You are not logged in.

#1 2006-06-23 12:32:28

zaozao
Member
Registered: 2006-05-12
Posts: 36

Vulnerability

Hi!

I want to clear one question exactly – Windows and *NIX systems.
Vulnerability is up to all the systems. The system is free for Vulnerability until we know it has Vulnerability.
Are there some key points make the approach different for Windows and *NIX?
Microsoft calls updates as Security Updates and updates for *NIX systems is for security or for reliability (I do not say for both systems about software updates like Service Packs)?
I mean if we can divide system modules to unVulnerability modules and Vulnerability modules for each system or not?
Here on forum I saw posts saying FreeBSD is more security system then Linux. How do I understand this? If I want more secure server I am to turn to FreeBSD?
And how all these are to Windows. I like Widows Server for comfortable configuration tools and many compatible easy integrated Services.
The vital point is Warranty. Microsoft takes money for the products and as I understand gives some Warranty and Support.
What Warranty is for *NIX systems and support? Or I am to turn to commercial products for getting Warranty and Support. As it commercial point then why I am turn to *NIX not to Windows?
What are the basic points for Security between Windows and *NIX? And what is for Arch with all these?

Please, do not answer with like "I use this because I like this".

I really need some professional answer with this question!



Thank you!

Offline

#2 2006-06-23 13:12:30

stavrosg
Member
From: Rhodes, Greece
Registered: 2005-05-01
Posts: 330
Website

Re: Vulnerability

For a professional answer, you should have gone to a consultant with this question. Here you'll only get opinion and bias. wink

Now, if you take some time to read EULAs and the most common open source licenses, you'll find out that everybody give the same warranty: There is no warranty.

For example, we read in the GPL:

11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.

Every license I've read (free or otherwise) contains a part with a similar wording, but the same meaning, with the exception of some accounting programs here in Greece, that they at least guarantee compliance to a certain law that permits their usage, but they have to do that to be able to sell.[/list]

Offline

#3 2006-06-23 13:21:49

ralvez
Member
From: Canada
Registered: 2005-12-06
Posts: 1,694
Website

Re: Vulnerability

Regardless of what OS  you use, there will always be software errors and bugs and that is a given.
There are however major differences between Windows and Unix (and all its variants) in the philosophy of system security, which turns out make Unix systems far more secure than Winidows.
To begin with in a Unix system there is a natural separation of the Administrator and the User rights (Windows Vista may take the same approach, or so I understand) which gives you "automatic protection" because a virus and/or malware can not spread (like it occurs in Windows) because as a user you do not have the rights to alter system files. Further more you have granular control of files ownership. By this I mean that you can use 'chomd' to establish permissions for the owner of the file, the users in the group of the file creator and others (as in everyone else) and is VERY easy to do.

Unixes were created to be part of a network, Windows is an OS conceived for the desktop and adapted to work on a network; therefore, all the natural securities, checks and bounces built into Unix are but an adaptation in Windows, I personally think that is in fact the major flaw in Windows and the root of all its bugs and problems.

When I comes to support you can get support for Linux/Unix just as you can for Windows. There are a number of commercial distros that will provide all kinds of support and just to mention two of the "big guns": RedHat and Novell.

As per security severity, this is an interesting thing.
Microsoft does not label security issues the same as most security companies.
For MS to have a security flaw labeled as 'critical' it means that someone out there can take control of your machine and or extract information at will; therefore, they label very fiew critical vulnerabilities (as opposed to Unix) BUT if you see how security companies label their issues THEN you find out that they have a much larger level of security issues. Their approach, regardless of what we think of it, is a commercial approach and they need to "protect" their investment by deflecting the impact of security issues. This is well known in the industry, therefore most  serious IT people take their reports with "a grain of salt"

Hope this helps.

p.s. I do not intend to start a flames war with my comments and they represent my personal views and experience in the field for the last 12 years ... so if anyone disagrees that's fine, but let's not get to hot about it.  wink

Offline

#4 2006-06-24 10:50:51

zaozao
Member
Registered: 2006-05-12
Posts: 36

Re: Vulnerability

stavrosg wrote:

For a professional answer, you should have gone to a consultant with this question. Here you'll only get opinion and bias. wink

Can you list some trusted recourses?

Thank you!

Offline

#5 2006-06-24 10:54:12

zaozao
Member
Registered: 2006-05-12
Posts: 36

Re: Vulnerability

ralvez wrote:

There are a number of commercial distros that will provide all kinds of support and just to mention two of the "big guns": RedHat and Novell.

Can you list some UNIX systems?

And what is about FreeBSD exactly?


Thank you!

Offline

#6 2006-06-24 13:20:16

ralvez
Member
From: Canada
Registered: 2005-12-06
Posts: 1,694
Website

Re: Vulnerability

Go to this link http://www.computerhope.com/unix/unix.htm and read about UNIX and BSD until you can take it any more  lol

p.s.: In the same web site this section answers also some of your questions:
http://www.computerhope.com/issues/ch000575.htm

Offline

#7 2006-06-24 13:41:39

zaozao
Member
Registered: 2006-05-12
Posts: 36

Re: Vulnerability

ralvez wrote:

Go to this link http://www.computerhope.com/unix/unix.htm and read about UNIX and BSD until you can take it any more  lol

p.s.: In the same web site this section answers also some of your questions:
http://www.computerhope.com/issues/ch000575.htm

Sorry. It is not helpful much!

Thank you!

Offline

#8 2006-06-24 14:29:06

phildg
Member
Registered: 2006-03-10
Posts: 146

Re: Vulnerability

zaozao wrote:

Sorry. It is not helpful much!

You know, you can do your own research on the subject, that way you'll find out exactly what you want or need to know rather than have people throw links at you that you may or may not find useful.

zaozao wrote:

And what is about FreeBSD exactly?

Visit FreeBSD's website, they have some of the finest documentation I have ever seen.

zaozao wrote:

Can you list some UNIX systems?

ralvez's link (which you said was unhelpful) contains a list of the more common unices along with a brief overview of them.

You'll not get much warranty with any software, at least with open source stuff or "off the shelf" products like Microsoft Windows. As has been said read the EULA of the software you use, it most likely says the company can not be held responsible for any damages caused by using their software.

You can get support for Linux distributions, Redhat offer support for their products. Slackware has a list of third party companies that offer support for it for example. However you need to pay for this support. In general you can obtain a Linux distribution for free. However that doesn't come with a support service that you can ring up or email and demand a solution from. If you need more support than the man pages, or a group of volunteers on a website forum your going to have to find a company willing to give it and sign a contract with them.

As regards whether or not FreeBSD is more secure than Linux, well I believe strongly that security is down to the system administrator's skill. Any one can set up a FreeBSD box insecurely. A good admin can set up a Linux box to be very secure. If your looking to set up a server I would choose the OS you have most experience with. If for example you have years and years of experience with Windows and no experience with FreeBSD then use Windows. If your interested in another system get it set up on a devel or test server in a protected environment and learn how to use it.

I can't be bothered with the Windows updates versus everyone elses updates argument/discussion. Sorry.

I haven't been using Arch for a long time. However it seems to me that it doesn't really have a security update policy. It doesn't have a security branch that only provides security updates to the 'release' branch. However Arch is a rolling release and as soon as a maintainer is notified that a piece of software that Arch uses is out of date they update the repositories with a new package of the software. So by keeping your system in sync with the repositories you'll be automatically keeping your system fully patched in theory.

The whole jist of your post, to me, seems to be "What shall I use: Windows, Linux, some other unix?". You have to make up your own mind on that I'm afraid. You need to put some time and effort researching and reading papers addressing your concerns and make an informed choice upon that information.

Offline

Board footer

Powered by FluxBB