As one person commented - that was because of an irresponsible server
admin - nothing to do with the security of Linux itself.
Oh, quite true. But so what. However much it matters at the enterprise
level, where "sensitive data" must be protected from unauthorised
access, it doesn't make that much of a difference to the ordinary user.
Or even, as the story demonstrates, the unordinary one. IMO, Linux fans'
focus on its (undoubtedly high) inherent security can distract from what
is far more important: the user.
The cited story merely points up the obvious: Users are always the most
crucial element of any security scheme. The reason the *nix OSs were
written to be difficult to hack at the admin level was precisely for
that reason: stupidity, inexperience, complacency, laziness, naivete,
helpfulness, etc, and so on and so forth, are the reasons the vast
majority of infections happen. The "inherent security" of Linux is a an
attempt to defend against these all-too-human traits.
Linux can no more be 100% secure than any other OS. It must give its
users permissions, else it's unusable. As I've said in another post: If
you understand the user's permissions, you can write malware to exploit
those permissions. If you understand people's psychology, it's almost
too easy to write malware such that the user will allow it to do what
you want. If Linux ever gets significant market share among ordinary
users, attacks on it will increase, and many will be successful because
they will exploit human traits rather than OS weaknesses.
Not to mention that most of the successful malware these days is
phishing email. My wife just got one supposedly from a known source
asking her to wire money, as he was stranded in Manchester, England,
without passport, cash, or baggage. No amount of inherent security on an
OS can guard against that.
Have a good day,
Wolf K.
