[RickDobbelmannqbtt]

TONY BRADLEY why do you keep on writing articles that are seriously flawed.. I guess you do not care about your reputation as a writer.

You constantly get schooled yet you continue to write false drivel. I cannot wait until PC world wakes up and fires your A__

Another nonsense article written by Tony Bradley.

This post has been edited by RickDobbelmannqbtt: 14 April 2012 - 07:45 AM

[MartinTurnerph6d]

Yes,and no.

This is exactly equivalent to the reason insurance companies give you a lower premium if you live in a safer neighbourhood. An OS which is attacked less often will, proportionately, see fewer successful attacks. Granted this doesn't make you safe, but it does make you safer.

[invalidopcode]

This article doesn't hold too much water, because Linux is targeted much more than people think. If you are a hacker, which would you rather target: one great Google server (running Linux) or a couple windows workstations? Linux is attacked all the time on large servers and it has held up to those attacks very well.

[MICHAEL6gvz]

Its been said before and I'll say it too.... Linux is indeed more secure than Windows.

[YellowEagle]

dtschmitz, on 13 April 2012 - 03:33 PM, said:

tonybradley, on 13 April 2012 - 02:28 PM, said:

LordInsidious, on 13 April 2012 - 02:04 PM, said:

Really the guy who just called disabling Java an 'innovative approach' to stopping OSX malware is calling others out on 'you're holding it wrong', really? What about OSX users who use Java, are they holding their mouse wrong? As for the rest of the content switching platforms because one got a virus and is therefore less secure is not an intelligent argument, but MS users have been telling that to Mac users for years.

I'm not following you. Users who use Java will continue to use Java. The proactive disabling of Java when not in use is not meant as a replacement for actually fixing Java. When vulnerabilities are discovered in Java, Oracle will have to address them, and Apple will have to incorporate the appropriate patch into its implementation as well. However, it is a core mantra of security best practices to uninstall or disable software that isn't being used, and the solution put forth by Apple takes care of the issue--at least for Java--to ensure that the potential attack exposure is as little as possible. Hopefully that will minimize the compromised machines and avoid this sort of attack in the future.

Folks,
This is Dietrich T. Schmitz, your Linux Advocate.
I've been watching Mr. Bradley for some time. Frankly, he needs to educate himself to the issues.

Here's an article I will share which I wrote recently:
http://2buntu.com/20...ty-modules-lsm/

Please read it and then come back.

Now, the issue here isn't that Linux can't get infected. It can, as can any other operating system.

What distinguishes Linux from OSX and Windows?: Linux Security Modules (LSM)

Essentially, I have been having this 'debate' with the Windows Tech crowd over at ZDNet for quite some time. So, I am quite used to the flamers who try to marginalize what I write. Bring it, if you think you can.

Linux wasn't designed with LSM built in. In fact, it came along as a modest 'design-in' change to set up a kernel 'hook' to pass control to an external dynamically loadable kernel module which when bound to the kernel at boot time will 'police' the actions of any profiled 'Application' and, THIS IS IMPORTANT, the KERNEL.

You see, what is happening in the Windows World is that Windows, all the way back to Windows 2000 is still using a legacy WinNT kernel. There is no equivalent to LSM in Windows or OSX.

LSM, when resident, will take each granular action taken by the Application, or, if a call is sent to the kernel, and compare it to its 'profile' and if the action is not defined will 'deny' otherwise, the action gets an 'allow' and the process id can execute.

This notion of having a third-party DKMS act as the 'police' makes LSM fool-proof.

Ubuntu Linux comes with LSM AppArmor and a profile for your Firefox. When Firefox is 'sandboxed' by LSM, any undefined action, or 'unintended side-effect' which is being used as an exploit to esclate privilege to launch a kernel 'root' administrative rights is simply denied.

So, you can if running Ubuntu with LSM be comforted in the knowledge that Zero Days will have no effect and your Distro will update your system within hours or days with a security patch.

No scrambling on Zero-Day.

Linux with LSM: The safest operating system on the Planet.

I stake my reputation on it.

Thank you Mr. Bradley

Dietrich T. Schmitz
Linux Advocate, Human Being

Is Ubuntu the only Linux system using LSM? And if it is why isn't this part of the Main Kernels Core system for any Build of Linux? after all keep Linux as secure as possible would be foremost in a build to me.

This post has been edited by YellowEagle: 15 April 2012 - 05:00 AM

[dtschmitz]

YellowEagle, on 15 April 2012 - 04:58 AM, said:

dtschmitz, on 13 April 2012 - 03:33 PM, said:

tonybradley, on 13 April 2012 - 02:28 PM, said:

LordInsidious, on 13 April 2012 - 02:04 PM, said:

Really the guy who just called disabling Java an 'innovative approach' to stopping OSX malware is calling others out on 'you're holding it wrong', really? What about OSX users who use Java, are they holding their mouse wrong? As for the rest of the content switching platforms because one got a virus and is therefore less secure is not an intelligent argument, but MS users have been telling that to Mac users for years.

I'm not following you. Users who use Java will continue to use Java. The proactive disabling of Java when not in use is not meant as a replacement for actually fixing Java. When vulnerabilities are discovered in Java, Oracle will have to address them, and Apple will have to incorporate the appropriate patch into its implementation as well. However, it is a core mantra of security best practices to uninstall or disable software that isn't being used, and the solution put forth by Apple takes care of the issue--at least for Java--to ensure that the potential attack exposure is as little as possible. Hopefully that will minimize the compromised machines and avoid this sort of attack in the future.

Folks,
This is Dietrich T. Schmitz, your Linux Advocate.
I've been watching Mr. Bradley for some time. Frankly, he needs to educate himself to the issues.

Here's an article I will share which I wrote recently:
http://2buntu.com/20...ty-modules-lsm/

Please read it and then come back.

Now, the issue here isn't that Linux can't get infected. It can, as can any other operating system.

What distinguishes Linux from OSX and Windows?: Linux Security Modules (LSM)

Essentially, I have been having this 'debate' with the Windows Tech crowd over at ZDNet for quite some time. So, I am quite used to the flamers who try to marginalize what I write. Bring it, if you think you can.

Linux wasn't designed with LSM built in. In fact, it came along as a modest 'design-in' change to set up a kernel 'hook' to pass control to an external dynamically loadable kernel module which when bound to the kernel at boot time will 'police' the actions of any profiled 'Application' and, THIS IS IMPORTANT, the KERNEL.

You see, what is happening in the Windows World is that Windows, all the way back to Windows 2000 is still using a legacy WinNT kernel. There is no equivalent to LSM in Windows or OSX.

LSM, when resident, will take each granular action taken by the Application, or, if a call is sent to the kernel, and compare it to its 'profile' and if the action is not defined will 'deny' otherwise, the action gets an 'allow' and the process id can execute.

This notion of having a third-party DKMS act as the 'police' makes LSM fool-proof.

Ubuntu Linux comes with LSM AppArmor and a profile for your Firefox. When Firefox is 'sandboxed' by LSM, any undefined action, or 'unintended side-effect' which is being used as an exploit to esclate privilege to launch a kernel 'root' administrative rights is simply denied.

So, you can if running Ubuntu with LSM be comforted in the knowledge that Zero Days will have no effect and your Distro will update your system within hours or days with a security patch.

No scrambling on Zero-Day.

Linux with LSM: The safest operating system on the Planet.

I stake my reputation on it.

Thank you Mr. Bradley

Dietrich T. Schmitz
Linux Advocate, Human Being

Is Ubuntu the only Linux system using LSM? and if it is why isn't this part of the Kernels core system for any Build of Linux?

Ubuntu is not the only Linux system using LSM.
AppArmor IS part of the mainline kernel and is the LSM running on Ubuntu.
openSuSE uses AppArmor.
Fedora uses LSM SELinux which is part of the kernel as well.
Red Hat Enterprise Linux uses SELinux

You can use LSM on any port of Linux.
Remember LSM is a Dynamically loadable module (DKMS) and binds at bootstrap to the kernel.

[ZipFolder]

No offense, i got lost with the debate.

[dtschmitz]

ZipFolder, on 15 April 2012 - 04:42 PM, said:

No offense, i got lost with the debate.

None taken.

[YellowEagle]

dtschmitz, on 15 April 2012 - 05:04 AM, said:

YellowEagle, on 15 April 2012 - 04:58 AM, said:

dtschmitz, on 13 April 2012 - 03:33 PM, said:

tonybradley, on 13 April 2012 - 02:28 PM, said:

LordInsidious, on 13 April 2012 - 02:04 PM, said:

Really the guy who just called disabling Java an 'innovative approach' to stopping OSX malware is calling others out on 'you're holding it wrong', really? What about OSX users who use Java, are they holding their mouse wrong? As for the rest of the content switching platforms because one got a virus and is therefore less secure is not an intelligent argument, but MS users have been telling that to Mac users for years.

I'm not following you. Users who use Java will continue to use Java. The proactive disabling of Java when not in use is not meant as a replacement for actually fixing Java. When vulnerabilities are discovered in Java, Oracle will have to address them, and Apple will have to incorporate the appropriate patch into its implementation as well. However, it is a core mantra of security best practices to uninstall or disable software that isn't being used, and the solution put forth by Apple takes care of the issue--at least for Java--to ensure that the potential attack exposure is as little as possible. Hopefully that will minimize the compromised machines and avoid this sort of attack in the future.

Folks,
This is Dietrich T. Schmitz, your Linux Advocate.
I've been watching Mr. Bradley for some time. Frankly, he needs to educate himself to the issues.

Here's an article I will share which I wrote recently:
http://2buntu.com/20...ty-modules-lsm/

Please read it and then come back.

Now, the issue here isn't that Linux can't get infected. It can, as can any other operating system.

What distinguishes Linux from OSX and Windows?: Linux Security Modules (LSM)

Essentially, I have been having this 'debate' with the Windows Tech crowd over at ZDNet for quite some time. So, I am quite used to the flamers who try to marginalize what I write. Bring it, if you think you can.

Linux wasn't designed with LSM built in. In fact, it came along as a modest 'design-in' change to set up a kernel 'hook' to pass control to an external dynamically loadable kernel module which when bound to the kernel at boot time will 'police' the actions of any profiled 'Application' and, THIS IS IMPORTANT, the KERNEL.

You see, what is happening in the Windows World is that Windows, all the way back to Windows 2000 is still using a legacy WinNT kernel. There is no equivalent to LSM in Windows or OSX.

LSM, when resident, will take each granular action taken by the Application, or, if a call is sent to the kernel, and compare it to its 'profile' and if the action is not defined will 'deny' otherwise, the action gets an 'allow' and the process id can execute.

This notion of having a third-party DKMS act as the 'police' makes LSM fool-proof.

Ubuntu Linux comes with LSM AppArmor and a profile for your Firefox. When Firefox is 'sandboxed' by LSM, any undefined action, or 'unintended side-effect' which is being used as an exploit to esclate privilege to launch a kernel 'root' administrative rights is simply denied.

So, you can if running Ubuntu with LSM be comforted in the knowledge that Zero Days will have no effect and your Distro will update your system within hours or days with a security patch.

No scrambling on Zero-Day.

Linux with LSM: The safest operating system on the Planet.

I stake my reputation on it.

Thank you Mr. Bradley

Dietrich T. Schmitz
Linux Advocate, Human Being

Is Ubuntu the only Linux system using LSM? and if it is why isn't this part of the Kernels core system for any Build of Linux?

Ubuntu is not the only Linux system using LSM.
AppArmor IS part of the mainline kernel and is the LSM running on Ubuntu.
openSuSE uses AppArmor.
Fedora uses LSM SELinux which is part of the kernel as well.
Red Hat Enterprise Linux uses SELinux

You can use LSM on any port of Linux.
Remember LSM is a Dynamically loadable module (DKMS) and binds at bootstrap to the kernel.

So this is just a Module? If so why isn't this Code written into the Core as a direct function of the Kernel's protection system, so that anyone that Downloads the Kernel now, to build from already has this included for any new builds of Linux. Or is it part of it now? Keep teaching I'm listening.

And do you have a Blog that a person can ask questions or comment on?

I run several machines, one is built to run any Operating system on the fly ( I don't dual boot )

(Oh and some of my software won't let me go to that Link it says there's a problem with it. Do you have another Link?)I don't use IE,I use Fire Fox and Malwarebytes Pro, could be a false positive but it Blocked the Site directly saying it was trying to load something Malicious onto my system.

Though i am a little familiar with Ubuntu, ( Not Much ) have been playing with it for many years on one of my testbed systems. ( And there are only so many hours in a day )Though don't care to much for the stock interface it has now. And i really like Compiz.

I still have Ubuntu Disks i use too order to give away, all the way back to 5:10, and Kubuntu to. Haven't been able to order any for a few years now, they tell me i have reach some limit. Which is strange to me as i give these out and have explained that.

This post has been edited by YellowEagle: 16 April 2012 - 12:09 AM

[zeke123]

Bravo Mr. Schmitz.

Your response is as excellent as the article is poor which is saying a lot.
You deal with specifics, the article with generalizations like Linux security is debatable because its often debated online. My head almost exploded when I read that.

Thank you for sticking to facts and setting the record straight.
I know its not as sexy as empty bromides and shaky analogies which is probably why you are not qualified to do THAT kind of writing in a place like this.
Stick to non-fiction, you are excellent at it and you do a very nice job explaining it.

I havent been this impressed by a commenter since Rainer Weikusat or GreyGeek.

[dtschmitz]

zeke123, on 16 April 2012 - 12:59 PM, said:

Bravo Mr. Schmitz.

Your response is as excellent as the article is poor which is saying a lot.
You deal with specifics, the article with generalizations like Linux security is debatable because its often debated online. My head almost exploded when I read that.

Thank you for sticking to facts and setting the record straight.
I know its not as sexy as empty bromides and shaky analogies which is probably why you are not qualified to do THAT kind of writing in a place like this.
Stick to non-fiction, you are excellent at it and you do a very nice job explaining it.

I havent been this impressed by a commenter since Rainer Weikusat or GreyGeek.

Thank you. I know Grey Geek personally and he certainly shines a light and is always an interesting read.

[amitzorba]

This editor is paid by Micro$oft. Who says Linux is obscure. It is used by more than 30 million users; and on numerous mission-critical systems like supercomputers, stock exchanges, big companies like Google.etc. Get some facts before writing anything. I didnt expect this in a pcworld article.

[amitzorba]

Quote

dtschmitz said

YellowEagle said

dtschmitz said

tonybradley said

LordInsidious said
Really the guy who just called disabling Java an 'innovative approach' to stopping OSX malware is calling others out on 'you're holding it wrong', really? What about OSX users who use Java, are they holding their mouse wrong? As for the rest of the content switching platforms because one got a virus and is therefore less secure is not an intelligent argument, but MS users have been telling that to Mac users for years. I'm not following you. Users who use Java will continue to use Java. The proactive disabling of Java when not in use is not meant as a replacement for actually fixing Java. When vulnerabilities are discovered in Java, Oracle will have to address them, and Apple will have to incorporate the appropriate patch into its implementation as well. However, it is a core mantra of security best practices to uninstall or disable software that isn't being used, and the solution put forth by Apple takes care of the issue--at least for Java--to ensure that the potential attack exposure is as little as possible. Hopefully that will minimize the compromised machines and avoid this sort of attack in the future. Folks, This is Dietrich T. Schmitz, your Linux Advocate. I've been watching Mr. Bradley for some time. Frankly, he needs to educate himself to the issues. Here's an article I will share which I wrote recently: http://2buntu.com/20...ty-modules-lsm/ Please read it and then come back. Now, the issue here isn't that Linux can't get infected. It can, as can any other operating system. What distinguishes Linux from OSX and Windows?: Linux Security Modules (LSM) Essentially, I have been having this 'debate' with the Windows Tech crowd over at ZDNet for quite some time. So, I am quite used to the flamers who try to marginalize what I write. Bring it, if you think you can. Linux wasn't designed with LSM built in. In fact, it came along as a modest 'design-in' change to set up a kernel 'hook' to pass control to an external dynamically loadable kernel module which when bound to the kernel at boot time will 'police' the actions of any profiled 'Application' and, THIS IS IMPORTANT, the KERNEL. You see, what is happening in the Windows World is that Windows, all the way back to Windows 2000 is still using a legacy WinNT kernel. There is no equivalent to LSM in Windows or OSX. LSM, when resident, will take each granular action taken by the Application, or, if a call is sent to the kernel, and compare it to its 'profile' and if the action is not defined will 'deny' otherwise, the action gets an 'allow' and the process id can execute. This notion of having a third-party DKMS act as the 'police' makes LSM fool-proof. Ubuntu Linux comes with LSM AppArmor and a profile for your Firefox. When Firefox is 'sandboxed' by LSM, any undefined action, or 'unintended side-effect' which is being used as an exploit to esclate privilege to launch a kernel 'root' administrative rights is simply denied. So, you can if running Ubuntu with LSM be comforted in the knowledge that Zero Days will have no effect and your Distro will update your system within hours or days with a security patch. No scrambling on Zero-Day. Linux with LSM: The safest operating system on the Planet. I stake my reputation on it. Thank you Mr. Bradley Dietrich T. Schmitz Linux Advocate, Human Being Is Ubuntu the only Linux system using LSM? and if it is why isn't this part of the Kernels core system for any Build of Linux? Ubuntu is not the only Linux system using LSM. AppArmor IS part of the mainline kernel and is the LSM running on Ubuntu. openSuSE uses AppArmor. Fedora uses LSM SELinux which is part of the kernel as well. Red Hat Enterprise Linux uses SELinux You can use LSM on any port of Linux. Remember LSM is a Dynamically loadable module (DKMS) and binds at bootstrap to the kernel. So this is just a Module? If so why isn't this Code written into the Core as a direct function of the Kernel's protection system, so that anyone that Downloads the Kernel now, to build from already has this included for any new builds of Linux. Or is it part of it now? Keep teaching I'm listening. And do you have a Blog that a person can ask questions or comment on? I run several machines, one is built to run any Operating system on the fly ( I don't dual boot ) (Oh and some of my software won't let me go to that Link it says there's a problem with it. Do you have another Link?)I don't use IE,I use Fire Fox and Malwarebytes Pro, could be a false positive but it Blocked the Site directly saying it was trying to load something Malicious onto my system. Though i am a little familiar with Ubuntu, ( Not Much ) have been playing with it for many years on one of my testbed systems. ( And there are only so many hours in a day )Though don't care to much for the stock interface it has now. And i really like Compiz. I still have Ubuntu Disks i use too order to give away, all the way back to 5:10, and Kubuntu to. Haven't been able to order any for a few years now, they tell me i have reach some limit. Which is strange to me as i give these out and have explained that.

Dear,
Try using Linux more frequently. It is the best.