THE technology news sites have begun pushing the "USB" story, suggesting that inheriting Windows-like behaviour makes Linux less secure. There are rebuttals written about it and we may address them at a later stage. For the time being, let us recall the advantage GNU/Linux has not only when it comes to software centralisation in trusted repositories (which verifies safety and protects from malicious downloads from arbitrary sites). One of the big advantages of this approach is that using the same mechanism GNU/Linux keeps all the underlying software -- not just the core of the operating system -- up to date with security patches. Windows does not have that (Apple emulates this and Microsoft only expresses hopes to emulate that, just like it emulates sudo) and in fact one writer is now saying that "Microsoft has to open Windows Update to third-party developers":
There's a lot of confusion out there about when attacks against computers occur as a result of vulnerabilities in software as opposed to some other weakness, usually social engineering. Considerable progress has been made in protection against vulnerabilities on Windows, and we can make exploitation even harder if Microsoft can be talked into my scheme: open up Windows Update to third-party applications.
My own opinion is that social engineering is far more important than vulnerabilities and has been increasing in importance. One reason for this is that vulnerabilities are a harder target than they used to be, and that's in large part because of the work Microsoft has done over the last 6 or 7 years.
The key thing to notice is that the dangerous link that the UK government idiots clicked on downloaded to their PCs the Zeus trojan horse - a keylogger that only affects Windows (not that you'd ever guess that from the pathetic mainstream coverage of any Zeus infection). So if the UK government swapped out lots of those expensive and vulnerable Windows systems with low-cost and rather more secure GNU/Linux ones, we'd be spared most of the losses from those cyber-wallies, for almost no outlay.
But that would be too easy, efficient and intelligent - especially when there's a baying pack of security companies who have the scent of those 650 million smackeroonies in their dilated nostrils. To avoid that threat of minimising the threat with such simple means, they'll doubtless create a crescendo of FUD about the imminent “cyber-Armageddon” we all face if the UK government doesn't throw buckets of dosh in their direction to “defend, delay, attack and manoeuvre in cyberspace”, as General Sir David Richards, chief of the defence staff, put it in the article quoted above (how on earth do you “manoeuvre in cyberspace”?)
The trouble is, no matter how much security firms claim their costly solutions are idiot-proof, they underestimate the cleverness of idiots - or the deep and intrinsic lack of security offered by a Microsoft monoculture, which is even more durable than that pesky “cyber” prefix....