Something for you Linux folks to read

[Asher]

There's an excellent column that attempts to shatter some of the misconceptions many Linux zealots have about Linux. Mainly about how it's more secure and less buggy than Windows. I mean, it's not really a big secret, it's just something so many people willingly blind themselves to in their ardent opposition to Microsoft.
We know that Linux and open source attacks are soaring while Windows attacks decline, but people love to ignore those facts and figures with the wave of their hand, and make up some weird excuse about why they shouldn't be trusted. I mean, organizations like SERN and CERT are not to be trusted, right?

Well, anyway, this guy's article is very well writtten, and I urge all of you to read it before using the trite Linux endorsement stuff you throw at me all the time: http://www.informationweek.com/story/IWK20030124S0013/1

[Harovan]

For Red Hat Linux 7.2, you go to the Red Hat "errata" page https://rhn.redhat.com/errata/ and from there to the page specific to version 7.2 https://rhn.redhat.com/errata/rh72-errata.html . There, you'll see that, to date, Red Hat has issued 151 patches and updates (mostly for security issues; that's what the "broken lock" icon means) for that Linux version. For a very crude sense of scale, that works out to an average of around 2.3 patches per week.

Next, let's do the same thing for XP Professional, starting on Microsoft's errata page, the "HotFix & Security Bulletin Service"; use the pull-down menu to isolate just the XP-related items. You'll see that the page lists 21 XP-specific patches and updates to date. That's an average 0.35 patches per week.

This one cracked me up . It reads "Red Hat released more patches, so it must be more buggy." Hmmm, let's look again at this statement. A Red Hat distribution is not only an operating system, but a full fledged software suite. It has, among others, office software, databases, lots of networking stuff, games etc. in a tenfold greater amount than Windows has with its shabby Write and Minesweeper stuff. All these software packets can have bugs. For example, email programs. With WinXP pro comes only Outlook Express. This has numerous bugs and security flaws. With RH come numerous (lazy to count them, must be 20 or more) email clients. Even if only half of them have one bug, this makes 10 bugs in Mr Langa's book, while Outlook Expresses 5 bugs makes only 5 in total. Hence, Windows must be twice as secure as Linux. Is it just me, or sees anyone else flaws in his logic?

Also, to compare the number of bugs with a company, that considers most of its bugs to be features, is ridiculous.

Sorry, but this guy is an idiot.

[Urban Ranger]

Glonkie, according to your link:

Over the first half of this year, just 54 US government systems were successfully attacked compared to the 204 that took place during the same period last year.

A total of 38 UK government systems were hit during the first six months of last year, but only 12 have fallen victim so far this year.

Compare this to the Slammer Worm attack. Which system is more buggy? Which system has more security flaws? The answer is crystal clear - Microsoft. I realised that Slammer targets SQL Server, but even the article you linked is about attacks on third party software, so it seems that SQL Server is more than fair game.

[Dr. A. Cula]

I found this little thing this morning

The Linux

A Technological Re-Write of Theodore Giesel's "The Lorax"

At the far end of Redmond where the Grickle-grass grows
and the wind smells slow-and-sour when it blows
and no birds ever sing excepting old crows...
is the Street of the Lifted Linux

And deep in the Grickle-grass, some people say,
if you look deep enough you can still see, today,
where the Linux once stood, just as long as it could
before somebody lifted the Linux away.

What was the Linux?
And why was it there?
And why was it lifted and taken somewhere
from the far end of town where the Grickle-grass grows?

The old Gates-ler still lives here.
Ask him. He knows.
You won't see the Gates-ler.
Don't knock at his door.

He stays in his Lerkim on top of his store.
He lurks in his Lerkim, cold under the roof,
where he makes his own software
out of vaporware, poof.

And on special dank midnights in August, he peeks
out of the shutters
and sometimes he speaks
and tells how the Linux was lifted away.

He'll tell you, perhaps...
if you're willing to pay.
On the end of a rope
he lets down a tin pail.

And you have to toss in fifteen cents
and a nail
and the shell of the great-great-great-
grandfather snail.

Then he pulls up the pail,
makes a most careful count
to see if you've paid him
the proper amount.

The he hides what you paid him
away in a musty compartment,
to keep it away
from the Justice Department.

Then he grunts, "I will call you by Whisper-ma-Phone,
for the secrets I tell are for your ears alone."
SLUPP!
Down slupps the Whisper-ma-Phone to your ear
and the old Gates-ler's whispers are not very clear,

since they have to come down
throught a snergelly hose,
and he sounds
as if he had
smallish bees up his nose.

"Now I'll tell you," he says, with the charisma of grey,
"how the Linux got lifted and taken away...
It all started way back...
such a long, long time back...

Way back in the days when flying toasters were cool
and a floppy could hold
your entire system install,
and the Mir satellite was still up in space...
one morning, I came to this glorious place.

And I first saw the PCs!
The custom PCs!
The bright-colored cases of the custom PCs!
Mile after mile all lined up in THREEs.

And, sitting at keyboards, I saw the consumers
Growing in numbers with revenue rumours
The chances of riches all ripe like satsumas.

From the silicon valley
came the comfortable sound
of the dot com brigade,
there was money around.

But those PCs! Those PCs!
Those custom PCs!
All my life I'd been searching
for PCs such as these.

The glow of their screens
was much brighter than flames.
And Lara brought 3-D to all the new games.


I felt a great leaping
of joy in my heart.
I knew just what I'd do!
I unloaded my cart.

In no time at all, I had downed a machine.
Wiped off the old system, leaving it clean.
And with great speedy speed and with marketing jive.
I clicked on the mouse and installed 95!

The instant I'd finished, I heard a rustling thrash!
I looked, I saw something pop out of the trash
of the PC I'd installed on. He was sort of a sanguine.
Describe him?...That's hard. He looked like a penguin.

He was shortish and stylish.
not pixelly or lossy.
And he spoke with a voice
that was sharpish and bossy.

"Mister!" he said with a mouth full of soothers,
"I am the Linux. I speak for the users.
I speak for the users, for the awake and the snoozers.
And I'm asking you, sir, at the top of my lungs"--

he was very upset as he shouted and wheezed--
"Whats that THING that you've put on that there PC?"
"Look, Linux," I said. "There's no cause for alarm.
I installed just one system. I am doing no harm.

"I'm being quite useful. This thing is Windows.
There's no need for choice as it already knows!
It's a system, there's a helper. Choose the dog or the cat.
But it has other uses. Yes, far beyond that.

"For surfing. For typing! Undoing deletes!
Or adding up things in your Excel spreadsheets!"

The Linux said,
"Sir! You are crazy with greed.
There is no one on earth
who, this system would need!"

But the very next minute I proved he was wrong.
For, just at that minute, a chap came along,
and he thought that the system I'd installed was great.
He happily bought it for three ninety-eight.

I laughed at the Linux, "You poor stupid guy!
You never can tell what some people will buy."

"I repeat," cried the Linux,
"I speak for the users!"
"I'm busy," I told him,
"shut up, all you losers."

I rushed 'cross the room, and in no time at all,
had run through the MSN messenger install.

I texted all my brothers and uncles and aunts
and I said, "Listen here! Here's a wonderful chance
for the whole Gates-ler Family to get mighty rich!

Get over here fast! Take the road to North Nitch.
Turn left at Weehawken. Sharp right at South Stitch."

And, in no time at all,
in the campus I built,
the whole Gates-ler Family
was working full tilt.

We were all writing software
just as busy as bees,
to the sound of the whirring
of those lovely PCs.

Then...
Oh! Baby! Oh!
How my business did grow!

Now, installing one system
at a time
was too slow.

So I quickly invented my bloated downloader
(Though a few dual boot systems just fizzled like soda).

We were making PCs
four times as slow as before!
And that Linux?...
He didn't show up any more.

But the next week
he knocked
on my new office door.

He snapped, "I'm the Linux who speaks for the users
which you seem to be loading with software abuses.

"But I'm also a friend of the hip young designers
who drank lots of coffee all sat in recliners
and worked on their iBooks while out at the diners.

"NOW...thanks to your hacking they've nothing to do,
you've placed this great 'Office' right into their view.
It's blocking their vision, they can't see the scene
no room to maneuver with Word on machine!

"They loved living here, but I can't let them stay.
They'll have to find flare. And I hope that they may.
Good luck, boys," he cried. And he sent them away.

I, the Gates-ler, felt sad
as I watched them all go.
BUT...
business is business!
And business must grow
regardless of designers in recliners, you know.

I meant no harm. I most truly did not.
But I had to grow bigger. So bigger I got.
I biggered my output, and with a few hacks.
I biggered my downloads - huge great service packs

on the PCs that shipped out, I had a great channel deal
they'd all install Windows or my wrath's what they'd feel.
I went right on biggering...selling more CDs.
And I biggered my money, which does always please.

Then again he came back! .NET had me slogging
when that old-nuisance Linux came in and called me a noggin.
"I am the Linux," his laptop unfolded.
He yapped and he whined. He snarggled. He scolded.

"Gates-ler!" he cried, now sounding defiant.
You're making most websites just IE compliant!
My poor PC users...the ones who like Netscape!
For them, webpage loading is becoming a sweepstake.

"And so," said the Linux,
"--please pardon my homepage--
they caannot surf here.
With your monopolised outrage.

"Where will they want to go to today?...
I don't hopefully know, if they don't want to pay.
"They may have to surf for a month...or a year...
To escape from the honey-pot trap around here.

"What's more," snapped the Linux, his arms in the air,
"Let me say a few words on useless bloatware.
Your machinery chugs on, updating, installing.
the disk space it leaves is downright apalling.

"And how do you use this leftover space?
I'll show you. A paperclip? Oh What a waste!
You're stressing the workers, they're PCs are crash scenes!
They're systems have hung, all frozen on splash screens.

"So I'm sending them off. Oh, their future is dreary.
They'll leave their dot coms and get woefully weary
in search of some software, innovative, not stale.
I hear all the clicks as they log out of Hotmail."

And then I got mad.
I got terribly mad.
I yelled at the Linux, "Now listen here, Tux!
All you do is yap on about users, that's sucks!

I'll soon have them all on .NET and XP
I intend to go on basing things around me
And, for your information, oh Linux, I'm figgering

on biggering
and BIGGERING
and BIGGERING
and BIGGERING,

turning MORE PCs to running on Windows
Our support page will be where EVERYONE, EVERYONE goes!"
And at that very moment, we heard a deep breath!
From outside, a user, with blue screen of death.

Then a hand on a plug. Then we heard the plug pull.
The very last Windows PC of them all!
No more PCs. No more leads. No installs to be done.
So, in no time, my uncles and aunts, every one,

all waved me good-bye. they jumped into my cars
and drove away from the shimmering screensaver stars.
Now all that was left 'neath the dark Redmond sky
was my big empty factory

the Linux...

and I.


The Linux said nothing. Just gave me a glance...
just gave me a very sad, sad backward glance...
as he lifted himself by the seat of his pants.
And I'll never forget the grim look on his face

when he heisted himself and took leave of this place,
through a hole in the security, without leaving a trace.
And all that the Linux left here in my hall
was a small pile of disks, with the one word...

"UNINSTALL."
Whatever that meant, well, I couldn't fathom at all.
That was long, long ago.

But each day since that day
I've sat here and worried
and worried away.

Through the years, while my buildings
have fallen apart,
I've worried about it
with all of my heart.

"But now," says the Gates-ler,
"Now that you're here,
the word of the Linux seems perfectly clear.

Unless you uninstall
Windows, the whole awful lot,
nothing is going to get better.
It's not.

"SO...
Catch!" calls the Gates-ler.
He lets something fall.
"It's a Linux CD.
It's the last one of all!

"You're in charge of the last of the custom PCs.
And custom PCs are what everyone needs.
Install a new system. Treat it with care.
A nice funny mousemat and shiny hardware.

"Grow a small network, use Unix! Use Mac!
Then the Linux
and all of his friends
may come back."

[MRT144]

asher, bill is happily married, stop trying to win his affection.

[Asher]

Originally posted by Sir Ralph
This one cracked me up . It reads "Red Hat released more patches, so it must be more buggy." Hmmm, let's look again at this statement. A Red Hat distribution is not only an operating system, but a full fledged software suite. It has, among others, office software, databases, lots of networking stuff, games etc. in a tenfold greater amount than Windows has with its shabby Write and Minesweeper stuff. All these software packets can have bugs.

This is what I was talking about for excuses.
It's not Linux that's buggy, since Linux is only the kernel, it's everything else.

How many of those Windows bugs are in the Windows kernel, Ralph, rather than in other software included in the suite like IIS and SQL Server.

Compare this to the Slammer Worm attack. Which system is more buggy? Which system has more security flaws? The answer is crystal clear - Microsoft.

Err...UR, the Slammer Worm exploits one bug, that doesn't magically make the software more buggy because MS is a much more fun target than some faceless open source programs...

I apply about 20 security updates from Mandrake Update every week, and still people tell me Linux (as a whole, not the kernel) is more secure. It only seems that way since Linux hacks are usually not anywhere near on the scale of Windows ones, since it's much more fun to hack MS software than open source ones. After all, MS is the enemy.

[Skanky Burns]

MS is the bigger target. The article got that part right, at least.

[Harovan]

Originally posted by Asher
This is what I was talking about for excuses.
It's not Linux that's buggy, since Linux is only the kernel, it's everything else.

Still I don't see the logic, how releasing more patches means to have a less secure system. If one company releases patches hours after a bug gets reported, while the other first denies their existence, then declares them to be a feature, then (weeks later, may be never) releases a service pack, which fixes the one bug and creates three new, guess which system of both I consider to be more secure.

[Asher]

Originally posted by Sir Ralph
Still I don't see the logic, how releasing more patches means to have a less secure system. If one company releases patches hours after a bug gets reported, while the other first denies their existence, then declares them to be a feature, then (weeks later, may be never) releases a service pack, which fixes the one bug and creates three new, guess which system of both I consider to be more secure.

Look at this list of security vulns patched in Mandrake 9.0 (which is very recent): http://www.mandrakesecure.net/en/adv...es.php?dis=9.0

And they're hardly in obscure programs like you seemed to imply, they're in stuff like KDE, kerberos, MySQL, sendmail, apache, etc.

[Harovan]

Originally posted by Asher
Look at this list of security vulns patched in Mandrake 9.0 (which is very recent): http://www.mandrakesecure.net/en/adv...es.php?dis=9.0

That tells us what, that in a system with about 10000 packets (unsure about the number, but several thousands for sure) they found not even 50 flaws in 4 months? In numbers, 0.5% of the packets were buggy, while 99.5% were not. And you have the free choice to avoid buggy applications and replace them with 10 equivalent others, while under Windows you just have to live with IIS or SQL server, because every change is a pain in the butt. True, among them were very common packages, but also a lot of packages hardly anyone ever needs.

[Ari Rahikkala]

You know, that article looks like it was written to be posted to Slashdot... I don't mean sensationalism, but that every time he mentions anything negative (negative, as in "not positive" - neutrality is an unknown concept in Holy Wars) about F/OSS he immediately notes that he shouldn't be gotten wrong and that he's not attacking anyone. It's like he was expecting that if he didn't do so he would be drowned in flames again ...

[Garth Vader]

apply about 20 security updates from Mandrake Update every week, and still people tell me Linux (as a whole, not the kernel) is more secure. It only seems that way since Linux hacks are usually not anywhere near on the scale of Windows ones, since it's much more fun to hack MS software than open source ones. After all, MS is the enemy.

I have only seen 5 security updates in the last week, and this was a heavy week. Usually I only see 1-2. Most of the updates I have seen are for packages I don't have installed. I haven't applied any since my initial install last last november, although with the update to msec I saw yesterday I will have to now.

[Asher]

Originally posted by Garth Vader
I have only seen 5 security updates in the last week, and this was a heavy week. Usually I only see 1-2. Most of the updates I have seen are for packages I don't have installed. I haven't applied any since my initial install last last november, although with the update to msec I saw yesterday I will have to now.

I had a huge number since I only boot into Linux to do homework, and I hadn't had to do any homework since early December.

That tells us what, that in a system with about 10000 packets (unsure about the number, but several thousands for sure) they found not even 50 flaws in 4 months? In numbers, 0.5% of the packets were buggy, while 99.5% were not.

What a fabulous way to look at things. Let's take it a step farther and look at it by lines of code.

WinXP has somewhere around 35M lines of code. How many of those do you think have security vulnerabilities, as a percent?

And you have the free choice to avoid buggy applications and replace them with 10 equivalent others, while under Windows you just have to live with IIS or SQL server, because every change is a pain in the butt.

Huh? No, you certainly do not. I use WinXP and I use Apache and MySQL. IIS and SQL may ship with Windows, you certainly don't need to use them...

[Asher]

dp 'cause Poly was acting up (cursed Apache and MySQL )

[uh Clem]

I thought Linux was cool, but now I see Tom Ridge is using it.

Department of Homeland Security Switches to Linux