Preston Gralla has a good blog entry on an insecurity report from IBM:
“It reports that Linux had more vulnerabilities than any other operating system. But that doesn’t necessarily mean that it is the most vulnerable operating system, because Microsoft had the most serious vulnerabilities. Here’s what the report has to say about operating systems:
As for operating systems, Linux took the number one position in the first half of this year for new operating system disclosures followed by Apple in second place. If you consider only the critical and high operating system disclosures, Microsoft dwarfed all the other players with 73 percent.
So there’s no doubt that Windows is vulnerable. But as the report shows, so are Apple devices, and devices that run Linux. In fact, the main message of the report is that overall, 2010 has been a bad one so far for security. The report notes that reported security vulnerabilities are up 36% compared to a year ago, and that the first half of 2010 had the highest number of vulnerabilities ever recorded in the first half of a year.
So if you’re a Mac or Linux user, don’t think you’re invulnerable — like Windows users, you’re not secure.”
He’s right of course. GNU/Linux is very insecure. I am very insecure walking around without a bullet-proof vest. I should be riding around in a tank but no one is shooting at me. Openness does have its disadvantages. One’s insecurities are laid bare for all to see. On the other hand they can be found and fixed sooner. With that other OS we often only find out about the vulnerabilities after malware-artists are driving trucks through them. Then M$ takes a few months to fix and test the fix before releasing the fix giving the malware-artists free reign over IT. The report mentions that M$ is number one on serious vulnerabilities, you know, the ones trucks fit.
If you are guarding Fort Knox and have a lot to lose, you should be worried about the insecurity of GNU/Linux but you definitely should not be using that other OS. GNU/Linux can be secured very well with layers of security: firewall, web filtering, USB device scanning, virtualization, backupped backups, good passwords and updates. With a few layers of security GNU/Linux becomes quite solid.
If you are just browsing the web for information, you can run from a live CD with GNU/Linux and be solid. For normal use you can do a lot just by minimizing the number of software packages you install and services running. Don’t lose sleep over the insecurities in GNU/Linux. Count the thousands of attacks that other OS gets for every one sent your way instead of counting sheep.