Minggu, 18 Januari 2009

Myth - Open Source is Invincible to Virus Attacks

Most people think that choosing Open Source operating system would be a better option to avoid mess caused by virus attack. Is it true? Let me tell you why it is not always true.

Common Statement:

1. Open Source is invincible because the number of virus operates in the operating system is less than the proprietary operating system.

It is true if you compare Windows with Linux or BSD. But it might not be true if you compare all Open Source with OS400 (proprietary operating system for AS 400 IBM machine) for example.

2. Microsoft Windows is more vulnerable to virus because it contains more bugs than Open Source.

Every operating system has bugs. Difference between Windows and Open Source in my opinion is just a matter of how long time is elapsed from bug being revealed to patch being developed. In this case, Open Source might be a winner.

So what is the main cause of vulnerability? How we avoid them?

In my observation, the main cause is lies on user behavior. For example, most operating system user does not aware that operating system offers adjustable level of security for user computer operations. Most people would choose super user privileges for its convenient to changing operating system setting while exposing their operating system to virus attacked by allowing unknown files to be executed in their computer. User simply relies upon antivirus (which is rarely updated) for prevention.

Best way to avoid virus attack is to use the computer with proper privileges. Using restricted access and capability sufficient for normal operations and using super user privileges for rarely activities related with system configuration, change operating system setting, etc. For Microsoft Windows 9x and ME users, better option might be upgrade or change to Open Source, since the operating system do not provide capability to adjust user privileges.

Another way is frequently updated antivirus list. This approach would be less effective, if user privileges are not properly maintained.

Other way, which is cheap but rather difficult, is to know if the file is coming from source you can trust prior execution.

The purpose of this writing is not a comparison or pros and cons between Operating System, but to express my thinking.