"1. don't use windows"...I realize how unpopular it is to question the groupthink on this site but this strikes me as simplistic. The public takedowns related to tor have been more about firefox than windows. But I get that Linux fans like to think that this is their sole bailiwick.
If you are using tor and you are using a web browser as your primary means of communication AND YOU REQUIRE SAFTEY you have already made a serious mistake.
Using a JSON or XML based API would be much safer since you aren't having to trust any level of javascript, css, or html...fetching executable code over the internet from a third party is the ROOT of the problem.
It all comes down to what you are trying to do...why are you using tor? who is your adversary?
Just using tails or whonix and being super paranoid...because security...is kind of a shit lifestyle decision. It can also lead to a false sense of security.
The public takedowns related to tor have been more about firefox than windows. But I get that Linux fans like to think that this is their sole bailiwick.
It's not exactly fanboyism that makes security-conscious people prefer Linux. In fact, anybody with even a basic understanding of infosec knows that Windows should be considered wide open: Microsoft has backdoors, they give the NSA backdoors, and their code isn't open to peer review. Moreover, the Tor Freedom Host attack only exploited Firefox on Windows.
Just using tails or whonix and being super paranoid...because security...is kind of a shit lifestyle decision.
Don't you think this is a little rude? Or even just presumptive?
He is right though, FF 0day is probably not expensive regardless of O/S. A life on the run or using multiple safe houses is also a shitty lifestyle when you could just avoid all tracking cookies and executable 3rd party code with a terminal script and not have to wear a fake beard at a different starbucks everday
I love that "Microsoft has backdoors"...no one credible has said that they have proof of that. They give the US Government early access to vulnerability data...they give those updates to several governments and large corporations early as the result of agreements they have made with big customers. They also let these same entities audit the source code for windows. Look it up. If you have the money and its important to you then, yes, you can audit the windows code base.
"security-conscious people prefer Linux"...That's kind of a sweeping statement. What does security conscious even mean?
To me it sounds like this..."People who talk about security a lot use Linux by and large"..."but some of them are really partial to OpenBSD"..."and lots of Windows security experts really use Windows a lot."
I say that its a shit lifestyle decision because what is it accomplishing? You use this really restricted platform to make sure that people can't track you doing ??? What exactly? Communicating with your team of spy's??? Downloading midget porn??? Why do you think that you can have a single workstation that's good for every security corner case? What in the history of computer security makes you think that is a good idea or even desirable?
Let's take the example of the Iranian dissident trying to avoid the oppressive badies in their weird ass government...what does tails or Linux buy you? You are better off with the "throw away laptop" plan using good opsec and running tor from public places. Don't use it for anything but tor and tweeting your pics of black helmeted assholes. Get a new one as soon as possible. Rotate them with other people. The OS means next to nothing.
People keep conflating tor's uses with every possible InfoSec edge case. The dissident has different needs than a guy trying to make sure that the NSA doesn't catch him posting documents. The whistleblower has different needs than the guy buying drugs.
In all cases applying some critical thinking about what you are trying to do is a bigger exercise than "Winblows is the suxor at securitehz!"
Unix doesn't have a monopoly on security. I'm not saying windows does, but Unix people are kind of crazy about their pet platform.
ah, come on. If someone comes up with "Microsoft has backdoors", you can always counter with "the NSA developed SELinux". Still, how many articles, strike that, theories did you read, that SELinux might not be as SE as "they" say?
Just because someone points out a flaw, he is not (necessarily) an employee who wants to discredit the argument.
I'm not a MS employee or even a stockholder. I just get tired of the group think around here. It doesn't do anybody any good to let some of these "everybody knows" style truisms pass unquestioned.
The accusations of being a shill are also pretty annoying...but hey...
What do you need Windows for anyway? Especially in a "secure computing" context, modern distros are cheaper, easier and quicker to install than Windows, and yes, often more secure. Plus, learning GNU/Linux will make you a better programmer and a more capable team player. What do you have to lose?
Learning Linux makes you a better programmer? That's what I'm talking about in a nutshell. "Learning GNU/Linux" doesn't make one a better programmer. I'm not even sure how that's supposed to work...you know that there are really good programmers that use other platforms, right?
Ever heard the term, "don't knock it til you try it"? What do you have to lose by trying free operating systems? It costs nothing to run GNU/Linux in VirtualBox on Windows, and learning to interact with your machine from the command line will expand your skillset and your horizons, making you a better programmer and more valuable team player. Regardless, you're bashing people for using free operating systems in a security context, which is just asinine. This is not the holy war you're making it out to be.
Do you honestly think that I have never tried Linux? Seriously? The first time I installed Linux I had to download the floppy images over a 2400 baud modem connection to a bulletin board.
I'm not bashing people for using Linux...I'm saying that its not good security to say..."Linux is secure"...and not review your security needs from the standpoint of what you are actually trying to accomplish. I'm not making it out to be a holy war...I'm saying that people are just accepting that "Linux is more secure" on blind faith.
"1. don't use windows"...I realize how unpopular it is to question the groupthink on this site but this strikes me as simplistic. The public takedowns related to tor have been more about firefox than windows. But I get that Linux fans like to think that this is their sole bailiwick.
The OS provides a number of security mechanisms which make exploitation harder, Windows' reputation for security (or lack thereof) is somewhat well-deserved, ask anyone who has done exploit R&D.
Even if you have an FF 0day, you still need to be able to weaponize it, bypass ASLR/DEP/etc and this may be more or less difficult depending on the target OS
Does Windows enforce ASLR on every process now? You only need one non-ASLR library to leverage with ROP. Though, you could say this falls under configuration (and I'm pretty sure the vsyscall table on x86_64 linux is still non-ASLR and that seems like a pretty trivial source of ROP gadgets), but I guess my point is its not as simple as supporting ASLR, not all implementations are created equal.
That's actually the new security model that Metro apps use. They are sandboxed by default with a declarative privileges model. I think its called AppContainer?
Comments
"1. don't use windows"...I realize how unpopular it is to question the groupthink on this site but this strikes me as simplistic. The public takedowns related to tor have been more about firefox than windows. But I get that Linux fans like to think that this is their sole bailiwick.
If you are using tor and you are using a web browser as your primary means of communication AND YOU REQUIRE SAFTEY you have already made a serious mistake.
Using a JSON or XML based API would be much safer since you aren't having to trust any level of javascript, css, or html...fetching executable code over the internet from a third party is the ROOT of the problem.
It all comes down to what you are trying to do...why are you using tor? who is your adversary?
Just using tails or whonix and being super paranoid...because security...is kind of a shit lifestyle decision. It can also lead to a false sense of security.
It's not exactly fanboyism that makes security-conscious people prefer Linux. In fact, anybody with even a basic understanding of infosec knows that Windows should be considered wide open: Microsoft has backdoors, they give the NSA backdoors, and their code isn't open to peer review. Moreover, the Tor Freedom Host attack only exploited Firefox on Windows.
Don't you think this is a little rude? Or even just presumptive?
He is right though, FF 0day is probably not expensive regardless of O/S. A life on the run or using multiple safe houses is also a shitty lifestyle when you could just avoid all tracking cookies and executable 3rd party code with a terminal script and not have to wear a fake beard at a different starbucks everday
I love that "Microsoft has backdoors"...no one credible has said that they have proof of that. They give the US Government early access to vulnerability data...they give those updates to several governments and large corporations early as the result of agreements they have made with big customers. They also let these same entities audit the source code for windows. Look it up. If you have the money and its important to you then, yes, you can audit the windows code base.
"security-conscious people prefer Linux"...That's kind of a sweeping statement. What does security conscious even mean?
To me it sounds like this..."People who talk about security a lot use Linux by and large"..."but some of them are really partial to OpenBSD"..."and lots of Windows security experts really use Windows a lot."
I say that its a shit lifestyle decision because what is it accomplishing? You use this really restricted platform to make sure that people can't track you doing ??? What exactly? Communicating with your team of spy's??? Downloading midget porn??? Why do you think that you can have a single workstation that's good for every security corner case? What in the history of computer security makes you think that is a good idea or even desirable?
Let's take the example of the Iranian dissident trying to avoid the oppressive badies in their weird ass government...what does tails or Linux buy you? You are better off with the "throw away laptop" plan using good opsec and running tor from public places. Don't use it for anything but tor and tweeting your pics of black helmeted assholes. Get a new one as soon as possible. Rotate them with other people. The OS means next to nothing.
People keep conflating tor's uses with every possible InfoSec edge case. The dissident has different needs than a guy trying to make sure that the NSA doesn't catch him posting documents. The whistleblower has different needs than the guy buying drugs.
In all cases applying some critical thinking about what you are trying to do is a bigger exercise than "Winblows is the suxor at securitehz!"
Unix doesn't have a monopoly on security. I'm not saying windows does, but Unix people are kind of crazy about their pet platform.
Microsoft employee, pls leave.
ah, come on. If someone comes up with "Microsoft has backdoors", you can always counter with "the NSA developed SELinux". Still, how many articles, strike that, theories did you read, that SELinux might not be as SE as "they" say? Just because someone points out a flaw, he is not (necessarily) an employee who wants to discredit the argument.
I'm not a MS employee or even a stockholder. I just get tired of the group think around here. It doesn't do anybody any good to let some of these "everybody knows" style truisms pass unquestioned.
The accusations of being a shill are also pretty annoying...but hey...
What do you need Windows for anyway? Especially in a "secure computing" context, modern distros are cheaper, easier and quicker to install than Windows, and yes, often more secure. Plus, learning GNU/Linux will make you a better programmer and a more capable team player. What do you have to lose?
Learning Linux makes you a better programmer? That's what I'm talking about in a nutshell. "Learning GNU/Linux" doesn't make one a better programmer. I'm not even sure how that's supposed to work...you know that there are really good programmers that use other platforms, right?
Ever heard the term, "don't knock it til you try it"? What do you have to lose by trying free operating systems? It costs nothing to run GNU/Linux in VirtualBox on Windows, and learning to interact with your machine from the command line will expand your skillset and your horizons, making you a better programmer and more valuable team player. Regardless, you're bashing people for using free operating systems in a security context, which is just asinine. This is not the holy war you're making it out to be.
Do you honestly think that I have never tried Linux? Seriously? The first time I installed Linux I had to download the floppy images over a 2400 baud modem connection to a bulletin board.
I'm not bashing people for using Linux...I'm saying that its not good security to say..."Linux is secure"...and not review your security needs from the standpoint of what you are actually trying to accomplish. I'm not making it out to be a holy war...I'm saying that people are just accepting that "Linux is more secure" on blind faith.
The OS provides a number of security mechanisms which make exploitation harder, Windows' reputation for security (or lack thereof) is somewhat well-deserved, ask anyone who has done exploit R&D.
Even if you have an FF 0day, you still need to be able to weaponize it, bypass ASLR/DEP/etc and this may be more or less difficult depending on the target OS
Windows has DEP and ASLR. They are actually pretty much on par with each other from a TLA standpoint.
There are configuration issues that affect security that should be taken into account if you have high security needs. Its not a capabilities issue.
Does Windows enforce ASLR on every process now? You only need one non-ASLR library to leverage with ROP. Though, you could say this falls under configuration (and I'm pretty sure the vsyscall table on x86_64 linux is still non-ASLR and that seems like a pretty trivial source of ROP gadgets), but I guess my point is its not as simple as supporting ASLR, not all implementations are created equal.
Not all implementations are created equal. I will cede that point.
And you're right, I would call that configuration.
Is there any equivalent of AppArmor on Windows? You can lock down the capabilities of an app pretty hardcore on Linux.
Sandboxie?
That's actually the new security model that Metro apps use. They are sandboxed by default with a declarative privileges model. I think its called AppContainer?
Here's a blog post: http://recxltd.blogspot.com/2012/03/windows-8-app-container-...