Gaming Stop Paying for Windows Security

Urza

hi
Member
Joined
Jul 18, 2007
Messages
6,493
Trophies
0
XP
783
Country
United States
Rydian said:
http://linux.slashdot.org/story/09/08/13/2...l-Linux-Kernels

Shit happens on all three major OSes that can bypass the normal security features.
In the example you provide, the exploit was patched that very day (if you bothered to read one screen further in the /. comments)
rolleyes.gif


All platforms have security flaws. The code is incredibly complicated and not every noose can be tied. The difference is that Windows has significantly more exploits, which stem from significant problems in how the NT kernel was designed. It's simply outdated software.
 

Rydian

Resident Furvert™
Member
Joined
Feb 4, 2010
Messages
27,880
Trophies
0
Age
36
Location
Cave Entrance, Watching Cyan Write Letters
Website
rydian.net
XP
9,111
Country
United States
Urza said:
In the example you provide, the exploit was patched that very day (if you bothered to read one screen further in the /. comments)
rolleyes.gif
Nowhere did I mention patch status, my point was that privilege escalation will bypass normal security features and happens on all major OSes.

Cut the bitchiness please.
 

Urza

hi
Member
Joined
Jul 18, 2007
Messages
6,493
Trophies
0
XP
783
Country
United States
Rydian said:
Urza said:
In the example you provide, the exploit was patched that very day (if you bothered to read one screen further in the /. comments)
rolleyes.gif
Nowhere did I mention patch status, my point was that privilege escalation will bypass normal security features and happens on all major OSes.
I think I'll have to refer you to my park bench vs black hooker metaphor. The fact that vulnerabilities exist in UNIX platforms (as any of its category) does not mean the floodgates to hell will open up and pour through said vulnerabilities as they do with the more numerous and significantly more detrimental security flaws in the Windows platform.
 

Urza

hi
Member
Joined
Jul 18, 2007
Messages
6,493
Trophies
0
XP
783
Country
United States
Rydian said:
I'll have to refer you back to your post.
tongue.gif

Urza said:
The difference in chance of coming across a POSIX-compliant virus that can actually do damage within the limitations of the permissions system
And I'm simply saying the permissions system can be bypassed.
Then do it, or provide an example of malware which took advantage of said flaw.

The fact that flaws exist is not proof of a platform's insecurity. If said flaws aren't actually exploited by anything, then it's simply a silly argument which means nothing.
 

Rydian

Resident Furvert™
Member
Joined
Feb 4, 2010
Messages
27,880
Trophies
0
Age
36
Location
Cave Entrance, Watching Cyan Write Letters
Website
rydian.net
XP
9,111
Country
United States

Urza

hi
Member
Joined
Jul 18, 2007
Messages
6,493
Trophies
0
XP
783
Country
United States
Rydian said:
Urza said:
The fact that flaws exist is not proof of a platform's insecurity. If said flaws aren't actually exploited by anything, then it's simply a silly argument which means nothing.
The government seems to think the fact that a flaw could exist in MD5 is good enough reason to move on to SHA-1 (and then the SHA-2 family).

http://www.kb.cert.org/vuls/id/836068
http://csrc.nist.gov/groups/ST/hash/policy.html
The government also thought that WMDs "maybe" existing in Iraq was a good reason to invade. How is it relevant?
 

sprogurt

Well-Known Member
Member
Joined
Dec 13, 2006
Messages
375
Trophies
0
XP
185
Country
Urza said:
The difference in chance of coming across a POSIX-compliant virus that can actually do damage within the limitations of the permissions system, and coming across a virus that absolutely rapes Windows' monolithic kernel is akin to the chance of getting AIDS from sitting on a park bench, and by having unprotected sex with a hooker holding a "FREE AIDS" sign.

XD that made my day!
smile.gif
. (I'm pretty sure you woudn't get AIDS from either, maybe HIV from the prostitute.)

I wasn't comparing the effects of the majority of viruses for each OS but the fact that a UNIX OS can still get viruses. Ecko said
QUOTE said:
Stop Paying for Windows Security, Linux is good enough implying that viruses, malware, etc won't harm Linux. Buffer overruns where quite popular on Linux a few years back which could gain other permissions including root if I remember correctly. Still, yes, you can do more damage to a UNIX system than any virus can. Also found this earlier, your comment reminded me of it
tongue.gif
.QUOTE
In the real world.. does wearing condom give you protection over HIV? yes of course, but you don't have to use it all the time. If you don't screw around you even don't need one. I thing that's goes to computer users, your best protection is your behaviour.
 

JonthanD

Well-Known Member
Member
Joined
Jul 9, 2010
Messages
279
Trophies
0
Age
50
Location
Sitting
XP
221
Country
United States
If your using windows and worried about virus's I cannot state this enough, get off Windows XP and move to 64 bit, ditch IE and use something like FF or Opera, then get Comodo Firewall AV combo.

Running windows 7 here, rampant downloader, haven't updated Malware Bytes or Spybot since march of this year so thats a long time. updated them both last night and ran them both, results? Clean. Nothing.

I remember running Windows XP and having to run the holy trinity constantly and still on occasion having to wrestle with virus's and malware.

Ever since I switched to Vista and now 7 my weekends are now free to spend doing more important things
smile.gif


I remember my kids PC running XP and they would catch all manner of nasty things so every week end I would spend at least an hour trying to clean out the crap and failing that I would spend another hour getting a back up back online for them...

Windows 7 I love your ASLR...

http://en.wikipedia.org/wiki/Address_space...t_randomization

Edit: Should also add that in all my machines I have UAC turned off although 7's is less anoying then vista's
 

Rydian

Resident Furvert™
Member
Joined
Feb 4, 2010
Messages
27,880
Trophies
0
Age
36
Location
Cave Entrance, Watching Cyan Write Letters
Website
rydian.net
XP
9,111
Country
United States
Urza said:
Rydian said:
If it wasn't a possible problem, why did they patch it?
The point is that it was patched, while most of Windows' problems cannot be.
That's not what I asked you.

EDIT: To clarify, I find it odd that you say if something isn't a possible problem it doesn't need to be patched, while also touting that the vulnerability I pointed out was patched. Contradiction as usual.

If it needed to be patched then it was a problem (after all, it is privilege escalation).
However if it wasn't a problem then why does whether it was patched or not matter, and why would there be a patch for something that wasn't a problem?

I'm not here to debate windows versus linux with you, I'm here to point out what you're saying doesn't always make sense.
 

Rydian

Resident Furvert™
Member
Joined
Feb 4, 2010
Messages
27,880
Trophies
0
Age
36
Location
Cave Entrance, Watching Cyan Write Letters
Website
rydian.net
XP
9,111
Country
United States
JonthanD said:
Edit: Should also add that in all my machines I have UAC turned off although 7's is less anoying then vista'sMissed this post earlier...

I don't suggest having UAC off.

OSX and Linux use the same type of security.

RayquazzaYou have the historical UNIX security model. This is what Vista's model with UAC tried, and failed, to be. Applications, also, usually do not require administrator (root) privileges, while their Windows counterparts do. This is because of historical reasons - running your daily life as root in any sort of UNIX environment is extremely strongly discouraged, by everyone. The end result is that developers are well aware their users may not have root privileges.
In contrast, almost everyone I've ever seen runs Windows using an Administrator account. Developers know this, and thus choose to, for instance, write their program data to the Program Files directory, which shouldn't be used for such purposes (Chrome, for instance, gets it right, as far as I know). This means that applications usually need administrator privileges to install (and sometimes even run), but for no particular reason - developers are just being lazy and not security conciencious.
Why is this important? If a virus enters your machine, for some reason, on OS X (and, for instances, all Linuxes) in all likelyhood you'll be running as an unprivileged user. This means the most damage a virus can do is the same damage you could do - delete your home directory, infect files you own or can write to, etc. It can never, for instance, add a new account to your machine, infect binaries that you can't write to (includes most privileged applications in the system), etc.
On the contrary, if this happens on Windows and you are, like most people, running as an administrator account, the virus can do pretty much anything it wants - it has your implicit permission to roam around free in your computer. This means raising its priority, killing processes (such as antiviruses), infect core system files, etc. This is clearly a much worse scenario than in OS X or Linux.

In escence, it's a problem of inertia - lazy Windows application developers (I'm speaking about third-party applications here, like Adobe's Flash) require administrator privileges needlessly, and this in turn makes your machine much more vulnerable to attacks. In a *nix's case, since it's much less common you'll even have these privileges in the first place, very rarely will applications need root for no good reason, and thus you'll have less places where the virus can do a lot of damage.

Mind you, in both cases, getting a virus and running it implies it has the same privileges as you, so you may have to kiss your data goodbye (the one you can modify). However, unlike in the case of an administrator-level infection, you don't need to reinstall to be secure (if the virus has gotten administrator level privileges, from a security standpoint, you can never trust this installation again - every binary you run may be part of a rootkit. There's nothing you can do that the virus can'tve thought of and planned for - it's a cat and mouse game and you are playing against, very likely, a team of well-trained russian programmers
smile.gif
). You simply need to run an antivirus (and hope it catches the infection) from an administrator account.


If you're curious, the differences in practical usage stem from UNIXes being mostly used, historically, for multiple users at a time, as a time sharing service. In Windows' case, it's been mostly used as a single-user machine (and, in fact, early versions of Windows had no actual concept of user accounts, at best they had different desktops, but it was single-user).

As long as people continues to leave UAC off instead of switching to programs that don't need admin access, programmer will still be lazy and assume admin access.
 

Urza

hi
Member
Joined
Jul 18, 2007
Messages
6,493
Trophies
0
XP
783
Country
United States
Rydian said:
Urza said:
Rydian said:
If it wasn't a possible problem, why did they patch it?
The point is that it was patched, while most of Windows' problems cannot be.
That's not what I asked you.

EDIT: To clarify, I find it odd that you say if something isn't a possible problem it doesn't need to be patched, while also touting that the vulnerability I pointed out was patched. Contradiction as usual.

If it needed to be patched then it was a problem (after all, it is privilege escalation).
However if it wasn't a problem then why does whether it was patched or not matter, and why would there be a patch for something that wasn't a problem?

I'm not here to debate windows versus linux with you, I'm here to point out what you're saying doesn't always make sense.
Maybe the trouble you have making sense of what I post due to you not actually reading what I post? Never once did I say that the vulnerability wasn't a problem.

Or maybe that was just a really transparent attempt at a straw man. If so, why? Is winning an argument on a random public forum really that important to you?
 

Rydian

Resident Furvert™
Member
Joined
Feb 4, 2010
Messages
27,880
Trophies
0
Age
36
Location
Cave Entrance, Watching Cyan Write Letters
Website
rydian.net
XP
9,111
Country
United States
Urza said:
Never once did I say that the vulnerability wasn't a problem.What about this?QUOTE(Urza @ Nov 30 2010, 01:54 PM) Then do it, or provide an example of malware which took advantage of said flaw.

The fact that flaws exist is not proof of a platform's insecurity. If said flaws aren't actually exploited by anything, then it's simply a silly argument which means nothing.
You said that the flaw existing isn't a problem as long as there's nothing in the wild (that's what I assume you mean by "malware" opposed to a proof of concept) that's been released yet to exploit it.

That led to me asking you why it was patched if it wasn't a problem.
 

Rydian

Resident Furvert™
Member
Joined
Feb 4, 2010
Messages
27,880
Trophies
0
Age
36
Location
Cave Entrance, Watching Cyan Write Letters
Website
rydian.net
XP
9,111
Country
United States
Law said:
Hey Urza, don't bother. Rydian likes to argue every little detail even if it isn't relevant. Move on.
Question.

Windows Security -> Antivirus -> UAC -> Privilege Escalation -> Specific Example -> Does it matter if it was patched before it was exploited by widely-distributed malware?

Show me where relevancy from the original topic stopped.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    I @ idonthave: :)