Kuro5hin.org: technology and culture, from the trenches
create account | help/FAQ | contact | links | search | IRC | site news
[ Everything | Diaries | Technology | Science | Culture | Politics | Media | News | Internet | Op-Ed | Fiction | Meta | MLP ]
We need your support: buy an ad | premium membership

[P]
Unix's Security Reputation

By in News
Mon Mar 27, 2000 at 02:42:31 PM EST
Tags: Security (all tags)
Security

Unix has an undeserved reputation for poor network security. This article is a quick overview of some of the factors that have given Unix this reputation.


Sponsors

Voxel dot net
o Managed Hosting
o VoxCAST Content Delivery
o Raw Infrastructure

Login

Related Links
o article
o Also by


Display: Sort:
Unix's Security Reputation | 12 comments (12 topical, editorial, 0 hidden)
Put a bit more in the box, eh? A tw... (3.00 / 1) (#4)
by pwhysall on Mon Mar 27, 2000 at 08:10:39 AM EST

pwhysall voted 1 on this story.

Put a bit more in the box, eh? A two-sentence summary would have been nice.
--
Peter
K5 Editors
I'm going to wager that the story keeps getting dumped because it is a steaming pile of badly formatted fool-meme.
CheeseBurgerBrown

Um... who told you Unix had a poor ... (4.00 / 1) (#1)
by rusty on Mon Mar 27, 2000 at 09:19:03 AM EST

rusty voted -1 on this story.

Um... who told you Unix had a poor security reputation? The truth (or lack thereof) of this rumor aside, that statement is like saying "food is fattening". Which food? "Unix" is dozens of OS'es, hundreds if you count platforms separately. This article doesn't really make sense to me.

____
Not the real rusty

Re: Um... who told you Unix had a poor ... (none / 0) (#6)
by djzoot on Mon Mar 27, 2000 at 05:18:01 PM EST

Hear hear ... Would be nice if the article had more meat to it ...

Perhaps I lived a sheltered (computer-wise) life, but have always been under the deluded notion that Unix-style OSes were amongst the most secure and that its biggest crime was allowing the user (inc root) to shoot itself in the foot.

Given that I'm not a big fan of systems or laws designed to protect people from themselves, I've been a rabid drooling advocate since day 0.

Is this really a general op of Unix? There are _some_ design choices that can be questioned (ie: the root user) and many distibutions of popular unices (sp?) leave as much as possible turned on by default in an effort to make life easy for the majority of their users (and more difficult for the few concerned about securuty), but ... *shrug* ...

Here's wishing that distros of linux had an 'all services off' option in their install frontends :)

-rob
--
There is no K5.
[ Parent ]

Re: Um... who told you Unix had a poor ... (none / 0) (#9)
by rusty on Mon Mar 27, 2000 at 11:41:32 PM EST

I think the deepest problem here is that people insist on referring to an OS as "secure" or "insecure." When you get right down to it, both of those are meaningless statements, until you say "The HPUX box sitting at foo.bar.com is insecure." OS'es are more or less easily securable IMO, but are not inherently secure or insecure. Trusted Solaris is very very securable. RedHat Linux is securable with some effort. NT 4 is securable in most cases, for most common needs, unless someone finds an exploit in the closed code. Then you have to wait for MS to make your machine securable for you. But that's the range of things that make sense to say. Saying "Unix isn't secure" or "Unix is secure" just doesn't say anything. Which is of course why the "my OS is more secure than yours" wars drag on ad infinitum, because arguments about meaningless statements (aka philosophy/religion ;-)) are unendable.

____
Not the real rusty
[ Parent ]
Re: Um... who told you Unix had a poor ... (none / 0) (#10)
by Inoshiro on Tue Mar 28, 2000 at 12:24:25 AM EST

Quite an enlightened view. Wieste Venema said a much similar thing when some marketting drones at IBM decided that his program should be called "IBM Secure Mailer" or some such, because vmailer had some namespace issues with another program. He chose Postfix instead, and the IBM page (and support documents) all refer to a version (from 1998) which thet have branded the "IBM Secure Mailer" .. Sigh. At least it is reasonably secure ;-)

As for the article. It's clearly an attempt at humour. Nothing else can explain the "Unix isn't secure" "Security through obscurity of Unix" comments.



--
[ イノシロ ]
[ Parent ]
It's a good topic, and it's worthy ... (4.00 / 1) (#3)
by eann on Mon Mar 27, 2000 at 09:52:38 AM EST

eann voted 1 on this story.

It's a good topic, and it's worthy of discussion here or elsewhere. But the article was significantly shallower (more shallow? less deep?) than I expected.

Is the reputation really that UNIX isn't secure, or is it more that it takes a skilled administrator to make it secure (and that skilled admins are scarce and/or expensive these days)? Has this been affected by NT's related but undeserved reputation that anyone who can find their way around Win95 can run it? Has OpenBSD made anyone wonder if the other BSD's really aren't secure?

What can UNIX advocates do to correct misconceptions about things like this? What can we do to encourage the major distributions to stop enabling defaultly-configured services most people don't need ("If you don't know how to find, configure, and activate sendmail, you probably shouldn't be running it.")?

Our scientific power has outrun our spiritual power. We have guided missiles and misguided men. —MLK

$email =~ s/0/o/; # The K5 cabal is out to get you.


... (2.50 / 2) (#2)
by stimuli on Mon Mar 27, 2000 at 11:37:50 AM EST

stimuli voted 1 on this story.

I think this article misses one point: the rampant buffer overflow problems found with so much Unix software is largely a factor of using C as a programming language.
-- Jeffrey Straszheim

Re: ... (none / 0) (#7)
by djzoot on Mon Mar 27, 2000 at 05:27:30 PM EST

No disrepect intended, but this statement is 100% false!

C allows the programmer to be foolish indeed, but proper practices (ie: replace all use of sprintf with snprintf and add appropriate boundary condition handling) are required IMHO in a C programmer's work.

A pretty decent howto on secure programming can be found here ... Both it and deep C secrets as well as some internal C guidelines are required reading round these parts ... and kinda fun to boot :)

-rob
--
There is no K5.
[ Parent ]

Re: ... (none / 0) (#8)
by stimuli on Mon Mar 27, 2000 at 05:42:02 PM EST

The proof is in the performance. Follow Bugtraq for a month and count the number of buffer overflows discovered. Many of these are in stable releases of mature programs. Now, why?

It is possible to write C code free of bugs. It is even possible to manage a large C projects with many programmers and have it free from memory bugs, but it is not easy. It becomes particularly hard as application complexity grows, with many dynamically sized data elements getting passed around.

Now, there are languages out there that can guarantee that you won't overflow a buffer. Java is such, although insufficient for kernel work. But Java is really a rather new player in this arena. Languages such as Eiffel and Ada have given us safe abstractions for many years. Even C++, if used with a good class library, will help you avoid many of the stupid buffer problems that plague C.

Sure, a skilled C programmer can invest enough effort to avoid these problems. However, with better tools he need invest much less effort, and in some cases the compiler can guarantee safety.
-- Jeffrey Straszheim
[ Parent ]

Re: ... (but only tangentially) (none / 0) (#12)
by eann on Tue Mar 28, 2000 at 10:37:33 AM EST

I wish I had an attribution for this:

Every significant program hast at least one bug, and at least one line of code that could be removed. Therefore, by induction, every program can be reduced to one line of code that doesn't work.

Our scientific power has outrun our spiritual power. We have guided missiles and misguided men. —MLK

$email =~ s/0/o/; # The K5 cabal is out to get you.


[ Parent ]
So what can we do about it? (none / 0) (#11)
by marlowe on Tue Mar 28, 2000 at 08:31:14 AM EST

No, seriously. There's an awful lot of C/C++ legacy code out there. It can't be machine translated to a decent language precisely because it's pointer based, and a decent language wouldn't be. I'd like to chuck it all and start coding from scratch in a better language, but I doubt very many will go along with me.
-- The Americans are the Jews of the 21st century. Only we won't go as quietly to the gas chambers. --
[ Parent ]
Okay, so it's counterspin. It's st... (2.00 / 1) (#5)
by marlowe on Mon Mar 27, 2000 at 12:05:14 PM EST

marlowe voted 1 on this story.

Okay, so it's counterspin. It's still interesting, and it contributes to the debate.
-- The Americans are the Jews of the 21st century. Only we won't go as quietly to the gas chambers. --

Unix's Security Reputation | 12 comments (12 topical, 0 editorial, 0 hidden)
Display: Sort:

kuro5hin.org

[XML]
All trademarks and copyrights on this page are owned by their respective companies. The Rest 2000 - Present Kuro5hin.org Inc.
See our legalese page for copyright policies. Please also read our Privacy Policy.
Kuro5hin.org is powered by Free Software, including Apache, Perl, and Linux, The Scoop Engine that runs this site is freely available, under the terms of the GPL.
Need some help? Email help@kuro5hin.org.
My heart's the long stairs.

Powered by Scoop create account | help/FAQ | mission | links | search | IRC | YOU choose the stories!