10 things you should know about Linux security

This almost doesn't pass the smell test, in that *nothing* on the list is Linux specific. "Be aware of session thieves", "Do not use unsafe internet protocols for administration or data transfer", these should apply to anything done on any OS, be it Linux, Windows, Multics, VMS, or NOS/VE. The article mentions Firewire and DMA attacks. These are due to the underlying hardware, not any OS property, as I recall.

Some of it seems like good advice, but I question the validity of changing passwords "often". This is one of those places where human factors interact poorly with so-called "best practices", and a "best" practice might actually cause problems when people write passwords on sticky notes left in desk drawers, etc.

The "use a firewall" one is just strange. As near as I can tell, running a "personal firewall" on a Windows box comes about because nobody is 100% certain what's running on their Windows box. Windows is just too baroque for anyone outside sysinternals.com to be sure. Like running an "anti-virus" program, "personal firewalls" are a WIndows practice that constitutes Cargo Cult behavior when brought to Linux.

This is just an odd article for a "let's make linux a better experience" blog. It's really all about making any computer use a worse experience. Why would such a blog run this article? Did someone have a monthly article quota to mee?

> I question the validity of changing passwords "often".

I'll agree with you on this one. Use a good password, keep it unique, so that even if one is broken it only works on that one system.

"Change passwords often" is silly if your system is cracked already, or the network is being sniffed, and then your new passwords are compromised too.

I've had several websites send me plain text "confirmation" email with my username and new password. Oh, wow, now that's security!

Write your passwords down, so that the passwords can be really good ones. The odds of an electronic attack are far higher than the CIA breaking into your house and copying your password list.

Passwords are just another form of "security through obscurity".

@ phsolide - I agreed with you 100% the minute I saw that article. I suspect that the author has already posted -- or will soon post -- the exact same article -- with a slightly different title -- on Windows and Mac blogs.

Also look for the author's upcoming, informative series of articles about how to use a seatbelt in a Chevy sedan, a BMW convertible, a Ford truck, etc.

@CB, you missed the Pulitzer prize winning, soon to be tv movie "How to use a toothpick chapters 1 through 32" unabridged directors cut.

I heard that the director's cut includes a surprise ending -- I don't want to spoil the surprise so I'll just say that it involves dental floss.

Bob, that's dental F/L OSS.

Now you've ruined the surprise.

Better than a thong.

Well, if the thinger hath had voithe training...

Make it loud, make it thtrong.

Quoting:A Russian security researcher on Thursday said he has released attack code that exploits a critical vulnerability in the latest version of Mozilla's Firefox browser. ................................... f Legerov's claim pans out, it would be one of the few times in recent memory that a zero-day vulnerability for Firefox has circulated in the wild. While the exploit is currently available only to those who pay a hefty licensing fee, wider circulation can't be far behind. This story will be updated as more is learned.

http://www.theregister.co.uk/2010/02/18/firefox_zero_day_rep...

Doesn't seem to affect non-Windows platforms.

Paying a fee to get the exploit is an interesting, that hardly seems 'in the wild'. More like "for sale."

@tuxchick Can you confim that?

> Can you confim that?

From the Register's article:

"We've played a lot with it in our labs - it was very reliable," Legerov wrote in an email to The Reg. "Works against the default install of Firefox 3.6. We've tested it on XP and Vista."

Which doesn't mean the bug isn't present in the Linux version, merely that the exploit probably doesn't work.

> Which doesn't mean the bug isn't present in the Linux version, merely that the exploit probably doesn't work.

Yep, the exploit has to get traction on the platform, even if it can get through the application.

That's one thing that has always kind of bugged me about Java scripting.

Yes, what jdixon said.

im in ur browser stealin ur cookies....

Oh noes! My cookies!

Mine mine mine cookies all mine mine mine...

Oops, Did I Curium again?

;-)

You did, Scott, all over your shoes.

Oh darns..and here I thought I kept my mouth closed..I tried I tried..LOL!!