Gentoo Developer: Is The Linux Desktop Less Secure Than Windows 10?

[phoronix]

Phoronix: Gentoo Developer: Is The Linux Desktop Less Secure Than Windows 10?

Gentoo Linux developer Hanno Böck, who also writes for Golem and runs The Fuzzing Project as a software fuzzing initiative to find issues in software, presented today at FOSDEM 2017 over some Linux desktop security shortcomings and how Microsoft Windows 10 is arguably more secure out-of-the-box...

http://www.phoronix.com/scan.php?page=news_item&px=Linux-Desktop-Win10-Security

[lvlark]

So Hanno Böck's argument for the Linux desktop being less secure than Windows being that the automatic indexing of files under Linux has "a lot of questionable quality parser code" and that there isn't this behavior on Windows by default, but that Windows users generally are running anti-virus software too. An exploit with Ubuntu's Apport bug reporting tool was also pointed out and that more must be done to improve the Linux desktop security.

This paragraph is quite hard to read... Apart from the fact that I wouldn't know the details of the automatic indexing and the mentioned parser code. 'that there isn't this behavior on Windows by default', does that mean that Windows' parser code is better? Or that Windows' parser code also doesn't behave properly, but at least the effects on Windows are mitigated by anti-virus software?

All in all though - more relevant to me would be 'what to do to better secure my Linux desktop'.

[juno]

This was topic some months ago, why an article now?

https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html

[tildearrow]

KDE's Ballo

[GreenByte]

'what to do to better secure my Linux desktop'

Hardened kernel like linux-grsecurity is a must to make the desktop possible to be as secure as possible. Then comes all the MAC stuff.

[sl1pkn07]

thnks to god my system is gstreamer free

[Guest]

thnks to god my system is gstreamer free

Another crap from the Gnome camp. KDE defaulted to xine as far as I remember. There's also Phonon VLC backend, but it seems gstreamer is default now.

[sl1pkn07]

idk why not create a backed with plain ffmpeg/libav....

phonon-mplayer and phonon-avkode is dead

[Guest]

This was topic some months ago, why an article now?
https://scarybeastsecurity.blogspot....isions-in.html

Because moronix. Even if there are shortcomings like mentioned in the article in Linux and BSD distributions (yes, you're using KDE and Gnome) I doubt they're more insecure than Windows 10 by default:

https://www.petri.com/microsoft-wind...re-boot-richij

Apparently, Microsoft created a secret backdoor, for internal QA use. But two Ring Of Lightning researchers uncovered the so-called “golden key.” Now that the cat’s out of the bag, IT can’t rely on UEFI and Secure Boot to prevent boot-time malware, such as bootkits. Oops.

Just great!

https://threatpost.com/tor-urges-use...indows/101825/

http://www.theregister.co.uk/2016/07..._10_microsoft/

I also wouldn't count on Windows ASLR:

https://securingtomorrow.mcafee.com/...y-august-2015/

Two (2) of these vulnerabilities are Security Feature Bypass vulnerabilities. Both of them bypass the Address Space Layout Randomization (ASLR) feature

Three (3) of the vulnerabilities are Remote Code Execution Memory Corruption vulnerabilities and the other one is an Address Space Layout Randomization (ASLR) Security Feature Bypass vulnerability.

[Gerii]

This paragraph is quite hard to read... Apart from the fact that I wouldn't know the details of the automatic indexing and the mentioned parser code. 'that there isn't this behavior on Windows by default', does that mean that Windows' parser code is better? Or that Windows' parser code also doesn't behave properly, but at least the effects on Windows are mitigated by anti-virus software?

All in all though - more relevant to me would be 'what to do to better secure my Linux desktop'.

I've read the original presentation and my understanding is that Windows does not have a similar parser by default but such parsers exist in antivirus software (which most Windows users have installed).
He may be referring to this: https://googleprojectzero.blogspot.c...-endpoint.html