Before reading further... Are you looking for great Linux hosting from a company that cares about GNU/Linux? Pick Dreamhost hosting, get a 10% bonus to the disk space (and support Free Software Magazine in the meantime!)
Security bulletins, computers, and cars
Changing the oil in your computer
Download the whole article as PDF
Write a full post in response to this!
This content was sponsored by:
If you’re connected to the internet, you are vulnerable to attacks. I don’t care what operating system, which browser, what firewall, anti-virus, or anti-spyware you have installed—there’s a vulnerability on your system somewhere. Even the tools security researchers use to analyze attacks can be used against their owners as a way of breaking into their machines.
People discover new vulnerabilities all the time, for all operating systems. Computers are complicated things, complicated enough that nobody can forsee all the possible ways to break into them. As people discover new ways of breaking into computers, other people develop countermeasures to keep your personal information safe. It’s an escalating war between thieves and people trying to stop them—and your data is the battleground.
If you’re running a business, a compromise could lead to you revealing any data you have about your customers, thus potentially leading to you being the target of a lawsuit
In July 2005 there were major vulnerabilities for all of the major operating systems. Basically, if you were on the internet, you needed to update your computer.
First off, Windows. Those poor souls limping along with Windows 98, ME, or NT reached the end of the line. Microsoft announced that they do not plan to release a fix for these operating systems, for the critical vulnerability revealed in July. If you use any Windows 98 or ME machines to browse the internet, you’re vulnerable, and the only thing you can do is update to a newer operating system.
What’s the issue? Basically, there’s a problem in the Windows code that translates image files from files to pictures. All you have to do is view a specially crafted image in any Windows program. Including Office, Outlook and Internet Explorer. Including Firefox. Including just about everything that can show you a picture. You could get infected by following a link on Google to a less-than savory site, or opening a Word document from a friend.
Anti-virus software can help block known viruses, but as always, can’t protect you from brand new viruses until the anti-virus folks can discover, dissect, and create virus signatures to detect them.
Now let’s take a look at another vulnerability from July: Firefox, Thunderbird, and the other Mozilla packages. New versions of each were released to fix some potential flaws that could lead to hijacks on any operating system.
Even the tools security researchers use to analyze attacks can be used against their owners as a way of breaking into their machines
Mac users on the newest version of the Apple operating system also got a major security release, for users of OS 10.4.
Fourth vulnerability: Zlib packages. Zlib is a set of software that makes files take up less space on the disk. This may not sound like much, but it’s built into hundreds of other programs, on all platforms. Especially Unix-based platforms, like Mac and Linux. There isn’t a specific action to take here, so much as keeping an eye on bulletins for programs you use.
Computer maintenance vs. car maintenance
Which brings me to the point of this article. Like it or not, somebody needs to actively take responsibility for keeping each computer up-to-date.
Think of your computer like your car: every 3,000 miles, you change the oil. Every 15,000 miles, it goes in for more major maintenance. And as things break, they need to get fixed.
Computer maintenance is similar to car maintenance in that with the proper tools, talents, and time, anybody can do it. But do you really want to? Most of us just take our cars into somebody else’s shop and pay somebody to handle the maintenance for us.
Obviously though, computer maintenance is different than car maintenance. Without maintenance, your car will eventually break down and stop working. It could kill you in the process, if something catastrophic goes wrong at a bad time. With a computer, the risks are entirely different:
- Your computer could break down, taking all of your digital photos, finances, and documents with it.
- Your computer could slow down, when a virus or spyware starts using up all of its memory, and uses your internet connection to send itself to all of your friends.
- Spyware or viruses could reveal your personal information, such as your credit card numbers or social security numbers, along with anything you ever type into it.
- Worms or viruses could lead you to being unable to get to web sites or send email to your friends, if your computer becomes marked as a virus-carrier.
- If you’re running a business, a compromise could lead to you revealing any data you have about your customers, thus potentially leading to you being the target of a lawsuit.
Aren’t you exaggerating a little?
No.
Technology people have an expression that’s starting to spread to the mainstream: FUD. FUD stands for Fear, Uncertainty, and Doubt, and basically refers to a marketing practice of whipping up these emotions in people in order to get them to buy a particular product, service, or U.S. Congress bill. So before I give you my marketing pitch, let me borrow a phrase from the late Douglas Adams:
DON’T PANIC!
But my point is valid. Think of all the complicated machinery we all have in our houses and lives, besides cars: televisions, toasters, DVD players, digital cameras, refrigerators, ovens, grills, bicycles, furnaces, and vacuum cleaners to name a few. None are as sophisticated or complex as your desktop computer. Most are far more reliable than your desktop computer. All require some sort of maintenance, and many require special expertise to provide that maintenance. And none of these can reveal your financial identity to a thief who lives on the other side of the world. At least not until you hook your toaster up to the internet, anyway.
Write a full post in response to this!
Similar articles
Do you like this post?
Vote for it!
Copyright information
This article is made available under the "Attribution-Sharealike" Creative Commons License 3.0 available from http://creativecommons.org/licenses/by-sa/3.0/.
Biography
John Locke: John Locke is the author of the book Open Source Solutions for Small Business Problems. He provides technology strategy and free software implementations for small and growing businesses in the Pacific Northwest through his business, Freelock Computing.
- Login or register to post comments
- 18006 reads
- Printer friendly version (unavailable!)




Looking for Linux hosting, reviews, coupons, etc.? See out user-voted list
Best voted contents
-
How do Drigg and Pligg compare?
Tony Mobily, 2008-08-17 -
The top 4 internet flame wars about free software
Andrew Min, 2008-08-16 -
What if copyright didn't apply to binary executables?
Terry Hancock, 2008-08-29 -
The Bizarre Cathedral - 18
Ryan Cartwright, 2008-08-17
Similar entries
Buzz authors
All news
Other sites
- The Top 10 Everything (Dave). The good, the bad and the ugly.
- Free Software news (Dave & Bridget). All about free software -- free as in freedom!
- Book Reviews: Illiterarty (Bridget). Book reviews, blogs, and short stories.
Hot topics - last 60 days
-
Don't compare GNU/Linux with Windows or MacOS - they are not in the same game
Ryan Cartwright, 2008-07-07 -
Self-signed certificates and Firefox 3 - a possible solution
Ryan Cartwright, 2008-08-05 -
Dictators in free and open source software
Tony Mobily, 2008-07-22 -
Why sharing matters more than marketshare to GNU/Linux
Terry Hancock, 2008-08-01 -
Why did Javascript/AJAX mop the floor with Java, Flash and Silverlight? Or, why open standards eventually win
Tony Mobily, 2008-07-30
Dedicated server
Never been a good experience!
Submitted by Anonymous visitor on Wed, 2006-09-06 03:31.
Vote!This once happened to me. I was up for a deadline the next day when my computer started to reboot while I was working. I don't think that I was exaggerating things but indeed I knew that my pc was in trouble. Thus, I didn't panic at first but when at 2:00 A.M. came I really started to freak out. AT 5:00 A.M. I was out of the house and off to an internet cafe. Such a tragic experience.
http://www.neworleansbl.com
Switch to Linux
Submitted by Anonymous visitor on Wed, 2006-09-06 09:30.
Vote!I agree with what you are saying here. I worked for Microsoft for 10 years, in Australia and in UK and of course I saw a fair share of attacks and viruses. That was 10 years ago, after another 6 years as a consultant I finally started waking up to how things are and how things can be. The amount of money an individual or company spends (if they have licences) on software can be outrageous. I believe a lot of this is down to ignorance or being locked into some for of property software. I have now been using Linux in some form for a couple of years now and yesterday I found myself forced to use a Windows machine. It was a strange experience and not a pleasant one. I found myself actually looking for free software alternatives to the software already installed. Looking for the tools I know and have come to love through using Linux. In this case it was Gimp as I was doing some image editing. I remember when I first used this app and I took one look and thought, I need Photoshop. Now, even with Photoshop available, I found myself installing GIMP on windows to use instead.
I hope to see a spread of the use of Linux and Open Source Software. It frees up people from the money grabbing corporations and lets them either just use good software written from a users perspective, interact with the people who write the software or even contribute to the software.
There are some great distributions out there now and they are so easy to install. In many cases, you don't just get an system, you get email, office suite, graphics tools all installed from the word go.
Yes, it is different, but the change is worth it.
Good general article but a lot of bias
Submitted by Anonymous visitor on Thu, 2006-09-07 00:52.
Vote!While I agree with the general viewpoint of the article, the overall article is very biased towards Linux.
As a user of both, my experience has been that certain common features of a desktop or laptop machine are at time very difficult to get working on Linux - for example, many current distributions, CD based or not, have a tough time with most built in wireless cards in laptops. On some distributions this can take hours to get working and that's for an IT professional. The truth is that the vast selection of Linux distros out there is actually a major hurdle for the casual user because different distros have differents strengths and weaknesses and the average user wouldn't have the time of expertise to select the right one, not to mention switch when a necessary feature is not supported or easier to use on a different distro.
In another example, the issue of remote support is completely incorrect. Microsoft Windows 2000 and later include a remote administration tool called remote desktop (or terminal services). While its true that there was a recent vulnerability discovered in it, there have also been recent vulnerabilities in the Linux SSH component which serves a similar purpose. What's important here is not the selection of OS but the observation that without current updates, your system can be compromised!
The use of Linux as a desktop platform is very dependant on a solid GUI based system, something that is often an afterthought for many Linux developers since the product started out as a server solution. The Xserver based GUIs of most Linux distros are inconsistent in the elements of the OS that they expose via GUI and sometimes very unintuitive or unstable (as the latest Ubuntu fix that disabled Xserver demonstrates).
So, while the general point of look around before you make a decision is very valid, I would argue that current Linux distros are a viable choice for individuals and/or organizations that have access to a knowledgable resources for deployment, configuration and support. The average home user is better off biting the Windows bullet for another version until a good solid friendly Linux desktop distro come out.
On the side, I couldn't agree more about applications. While some of us have access to MS apps based on licensing arrangement from work, general software packages for Windows are bloated, expensive and contain more features than most people can use in a lifetime. A free alternative that provides 80% of the features is usually a fantastic alternative.
Well, there are plenty of tools to secure Windows as well...
Submitted by Anonymous visitor on Thu, 2006-09-07 00:56.
Vote!Not to be raining on your parade about how easy it is to remote admin Linux (it is), but the tools are there for Windows as well.
As a person that runs several game servers out there (entire boxes - not virtual servers), I run them all on Windows (the code is often cleaner, unfortunately since the code is written for Windows then ported to Linux), and I admin all my stuff far more securely than just using Remote Desktop. Install OpenSSH on Windows (http://sshwindows.sourceforge.net/), set it up for certificate authentication, and tunnel all administrative connections through it. Does Windows come with it? No. But it doesn't come with most other stuff that it really needs, either, like a good firewall, antivirus software, etc. Configure the firewall for only what it needs, and you're good. The running OpenSSH server will only consume a few MB of RAM, and you can tunnel Remote Desktop, etc., through it. Have more than one machine behind the NAT proxy? Allow Remote desktop connections only from the machine that has SSHD on it, and connect open a remote tool from that machine, or forward your connection via the tunnel.
Having said that? Linux rox. I run it every day. My sole point is that while Linux has some great things going for it, the nature of open source brings most of that great stuff to Windows as well. Now, if I could just find a "tabbed" SSH client, like Konsole.
Hello up there!
Submitted by Anonymous visitor on Thu, 2006-09-07 02:39.
Vote!Non geek down here...thanks to the author for a good, English explanation. I am borderline tech savvy, mostly aware enough to know what I don't know, do some basic maintenance and troubleshooting (just beyond - is the power cord kicked out?). At one point, I was much more knowledgeable (enough to earn respect of geeks and close deals for hardware co.) but have been out of the tech world too long.
Finding through my current work (writing for 'zine and blogging) that most advice and help out there is either really, really basic; or more often, geared toward much higher level of proficiency than many of us have.
I really appreciate straight talk from knowledgeable people who get how to dumb it down for the rest of us!
Thanks!
Jacqueline Church
Leather District Gourmet
Gourmet Food
My biggest frustration about Linux security
Submitted by Terry Hancock on Mon, 2006-09-18 00:30.
Vote!My biggest frustration about Linux security is that most of the documentation is written for “high buy-in” technical users. Most of the tech support makes the same assumption.
There is a general “Windows users are idiots” / “Linux users are experts” meme that works against the newcomer to Linux.
Now, I'm neither an “idiot user” nor a “professional IT guy”. I'm a moderately experienced desktop user, with a fair amount of scientific and tinkerer programming experience. I personally hate worrying about security, and would really rather I could get somebody else to do it.
However, I also want to run my own web site, using technologies like Zope, which means I need to administrate my own server. I'm okay with that, but it annoys me that all the resources I can find are the ones only an engineer could love. I recently had a run-in with the tech support on my virtual server site, because I made a configuration error that left the site open to exploitation as an “open proxy”. That was obviously a bad mistake, and I'm glad they shut it down.
If you've ever actually tried to set up an Apache server to front a back-end web server like Zope as a “reverse proxy”, while simultaneously juggling virtual domain names with mod_rewrite, then you know that it's an amazingly tricky, overly complicated, and under-documented system. It's what we like to describe as “a maze of twisty passages, all alike”, as the IF games used to put it. So the fact that I could make an error like this by accident, should not be at all surprising, no matter how destructive it might be.
But what bothered me is that they implied I was doing it on purpose! That's because, being “someone who knows Linux” they just automatically assume I'm some kind of expert (I guess). I believe this problem is behind me, and I'm pretty certain I've secured my site better—but you never really know. Deliberate malice will always find a way to break the system.
One of the continuing attractions of Windows-based servers, regardless of the technical problems, is probably that you don't get insulted for your lack of privileged inside information: everybody just assumes you're an idiot to begin with, which is sort of comforting in a twisted sort of way.
If GNU/Linux is to get more broadly accepted, even in the server market (especially on the low, small-business end), the community and the industry is going to have to develop a more friendly attitude to part-timers like myself, who are not being paid high-dollar IT salaries to maintain their servers (and to know all the ins and outs of doing so), but are instead trying to juggle the task with designing and improving their websites or just running their business.
Why I'll Probably Stick With Windows
Submitted by Anonymous visitor on Fri, 2007-03-23 21:44.
Vote!I've recently tried Linux again for the third time in six plus years. I don't like WGA in XP, I don't like the DRM crap in Vista, and I don't like what I read about Microsoft's future plans and technology and what they could do with the technology (http://lxer.com/module/newswire/view/79728/index.html).
Having tried Ubuntu last year and liking it, I decided to try Xubuntu this year because I could have a nice looking desktop that wasn't resource intensive. I like Linux and Xubuntu in general very much but here is what will probably keep me from switching to it - Linux versions, or similar alternatives, of current Windows apps that I use.
Yes, I can dual boot or use QEMU or VMware, but then I'm still using Windows, so if I still have to use Windows, why not just use it period? I have other interests in life and keeping Windows and programs up-to-date already consumes enough of my free time. I don't need to add more work keeping a Linux OS and apps up-to-date as well.
In any case, the lack of a Linux version, or acceptable comparable alternative, to the following Windows apps will keep me from switching: Adobe Acrobat, Quicken, Visual Studio, SnagIt, TreePad (although they're currently working on Linux versions), ExamDiff Pro, Password Agent, Easy CD-DA Extractor.
Listing these apps brought something else to mind about why I'm resistant to making the switch; the time involved to find and play around with alternative apps.
One last point about the editorial regarding "...vendors who can cut off your service." This can happen with open source projects as well if the developer(s) decide not to continue development. Sure, someone else could take over development, but there's no guarantee that will happen.