Subject: RE: Linux (was: Re: Mbone Apps on Pentiums running Solaris ?)

From: [email-masked]
Date: Fri, 31 Oct 1997 09:40:52 -0500

Hi,

I want to say that I am sorry if I started a FreeBSD vs Linux war. My
original message merely stated that I personnally prefer FreeBSD. I do
not have to justify my preference. 

However:

- Linux machines are used mainly as workstations by people who may be
less familiar with Unix, leaving the machine open for intruders (it is
so easy, _anyone can setup a Linux machine)
- FreeBSD machines are used mainly for servers, which involves a greater
level of Unix expertise, leaving the machines less open for intruders
- People do not necessarily run the latest version of Linux. In fact,
for a newcomer, it is rather hard to get out of the confusion generated
by the many distributions of Linux, let alone running the latest version
of the better ones

Security on a machine is much less a function of the OS than a function
of the type of people running it.

CERT statistics cannot be considered a valid base for establishing which
OS is more secure. CERT only knows about intrusions that were detected
and reported. From what I could see here, FreeBSD intrusions are
detected and eliminated faster than Linux ones, just because of the use
the OS is put to (which conditions the type of user).

Now, we should either take this interesting conversation off of the
mbone list or drop it completely.

Yves Lepage

> -----Original Message-----
> From:	Malcolm Beattie [SMTP:[email-masked]]
> Sent:	Friday, October 31, 1997 05:17
> To:	[email-masked]
> Cc:	[email-masked]; [email-masked]
> Subject:	Re: Linux (was: Re: Mbone Apps on Pentiums running
> Solaris ?)
> 
> Carsten Bormann writes:
> > Heiko W. Rupp writes:
> > > I am no Linux fan at all, but this is not entirely true. I ran
> apps
> > > (mcntp) on linux with and without mrouted. Both without problems.
> > 
> > Sure, *you* won't have problems with a badly pruning Linux mrouted,
> > just the rest of the world around you will.
> 
> The original message which suggested that Linux wasn't suitable
> (from [email-masked]) brought up two claims to justify that
> conclusion:
>   (1) Linux is less secure than FreeBSD.
>         That's wrong. Look at CERT announcements and postings to the
>         bugtraq mailing list, comp.security newsgroups and similar
>         places. Leaving aside the security holes in userland
>         applications which apply to FreeBSD, Linux and usually many
>         other O/Ses (and don't affect the relative security between
>         FreeBSD and Linux), that leaves kernel security holes and
>         systems-level security holes (e.g. daemons, suid utilities
>         and such like). There have been roughly the same number of
>         security holes for daemons reported against both Linux and
>         FreeBSD. On the kernel side, FreeBSD is losing: the two most
>         recent kernel security holes both affect BSDs (FreeBSD, in
>         particular, for this discussion) but not Linux. Those are the
>         open() bug (which lets anyone open raw device files) and the
>         rfork() bug (letting people manipulate file descriptors of
>         suid executables to gain access to protected files).
>   (2) you can find MBone apps already compiled.
> 
> [email-masked] said:
> > Compiling the popular MBone apps is a bitch (get the source code,
> find
> > the matching and right combination of tcl/tk, compile tcl, compile
> tk,
> > compile the MBone app, etc...) and you want to avoid it.
> 
>      If you do have to compile anything yourself, the RPM package
>      system used by the RedHat Linux distribution (or the dpkg system
>      used by Debian) both let you install/de-install installations of
>      version of packages like Tcl and Tk very easily.
> 
> Another message, from "Forrest W. Christian" <[email-masked]>,
> said:
> 
> >> 2. Linux on a similar Pentium
> 
> > Not recommended.  I spent much time with mrouted.  Couldn't get it
> to
> > prune.  I also am aware that mrouted and apps cannot work on the
> same
> > linux box.  Possibly ok for just running the apps, though if you
> don't
> > need mrouted.
> 
> That's also wrong. I've been running mrouted and multi-cast
> applications
> (e.g. from nv, sd, vat, wb to vic, sdr) on and off on the same Linux
> box
> for well over a year. There have been kernel bugs fixed in the
> multicast
> routing in that time but "cannot work" is absolutely wrong.
> 
> Finally, as to Linux mrouted not pruning properly, I suspect that that
> was one of the kernel bugs now fixed. I've tried both mrouted 3.81 and
> mrouted 3.9beta2 (I'm currrently using the latter) with Linux 2.0.31
> and
> it appears to be working fine. I've noticed before on this mailing
> list
> some odd dubious claims about Linux problems with multicasting. Some
> document true bugs which are tracked down and fixed. Some, however,
> seem
> to be third-hand rumours which the senders never bother to check.
> 
> I'd therefore like to ask those on the list with first-hand experience
> of mrouted and kernel multicast routing the two questions about
> Linux/multicast which I haven't found good answers to yet:
> 
> (1) Is the claim about pruning made above true for current kernels
> (2.0.31) or was it a bug which (if it existed) has now been fixed?
> 
> (2) Another rumour on this list is that mrouted under Linux has
> problems tunnelling out to other hosts. Is that true? I currently have
> Linux mrouted running as a leaf node but I'll be setting up tunnels to
> others soon. As far as I'm aware, no outstanding Linux kernel
> multicast
> bugs have shown up in the developers mailing list for a long time.
> Possibly that's because there really aren't any, because the main
> developers haven't mentioned them to the list or because nobody has
> given any bug reports. If it's either of the latter two cases, I'd
> like
> to see detailed bug reports here and I'll either forward them to the
> relevant lists/people and/or try to fix them myself.
> 
> --Malcolm
> 
> -- 
> Malcolm Beattie <[email-masked]>
> Unix Systems Programmer
> Oxford University Computing Services