Moreover, most of Windows users are running their home OS with the
administration rights all day long, they used to download and install
lots of non-opened freeware from the web.

Well, they just do lots of important/dangerous/admin tasks that should
be done normally with a lot of care. Linux learns you these notions
that lots of basic MS users lack. Just tell linux users to ride their
boxes as root, installing lots of binaries not managed by their
distros without extra care, updating as much often as new versions
come out without thinking about stability, and you would see a huge
smile on their faces, with a "good joke !" comment. This is the
cultural gap.


Gal'

2007/4/20, Joe Hart <j.hart@orange.nl>:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Johannes Wiedersich wrote:
> > Jim Hyslop wrote:
> >> Ron Johnson wrote:
> >>> There's [...] no need for Symantec anti-virus
> >>> products.
> >> I'm curious why you say that. I'm fairly new to Linux, but I understand
> >> it is more robust and secure than MS Windows. Still, it's not totally
> >> secure - nothing made by humans could be. So, do you mean that there's
> >> no need for Symantec because of the freely available alternatives, or
> >> because Linux just doesn't need anti-virus protection, or something else
> >> altogether?
>
> The main reason is because almost all virus programs target Windows and
> will not run on Linux. However, proof of concept viruses have been
> shown and when they are, the system is usually patched to not allow that
> type of concept to work.
>
> >
> > Linux is not 100% secure. But it has a different attitude to security
> > and to viruses.
> >
> Yes.
> > If a virus hits a windows box, it is a personal mishap, but one can buy
> > a special software to detect and delete the virus.
> >
> Unless it wasn't a real mean virus and wiped the user's pc clean.
> That's one of the major differences. If one is using a user account in
> Linux, a virus would be limited in its ability to damage files outside
> of the userspace (ie. /home/username).
>
> > If a virus hits a linux box (it rarely happens), it is considered a
> > security hole. The developers analyse the path the virus got in, fix it
> > and neither that nor any virus of similar kind will be able to spread
> > again.
> >
> > This is a simplification, of course, but I hope you get the point.
> >
> > Johannes
> >
> > http://en.wikipedia.org/wiki/List_of...mputer_viruses
>
> nice link. It seems that most of the virus and worm programs listed
> there are old and no longer a threat. Want a good comparison, take a
> look at this:
>
> http://en.wikipedia.org/wiki/Virus_statistics
>
> Joe
> - --
> Registerd Linux user #443289 at http://counter.li.org/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFGKIAFiXBCVWpc5J4RAqxhAKDCbrbDdC0v+EoGS6alQj GfW8oQ4QCgqjZH
> orQs4HyIqTYUTZ7lYOa4/xg=
> =MYrR
> -----END PGP SIGNATURE-----
>
>
> --
> To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
>
>


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/20/07 04:58, galevsky@gmail.com wrote:
> Moreover, most of Windows users are running their home OS with the
> administration rights all day long, they used to download and install
> lots of non-opened freeware from the web.
>
> Well, they just do lots of important/dangerous/admin tasks that should
> be done normally with a lot of care. Linux learns you these notions
> that lots of basic MS users lack. Just tell linux users to ride their
> boxes as root, installing lots of binaries not managed by their
> distros without extra care, updating as much often as new versions
> come out without thinking about stability, and you would see a huge
> smile on their faces, with a "good joke !" comment. This is the
> cultural gap.

What galevsky writes is key.

Also, note that while I have absolutely *no* worries about viruses,
and *would* worry about worms, rootkits & buffer-overflows if my box
had any daemons listening on net-viewable ports, I *do* worry about:

Firefox/Iceweasel.

An XSS bug + a buffer overflow could lead to privilege escalation
and a rootkit being installed which could phone home or do other
malicious things as root.

- --
Ron Johnson, Jr.
Jefferson LA USA

Give a man a fish, and he eats for a day.
Hit him with a fish, and he goes away for good!

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGKMHOS9HxQb37XmcRAuGvAKCD9qXgb6ZR6IfA9l9xh9 SJ1WSOvwCfavhG
UXCj+zkh/3lqbInV2sXXFAA=
=CiMU
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Fri, 2007-04-20 at 10:55 +0200, Joe Hart wrote:
> Johannes Wiedersich wrote:
> > Jim Hyslop wrote:
> >> Ron Johnson wrote:
> >>> There's [...] no need for Symantec anti-virus
> >>> products.
> >> I'm curious why you say that. I'm fairly new to Linux, but I understand
> >> it is more robust and secure than MS Windows. Still, it's not totally
> >> secure - nothing made by humans could be. So, do you mean that there's
> >> no need for Symantec because of the freely available alternatives, or
> >> because Linux just doesn't need anti-virus protection, or something else
> >> altogether?
>
> The main reason is because almost all virus programs target Windows and
> will not run on Linux. However, proof of concept viruses have been
> shown and when they are, the system is usually patched to not allow that
> type of concept to work.
>
> >
> > Linux is not 100% secure. But it has a different attitude to security
> > and to viruses.
> >
> Yes.
> > If a virus hits a windows box, it is a personal mishap, but one can buy
> > a special software to detect and delete the virus.
> >
> Unless it wasn't a real mean virus and wiped the user's pc clean.
> That's one of the major differences. If one is using a user account in
> Linux, a virus would be limited in its ability to damage files outside
> of the userspace (ie. /home/username).
>
> > If a virus hits a linux box (it rarely happens), it is considered a
> > security hole. The developers analyse the path the virus got in, fix it
> > and neither that nor any virus of similar kind will be able to spread
> > again.
> >
> > This is a simplification, of course, but I hope you get the point.
> >
> > http://en.wikipedia.org/wiki/List_of...mputer_viruses
>
> nice link. It seems that most of the virus and worm programs listed
> there are old and no longer a threat. Want a good comparison, take a
> look at this:
>
> http://en.wikipedia.org/wiki/Virus_statistics

Most Linux proof of concept virus reports and "proof" require a huge
amount of stupidity on the part of the Linux user. The recent "iPod"
virus proof means Linux can carry the virus but not actually be infected
with it. It also proves that when making "Windows functionality" as part
of Linux, it can hurt the users data just as badly as an "rm -rf
$HOMEDIR" does when the user does it to their homedir.

One of the main reasons Windows is so bad, stupidity on the part of the
user compounded by bad systems design and authoring.

I see it all the time. Best Buy sees it all the time, selling
"rebuild/recovery" services or new machines to these people. Circuit
City sees it all the time, selling "recovery/rebuild" services to these
people. Dell's support center deals with it all the time, being able to
actually charge for support once they find that machines are zombied due
to worms or trojans or viruseseses. 97%+ of all the Windows PC problems
can be attributed user error of trusting something or somewhere they go
to, download or open says it does or gives them.

Quite simply, Windows system design and coding allows nearly any user to
compromise their own system without admin user rights, whether or not
they know they have done it. But the shiny new game (loaded with tons of
adware/spyware/keyloggers/activeX things) runs really well, until the
next reboot when the computer falls down and starts sucking its thumb in
response to the 8000 zombie processes running.

Summarizing this, I'd like to think that a Linux user, typically, cannot
compromise the system they use, unless they take active steps to destroy
it. On the other hand, Windows users, mostly, have no knowledge they are
compromising the system they use by downloading and running/installing
this great new GAME/ they got off a website or the "latest Windows
Security Patch" through an e-mail (directly from Microsoft, don't you
know.)
--
greg, greg@gregfolkert.net

Novell's Directory Services is a competitive product to Microsoft's
Active Directory in much the same way that the Saturn V is a competitive
product to those dinky little model rockets that kids light off down at
the playfield. -- Thane Walkup

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQBGKN3r7WZpcbUkaHwRAiykAJ453lcsVKT1FzEuGFYqM4 Wuv47sEQCfbssK
WsZe6yWh9XMCbv0yllE3EaY=
=ioXb
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Greg Folkert wrote:
> On Fri, 2007-04-20 at 10:55 +0200, Joe Hart wrote:
>> Johannes Wiedersich wrote:

Uh, I wrote this level, but I'm going to snip anyway, just didn't want
someone else to get the credit for writing the stupid stuff that I do.

[snip]
>> Want a good comparison, take a
>> look at this:
>>
>> http://en.wikipedia.org/wiki/Virus_statistics
>
> Most Linux proof of concept virus reports and "proof" require a huge
> amount of stupidity on the part of the Linux user. The recent "iPod"
> virus proof means Linux can carry the virus but not actually be infected
> with it. It also proves that when making "Windows functionality" as part
> of Linux, it can hurt the users data just as badly as an "rm -rf
> $HOMEDIR" does when the user does it to their homedir.
>
> One of the main reasons Windows is so bad, stupidity on the part of the
> user compounded by bad systems design and authoring.
>
> I see it all the time. Best Buy sees it all the time, selling
> "rebuild/recovery" services or new machines to these people. Circuit
> City sees it all the time, selling "recovery/rebuild" services to these
> people. Dell's support center deals with it all the time, being able to
> actually charge for support once they find that machines are zombied due
> to worms or trojans or viruseseses. 97%+ of all the Windows PC problems
> can be attributed user error of trusting something or somewhere they go
> to, download or open says it does or gives them.
>
> Quite simply, Windows system design and coding allows nearly any user to
> compromise their own system without admin user rights, whether or not
> they know they have done it. But the shiny new game (loaded with tons of
> adware/spyware/keyloggers/activeX things) runs really well, until the
> next reboot when the computer falls down and starts sucking its thumb in
> response to the 8000 zombie processes running.
>
Very correct in your assessment so far.

> Summarizing this, I'd like to think that a Linux user, typically, cannot
> compromise the system they use, unless they take active steps to destroy
> it. On the other hand, Windows users, mostly, have no knowledge they are
> compromising the system they use by downloading and running/installing
> this great new GAME/ they got off a website or the "latest Windows
> Security Patch" through an e-mail (directly from Microsoft, don't you
> know.)

But here's where it falters. In order to install packages (for system
wide use) in Linux, one must have root privileges, which means total
access to the system. If the package that said root user installs
contains viral code, malware for a broader term, then it can infect the
system. Therefore, it is imperative that one trust the source of the
packages being installed.

Now, we in Debian can be pretty assured that no such infected packages
exist, but we cannot be positive. Users that go outside of the official
repositories to obtain packages increase their risk, especially dealing
with non-free software.

That is one reason that gpg keys have been introduced into the apt system.

Needless to say, one does need to be careful, even on a Debian system,
but the chances of being the victim of a virus or worm is dramatically
reduced by using *any* operating system not made by Microsoft,
especially well designed ones like Debian, and Linux in general.

What this has to do with Dell I don't really know, but alas, we have
done it again; change the topic in the middle of the thread. Happens
all the time.

Joe

- --
Registerd Linux user #443289 at http://counter.li.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGKSrciXBCVWpc5J4RApsSAJ9vzOMNjp4cNIKjn2YzhU ealA6AcwCfRoNl
nyeQIPOS3HtiB/doQSXiKMc=
=Muj/
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Fri, Apr 20, 2007 at 11:58:56AM +0200, galevsky@gmail.com wrote:
> Moreover, most of Windows users are running their home OS with the
> administration rights all day long, they used to download and install
> lots of non-opened freeware from the web.

True (I did it as well)

> Well, they just do lots of important/dangerous/admin tasks that should
> be done normally with a lot of care. Linux learns you these notions
> that lots of basic MS users lack. Just tell linux users to ride their
> boxes as root, installing lots of binaries not managed by their
> distros without extra care, updating as much often as new versions
> come out without thinking about stability, and you would see a huge
> smile on their faces, with a "good joke !" comment. This is the
> cultural gap.

From my experience, Linux makes it much easier to run as user and still
have root control whenever (really) needed.

Regards,
Andrei
--
If you can't explain it simply, you don't understand it well enough.
(Albert Einstein)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGNhv3qJyztHCFm9kRAuivAKC0+sXm1v6yQUp+vWxz9r h2Tbyz0QCcDicx
AQllz+HFGaneEZGhxgEfxsA=
=uHnv
-----END PGP SIGNATURE-----