Security is sensible defaults

ben
Sat, 05 Jan 2008 13:10:55 +0000

There are many things tech'y people argue about online, from vim vs emacs, Python vs Ruby, imperative vs functional languages. The list is nearly endless.

One of the most common is "Which is the most secure OS". Typically it goes that Windows is the most ridiculously insecure OS, and Linux the far more secure. Mac OS X users then point out that they don't get viruses. Then a Windows user points out that he's run Windows for years without getting any viruses, and that there are lots of exploits for Linux applications.

These arguments are all pretty much right. Windows is insecure. Linux is more secure. Mac OS X doesn't get many viruses.. But you can make Windows secure, and Linux insecure..

Does this mean one OS is more secure than another? No.

You can secure pretty much any OS given a bit of effort. Installing a virus scanner/firewall on a Windows machine, and not clicking random email attachments will pretty much stop most problems.

So why is Windows considered so insecure? Because people are technologically stupid - they don't know that they need a firewall, or to enable WPA security on their router, or...

Windows, by default, is very insecure - There are lots of processes running, Internet Explorer runs ActiveX Controls without hesitation, there are plenty of services running, and many listening sockets (DCOM is a famous example)

Compare this to your average Linux install - Ubuntu is probably the best example of this - It has no listening services by default. You run as a non-administrative user by default. If you install Ubuntu, change nothing and connected it to the Internet, it doesn't get infected within minutes.

OpenBSD is considered the most secure OS. You can still run "rm -rf /" and destroy the system in seconds, or "nc -l -p 21 -e /bin/bash" and allow anyone passwordless access to your machine. The difference is, it is "Secure by Default" - you can count the number of remote-exploits for a default OpenBSD install using about two fingers.. As the OpenBSD site says, it lets inexperienced users setup OpenBSD securely, then as they learn more about the OS, they can enable extra daemons and services, standing more chance of knowing what they are doing.

Take wireless routers as another example. A few years ago, if you took Kismac and wandered pretty much populated area, chances are you'd see about 80-90% of visible access points would be unencrypted.

Today, it's nearly the opposite - 80-90% are now encrypted.

Are people becoming more security conscious? More technologically competent?

No. Router manufactures are shipping wireless routers with WPA enabled by default! To connect to the access point, click "Connect" and enter the WPA key printed on the base of your new router. Easy, and it stops random people using your internet connection, and it requires no setup.

Security is sensible defaults. Linux, Mac OS X, FreeBSD, OpenBSD, modern wireless routers - all have fairly secure default settings, all are considered secure.

Of course, there are other factors - People using Linux are generally more technologically competent than someone who have just bought their first computer (which will have Windows installed by default).

The fact Windows is installed on a lot of computers is the reason there are so many random "this_is_not_a_trojan.jpg.gif.bmp.exe" viruses floating around. More important is the fact it's installed on a lot of computers, owned by new or inexperienced computers owners, where you can be a single click away from installing a virus that can completely take control of the system quite easily..