My previous post could be shorter: if you want a binary tree-like storage, it already exists and it's called the file system. Each OS has one, and it is standard, comes with a bunch of tools, is familiar to users. Thus I just don't get why Microsoft felt the need for implementing yet another proprietary FS (registry), especially when it's inferior to NTFS or Ext3 in every way, including security, reliability and performance. Perhaps it made sense in FAT/Win16 days.
But I hear you, good tools can be misused and bad ones can be improved upon
Maybe it is harder to notice a breach on Unix, but it is also correspondingly unlikely that the breach will affect all programs and make the system unusable. The closest thing to the frailty of the registry would be something like hacking /etc/ld.so.conf on a Unix system.
If the Unix root user is not enabled, especially for remote access, and assuming you don't have access to the physical device, then it's a question of which Unix accounts and groups you do have access to. Also, technically directory write permission is all that's needed to compromise a Unix file, so all files in the same directory are equally vulnerable. (Even this assumes base permissions and not ACLs, etc.)
Second, the registry is privileged the same way; write access to one part of the registry doesn't give you write access to all of it.
Third, it is notoriously hard to keep permissions straight on configuration files, especially when you're trying to manage multiple roles (for MySQL, qmail, and root, for instance). So most people screw it up.
But I mean, I don't think this is a huge problem. I just think I can knock down a lot of arguments about how the Win32 registry is an abomination. There's a lot not to like about it, but it isn't crazy.
First, there are just as many places to backdoor on a Unix desktop (of comparable functionality) as there are in Windows. The difference is that there's one place to monitor and scan in Win32, and a zillion in Unix --- you literally can't know everything (or even 80%) of what you need to monitor in Unix.
Second, it's not as if the Unix permissions model is any more flexible than the Win32 model. If you can edit files in /etc, you own the box. If you can edit files in ~, you own the user. It's the same scenario in Win32.
Third, the reasons there are "cleaners" and "doctors" for Windows are twofold:
---- (1) Windows users have been sold the bill of goods that they need to keep their registries swept. Unix users don't give a shit. I have Evolution config files from 2000 in my homedir, on my Macbook.
---- (2) Windows users get a disproportionate share of all viruses and trojans, because Windows desktops are more than 90% of the outstanding population of hosts, and are nowhere near tapped out for attackers yet.
As for the rest of it:
* show me a registry subtree on Windows that you think is a bad example of sane, automatable, declarative configuration, and I'll find a comparably bad Unix configuration file.
* every enterprise in the world has a standard Win32 build/replication system that covers the registry, and most of the ones I've seen are homebrew, so all my evidence is that this is a solved problem. On the other hand, a lot of my clients don't have a well-managed automated Solaris build.