Comment Manrake 9.1 review rebuttals and a whine (long) (Score 1) 334
As far as it goes with the purported lies that Linux users propogate against Windows, please, don't make me laugh. I'm a developer, and am often pressed into service as a network admin, as well. If I were to receive a dollar for every hour I have wasted during the past seven years making up for the fact that, as a whole, Windows and much of the industry-standard software written for Windows is amateurish, half-baked technology, I could use the pile of cash to fund a very nice European vacation.
Let's look at the three issues he raises:
1. and 2. XP doesn't crash, and it's reasonably stable. Well, it depends on what you define as "crash" and what your standards are for stability. Yes, the well-worn BSOD has been getting much less use lately. Thank God. It's about time. Actually, I find Win2K to be more stable than XP. But when the kernel code is so leaky that after a long week of web development it can't fit its paged virtual memory into the available RAM even with all apps closed, then I get severely degraded performance. I'm also seeing lots of "weirdness" such as icons getting overwritten with garbage, and orphaned Explorer instances floating around in the process list, each sitting on 35MB of RAM. I could keep running like that, I suppose, as things grind slower and slower. But why? Better to just reboot--a procedure that is only truly necessary under Linux after a hardware or kernel upgrade.
It also bothers me to distraction that, as soon as I do manage to get a Windows install patched just so that it seems very stable, it becomes critically important to install another "security rollup" or whatever the nom-du-jour is for their latest parade of emergency fixes, and after installing that, it's right back to the phone calls from clients on Saturday asking why their server is down again. And for comparison, I have only ever seen a Linux system become unresponsive or do a kernel panic as a result of defective hardware or of my own incompetence during an attempt to compile a kernel specially tuned for my hardware. The difference in stability and robustness between the two OS's--especially under heavy processing loads--is so dramatic that anyone who says the two systems are comparable in that regard simply doesn't know what they are talking about. When you can flog a Windows web application server at near capacity traffic loads for a couple of years with no reboots and stable memory usage, then maybe we will have something to debate.
3. Ah, yes...the old "Windows is the dominant platform, so it is the primary target" argument. Actually, there are many reasons why Linux systems tend to be more secure than Windows ones. This, however, isn't one of them.
Let's start with something really mundane. It's called "su". Windows doesn't have it unless you're running CygWin, which most people don't do. That's why the normal thing to do in Windows-land seems to be to run as an Administrator all the time. Who wants to keep logging off and logging back into the system every time they need to do something as routine as rehupping a darn service? Nobody--me neither. So we run everything as admins, including reading our email. And then so do nimda and the love bug worms. Arrgh! I have tried a few times to run Windows the way I would run a *nix system, and I've always run into too many problems for it to be practical. Usability concerns aside, it often occurs that software you need to run just takes for granted that it has access to all the resources on the machine. This is part of the Windows culture more than it is the OS itself. In fact, Windows' access lists theoretically provide even finer-grained control over who can access what than you get in *nix. But I've never come across a situation where this increased versatility (and complexity) was necessary or even used to its fullest extent. Furthermore, if users don't or can't use the security model of an OS in a convenient, practical manner, then it doesn't matter how good it looks on paper.
I would turn Mr. Vaughan's argument on its head and say that worms are written for Windows because the expoits are there, not the other way around.
The Linux security bug lists you see are mostly the result of many eyes scanning the open-source code. Isn't it interesting how many theoretical exploits that didn't actually appear in the wild turn up from code reviews of open-source code at laboratories and Universities? Isn't it interesting how many actual expoits take advantage of the holes in Windows and go on to do billions of dollars worth of damage?
I looked at the code behind the ILoveYou virus (I think) from a couple years back that took down major parts of the Internet. I was very surprised at how simple that exploit was. Any script-kiddie could have written that code. In fact, a real cracker probably wouldn't have tried it because s/he wouldn't have believed that even Windows could have left such an obvious, gaping vulnerability open to attack.
Mr. Vaughan states that Linux will start having problems when it gains 30% of market share. I assume he's talking about desktops, because Linux already has somewhere around that figure in servers, and successful exploits against these machines have been scarce and apparently not very damaging, as far as I know.
But maybe he's right about what will happen when non-technical people start using Linux on their desktops. However, it would take a perverse effort on the part of the major Linux vendors to deliberately misconfigure their distributions to open up the widespread, systematic vulnerabilities that have caused such havoc on Windows platforms lately. And I'm also guessing that an individual user who is knowlegeable enough about Linux system administration to modify permissions in the first place will probably also have at least a vague clue about what sorts of things not to do.
And now I have a bone of my own to pick with Mandrake--specifically with the install process. It installed the boot loader without asking me how I wanted this done, and overwrote my MBR without checking with me first. The installation of the boot loader was listed as one of the steps in the install process, so I felt comforted that this would not simply occur silently. But that was the one step that it simply flew through without stopping to ask. I know Windows does this type of thing as a matter of course, but that doesn't mean a Linux distro should stoop to that type of behavior.
--Best Regards,
Erik Midtskogen
