On Tue, 5 Feb 2002, Octavian Rasnita wrote: > 4. A knowleageable guy told me that Linux has more security > holes than Windows. Is it true? Not knowledgeable about linux and security. There have been news stories, by incompetent or shill journalists, and M$ FUD to this effect, based on some pretty stupid counts of patches. With well over 150 distributions of linux, they only counted the most popular brands of Linux, and then added all the patches together, so that, for instance the telnet patch packages for the same bug were counted for each distribution, thus multiplying the count by the distributions examined. As if security could be measured by counting bugs, with no consideration given for questions about peer review, seriousness, timeliness, etc. Many linux patches come from the security auditing projects (Open Source can be peer reviewed), before exploits are even available: should these be counted in a comparison with proprietary vendors? It is well understood in the security community that genuine security is simply not possible without Open Source and peer review, and even then there will always be more bugs discovered. Where does that leave M$? They aren't even in the running, of course, because they haven't really entered the game. M$ is almost universally scorned in the security community (often subtly), for this and many other reasons. BTW, the telnet bug fix is and was version .17 -- still beta software, as is often the case when bugs are found. Whenever possible, linux users use ssh instead. Telnet has inherent flaws in the protocol standard, and can't be made safe in the vanilla version. To give you some idea what this means in a practical sense, I didn't even install most of the Red Hat patches announced in the last couple of years, for the simple reason that I didn't have those software packages installed on my system in the first place. In a few cases I just deleted the old buggy package I wasn't using (good reminder). Competent system administrators won't even have most of the server software installed on a system even if it's a server (only running the server programs that they actually need). What does all this mean to you, in practice? Don't do a server install (see my other message), or install the GUI stuff if you're not going to use it. That's where the bulk of the bugs have been (and logically, always will be). Go to the updates ftp directory for your distribution immediately after your install, and collect anything that applies to you, and make regular visits thereafter, and get on their security announce mailing list. Use an automatic update daemon (most distributions have them) -- look for a second party textmode auto-update package if necessary. > 5. I also heard that there are viruses under Linux. Are there > any good antiviruses? This question has been mostly answered already, by another poster. I will simply say that practical viruses (real ones, not trojans and security exploits of buffer overflows and the like), are almost unknown on linux because of relatively simple basic design differences (permissions and the like). Real viruses simply do not propagate well enough to be a problem. Every year or so we get a laugh from an article in the press by a clueless journalist claiming that, with increasing popularity, linux will soon have just as many as M$. Nobody has virus problems like M$. Not Apple, not Sun, or IBM, or anyone else: stupid design. The linux antivirus packages mentioned by the other poster are server side filter packages for linux email gateway servers that have M$ machines behind them (ie, to protect vulnerable M$ machines -- I haven't really checked the specifics for the software he mentioned, but that's how things have generally been). There is no market for linux antivirus packages other than that (and there are some excellent free, open source antivirus packages available that can trap even undiscovered M$ email viruses). So you probably don't care about any linux antivirus stuff right now. > 6. I also heard that Linux is not 100% stable and there are > also crashes under this OS, like under Win 2k I am using now. Stardard FUD. Crashes are rare, and usually due to hardware problems -- flakey memory comes to mind. But no complex modern system is bug free. We have seen a few crash causing kernel bugs in the last 10 years: they were quickly fixed. User mode software crashes cannot bring down the system: sometimes you have to kill a locked up process from somewhere else on the system, if you like to run beta software or help in development. If you run high end or unusual hardware you might see more, until enough developers have the hardware to make finding the problem possible. People don't have to put up with this sort of thing when they have the source code. Stay with the production releases. If you try alpha or beta stuff, you should know what to expect. > 7. What do you say? Is Linux only for those who are curious > about it and want to control the system 100% or it could be a > helpfull tool for those who want it to be more easy to use than > Windows? Linux serves both these types of users, but most are of the latter type (or there would be very few of us). Anyway, an OS is really a base for the tools people want: if you have a solid one, and it is Open Source, people can (and do) make the environment whatever they want, in an ongoing process. It's been a real adventure to watch that process for the last 10 years or so: I am still amazed at the progress of these tools, which beats anything else in computer history. If M$ is a leading innovator, then I am a.... If someone tells you linux can't do..., you should be immediately suspicious. Go to a good linux search site. If you don't find something that way, just wait a few months, and you will probably see a new project born. If you're in a hurry, get in one of the high traffic linux newsgroups and complain (risk: prepare to get flamed for claiming... does not exist). > From these questions you may think I am stupid or something, > but I just want to learn which are the advantages of Linux over > Windows 2k. I know it is free, but are there any other > advantages? There are many FAQs, HOWTOs and other articles covering such a general question, in all it's many facets. Start at linuxdoc.org and join the comp.os.linux.advocacy newsgroup (but you might need to be a bit of a masochist for that last). LCR -- L. C. Robinson reply to no_spam+munged_lcr@onewest.net.invalid People buy MicroShaft for compatibility, but get incompatibility and instability instead. This is award winning "innovation". Find out how MS holds your data hostage with "The *Lens*"; see "CyberSnare" at http://www.netaction.org/msoft/cybersnare.html