Security without a threat assessment is not very meaningful. If we are comparing a default linux desktop installation and a default windows installation, what would the test setup look like?

Let say we had two such machines and gave them each a reachable ip address and let the first test just be them running unattended until unwanted software got in.

In the second experiment we had the same machines go to random websites (top 1k), clicking randomly, using the default web browser.

In the third, we let them click and run attachment from email spam.

In the fourth and final experiment, we hire pen testers to target the machines explicitly.

With the same conviction that xpaulbettsx wrote, I have no doubt that the first 3 tests would show Windows 10 going down first. The amount of threats that targets window user is just order of magnitude more than those targeting linux users. The fourth test might give different results, but users who want to defend against targeted attack are generally advised to use extra security tools to defend themselves.

Just because Windows goes down first doesn't mean that Linux is more secure. It only means that it doesn't have a high enough market share to meaningfully exploit for a return on investment.

We should take the metric of "given a motivated party, how difficult would it be to exploit this machine" I have no doubt people are already sufficiently motivated to exploit Windows. But maybe only the NSA gives a shit about Linux- do we leave them unchecked?

Security without threat assessment is meaningless because security is about preventing a negative outcome. If the environment is perfectly safe then no security is needed, and if the environment is infinitely hostile then no amount of security will prevent a negative outcome.

Example: Being in an armored car in a war zone is still more risky than riding a bike in a peaceful country side, even if the bike has significant less security than an armored car. The Advice then is not to tell people in war zones to get bikes, nor is it to tell people to get rid of bikes in favor of armored cars. Security needs to match the need, which depends on the threat level.

In my above post I included "targeted attack" as the fourth test, named by security theory as an attack by a motivated party towards a specific resource. If a motivated party wants to attack a specific resource, then the defender needs to raise security above that of general security. Many government agencies have policies based on such threats, and neither a default Windows 10 or default Linux distribution would qualify for such environment. SELinux however was designed for that threat level and is thus common in military organizations, banks, and similar high risk environments.

You're ignoring that most Linux distros come with better defaults, i.e. no open ports. Reducing the attack surface is an important part in keeping the OS safe. Windows is remarkably bad in that regard.

Windows comes with its firewall turned on by default since XP SP2, most popular distros doesn't do that even today. Windows 10 doesn't even respond to ping by default (which is a pita).

Not sure about other distros but opensuse comes with a pretty strict firewall out of the box. My logic says that this is probably common practice for many general-use distros.

openSUSE uses a password protected root account (shared secret), doesn't use ASLR and doesn't even run apparmor...

Ubuntu and debian does not. Well, they are installed and debian is enabled too (but defaults to allow all traffic).

I had a look at Windows 10, by default, assuming you clicked Private for the network connection, there are no ports that are open for any program to use. There are 33 rules for the All profile, 18 for the private profile, some duplicates, each of which specifies what local program is allowed to receive data:

9 connect to Modern Windows apps, 1 for ICMPv4, 12 for ICMPv6, 1 for IGMP, 1 for ISATAP, 12 for TCP, Cast to device, IPHTTPS, Network Discovery, WiDi. 15 UDP: 2 for Cast to device, 2 for DHCP, 1 for Teredo, 1 for Delivery Optimization, 1 for mDNS, 7 for network discovery, 1 for miracast.

You're disregarding the difference between being more secure theoretically versus in practice.

There is no unequivocally answer in the domain of security, secure refers to a threat model.

When your threat model includes Microsoft or US surveillance then no Microsoft OS can provide you the security you're aiming for.

Then again Desktop Linux is no OpenBSD or GRsecurity[1], A hardened linux experience usually doesn't come out of the box with Desktop Linux, but still there are options to explore[2] if you're so inclined.

[1]: https://grsecurity.net/ [2]: https://wiki.archlinux.org/index.php/Security

Windows does have better technical defenses but its attack surface is also much higher due to the thousands of deprecated but still supported older technologies for backward compatibility so I don't know, it's just different problems

The thing with the Linux Desktop is that you can selectively enable SELinux, use PaX etc. and have security comparable to, if not better, than Windows 10, plus the fact that Linux is a much more varied attack surface still applies.

Or you can do nothing, in which case you're probably less secure.

This is exactly the problem. You can buy Windows 10 machine and if it becomes vulnerable it's Microsoft's fault and you would count on them to fix it immediately, push out the automatic update and go on with your life. If default Linux desktop is insecure then consumer is supposed to figure out what exactly is insecure, be expert in knowing the alternatives and how to replace everything. The question isn't whether Linux desktop can be made more secure but rather why isn't it secure by default?

> you would count on them to fix it immediately, push out the automatic update and go on with your life.

Not only do you get security updates for your distro with the vast majority of Linux distros, but you also get it for all your 3rd party software, using the same system mechanism.

They may not push the updates automatically, (you can of course set it that way), but some of us still want to be in control of what gets installed on our machines

That's not to say it can't be improved, but the situation isn't quite as bad as you are painting it, ie there are mainstream distros that come hardened by default and security patches are regularly backported.

I'd argue that macOS is also technologically less secure than modern Windows, yet its users are in no more danger than Windows users are, (despite its theoretically security), because security depends on a lot of factors including the user culture, market share etc. i.e. Linux doesn't have a culture of downloading executables from random websites for one.

I'd guess most distributions feel like they're providing an adequate level of protection for their users as of now, without introducing too much friction. Once that is no longer the case, it's easy to turn on a few more knobs, the software is already there.

The 3rd party software is huge problem, actually. When you do apt-get or install using Ubuntu App Store it gives a false sense of security to novice user that things are safe. This is even more problematic because there are so many things one needs to download on default desktop to be on par with default Windows. The File Manager UI, for example, lacks too many features and user must investigate alternatives and either assume that everything is all right or deeply examine security vulnerabilities for each available option. Same goes for basic things like text editor or calculator and so on.

> it gives a false sense of security

Why is getting the latest security updates giving a false sense of security exactly?

> The File Manager UI, for example, lacks too many features and user must investigate alternatives and either assume that everything is all right or deeply examine security vulnerabilities for each available option. Same goes for basic things like text editor or calculator and so on.

This is where you're being unfair, the notion that the default file manager is not good enough is subjective, it is plenty good for most people.

(Finder for macOS also lacks many features, yet many people never bother with alternatives).

Moreover, if you do need to find a replacement, if it is in the official repos, it probably means it is popular enough to be solid.

As for things like an editor,, are you telling me that Notepad is more featured than gedit?

> Why is getting the latest security updates giving a false sense of security exactly?

Because in quite a few distributions you don't get security updates reliably. For example Debian Stable excludes most WebKit-based libraries from their update policy.

https://www.debian.org/releases/stable/amd64/release-notes/c...

So users of browsers like Midori and Epiphany or E-Mail-Clients like Evolution on Debian Stable, currently end up using a WebKit library that hasn't been updated in more than a year.

The same issue applies to Ubuntu and most of its derivatives as well. E.g. Ubuntu 14.04 users get a WebKitGTK+ library which hasn't been updated in almost a year.

http://changelogs.ubuntu.com/changelogs/pool/main/w/webkitgt...

Of course, the user doesn't get a warning dialog when he installs applications which rely on those outdated and insecure libraries.

Ubuntu users also shouldn't rely on packages from the Universe repository (which are by far the most packages), if they care about security. Those packages are community maintained and often don't get a single update in years. In the past they didn't even update Chromium reliably.

This is why I think Rolling Release is the only viable model of Linux distribution in desktops. Instead of overloading a team of security experts expecting them to backport every security change to the stable version of a package, they simply follow upstream releases, build it and make sure that isn't horrible broken (however, they can't be sure that the upgrade path is seamless for every possible configuration).

BTW, it is possible to check in Ubuntu which packages are supported or not: http://manpages.ubuntu.com/manpages/xenial/man1/check-suppor...

You. Are. Not. Supposed. To. Install. Debian. Stable. On. A. Desktop. Machine.

How many times will this have to be repeated? Stable is for servers. If you're running webkit based libraries on your server you have other issues. For desktops, both Testing and Unstable are the valid options.

that's like ... your opinion. the way you try tu make it look as if it's a widely accepted best practice among Debian users is not cool. Debian stable is a perfectly viable distribution for desktop use.

Except... it is? Having spoken with quite a few people on #debian, hell, even a simple google search agrees with that. Don't use stable unless you have a very old machine. Using stable brings you... stability and three years old packages. Using testing brings you stability and six months old packages. Using unstable brings you stability and sometimes fun things and one week old packages. For the Personal Anecdote Bonus Points, even sysadmin friends that swear by stable would tell me to use testing for a desktop distro.

People over #debian or your sysadmin friends are entitled to their own opinions and not representative of Debian users other than themselves, and for every random recommendation for not using stable you can find another random one about dangers of using testing or unstable.

If you check the Debian web site you'll see stable is the only one which is offically supported and recommended by the project and there is no distinction for "server" or "desktop" use cases. Had stable was non-suitable as a desktop OS you can be sure Debian developers wouldn't bother releasing and supporting thousands of desktop/graphical packages with the stable release.

In the end stable, testing and unstable have all their pros and cons, strong and weak areas and some are more suitable for some use cases. That Debian stable is only for servers and it is not a good desktop OS is a myth that needs to die. Stable is a damn fine desktop OS. Everyone is free to use whatever they deemed best for their use but when you post blanket statements like "You. Are. Not. Supposed. To. Install. Debian. Stable. On. A. Desktop. Machine." and "Stable is for servers" on a public forum you are spreading misinformation and you should just stop.

My actual experience of post release vulnerability patching is that Desktop Linux will provide the required update in a timely manner and it will be installed transparently through system update. The user often doesn't even notice there was a vulnerability in the first place. On par with windows update though a bit less intrusive and annoying.

Linux Desktop is not secure by default for the same reason Secure Linux does not offer the best desktop experience: more secure means less convenient. Desktop Linux aims at being convenient.

Also keep in mind, we are comparing a single Microsoft OS to a variety of Linux distros each with its own default. it would make more sense to compare all of those individually to see how they fit to a couple standard threat models. Then put them through a week of everyday use by a not knowing better user and see how much damage the different OS sustain.

Sure, extremely motivated individuals or governments might do that. But I'd still rate a distribution by it's default security settings. Being secure by default is important if you are shipping to thousands of users.

Fedora comes with SELinux enabled by default, and is working towards more interesting sandboxing stuff for the future too.

Unfortunately, while SELinux itself is good, the tooling around it has to be the most atrocious, useless steaming pile of thrash in this niche. From setroubleshootd randomly deciding to eat up 100% of CPU time (and no one being able to explain exactly what it does) to the endless fun of figuring out what policycoreutils-python & friends do and how, actually doing something useful with it is somewhere between "painful" and "frustrating". If Microsoft had published something like this, they'd have been the laughing stock of the whole Linux community.

I don't know anyone in my immediate circle of peers - not even people who use SELinux on servers or in products that they develop - who doesn't disable SELinux on their desktop. They're not idiots, either, nor re-booted Windows programmers that the IoT and DevOps craze has thrown into the Linux world, many of us have been using Linux since back when there was no E in RHEL.

Oh yes, SElinux tooling is an abomination.

I feel like there should be a way to write a new set of simplified tooling on top of the kernel API.

I've been running fedora at home an on my laptop for about a year now, and don't need to turn SElinux off. I only needed to add one custom role myself too, when trying to mount certain host directories as volumes in docker. Which is fair enough.

Ubuntu comes with AppArmor enabled by default [1]. Unfortunately its service will terminate at startup due to missing profiles [2]. This shows how much QA goes into security related stuff in a distro of this size.

---

[1] https://wiki.ubuntu.com/AppArmor

[2] sudo apt install apparmor-profiles-extra

Where's a good place to get a general guide on every day desktop use of SELinux, PaX, etc?

Arch wiki is a goldmine: https://wiki.archlinux.org/index.php/Security

One of the slides also mentioned at what point each distro introduced ASLR (ie. it might be worth upgrading your Ubuntu to 16.10 if you're on an older one)

I'd look into Fedora and Arch Linux documentation/wiki.

Windows still has better protection of credentials, it can be better protected against DMA attacks and has quite a few other tricks under its belt.

Now imagine what a Linux distribution could achieve with the same budget...

Write another desktop enviroment from scratch?

/sarcasm

> Write another desktop enviroment from scratch?

I think you mean a new distro which is mostly, but not entirely yet another a Ubuntu-derivative, which comes packaged with its own DE and related software.

And no, this new and perfect email-client will still not try to beat Outlook by managing both email and calendar at the same time. Go away!

Seriously... What are Linux Mint and ElementaryOS even thinking?

Realistically, about the same. Many of the problems with Windows are rooted in being developed by a huge corporation with as much budget and manpower as it has.

I get your point, but I meant that the open source community works because it can leverage on the work from each other. The achievements would be multiplied by the potential reach.

No, because everyone is busy doing its own little thing.

Well, that can't be used as an excuse for not being secure by default.

Maybe I'm not rational but I'm much more worried about Microsoft having access to my data than some random "Russian" hacker.

> Maybe I'm not rational but I'm much more worried about Microsoft having access to my data than some random "Russian" hacker.

Russian hackers, past, present and future, routinely steal information and use it against the victim, whether we're talking about individuals or corporations. And I'm just talking about login credentials or credit card information, nevermind more personal data like phones or even intellectual property.

Microsoft hasn't done any of that, as far as I am aware.

Yes, that does not exactly strike me as a rational stance to take. Are you actually more worried about Microsoft blackmailing you about those photos from 4 years ago?

No, but i'd be worried about a government with power to control Microsoft using such information in a negative way.

Basically this scenario comes to mind :

a) A power change occurs within a government. This power change facilitates the changing of laws.

b) A corporation with massive stores of information about individuals is within this government.

c) New government doesn't like X people because they aren't Y people. New government coerces corporation within legal boundaries to fess up data on X people.

d) New government does horrible things using list provided by and facilitated by corporation, through no direct fault of that corporation other than the happenstance of existing within a country with ever-changing laws and regulation.

But surely almost all of the above, while theoretically a possible future issue in the USA, is day-to-day reality in Russia and China already.

Presumably the commenter is physically out of reach of the Russian and Chinese governments, and being the victim of regime change in the US is more likely than being invaded by the other two.

I don't live in Russia or China. I'm not worried about their governments not liking me.

Government could as easily control Red Hat, for example.

You may be aware that since Trump, when you're not a US citizen, you have no rights to privacy. Everything Microsoft collect about the rest of the world is fair game. IIANM this feature was introduced with the patriot act update.

"Since Trump"? The most recent rev to that law was last year. Obama didn't leave office until this one.

yup! Since trump[1]. As I said IIRC this feature has been introduced with the patriot act. At least out of US, privacy oriented online companies put forward that they are outside patriot act jurisdiction.

[1]: https://www.engadget.com/2017/01/26/trump-signs-executive-or...

Ah, I see. That is a thing Trump did, but has no relationship with the "USA PATRIOT Act", hence my confusion.

Well, I'm worried about Microsoft knowing who I am. It's hard to get legitimate Windows installs that aren't linked to non-anonymous payment methods. Not impossible, but hard.

Take cash, buy computer at retailer...

Sure. Except that I don't want another computer. Just an OS to install. What's hard to get anonymously is the license.

Take cash, go to retailer and buy prepaid visa card, buy digital license using that card.

Hope retailer has no CCTV. Hope town has no CCTV. Leave phone at home.

It depends how deep your desire for annonimity is...

Don't post online either, unless you are able to alter your writing style often. Passed writings linked to your profile will be used to try to identify you.

It all depends on your threat model and how wanted you are as a target.

It helps to be multilingual :)

Why? Surely using two multiple languages competently is a fingerprinting characteristic? Unless you manage to use them only in different contexts in different hardware...

Different hardware, VMs, VPNs, Tor, etc, and combinations thereof.

Government and the police state are already abusing access to our personal information in awful ways. Sometimes that means cops stalking people whom they have a grudge against, or even a love interest in(1). CEOs of major companies leave their cell phones outside of important meetings.

1 - (https://jezebel.com/5887363/creepy-cops-use-dmv-database-to-...

I'm not worried about Microsoft having access to my data, but I am worried about Microsoft having access to everyone's data.

And I'm worried about who MS is giving my data to