Shellshock: Bash software bug leaves up to 500 million computers at risk of hacking

[cromag]

Originally Posted by ShellShock

Who do you mean by "they"? Microsoft and Apple? Where is your evidence for this statement? With Windows 7 I get regular security patches automatically downloaded. My experience is that Microsoft is extremely security aware, and do their utmost to quickly fix any security holes that are found. This is in their own commercial interest--they have to protect their reputation at all costs.

...

Again, do you have any evidence for this statement? Who are you quoting? My personal experience with Microsoft and Windows 7 is that I get a lot of security patches for things that I didn't even know were vulnerable, which seems to match what happens in the Linux world.

I don't see why you feel you have to bash Microsoft with a lot of unsubstantiated claims, in a thread about a Linux security flaw.

It's self-evident. Email Microsoft or Apple and ask to see the source code for any part of their OS or commercial releases. It's closed.

Linux is open. Anyone can offer their own tweaked version, or tweak it for their own use.

You may not like the "bashing" of Microsoft (I assume that was intentional? ) but to suggest that their worlds are open is naive at best.

A few years ago, in spite of constant updates to the OS, a big-name antivirus program, a third party firewall, and an antimalware program, and regular time-consuming scans, my Windows XP computer got nailed with a truly impressive virus attack. My Linux boxes just chug along. Even the one running a version of Ubuntu that was years out of date because I didn't want to switch it from the Gnome desktop to Unity.

The Bash flaw put servers, routers and network-attached at risk, but home computers were still relatively safe. The user would still have to be conned into installing the virus.

And I got an update to bash within 24 hours of the news breaking.

[eschwartz]

Originally Posted by cromag

Even the one running a version of Ubuntu that was years out of date because I didn't want to switch it from the Gnome desktop to Unity.

Linux Mint with MATE-desktop.

I hate Unity, so I switched to Arch Linux and am happily messing around with dwm and openbox*, but that could be considered a little extreme.

* -- EDIT: to start with, but possibly going to look at awesome and xfce and lxde and maybe a few others, because why not?

[cromag]

Originally Posted by eschwartz

Linux Mint with MATE-desktop.

I hate Unity, so I switched to Arch Linux and am happily messing around with dwm and openbox, but that could be considered a little extreme.

Actually, I stuck with Ubuntu and finally switched the desktop to Cinnamon. Its layout is very Gnome-like, with a few nice extras.

[eschwartz]

Originally Posted by ShellShock

Who do you mean by "they"? Microsoft and Apple? Where is your evidence for this statement? With Windows 7 I get regular security patches automatically downloaded. My experience is that Microsoft is extremely security aware, and do their utmost to quickly fix any security holes that are found. This is in their own commercial interest--they have to protect their reputation at all costs.

I don't think anyone is arguing that MS doesn't try to fix security holes -- just that their patches tend to happen on a slower schedule than when the people affected can join the patching process and supply a patch first.

Originally Posted by ShellShock

Again, do you have any evidence for this statement? Who are you quoting? My personal experience with Microsoft and Windows 7 is that I get a lot of security patches for things that I didn't even know were vulnerable, which seems to match what happens in the Linux world.

I don't see why you feel you have to bash Microsoft with a lot of unsubstantiated claims, in a thread about a Linux security flaw.

And because you get patches without knowing you needed them, that magically equates to an evaluation of how long MS was working on providing a patch vs linux distros???

By your own admission, you have no idea whether MS was timely or not. In fact, by nature you cannot know, it is a trade secret.
linux patches on the other hand, are all in the public eye (to those who care) and we can track their history and compare them to the in-the-public-eye reports of the problem they are fixing -- we know exactly how long it takes to fix the problem. And if someone needs it fixed and feels it is taking too long, they can write the fix themselves and be safe (and email the fix upstream for the glory).

Which is the only point Sregener was trying to make.

[eschwartz]

Originally Posted by cromag

Actually, I stuck with Ubuntu and finally switched the desktop to Cinnamon. Its layout is very Gnome-like, with a few nice extras.

Cinnamon is nice too. It is one of my installed desktops on Arch.

The menu is sort of a cross between gnome2 and Windows, with the best parts of each... but I kind of prefer the flyouts of gnome2.

Linux Mint is basically Ubuntu with Cinnamon/MATE installed. Guaranteed smoothness because it's all built together, and stuff, whereas I thought with Ubuntu, you had to get patched versions of all kinds of stuff?
When installing on Ubuntu, don't you need to use a PPA? I heard it got shut down...

(I may be totally wrong, I don't follow Ubuntu news anymore.)

[EowynCarter]

Originally Posted by jgaiser

It's important if you have an internet facing system. It is most definitely *not* 500 million computers. The majority of Linux systems are *not* internet servers and as such someone would have to get direct access to the machine and at the point it wouldn't matter. Update you systems. Quickly update your systems if they are serving up cgi or php. Take a deep breath. The world is not ending.

Plus, you would need to be able to change environment variables that you're not supposed to be able to change to exploit it.

[cromag]

Originally Posted by eschwartz

Cinnamon is nice too. It is one of my installed desktops on Arch.

The menu is sort of a cross between gnome2 and Windows, with the best parts of each... but I kind of prefer the flyouts of gnome2.

Linux Mint is basically Ubuntu with Cinnamon/MATE installed. Guaranteed smoothness because it's all built together, and stuff, whereas I thought with Ubuntu, you had to get patched versions of all kinds of stuff?
When installing on Ubuntu, don't you need to use a PPA? I heard it got shut down...

(I may be totally wrong, I don't follow Ubuntu news anymore.)

No, Canonical, developers of Ubuntu, still provide software via the Ubuntu Software Center, but I tend to use the Synaptic Package Manager. Most of the software is patched as part of its ongoing life cycle -- I wouldn't want to use software that couldn't be patched. They have closed down some of the business-oriented services, like Ubuntu One, but I don't miss them.

The only time I've ever had to worry about PPAs is when I'm installing non-free software, like Skype.

My understanding may not be in-depth enough to give you a comprehensive answer.

[ShellShock]

Originally Posted by cromag

It's self-evident. Email Microsoft or Apple and ask to see the source code for any part of their OS or commercial releases. It's closed.

Linux is open. Anyone can offer their own tweaked version, or tweak it for their own use.

You may not like the "bashing" of Microsoft (I assume that was intentional? ) but to suggest that their worlds are open is naive at best.

I never suggested that. I was mainly objecting to this statement: "Compare this to Windows/OS X which believe obscurity equals protection; they are counting on the fact that because you can't see the code, it will be harder to find the flaws that are there."

Where is the evidence that Microsoft "believe obscurity equals protection"? Whether Windows/OS X are open or closed has little to do with how secure they are. Being open source did not prevent the bash security flaw, which has been around for a long time. I could characterise this as "linux users believe open source equals protection". See what I did there?

Is there any evidence for how secure Windows is compared to Linux? (which would have to take into account lots of factors, including their relative popularity).

[jbjb]

Originally Posted by cromag

It's self-evident. Email Microsoft or Apple and ask to see the source code for any part of their OS or commercial releases. It's closed.

(Emphasis mine).

That's wrong - a significant part of OSX (the Darwin core - kernel and Unix-ish command-line facilities) is open source.

In any case, equating proprietary to insecure and open source to secure is clearly fallacious - the two best-known security concerns of recent times (Shellshock and Heartbleed) came from open source software.

/JB

[crich70]

Originally Posted by darryl

The bug is in the bash shell which is used on most Linux systems and runs on most Unix type operating systems. While Linux is not even in the same ballpark as Windows so far as desktop use is concerned, it is used extensively on servers, including some banks, large companies, even, I seem to recall, at least one stock exchange. There is apparently a "proof of concept" floating around but so far I have seen no reports of any actual hacks.

Linux is my preferred operating system and I use it on my desktop and notebook I will continue to do so. Whilst Linux is a "safer" operating system than Windows it is neither completely safe nor immune. The lesson to be learnt here is that no operating system is completely safe from human ingenuity. We need to be realistic about the environment we are operating in and act accordingly.

If you have a Linux or Unix operating system you need to make sure that it is up to data and the version of bash on your system has been patched for this bug.

And it's what Garcia uses on Criminal Minds as well. I don't know if the actual U.S. Government uses it or not but I guess it's not too far fetched that some Government in the world does.

[eschwartz]

Originally Posted by ShellShock

Is there any evidence for how secure Windows is compared to Linux? (which would have to take into account lots of factors, including their relative popularity).

Originally Posted by jbjb

In any case, equating proprietary to insecure and open source to secure is clearly fallacious - the two best-known security concerns of recent times (Shellshock and Heartbleed) came from open source software.

http://www.computerworlduk.com/blogs...again-3569376/

[eschwartz]

Originally Posted by cromag

No, Canonical, developers of Ubuntu, still provide software via the Ubuntu Software Center, but I tend to use the Synaptic Package Manager. Most of the software is patched as part of its ongoing life cycle -- I wouldn't want to use software that couldn't be patched. They have closed down some of the business-oriented services, like Ubuntu One, but I don't miss them.

The only time I've ever had to worry about PPAs is when I'm installing non-free software, like Skype.

My understanding may not be in-depth enough to give you a comprehensive answer.

Hmm, I think I was just operating under outdated info.

Apparently cinnamon and MATE have both joined the official repo sometime in the last 1.5 years, and Ubuntu Mate is on the verge of being an official flavor.
When I left, they were both in PPAs (which do show up in package managers ) on account of PPAs are for software which Canonical doesn't want to be responsible for.

Regarding patches -- what I mean is like the way a number of core components:

• nautilus --> caja
• gedit --> pluma
• eye of gnome (eog) --> eye of mate (eom)
• evince --> atril
• file-roller --> engrampa
• gnome-terminal --> mate-terminal

had to be forked and modified to prevent incompatibility between the desktop environments.

[rcentros]

Originally Posted by eschwartz

Linux Mint with MATE-desktop.

That's the direction I went -- had zero interest in Unity.

[cromag]

Originally Posted by eschwartz

Apparently cinnamon and MATE have both joined the official repo sometime in the last 1.5 years, and Ubuntu Mate is on the verge of being an official flavor.
When I left, they were both in PPAs (which do show up in package managers ) on account of PPAs are for software which Canonical doesn't want to be responsible for.
...

Ahh. Yes, I think Cinnamon only joined the official repository a year ago. I believe I switched about 6 months ago. WRT PPAs, I was thinking in terms of those PPAs that I had to specifically add to my Software Sources for updates.

[cromag]

Originally Posted by crich70

And it's what Garcia uses on Criminal Minds as well. I don't know if the actual U.S. Government uses it or not but I guess it's not too far fetched that some Government in the world does.

Actually, the government was a big user of UNIX (back in my day) and there are several versions of Linux that are approved for use in various departments. In particular, there is at least one version approved for the Dept of Defense -- with rumors that they have at least one even more secure version they use in-house.