Kaspersky: Mac, Linux, BSD open for attack

Apache is not an operating system

I think my subject line here says it all, but I'll elaborate. Apache, which mburton325 mentions, is an open source HTTP server, which just happens to be available on nearly every platform on the planet...including Win32/64.

What he's failed to realize here is that being open source isn't a bad thing, because there are tons of review on most applications that are available on public repos for just about every major linux distribution. This means that the code is under scrutiny to ensure that any vulnerability found is snuffed out quickly, which often leads to multi-platform fixes, not just Linux, BSD, or Mac native.

Now, I'm not going to berate this person, because it shows that he hasn't used Linux to any extent or he would know how quickly it's out-evolved every other operating system out there. There are a lot of differences in one distro to the next, just like there are a lot of differences from one car make and model to the next. It's all about taste, not differing ideas in security. People tend to forget, Linux is a kernel, not an operating system, even though most distributions are referred to as Linux. Hence 'Red Hat Linux', 'SuSE Linux', 'Kubuntu Linux'. Notice that the distribution name preceeds what powers it. Linux, just like BSD, or any other UNIX/posix OS, is a comglomeration of tools. Windows is no different. When you load out a Windows server, do you only use what came on the installation CD, and never anything more? Not often, I would imagine.

Now, all that said, think about which user-group these OS communities really focus on. Linux, traditionally, has been a server/workstation OS designed with Power Users in mind. Windows, like MacOS, has always been about being everything to everyone, though Windows has traditionally been more open to a greater number of developers. True Linux distros are changing that, and yes... I figure we'll see a lot more flavors of consumer grade Linux distros, but that doesn't make them any more or less secure due to development model. Vulnerabilities in code, are vulnerabilities in code, regardless of what kernel is powering the operations.

In the end, it all comes down to education. If a system-owner / user are not properly trained in system security practices (as most are not), then they will more likely suffer a security breach many times over. I can't keep track of the number of systems that I've had to 'de-infest' of malware because the 'average joe consumer' took his new Windows XP or Vista box, and connected it directly to a Cable modem or DSL, because his ISP sent him only a modem & starter disc and told him 'here... install this and you'll be good to go'.

If you really want to fix the internet security problems, restrict all access to those that can pass a standardized system security and usage training course, tied to an ID card, teamed with a standardized card reader to be used on all systems world wide. The problems with that idea are many-fold however, and most would see this as Orwellian. But, I'd bet that if these login control systems & licensing were tied to biometrics, we would see the internet security problems become a thing of the past, since noone would want to throw up a red flag every time they did something against the 'global internet usage agreement'.

M. Burton is an idiot

This BS is what one would expect to come from one who is so bigoted toward a fatally flawed operating system such as Windoze.

That Windoze is essentially the only operating system that hackers attack speaks volumes. Unix has been around for a long time. Why have we not seen attacks against it. It is pretty much the same for Linux and OS X.

M. Burton's sophomoric statement regarding the vulnerability of Open Source software gives one the impression that he works at Microsloth since his statement so closely parallels that of Microsloth.

For the record, I routinely work with all flavors of Unix, Linux, OS X, i5/OS, and even Windoze. Of all of those operating systems, Windoze gives us the most headaches.

mburton325 reality check

mburton325,

* Linux has been targeted for attack. It's just that the success of each attack is very short lived, due to sane fundamental design which allows holes to be quickly patched. http://en.wikipedia.org/wiki/List_of_Linux_computer_viruses

* Linux is not just used on the desktop.

* Linux is only a 3rd rate OS for people who cannot command its power. UNIX and UNIX-like systems shift the power towards the intelligence and creativity of the operator, by providing smaller tools designed to be used in combination with each other. Windows assumes its users are idiots and thereby limits them to specific features. Mac OSX provides the best of both Worlds.

* The machines most vulnerable on the Internet are servers, since they always have exposed attack surfaces. Most desktops are not addressable thanks to the high use of NAT routers, are used sporadically and often hop around to different IP addresses between use. Of the hosts which are accessible and SSL enabled, Linux and the BSD's account for 43%. http://news.netcraft.com/SSL-Survey/CMatch/osdv_all Yet Windows still dominates when it comes to exploited hosts.

* If source being open makes the system less secure, explain the OpenBSD success story.

* Money driving some aspects of hacking is very old news. What do you think are the most common targets for SPAM zombie hosts? If open source reduced security, we would have had a shift towards Linux for exploited hosts by now.

* And as someone else pointed out, Apache is not Linux, nor is it an OS.

You should quit being ignorant and start educating yourself and thinking before you talk. If you are creatively challenged, just stick with Windows and be happy that a company caters to the special needs of people like yourself.