Re: Security followup

["Decker F. Wong-Godfrey" <dfgodfrey -at- milmanco -dot- com>]

In the beginning, this issue was whether Linux needs lots of different 
antivirus scanners to be seen as competitive with Windows. It doesn't. 
Why? The system itself works against viruses. The security issues one 
faces when they run Linux are different than the ones faced by someone 
running Windows. Andrew conceded the point in his last e-mail.

The origination of this whole thread (just incase you've forgotten) was 
advice that attempted to find a Linux analog to all the security and 
bad-engineering woes of Windows.  The issue is not whether there are 
vulnerabilities. The issue is that a robust, well engineered OS doesn't 
need to be butressed by add-ons simply because it works right. People 
jumping on the "security means secure" bandwagon need to reassess what 
security is. When it comes to computers, security is not a stable 
state--it is not the Nirvana of computing--it is a practice. Windows 
makes it hard to practice security because it is engineered badly.

Using a better engineered operating system that provides more 
protections to its users is a good way to practice security. That's the 
point. You don't have to like it--you don't even have to believe it; 
it's your prerogative to use whatever OS you want. I simply don't care 
what you personally choose to do with your time and money. But don't try 
telling me, that people face the same problems running Linux as they do 
running Windows.

I've had the opportunity to administer a Windows domain.  I've also had 
the pleasure to administer better engineered OSs, like FreeBSD, OpenBSD, 
Linux, Solaris and Mac OS X. I've seen the differences and I know from 
experience that  they are big.

As someone who is just now starting to look at what Linux is, you should 
be happy VERY HAPPY that your vendor provides you with an immediate, 
easy to use interface for updating your system. Up2date makes your job 
simple. The issue is not whether Linux/UNIX is bulletproof. The issue 
has always been whether the choice of OS plays into the overall security 
of a system.

Hopefully with the next version of their server, Microsoft has finally 
put a little bit of quality behind all that marketing. Hopefully we'll 
all be better off because the OS was actually engineered for usability 
and security, rather than sellability.