Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #221222 > unrolled thread

Re: Anti-malware for my personal Debian workstation?

Back to article view | Back to linux.debian.user

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: Anti-malware for my personal Debian workstation? l0f4r0@tuta.io - 2020-04-11 19:10 +0200
    Re: Anti-malware for my personal Debian workstation? "Thomas Schmitt" <scdbackup@gmx.net> - 2020-04-11 19:50 +0200
      Re: Anti-malware for my personal Debian workstation? l0f4r0@tuta.io - 2020-04-24 00:00 +0200
        Re: Anti-malware for my personal Debian workstation? David Wright <deblis@lionunicorn.co.uk> - 2020-04-24 02:50 +0200
          Re: Anti-malware for my personal Debian workstation? Kenneth Parker <sea7kenp@gmail.com> - 2020-04-24 04:00 +0200
          Re: Anti-malware for my personal Debian workstation? "Rick Thomas" <rick.thomas@pobox.com> - 2020-04-24 08:50 +0200
        Re: Anti-malware for my personal Debian workstation? "Thomas Schmitt" <scdbackup@gmx.net> - 2020-04-24 09:00 +0200
          Re: Anti-malware for my personal Debian workstation? l0f4r0@tuta.io - 2020-05-03 18:20 +0200
            Re: Anti-malware for my personal Debian workstation? "Thomas Schmitt" <scdbackup@gmx.net> - 2020-05-03 20:00 +0200
              Re: Anti-malware for my personal Debian workstation? l0f4r0@tuta.io - 2020-05-04 01:40 +0200
              systemd-homed (was Re: Anti-malware for my personal Debian workstation?) Kenneth Parker <sea7kenp@gmail.com> - 2020-05-04 02:10 +0200
                Re: systemd-homed "Thomas Schmitt" <scdbackup@gmx.net> - 2020-05-04 09:20 +0200
    Re: Anti-malware for my personal Debian workstation? Joe <joe@jretrading.com> - 2020-04-12 00:10 +0200
      Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 09:10 +0200
        Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 09:20 +0200
      Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 09:10 +0200
        Re: Anti-malware for my personal Debian workstation? Dan Purgert <dan@djph.net> - 2020-04-12 17:40 +0200
        Re: Anti-malware for my personal Debian workstation? John Hasler <jhasler@newsguy.com> - 2020-04-12 21:10 +0200
    Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 09:00 +0200
      Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 09:20 +0200
        Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 10:40 +0200
          Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 11:00 +0200
            Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 11:50 +0200
              Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 12:10 +0200
                Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 15:10 +0200
                  Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 15:50 +0200
                    Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 17:50 +0200
                  Re: Anti-malware for my personal Debian workstation? Gene Heskett <gheskett@shentel.net> - 2020-04-12 17:30 +0200
                    Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 17:40 +0200
          Re: Anti-malware for my personal Debian workstation? Celejar <celejar@gmail.com> - 2020-04-12 16:50 +0200
            Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 17:50 +0200
              Re: Anti-malware for my personal Debian workstation? Celejar <celejar@gmail.com> - 2020-04-12 18:30 +0200
                Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 20:50 +0200
              Re: Anti-malware for my personal Debian workstation? John Hasler <jhasler@newsguy.com> - 2020-04-12 19:40 +0200

Page 1 of 2  [1] 2  Next page →

#221222 — Re: Anti-malware for my personal Debian workstation?

Hi,

Thank you everybody for your answers.

I understand most of you respondents don't use anti-malware at all. A good hygiene or other kind of solutions like system hardening (AppArmor, SELinux) are way more efficient.

NB : I've been told SELinux is so complex, people eventually let it drop... Do you all succeed in configuring & using it? ;)

Do you follow any guide or tool to help you in hardening your Linux distro?
I've used Lynis for the audit part, it's nicely done. What do you think about it?

Anti-malware on Windows is common/best practice. However, as we are discussing it here, things seem to be different with Linux. I don't really think Linux is intrinsically more secure than Windows nowadays (a vulnerability remains as such) but I really think Linux ecosystem is. Here are some reasons that could explain that according to me:
* Most softwares are downloaded through official preconfigured repositories. Users are less prone to download malware on suspicions websites
* Updates are easier as well because tracked/centralized through repositories themselves for the most part. On Windows you need to check Windows Update + Windows Store + each application individually
* Linux users are globally more tech-savvy so they take care more about their systems
* Open source is more common on Linux (community-based) than Windows (money-based) so theoretically anyone competent enough could view the source by oneself and spot a malovelent behavior (/!\ in practice this is not so easy, see what happened with OpenSSL / HeartBleed)
* Linux desktops are less exposed : it's more lucrative for black hats to target Windows users with malware (see desktop marketshares). However this is only half of an argument because Linux server marketshares are quite the opposite!
* Until some years ago, I would have added that Linux is more secured by design (least privilege, compartmentalization) than Windows but I think this is not so true now, Windows has cought up apparently...
=> What is your opinion?

Thank you & Best regards,
l0f4r0

[toc] | [next] | [standalone]

#221223

Hi,

l0f4r0@tuta.io wrote:
> I don't really
> think Linux is intrinsically more secure than Windows nowadays (a
> vulnerability remains as such) but I really think Linux ecosystem is.

This might be a merciful misperception. To my theory, free virus producers
are just much better programmers than those of MS-Windows malware.

  "When you do things right, people won’t be sure you’ve done anything
   at all." - Futurama


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#221882

Hi,

11 avr. 2020 à 19:48 de scdbackup@gmx.net:

> l0f4r0@tuta.io wrote:
>
>> I don't really
>> think Linux is intrinsically more secure than Windows nowadays (a
>> vulnerability remains as such) but I really think Linux ecosystem is.
>>
> This might be a merciful misperception. To my theory, free virus producers
> are just much better programmers than those of MS-Windows malware.
>
> "When you do things right, people won’t be sure you’ve done anything
> at all." - Futurama
>
Could you explain that please?

12 avr. 2020 à 00:01 de joe@jretrading.com:

> (Most) Linux users are horrified by the thought of surfing the Web with
> root privileges, most Windows users are not even aware that their
> computers can be run at one of two privilege levels (many more with the
> business/professional versions).
>
Yes, and if they are aware of that, they tend to think more is better.
Least privilege in security is a leading principle but for the average person it's just seen as useless/unfair restrictions. People may feel less powerful and don't understand why they don't have full permissions.

12 avr. 2020 à 08:52 de andreimpopescu@gmail.com:

> On Sb, 11 apr 20, 19:06:59, > l0f4r0@tuta.io>  wrote:
>
>> * Most softwares are downloaded through official preconfigured
>> repositories. Users are less prone to download malware on suspicions
>> websites
>>
> There are sufficient tutorials advising to download random scripts and
> run with root privileges.
>
>> * Updates are easier as well because tracked/centralized through
>> repositories themselves for the most part. On Windows you need to
>> check Windows Update + Windows Store + each application individually
>>
> Would be the same on Debian if you chose to install additional software
> with some other package manager and debs downloaded from whatever
> website.
>
Yes, of course, you're right. That is why I used "most" 2 times ;)
Indeed, users are free to go off-piste.

>> * Open source is more common on Linux (community-based) than Windows
>> (money-based) so theoretically anyone competent enough could view the
>> source by oneself and spot a malovelent behavior (/!\ in practice this
>> is not so easy, see what happened with OpenSSL / HeartBleed)
>>
> You probably mean Linus's law[2]. Unfortunately the reverse is true as
> well: without sufficient eyeballs there will be many bugs.
>
Thanks, I didn't know about this designation.

12 avr. 2020 à 18:25 de celejar@gmail.com:

> On Sun, 12 Apr 2020 17:41:54 +0200
> <> tomas@tuxteam.de> > wrote:
>
>> Trust is a complex beast. At its bottom it can't be completely
>> rational, but usually you trust a community because you somehow
>> think you understand how it works and you trust the information
>> chain linking you to that community.
>>
> Exactly. So if I trust the Sandstorm community (for example - I know
> nothing about them), then I'm not sure that there's any particularly
> great risk in installing their product via "curl | bash", and if I
> don't trust them, I shouldn't install their product via any other
> mechanism either.
>
Yes, this is the basics.
But you can encounter dangerous situations later that can easily jeopardize your initial trust, e.g: owner's change.
A black hat can register some expired/deleted legitimate resources (website, account) and start serving malware instead while current users are not aware...
Tomas has mentioned another variant with event-stream where a volonteer (but ultimately malevolent) person simply asked to take over the maintenance.
So I would say that trust is a perpetual exercise.
Best regards,
l0f4r0

[toc] | [prev] | [next] | [standalone]

#221888

On Thu 23 Apr 2020 at 23:58:41 (+0200), l0f4r0@tuta.io wrote:

> > "When you do things right, people won’t be sure you’ve done anything
> > at all." - Futurama
> >
> Could you explain that please?

If you're like me when you go for your flu shot, you offer your arm
and look the other way. A good nurse will surprise you when they
unexpectedly say, "All done".

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#221891

[Multipart message — attachments visible in raw view] — view raw

On Thu, Apr 23, 2020, 8:42 PM David Wright <deblis@lionunicorn.co.uk> wrote:

> On Thu 23 Apr 2020 at 23:58:41 (+0200), l0f4r0@tuta.io wrote:
>
> > > "When you do things right, people won’t be sure you’ve done anything
> > > at all." - Futurama
> > >
> > Could you explain that please?
>
> If you're like me when you go for your flu shot, you offer your arm
> and look the other way. A good nurse will surprise you when they
> unexpectedly say, "All done".
>

+1

Cheers,
> David.
>

Kenneth Parker

>

[toc] | [prev] | [next] | [standalone]

#221894

On Thu, Apr 23, 2020, at 5:40 PM, David Wright wrote:
> On Thu 23 Apr 2020 at 23:58:41 (+0200), l0f4r0@tuta.io wrote:
> 
> > > "When you do things right, people won’t be sure you’ve done anything
> > > at all." - Futurama
> > >
> > Could you explain that please?
> 
> If you're like me when you go for your flu shot, you offer your arm
> and look the other way. A good nurse will surprise you when they
> unexpectedly say, "All done".

I used to manage a group of system administrators for an academic department at a major East-coast University.  We used to say that "The best sysadmin is the one whose phone number you don't know."  The intention being that a good sysadmin will anticipate the problems and fix them before you, the user, even realize the problem is a possibility.  You never have to look up their phone number because you don't see any problems.  Being that good is hard work!  You have to keep up-to-the-minute-and-beyond on every aspect of anything that might affect your users.  Attend technical conferences; participate actively in you local professional society chapters; be alert and at your best when you get a trouble call at three in the morning, and so on...

Does that help?

Rick

[toc] | [prev] | [next] | [standalone]

#221895

Hi,

i wrote:
> > To my theory, free virus producers
> > are just much better programmers than those of MS-Windows malware.
> >
> > "When you do things right, people won’t be sure you’ve done anything
> > at all." - Futurama

l0f4r0@tuta.io wrote:
> Could you explain that please?

Well, Bender became the world of very tiny beings who in the end fought
a nuclear war over the question whether he is a god or not. This brought
him in contact with the deity who manages the world Bender lives in.
The quoted statement summarizes the work mode of that deity.

I assume that our malware producers adhere to the same work mode and am
thankful for all their bugs which are for free and lots of fun to hunt.


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#222204

Hi,

24 avr. 2020 à 02:40 de deblis@lionunicorn.co.uk:

> On Thu 23 Apr 2020 at 23:58:41 (+0200), > l0f4r0@tuta.io>  wrote:
>
>> > "When you do things right, people won’t be sure you’ve done anything
>> > at all." - Futurama
>> >
>> Could you explain that please?
>>
> If you're like me when you go for your flu shot, you offer your arm
> and look the other way. A good nurse will surprise you when they
> unexpectedly say, "All done".
>
Thanks for the analogy ;)

24 avr. 2020 à 08:54 de scdbackup@gmx.net:

> i wrote:
>
>> > To my theory, free virus producers
>> > are just much better programmers than those of MS-Windows malware.
>> >
>> > "When you do things right, people won’t be sure you’ve done anything
>> > at all." - Futurama
>>
> l0f4r0@tuta.io wrote:
>
>> Could you explain that please?
>>
> Well, Bender became the world of very tiny beings who in the end fought
> a nuclear war over the question whether he is a god or not. This brought
> him in contact with the deity who manages the world Bender lives in.
> The quoted statement summarizes the work mode of that deity.
>
> I assume that our malware producers adhere to the same work mode and am
> thankful for all their bugs which are for free and lots of fun to hunt.
>
I didn't know about this animated SF television program so I had to read multiple times your answer+watch the (enlightening) episode to get what you were talking about with "Bender", "deity"... Anyway, thanks for the summary ;)

I understand you like hunting for bugs into malware. It's like R&D...
But what makes you think "free virus producers are just much better programmers than those of MS-Windows malware"? Do you think writing a malware on Linux requires more technical knowledge than on Windows?
Besides, do you mean "free virus" as in "free beer" or "free speech" please?

Thank you & Best regards,
l0f4r0

[toc] | [prev] | [next] | [standalone]

#222208

Hi,

i wrote:
> ... > "When you do things right, people won’t be sure you’ve done anything
> ... > at all." - Futurama

> > I assume that our malware producers adhere to the same work mode and am
> > thankful for all their bugs which are for free and lots of fun to hunt.

l0f4r0@tuta.io wrote:
> I understand you like hunting for bugs into malware. It's like R&D...
> But what makes you think "free virus producers are just much better
> programmers than those of MS-Windows malware"? Do you think writing a
> malware on Linux requires more technical knowledge than on Windows?

They skillfully disguise their misanthropy as unintended mistakes
which nevertheless get defended against any fixing for decades.

(I fear to have already told the stories of the CD TAO Read-Ahead bug,
 the sr SG_IO Concurrency bug, or the Automatic CD Tray Loading bug.
 Else i would now annoy the public by lamenting them and their near
 immortality.)


> Besides, do you mean "free virus" as in "free beer" or "free speech" please?

Beer of course. I can at any time apply changes to local kernels,
be they good or bad, and talk publicly about them.
I cannot tell the brewery what to put into their bottles of free beer.

But there is hope:
Linux will soon be replaced. We will be able to control kernel bugs by
some JSON lines in the configuration of systemd-homed.


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#222212

Hi Thomas,

3 mai 2020 à 19:53 de scdbackup@gmx.net:

> l0f4r0@tuta.io wrote:
>
>> I understand you like hunting for bugs into malware. It's like R&D...
>> But what makes you think "free virus producers are just much better
>> programmers than those of MS-Windows malware"? Do you think writing a
>> malware on Linux requires more technical knowledge than on Windows?
>>
> They skillfully disguise their misanthropy as unintended mistakes
> which nevertheless get defended against any fixing for decades.
>
> (I fear to have already told the stories of the CD TAO Read-Ahead bug,
> the sr SG_IO Concurrency bug, or the Automatic CD Tray Loading bug.
> Else i would now annoy the public by lamenting them and their near
> immortality.)
>
I've searched into the debian-user ML archives because I had no idea what you were talking about...
These topics seem to be dedicated to initiated people ;)

> Have a nice day :)
>
Thanks, a "good night" for me ;)
Take care!

l0f4r0

[toc] | [prev] | [next] | [standalone]

#222213 — systemd-homed (was Re: Anti-malware for my personal Debian workstation?)

[Multipart message — attachments visible in raw view] — view raw

On Sun, May 3, 2020 at 1:51 PM Thomas Schmitt <scdbackup@gmx.net> wrote (in
part):

> Hi,
>

<snip>

But there is hope:
> Linux will soon be replaced. We will be able to control kernel bugs by
> some JSON lines in the configuration of systemd-homed.
>

This issue (systemd-homed) was brought up on a different Linux-based email
list.  I suggested that, to learn more, I would be happy to  "sacrifice"
 a partition on a USB Memory Stick.  But, to my question on links to
people, doing this, I got nothing, except for a vague suggestion that some
Centos people are "thinking about it".  Anybody here know anyone who is, in
anything past "thinking about it"?  (Not even Debian Sid has mention of
it).  Thanks!

Have a nice day :)
>
> Thomas
>

Kenneth Parker

[toc] | [prev] | [next] | [standalone]

#222217 — Re: systemd-homed

Hi,

Kenneth Parker wrote:
> This issue (systemd-homed) was brought up on a different Linux-based email
> list.  I suggested that, to learn more, I would be happy to  "sacrifice"   a
> partition on a USB Memory Stick. But, to my question on links to people,
> doing this, I got nothing, except for a vague suggestion that some Centos
> people are "thinking about it".

I mentioned it because of its potential for the sysadmin to use it as
ransomware against the users. (Well, the BOFH community will only mildly
grin in their retirement homes.)

  https://systemd.io/HOME_DIRECTORY/
points to a man page systemd-homed.service(8).
Archlinux wiki has hands-on instructions:
  https://wiki.archlinux.org/index.php/Systemd-homed
But getting it on Debian still might become adventurous.


> (Not even Debian Sid has mention of it).

Sid is quite outdated when it comes to newest kernel bugs or features.

For example
  https://bugzilla.redhat.com/show_bug.cgi?id=1801353
never made it into Debian.

Kernel commit 78ed001d9e71 overwrote the function pointer for ioctl()
on sr by the pointer to a legacy ioctl() function. Result was that the
root filesystem of the installation ISO could not be mounted. (Not
specific to ISO 9660. But generic bugs have a tendency to show up first
on the newest ISOs.)


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#221235

On Sat, 11 Apr 2020 19:06:59 +0200 (CEST)
l0f4r0@tuta.io wrote:


> 
> Anti-malware on Windows is common/best practice. However, as we are
> discussing it here, things seem to be different with Linux. I don't
> really think Linux is intrinsically more secure than Windows nowadays
> (a vulnerability remains as such) but I really think Linux ecosystem
> is. 

My feeling is that running as root is considered an extreme no-no in
Linux (probably apart from the toy distros) and it is this that makes
Linux viruses non-viable. There just aren't enough infectable targets.
(Most) Linux users are horrified by the thought of surfing the Web with
root privileges, most Windows users are not even aware that their
computers can be run at one of two privilege levels (many more with the
business/professional versions).

Even today, with a new Windows 10 installation, the first user is given
root privileges by default, and no advice is offered about demoting the
user to unprivileged later.

About fifteen years ago, I used to help out on a Small Business Server
newsgroup (later web forum) and I was amazed at how sloppy many other
helpers (including MCSEs, which I wasn't) were as regards security.
What really didn't help was the need for each user of a workstation to
open the Office applications for the first time with root privileges,
otherwise some initialisations didn't happen. Lazy admins just gave all
the new users root privileges for a week or two to let them sort it out.
You can't win against that kind of mindset.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#221250

[Multipart message — attachments visible in raw view] — view raw

On Sb, 11 apr 20, 23:01:28, Joe wrote:
> 
> My feeling is that running as root is considered an extreme no-no in
> Linux (probably apart from the toy distros) and it is this that makes
> Linux viruses non-viable. 

Compromising regular user accounts is bad enough already.

https://xkcd.com/1200/

Compromising the user account that is used to gain root privileges is 
almost the same as gaining root privileges (the additional step needed 
is in most cases trivial).

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#221253

[Multipart message — attachments visible in raw view] — view raw

On Sun, Apr 12, 2020 at 10:01:33AM +0300, Andrei POPESCU wrote:
> On Sb, 11 apr 20, 23:01:28, Joe wrote:
> > 
> > My feeling is that running as root is considered an extreme no-no in
> > Linux (probably apart from the toy distros) and it is this that makes
> > Linux viruses non-viable. 
> 
> Compromising regular user accounts is bad enough already.
> 
> https://xkcd.com/1200/

Thanks for that one -- I think this brings both of my points home
pretty well :-)

> Compromising the user account that is used to gain root privileges is 
> almost the same as gaining root privileges (the additional step needed 
> is in most cases trivial).

...but perhaps still unnecessary work and risk of detection: a happy
malware running under your main user account is a happy malware, after
all.

Cheers
-- t

[toc] | [prev] | [next] | [standalone]

#221251

[Multipart message — attachments visible in raw view] — view raw

On Sat, Apr 11, 2020 at 11:01:28PM +0100, Joe wrote:
> On Sat, 11 Apr 2020 19:06:59 +0200 (CEST)
> l0f4r0@tuta.io wrote:
> 
> 
> > 
> > Anti-malware on Windows is common/best practice [...]

> My feeling is that running as root is considered an extreme no-no in
> Linux (probably apart from the toy distros) and it is this that makes
> Linux viruses non-viable [...]

This is far too simplistic. For one example: how many users (apart
from those system users) do you have on your box? I'd guess just
one: let's call him joe. Where's all the data you care about?
Exactly: /home/joe. And what's the identity your browser runs as?

So one of those newfangled malwares encrypting your stuff and asking
ransom for the decryption keys (aka ransomware) doesn't need system
privileges to hurt you. All the tasty data is already there, with the
right permissions. Yay!

Compose that with the sad fact that nowadays, the browser and some
"cloud" out there is replacing the role your operating system used
to play: operated by actors out there who mainly want to sell your
eyeballs to some third party's ads.

I could go on, but I think you get the gist.

No, I think the only (small) edge free operating systems have over
the rest of the pack is that, on average, their users tend to be
more curious (and, as a result, educated).

Cheers
-- t

[toc] | [prev] | [next] | [standalone]

#221324

[Multipart message — attachments visible in raw view] — view raw

On Apr 12, 2020, tomas@tuxteam.de wrote:
> [...]
> No, I think the only (small) edge free operating systems have over
> the rest of the pack is that, on average, their users tend to be
> more curious (and, as a result, educated).

Don't forget "distrustful of the 'this is waaaaay better for you than
$unmodern way!!!" shtick that many (all) of those web-based tools try
using to get users locked in.


-- 
|_|O|_| 
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#221346

tomas writes:
> No, I think the only (small) edge free operating systems have over the
> rest of the pack is that, on average, their users tend to be more
> curious (and, as a result, educated).

I think that the (big) edge that free operating systems on the desktop
have is too few users to interest malware operators.  Their interest is
in getting their stuff onto as many machines as possible and the effort
it would take to port it to Linux is more profitably expended on
improving the Windows version.
-- 
John Hasler 
jhasler@newsguy.com
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]

#221249

[Multipart message — attachments visible in raw view] — view raw

On Sb, 11 apr 20, 19:06:59, l0f4r0@tuta.io wrote:
> 
> I understand most of you respondents don't use anti-malware at all. A 
> good hygiene or other kind of solutions like system hardening 
> (AppArmor, SELinux) are way more efficient.
> 
> NB : I've been told SELinux is so complex, people eventually let it 
> drop... Do you all succeed in configuring & using it? ;)

Didn't even try, I just take whatever Debian does by default.
 
> Do you follow any guide or tool to help you in hardening your Linux 
> distro?
> I've used Lynis for the audit part, it's nicely done. What do you 
> think about it?

Any such tool you are using has to be regularly updated as well and by 
definition is built on the assumptions of the developers of what is 
(not) necessary for me. This can easily lead to a false sense of 
security.

> Anti-malware on Windows is common/best practice. However, as we are 
> discussing it here, things seem to be different with Linux. I don't 
> really think Linux is intrinsically more secure than Windows nowadays 
> (a vulnerability remains as such) but I really think Linux ecosystem 
> is. Here are some reasons that could explain that according to me:
>
> * Most softwares are downloaded through official preconfigured 
> repositories. Users are less prone to download malware on suspicions 
> websites

There are sufficient tutorials advising to download random scripts and 
run with root privileges.

> * Updates are easier as well because tracked/centralized through 
> repositories themselves for the most part. On Windows you need to 
> check Windows Update + Windows Store + each application individually

Would be the same on Debian if you chose to install additional software 
with some other package manager and debs downloaded from whatever 
website.

> * Linux users are globally more tech-savvy so they take care more 
> about their systems

This is just a side effect of Linux being much less common on typical[1] 
desktop / laptop systems.

> * Open source is more common on Linux (community-based) than Windows 
> (money-based) so theoretically anyone competent enough could view the 
> source by oneself and spot a malovelent behavior (/!\ in practice this 
> is not so easy, see what happened with OpenSSL / HeartBleed)

You probably mean Linus's law[2]. Unfortunately the reverse is true as 
well: without sufficient eyeballs there will be many bugs.

If something like Heartbleed can happen to a widely deployed software 
imagine what is probably hidden in all the software with a much smaller 
user-base and almost no active maintenance.

> * Linux desktops are less exposed : it's more lucrative for black hats 
> to target Windows users with malware (see desktop marketshares). 
> However this is only half of an argument because Linux server 
> marketshares are quite the opposite!
>
> * Until some years ago, I would have added that Linux is more secured 
> by design (least privilege, compartmentalization) than Windows but I 
> think this is not so true now, Windows has cought up apparently...
>
> => What is your opinion?

In my opinion any system can be made very secure, but not 100%.

The given/chosen hardware and software can make some things easier while 
making others more difficult.

The FLOSS ecosystem has a slight cultural advantage: less reliance on 
tools to stop and/or detect malware. Instead the vulnerability is 
(hopefully) found and patched.

This advantage is partially due to Microsoft's security practices in the 
past. While these have improved significantly in recent years some 
practices are difficult to change and will probably only disappear 
together with the desktops and laptops[3].

[1] not including Chromebooks
[2] https://en.wikipedia.org/wiki/Linus%27s_law
[3] fortunately when new types of devices like smartphones and tablets 
were introduced the hardware and software makers used the opportunity to 
also introduce better security models and practices, unfortunately 
together with an entire class of new privacy issues.

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#221254

[Multipart message — attachments visible in raw view] — view raw

On Sun, Apr 12, 2020 at 09:52:50AM +0300, Andrei POPESCU wrote:

[...]

> There are sufficient tutorials advising to download random scripts and 
> run with root privileges.

My fave still is

  curl https://random.site.net/script | sudo bash

And there are still people out there who even advocate it [1].

I think I was three when my mom taught me not to stuff random scripts
...uh stuff I found on the street into my mouth.

Cheers
[1] https://gist.github.com/btm/6700524
    (but then, it's Github, so Microsoft, so what do you expect?)
    (Yah, I know this gist probably predates takeover, So what?)

-- tomás

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.debian.user

csiph-web