure, but to think they are immune to threats is naive thinking.

Many holes have been found in services such as FTP, SSH, HTTP servers.

How long did SENDMAIL just accept mail from anyone?


I wouldn't suggest that *nix is immune to threats. The threats and dangers are, however, different.

Issues that you pointed out are certainly real, but absolutely different than the average threat a Windows user can routinely face. From a security perspective, the threats and loopholes that have existed in some of those that you mention included DDOS vulnerabilities, snooping through data, and password vulnerabilities.

That's an entirely different animal than the ability of malware in Windows to do whatever it wishes to the OS and registry, for example. I would certainly agree that I cannot just put whatever confidential information I want on a Linux box and think it's magically protected from all evil doers.

That, however, isn't my point. A couple basic commands in a batch file or a piece of malware can format the HD in Windows without any authorization whatsoever. That isn't going to happen in Linux, at least not without my explicit authorization, which would be rather foolish.

With the Firefox add-on issue, for example, let's say I installed a strange and unknown add-on. No matter what the OS, it could conceivably steal my passwords or something bad like that. I would be none the wiser until it's too late. However, if it tried to do something harmful to the system itself, the OS simply wouldn't allow it, unless I gave the root password. If an add-on is asking for a root password, I know there's a problem and I won't be supplying the password.

I tend to be a little old fashioned about computer security, for good or for bad. I don't rely on a lot of add ons. I don't allow Firefox to remember passwords for me or to keep persistent cookies. I rely on my memory for passwords and if a file is confidential, I encrypt it. I have always been more concerned with a piece of malware doing harm to the OS or the data on the system.

I do realize that people who create malware of various forms have changed over the years. There are a lot less people who simply set out to do serious damage to systems, and a lot more who would rather steal private data, be a minor nuisance, or subvert machines for their own ends (i.e. bots to be used in denials of service).

That's been very fortunate for Microsoft. A few years ago, when that MSN link thing was going around that infected almost everyone on Windows I know, it could have been much worse. Had the hacker decided to, say, format everyone's hard drive, instead of simply replicating itself, there would have been a lot of Windows boxes down for the count and a lot of people screaming for blood.

I would suggest that it's a mix of a good measure of luck, ethics on the part of certain hackers, and greed overriding vandalism on the part of other hackers that has allowed Windows machines to run relatively smoothly the last number of years. Things could have been a lot worse, and I'm rather surprised that someone hasn't tried to deal the ultimate deathblow to machines en masse. I suppose some of the very stiff penalties for hacking have helped, too.

 

[javacontour]

I think we tend to agree. I had a long day yesterday and mis-read what you originally said. Sorry for my inability to comprehend.

I agree, Windows has largely been about user convenience.

Many users have developed bad habits. Using an account that has Admin rights to do day to day tasks, because it's convenient, etc.

It's long been said that 1/convenience = security. The more convenient you make something, the less secure it becomes.

 

[Garak]

Originally Posted By: javacontour
I think we tend to agree. I had a long day yesterday and mis-read what you originally said. Sorry for my inability to comprehend.


And one can justifiably fault my pigheadedness about what concerns me with respect to computer security. Like I said, I'm far more worried about someone making my computer unworkable than I am about passwords or financial information.

In fact, that's the bulk of my security concern, and Linux has two benefits with that. One, it's hard for a hacker to do in the system entirely. Secondly, I keep a tarball of my entire main partition elsewhere, so a complete system restore involves a tar command and an edit of the fstab and grub list. It works at least as well as any commercial package, plus it costs nothing, and I know there will be no surprises.

Bad habits are certainly the bulk of the problem. Windows certainly is improving with respect to administrator accounts versus user accounts. There still is much to be done, though.

You're definitely right about the convenience factor. My friends on Windows fall into the trap all the time. They want to download music, so instead of doing things the more difficult way (either buying the music or using IRC and following good IRC habits), they download some hokey P2P thing and then complain about the spyware and how it starts up and runs in the background with the system.

The latest Ubuntu LTS edition is pretty amazing. The boot up and shut down times are amazing. It was even more plug and play than the last version. NVidia support is even better than before, with absolutely nothing having to be downloaded. With the older version, one could download proprietary drivers, use the open source drivers, or use a separate package to manage proprietary drivers. With the latest version, it's seamless. My HP printer required no driver download, either, with the HP libraries part of the original install.

I did have to download Emacs, since some ninnies at Canonical seem to think that Vi is superior.

 

[uc50ic4more]

Originally Posted By: Mystic
If Linux is so great why is Linux losing the desktop war?


Who exactly *is* "Linux"? And against whom are "they" fighting a war? I think if there is one defining element of the Linux and open source ecosystem, it is freedom and choice. The code and the hundreds of Linux-based OS's are just out there for you to use or not use.

 

[simple_gifts]

Quote:

If Linux is so great why is Linux losing the desktop war?


Because choices are made due to installed software base and there is little in that arena WRT linux. MS has dipped below 90% of the desktop market which indicates people are looking @ other choices readily. Additionally smart phones are now sold @ at rate 5 times higher than desktop PCs, so MS continues to try to hold onto a market that is less and less important to ordinary citizens, but continues only to be important to business. Many connected people do not own a desktop PC nor do they care about what company has what % of the market; it is about staying connected.

Market share does not equate to technical quality By your analogy, Porsche can't possibly make a high performance vehicle because Kia sells more cars?

Isn't having a choice a good thing?

Happy linux user

Quote:

The result?
I was absolutely blown away. It does everything I need to do with a computer, with aplomb. The installation was easy, and configuring it was a snap with no help or how-to guides needed. The tools and applications that come with it are also amazing. Everything about this OS seems to be better than Windows. And the best part is, it's free, and so are the applications I want.


And this user won't spent time tracing down the best a/v or spyware removal tools.

 

[Bill in Utah]

Hey guys, I think your getting WAY off the Firefox subject in this thread?

How about another one about security? Windows vs Linux?

I don't know, good info being passed here but someone who was just looking at subjects would miss this.

Just a thought... Don't shoot the messenger

Bill

 

[Garak]

Originally Posted By: Bill in Utah
Hey guys, I think your getting WAY off the Firefox subject in this thread?

How about another one about security? Windows vs Linux?

I don't know, good info being passed here but someone who was just looking at subjects would miss this.

Just a thought... Don't shoot the messenger

Well, you do have to admit, Bill, that I at least put lip service into keeping it on topic. I mentioned Firefox add-ons at least once or twice per post.