Re: [OS:N:] Security w/emulation

[Thomas Corriher <thomas hcconst com>]

>>  I got to thinking: if there is a hole in a piece of software
>>  is that hole still has much of a concern when run on a *nix
>>  system under emulation?

> Wine ... doesn't change the file and user permissions, so it
> wouldn't allow a virus to find or use what it expected to.

There is less danger when using Windows programs via a Linux system 
because, as Jeremy already mentioned, Linux automatically has a 
degree of containment.  However, there are some exploits which 
would work.  Data or applications accessible by an insecure Windows 
program is always at risk of being erased, corrupted, or silently 
manipulated.  You need to access important files using a Windows 
program, but granting that access places the same important files 
at risk.  It would therefore be foolish to adopt a false sense of 
security -- that Linux is the magic pill that cures all which ills 
Windows.

Every time there is a major configuration change or significant 
change in the applications used, there are security implications: 
for better or for worse.  This rule applies to every operating 
system.  Linux can be used to help protect one from shoddy Windows 
programs, whenever the installer is fairly knowledgeable about 
fundamental security issues.  Careful consideration is required.  
For instance, if one were to assume Linux were the magic security 
cure for Windows, and then grant an insecure Windows program 
comprehensive access to all user files for convenience sake, then 
he would be courting a disaster.

Everything stated in this topic is true, but we must be careful not 
to give anyone a false sense of security by over simplifying 
security issues.  Linux can be configured to be as dangerous, and 
even more so, than Windows.  Thus, the most important part of 
security, at least with Linux, rests between the chair and 
keyboard.  Linux will save you if you know how to use it, while 
Windows security is like Russian Roulette.

May the source be with you.

-- 
 Thomas Corriher