Comment by belorn | Hacker News Reader

Comment by belorn | Hacker News Reader

Parent Full thread

Security without a threat assessment is not very meaningful. If we are comparing a default linux desktop installation and a default windows installation, what would the test setup look like?

Let say we had two such machines and gave them each a reachable ip address and let the first test just be them running unattended until unwanted software got in.

In the second experiment we had the same machines go to random websites (top 1k), clicking randomly, using the default web browser.

In the third, we let them click and run attachment from email spam.

In the fourth and final experiment, we hire pen testers to target the machines explicitly.

With the same conviction that xpaulbettsx wrote, I have no doubt that the first 3 tests would show Windows 10 going down first. The amount of threats that targets window user is just order of magnitude more than those targeting linux users. The fourth test might give different results, but users who want to defend against targeted attack are generally advised to use extra security tools to defend themselves.

Just because Windows goes down first doesn't mean that Linux is more secure. It only means that it doesn't have a high enough market share to meaningfully exploit for a return on investment.

We should take the metric of "given a motivated party, how difficult would it be to exploit this machine" I have no doubt people are already sufficiently motivated to exploit Windows. But maybe only the NSA gives a shit about Linux- do we leave them unchecked?

You're ignoring that most Linux distros come with better defaults, i.e. no open ports. Reducing the attack surface is an important part in keeping the OS safe. Windows is remarkably bad in that regard.

I had a look at Windows 10, by default, assuming you clicked Private for the network connection, there are no ports that are open for any program to use. There are 33 rules for the All profile, 18 for the private profile, some duplicates, each of which specifies what local program is allowed to receive data:

9 connect to Modern Windows apps, 1 for ICMPv4, 12 for ICMPv6, 1 for IGMP, 1 for ISATAP, 12 for TCP, Cast to device, IPHTTPS, Network Discovery, WiDi. 15 UDP: 2 for Cast to device, 2 for DHCP, 1 for Teredo, 1 for Delivery Optimization, 1 for mDNS, 7 for network discovery, 1 for miracast.

Windows comes with its firewall turned on by default since XP SP2, most popular distros doesn't do that even today. Windows 10 doesn't even respond to ping by default (which is a pita).

Not sure about other distros but opensuse comes with a pretty strict firewall out of the box. My logic says that this is probably common practice for many general-use distros.

Ubuntu and debian does not. Well, they are installed and debian is enabled too (but defaults to allow all traffic).

openSUSE uses a password protected root account (shared secret), doesn't use ASLR and doesn't even run apparmor...

You're disregarding the difference between being more secure theoretically versus in practice.

Security without threat assessment is meaningless because security is about preventing a negative outcome. If the environment is perfectly safe then no security is needed, and if the environment is infinitely hostile then no amount of security will prevent a negative outcome.

Example: Being in an armored car in a war zone is still more risky than riding a bike in a peaceful country side, even if the bike has significant less security than an armored car. The Advice then is not to tell people in war zones to get bikes, nor is it to tell people to get rid of bikes in favor of armored cars. Security needs to match the need, which depends on the threat level.

In my above post I included "targeted attack" as the fourth test, named by security theory as an attack by a motivated party towards a specific resource. If a motivated party wants to attack a specific resource, then the defender needs to raise security above that of general security. Many government agencies have policies based on such threats, and neither a default Windows 10 or default Linux distribution would qualify for such environment. SELinux however was designed for that threat level and is thus common in military organizations, banks, and similar high risk environments.

Reply on news.ycombinator.com