Linux vs Windows - who wins ?

[phenomlab]

During an unrelated discussion today, I was asked why I preferred Linux over Windows. The most obvious responses are that Linux does not have any licensing costs (perhaps not the case entirely with RHEL) and is capable of running on hardware much older than Windows10 will readily accept (or run on without acting like a snail). The other seeking point for Linux is that it’s the backbone of most web servers these days running either Apache or NGINX.

The remainder of the discussion centered around the points below;

• Linux is pretty secure out of the box (based on the fact that most distros update as part of the install process), whilst Windows, well, isn’t. Admittedly, there’s an argument for both sides of the fence here - the most common being that Windows is more of a target because of its popularity and market presence - in other words, malware, ransomware, and “whatever-other-nasty-ware” (you fill in the blanks) are typically designed for the Windows platform in order to increase the success and hit rate of any potential campaign to it’s full potential.

• Windows is also a monolithic kernel, meaning it’s installed in it’s entirety regardless of the hardware it sits on. What makes Linux unique is that each module is compiled based on the hardware in the system, so no “bloat” - you are also free to modify the system directly if you don’t like the layout or material design that the developer provided.

• Linux is far superior in the security space. Windows only acquired “run as” in Windows XP, and a “reasonable” UAC environment (the reference to “reasonable” is loose, as it relates to Windows Vista). However, Microsoft were very slow to the gate with this - it’s something that Unix has had for years.

• Possibly the most glaring security hole in Windows systems (in terms of NTFS) is that it can be easily read by the EXT file system in Linux (but not the other way round). And let’s not forget the fact that it’s a simple exercise to break the SAM database on a Windows install with Linux, and reset the local admin account.

• Linux enjoys an open source community where issues reported are often picked up extremely quickly by developers all over the world, resolved, and an update issued to multiple repositories to remediate the issue.

• Windows cannot be run from a DVD or thumb drive. Want to use it ? You’ll have to install it

Linux isn’t perfect by any stretch of the imagination, but I for one absolutely refuse to buy into the Microsoft ecosystem on a personal level - particularly using an operating system that by default doesn’t respect privacy. And no prizes for guessing what my take on Apple is - it’s essentially BSD in an expensive suit.

However, since COVID, I am in fact using Windows 11 at home, but that’s only for the integration. If I had the choice, I would be using Linux. There are a number of applications which I’d consider core that just do not work properly under Linux, and that’s the only real reason as to why I made the decision (somewhat resentfully) to move back to Windows on the home front.

Here’s a thought to leave you with. How many penetration testers do you know that use Windows for vulnerability assessments ?

This isn’t meant to be an “operating system war”. It’s a debate