"What OS is right for me?" - My thoughts to that question
Page 1 of 2 12 LastLast
Results 1 to 10 of 17

Thread: "What OS is right for me?" - My thoughts to that question

  1. #1

    "What OS is right for me?" - My thoughts to that question

    Greetings,

    Many times throughout my security years of both teaching and learning, I find that at least once every few months someone asks me "What Operating system is the best?" or "What Operating System is better/more secure/less secure/faster/cooler/easier to hack with". To each I've given the same answer and thoughts that I shall share here, as I merely feel it is time to do so. Do not expect a list of Operating Systems, nor expect biased opinions in this post. I want to offer insight to one of the most valuable peices of wisdom one can have in the security buisness.

    The answer to the question of "What Operating system is the best?" is quite simple:

    Each and every Operating System is capable of preforming and responding just as well as the next.

    That's correct. Now, set aside differences, stereotypes, and your past knowledge for a moment, please. And allow me to share my thoughts with you. Here is a quote I want you to never forget, something that I have never forgotten once my mentor taught me: The OS is only as good as the Admin, and the OS can never make up for a bad admin. A veteran of a Windows Operating System can lock up any windows distro in a heartbeat, more secure than an SElinux kernel on OpenBSD running tripwire, by using their knowledge and experience of windows. A newbie of OpenBSD, however, can make it as insecure as an unfirewalled, unupdated, windows 95 distrobution. Think about this for a second, if you will for me. An Operating System can have all sorts of default safeguards and built in security functions, plus unlimited tools at the admins disposal to secure it with. But, if the admin is not familiar with that Operating System, whichever one he is using, then it is all useless to him.

    There is an old adagio: "A firewall is no good if you do not know how to configure it and read the logfiles"

    It holds true to Operating System security, upkeep, and usage. While so many people may argue about "LINUX IS TEH GOD!!!111 windows is INSECURE omfg!!!11FIVE" and about "LINUX IS 31337 :P yuh rght", they are forgetting how important it is to learn and master both. A good security admin doesn't just brag and become a fanboy about their OS, they dig deep into the core of it to discover how they can tweak and modify it in each and every way, so that when the time comes to modify it, they already know how. Be it mastering the Registry in Windows, which by the way is actually every single module configuration that directly links into the Windows kernel at your finger tips. Or be it learning how to use KDE, even if your past experience with it was shotty. Why is it so important to focus deeply onto your OS of choice? I'll tell you why.

    When an admin is comfortable with their OS, they can begin to actually learn. Thus is the root of my entire answer. Despite what OS you are on, find the one you are most comfortable with and master it. Because when you master it, nothing can penetrate you, and you are quick to both problem solving and prevention. Forget the stereotypes of Windows not being "leet enough", or Linux being only for "geeks". Find what you like best, and master it. This leaves me to the last part of my post here, dear friends.

    When you have mastered an OS, truley knowing it inside and out, then move onto a new one. A completely different one. If you mastered Gentoo Linux to the bone, then give Windows XP a shot. Remember, shove aside stereotypes and previous bad experiences and use that to drive you even harder to make it WORK like it should. With equal knowledge of multiple operating systems, not only does that widen your "hire me" contract, but it helps build general knowledge about computers, period.

    So I say again, and I leave you with this: Each and every OS is just as good as the next, and can do the same thing in different ways. The key and the challenge is finding the OS you are most comfortable with, blowing off the windows and linux zealots that will stereotype you, and actually learning. Remember, there isn't a single thing that Linux can do that I can't make Windows do just as good, and there isn't a single thing that Windows can do, that I can't make Linux do just as good.

    Take care, be well, and do not take this as a flame war post, but as something to honestly think about, grow on, and take to heart.

    kindest regards,
    Pooh Sun Tzu

  2. #2
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,190
    Well said,

    Although you may not have intended it as such, I would say that this is a rather nice, succinct little tutorial?

    Just my opinion

    Moderators?

    Cheers
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  3. #3
    Senior Member
    Join Date
    May 2003
    Posts
    159
    Good point raised... I guess yeah a sort of Mini tutorials for the best OS....

    Agreed any OS is as good as its admin....

    Only diffrence is the way the manufacturers package the product...

    Windows comes with lot of already open services.. I guess that has made life decent for many computer users...

    Linux , Unix , open BSD come with tight compartment form of package.. It in turns gives lot of Admins a good life to live.....


    Cheers....
    ****** Any man who knows all the answers most likely misunderstood the questions *****

  4. #4
    I disagree anjali, as we can't just look at "Default securities" because if the admin doesn't know it's secure already and how, it's a waste. Windows doesn't come with as many open services as you think (I counted 3 - 4 on a default tcp probe unfirewalled), and this is equal to a default install of Redhat.

    Thus we can't say Linux is more secure than Windows, or vice versa, because it isn't about the OS it is about the admin knowing what securities are in place. If someone from Redhat switches to OpenBSD and starts changing a ton of settings because they knew Redhat down pat but BSD runs differently, then BSD's default security is once again worthless. Point being, though, that defaults mean absolutley nothing in the world of security. If someone is defending their network with a default install I would call them an untrustworthy admin. Not just because it is a default install (and even OpenBSD at that), but because they would not take the time to learn the OS and take the extra steps to secure it further.

    Because, in the end, they can all be just as secure with the same amount of hassel. While setting up Ipchains may take someone weeks to figure out, installing zone alarm takes them 5 minutes. Where as it may take someone a few weeks to learn how to turn off windows services, editing starting services on a linux box can take 3 minutes. It isn't about default, it's about what the OS can do in the end and what limits you can stretch it to.

  5. #5
    Macht Nicht Aus moxnix's Avatar
    Join Date
    May 2002
    Location
    Huson Mt.
    Posts
    1,752
    Excellent answer to a very comon question. And it should be a tutorial.
    \"Life should NOT be a journey to the grave with the intention of arriving safely in an attractive and well preserved body, but rather to skid in sideways, Champagne in one hand - strawberries in the other, body thoroughly used up, totally worn out and screaming WOO HOO - What a Ride!\"
    Author Unknown

  6. #6
    Senior Member
    Join Date
    Jan 2003
    Posts
    100
    Nice,
    Whatever, whoever whenever, Slackware is best http:\\www.slackware.com
    jks, Good tip on afta mastering onw to move on even if it is winxp lol

    but slackware

  7. #7
    Super Moderator
    Know-it-All Master Beaver

    Join Date
    Jan 2003
    Posts
    3,914
    Originally posted here by anjali
    Good point raised... I guess yeah a sort of Mini tutorials for the best OS....

    Agreed any OS is as good as its admin....

    Only diffrence is the way the manufacturers package the product...

    Windows comes with lot of already open services.. I guess that has made life decent for many computer users...

    Linux , Unix , open BSD come with tight compartment form of package.. It in turns gives lot of Admins a good life to live.....


    Cheers....
    Hey Hey

    I'm gonna go with PST on this one and say I disagree with you. You may look at services and say "Hey a lot of stuff is running" on a windows machine, yet do you know what those services do? My DSL connection has it's own service ( that doesn't affect security in the least). Sure there are open ports, but that's why the first thing an admin does is lock down the box (a good admin anyways).

    If you look through the newsletters, one of them.. I'm not sure which (I'm guessing 9 or 10) has an article I wrote titled the "Joys of Being Rewted". It was a mandrake 9.1 box and a fresh install. I was lazy and in less than 24 hours the box had been rooted by script kiddies. Yet I have seen Windows boxes go for months without being touched off the default install. Windows has it's share of problems... worms that affect the various services. If you install almost any Linux distro right now, I guarentee you at least one service will be vulnerable to some sort of root exploit, be it the version of ssh they use, or the samba service.

    The problem is most people have experience with a single user system. They base their opinions on this and even in that one system they don't explore it. Did you know that on top of the ICF and it's stupid little check boxes in Windows, there is also TCP/UDP/ICMP packet filtering? Have you ever experienced the power of AD, especially group policy editor?

    I may seem biased here, but I run both systems on a daily basis and I troubleshoot both systems on a daily basis. Both systems have their advantages and disadvantages. If you really want to compare things and you mentioned the way OSs are packaged. This can be a big disadvantage for admins. People install a linux disto and say "Wow look at how many tools it comes with" most of those tools are third party tools, they are Linux itself they are addons. Now take a windows box. It contains very few third party tools (sure there's a folder on the CD but it's fairly empty). To gather a lot of the same functionality on Windows you have to download outside tools and install them. This is especially true at the console more than anywhere else.

    Let's say I take over for a lazy admin and we'll run through both scenerios.

    Windows:

    He hasn't done anything to secure the system or installed any third party apps other than an application based firewall because they're easily installed. That in itself is leaving the system fairly secure from and outside point of view. I tweak the firewall settings, disable unnecessary services (very easy with the services mmc) and use group policy editor to lock down the accounts quickly. Maybe run spybot to remove spyware and use the system startup to see what's starting on boot (or msconfig for the purists)

    Linux:

    He hasn't done anything and didn't wanna learrn iptables so it isn't even firewalled. The odds are the system has already been rooted because he did a shitty install (clicked the select everything option) and there are many services running. I have to search for a break-in and if so the odds are my system may as well be reinstalled, which means I have to set-up everything myself but at least it'll be done right. If I find nothing to point to a successfully hack/crack and decide to secure the system, I have to start writing iptables rules... then I have to disable services (which may be in several locations... could be in inetd.conf, could be in x.inetd, could be in rc.d, could be a cron job). Now I have a huge install with many users. I have to find out where the users are (oh look each one has their own group), now I have to start creating groups... and then I have to chgrp all the utilities in /usr/bin /usr/sbin /usr/local/bin... etc because I want to make sure they are locked down and only certain people have access to them. With the windows install I didn't have to do this because third party apps aren't installed by default.

    Looks like Linux has made my life a lot harder in this case and created more work for me. You can argue there are scripts to automate everything, but that's besides the point. There are more tasks to complete on one rather than the other. With the way MS supports scripting languages now , whether you use VBS, jS or something else.... an admin can be extremely powerful and his job can be relatively easy.

    You have to look a this from a network point of view instead of a stand-alone system to get the fell of what the admin's work is going to be. A single computer.. there's no difference, either one can be locked up just as tight, and is just as insecure of the install. The services running are only part of it, you also need to think about which of those services are actually a hazard and a really truly vulnerable.


    Anyways I'm done,

    Peace
    IT Blog: .:Computer Defense:.
    PnCHd (Pronounced Pinched): Acronym - Point 'n Click Hacked. As in: "That website was pinched" or "The skiddie pinched my computer because I forgot to patch".

  8. #8
    Senior Member
    Join Date
    May 2003
    Posts
    159
    I stand corrected.....

    Thanks pooh . hertz for bringing the same to my notice.....
    ****** Any man who knows all the answers most likely misunderstood the questions *****

  9. #9
    Senior Member
    Join Date
    Dec 2003
    Location
    Pacific Northwest
    Posts
    1,675
    Good Morning All,

    Threads and discussions like these are exactly why I come in here. Great knowledge base to learn from all. Even if I was only just browsing thru, I'd learn by osmosis. So keep it up folks, I know I appreciate it!

  10. #10
    Yes, that's my CC number! 576869746568617's Avatar
    Join Date
    Dec 2003
    Location
    Earth
    Posts
    397
    I don't think anybody could have said it better, pooh.......I'm speechless!
    Windows 9x: n. A collection of 32 bit extensions and a graphical shell for a 16 bit patch to an 8 bit operating system originally coded for a 4 bit microprocessor. Written by a 2 bit company that can\'t stand 1 bit of competition.


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides