this post was submitted on 09 Mar 2024
342 points (97.2% liked)
Technology
59374 readers
3714 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I don’t want to sound dismissive, this is a genuine question and not an attack on Linux.
Other than security by obscurity, how is it possible that an operating system whose entire source code is available to hackers to peruse at will could be more secure than a closed source one?
Because if a vuln gets found or exploited, it gets immediately patched, often with some big backing by OEMs that run on Linux.
Open source also reduces the likelihood of exploitable bugs going unnoticed because everyone can see and play with the source code by themselves.
There is a risk of malicious merge requests, but so far that hasn't been a problem besides a university getting banned for pointing out the issue with a live test without telling the devs.
Much of linux is also designed to be hardened by default because it's used on so much infara. SELinux by itself is a great example because it was essentially created by RedHat and now is a major standard for MAC.
Windows on the other hand needs Microsoft alone to solve the problem. No one can patch it themselves, and there's no guarantee the patches will work, which has happened several times. I believe print spooler basically had to be disabled because there was no good solution due to implementation.
The amount of Windows OS specific exploits vs Linux specific exploits kind of shows the results of closed source vs open source.
The worst vuln I can think of for Linux is dirty cow which is a local priv esc on basically Linux kernels 2.x-4.x which was a big deal when it was discovered because of the range of versions
Meanwhile windows had eternal blue, a whole remote code execution that existed on every version of windows since win95 that the NSA kept for probably a decade before it was leaked.
Imagine for a moment that the business world transitioned to Linux, and now there's enormous incentive for all adversaries from state sponsored to financially motivated criminals to spend all their time hunting through linux source code.
Do you think the ideas above stand up? (I'm not saying they dont)
Would linux vulnerabilities be found at a higher rate? I wonder if they aren't now because there aren't as many eyes on them. Sure there's corporate side project efforts and volunteers, just curious how that stacks up against the amount of research happening to break Windows systems.
NSA would definitely want to keep some linux exploits around if their adversaries were using linux instead of windows. I think the result would be the same regarding eternal blue.
Linux is currently having parts of the kernel rewritten in memory safe languages like Rust, eliminating entire classes of exploits. Wayland is being developed with a far more secure architecture than the old X.org window manager. One important reason why they can do this is because the whole industry follows and stuff like drivers can be updated at the same time to keep everything working, and it doesn't even need to be the original developer patching it.
Microsoft's opacity makes it near impossible for them to do the same thing, so much of their security improvements are essentially hacked in on top of old code to not break compatibility. Instead of eliminating bug classes they rely on tons of techniques to make them harder to exploit instead - yet not impossible.