10 fundamental differences between Linux and Windows

#1: Full access vs. no access

Having access to the source code is probably the single most significant difference between Linux and Windows. The fact that Linux belongs to the GNU Public License ensures that users (of all sorts) can access (and alter) the code to the very kernel that serves as the foundation of the Linux operating system. You want to peer at the Windows code? Good luck. Unless you are a member of a very select (and elite, to many) group, you will never lay eyes on code making up the Windows operating system.

You can look at this from both sides of the fence. Some say giving the public access to the code opens the operating system (and the software that runs on top of it) to malicious developers who will take advantage of any weakness they find. Others say that having full access to the code helps bring about faster improvements and bug fixes to keep those malicious developers from being able to bring the system down. I have, on occasion, dipped into the code of one Linux application or another, and when all was said and done, was happy with the results. Could I have done that with a closed-source Windows application? No.

#2: Licensing freedom vs. licensing restrictions

Along with access comes the difference between the licenses. I’m sure that every IT professional could go on and on about licensing of PC software. But let’s just look at the key aspect of the licenses (without getting into legalese). With a Linux GPL-licensed operating system, you are free to modify that software and use and even republish or sell it (so long as you make the code available). Also, with the GPL, you can download a single copy of a Linux distribution (or application) and install it on as many machines as you like. With the Microsoft license, you can do none of the above. You are bound to the number of licenses you purchase, so if you purchase 10 licenses, you can legally install that operating system (or application) on only 10 machines.

#3: Online peer support vs. paid help-desk support

This is one issue where most companies turn their backs on Linux. But it’s really not necessary. With Linux, you have the support of a huge community via forums, online search, and plenty of dedicated Web sites. And of course, if you feel the need, you can purchase support contracts from some of the bigger Linux companies (Red Hat and Novell for instance).

However, when you use the peer support inherent in Linux, you do fall prey to time. You could have an issue with something, send out e-mail to a mailing list or post on a forum, and within 10 minutes be flooded with suggestions. Or these suggestions could take hours of days to come in. It seems all up to chance sometimes. Still, generally speaking, most problems with Linux have been encountered and documented. So chances are good you’ll find your solution fairly quickly.

On the other side of the coin is support for Windows. Yes, you can go the same route with Microsoft and depend upon your peers for solutions. There are just as many help sites/lists/forums for Windows as there are for Linux. And you can purchase support from Microsoft itself. Most corporate higher-ups easily fall victim to the safety net that having a support contract brings. But most higher-ups haven’t had to depend up on said support contract. Of the various people I know who have used either a Linux paid support contract or a Microsoft paid support contract, I can’t say one was more pleased than the other. This of course begs the question “Why do so many say that Microsoft support is superior to Linux paid support?”

#4: Full vs. partial hardware support

One issue that is slowly becoming nonexistent is hardware support. Years ago, if you wanted to install Linux on a machine you had to make sure you hand-picked each piece of hardware or your installation would not work 100 percent. I can remember, back in 1997-ish, trying to figure out why I couldn’t get Caldera Linux or Red Hat Linux to see my modem. After much looking around, I found I was the proud owner of a Winmodem. So I had to go out and purchase a US Robotics external modem because that was the one modem I knew would work. This is not so much the case now. You can grab a PC (or laptop) and most likely get one or more Linux distributions to install and work nearly 100 percent. But there are still some exceptions. For instance, hibernate/suspend remains a problem with many laptops, although it has come a long way.

With Windows, you know that most every piece of hardware will work with the operating system. Of course, there are times (and I have experienced this over and over) when you will wind up spending much of the day searching for the correct drivers for that piece of hardware you no longer have the install disk for. But you can go out and buy that 10-cent Ethernet card and know it’ll work on your machine (so long as you have, or can find, the drivers). You also can rest assured that when you purchase that insanely powerful graphics card, you will probably be able to take full advantage of its power.

#5: Command line vs. no command line

No matter how far the Linux operating system has come and how amazing the desktop environment becomes, the command line will always be an invaluable tool for administration purposes. Nothing will ever replace my favorite text-based editor, ssh, and any given command-line tool. I can’t imagine administering a Linux machine without the command line. But for the end user — not so much. You could use a Linux machine for years and never touch the command line. Same with Windows. You can still use the command line with Windows, but not nearly to the extent as with Linux. And Microsoft tends to obfuscate the command prompt from users. Without going to Run and entering cmd (or command, or whichever it is these days), the user won’t even know the command-line tool exists. And if a user does get the Windows command line up and running, how useful is it really?

#6: Centralized vs. noncentralized application installation

The heading for this point might have thrown you for a loop. But let’s think about this for a second. With Linux you have (with nearly every distribution) a centralized location where you can search for, add, or remove software. I’m talking about package management systems, such as Synaptic. With Synaptic, you can open up one tool, search for an application (or group of applications), and install that application without having to do any Web searching (or purchasing).

Windows has nothing like this. With Windows, you must know where to find the software you want to install, download the software (or put the CD into your machine), and run setup.exe or install.exe with a simple double-click. For many years, it was thought that installing applications on Windows was far easier than on Linux. And for many years, that thought was right on target. Not so much now. Installation under Linux is simple, painless, and centralized.

#7: Flexibility vs. rigidity

I always compare Linux (especially the desktop) and Windows to a room where the floor and ceiling are either movable or not. With Linux, you have a room where the floor and ceiling can be raised or lowered, at will, as high or low as you want to make them. With Windows, that floor and ceiling are immovable. You can’t go further than Microsoft has deemed it necessary to go.

Take, for instance, the desktop. Unless you are willing to pay for and install a third-party application that can alter the desktop appearance, with Windows you are stuck with what Microsoft has declared is the ideal desktop for you. With Linux, you can pretty much make your desktop look and feel exactly how you want/need. You can have as much or as little on your desktop as you want. From simple flat Fluxbox to a full-blown 3D Compiz experience, the Linux desktop is as flexible an environment as there is on a computer.

#8: Fanboys vs. corporate types

I wanted to add this because even though Linux has reached well beyond its school-project roots, Linux users tend to be soapbox-dwelling fanatics who are quick to spout off about why you should be choosing Linux over Windows. I am guilty of this on a daily basis (I try hard to recruit new fanboys/girls), and it’s a badge I wear proudly. Of course, this is seen as less than professional by some. After all, why would something worthy of a corporate environment have or need cheerleaders? Shouldn’t the software sell itself? Because of the open source nature of Linux, it has to make do without the help of the marketing budgets and deep pockets of Microsoft. With that comes the need for fans to help spread the word. And word of mouth is the best friend of Linux.

Some see the fanaticism as the same college-level hoorah that keeps Linux in the basements for LUG meetings and science projects. But I beg to differ. Another company, thanks to the phenomenon of a simple music player and phone, has fallen into the same fanboy fanaticism, and yet that company’s image has not been besmirched because of that fanaticism. Windows does not have these same fans. Instead, Windows has a league of paper-certified administrators who believe the hype when they hear the misrepresented market share numbers reassuring them they will be employable until the end of time.

#9: Automated vs. nonautomated removable media

I remember the days of old when you had to mount your floppy to use it and unmount it to remove it. Well, those times are drawing to a close — but not completely. One issue that plagues new Linux users is how removable media is used. The idea of having to manually “mount” a CD drive to access the contents of a CD is completely foreign to new users. There is a reason this is the way it is. Because Linux has always been a multiuser platform, it was thought that forcing a user to mount a media to use it would keep the user’s files from being overwritten by another user. Think about it: On a multiuser system, if everyone had instant access to a disk that had been inserted, what would stop them from deleting or overwriting a file you had just added to the media? Things have now evolved to the point where Linux subsystems are set up so that you can use a removable device in the same way you use them in Windows. But it’s not the norm. And besides, who doesn’t want to manually edit the /etc/fstab fle?

#10: Multilayered run levels vs. a single-layered run level

I couldn’t figure out how best to title this point, so I went with a description. What I’m talking about is Linux’ inherent ability to stop at different run levels. With this, you can work from either the command line (run level 3) or the GUI (run level 5). This can really save your socks when X Windows is fubared and you need to figure out the problem. You can do this by booting into run level 3, logging in as root, and finding/fixing the problem.

With Windows, you’re lucky to get to a command line via safe mode — and then you may or may not have the tools you need to fix the problem. In Linux, even in run level 3, you can still get and install a tool to help you out (hello apt-get install APPLICATION via the command line). Having different run levels is helpful in another way. Say the machine in question is a Web or mail server. You want to give it all the memory you have, so you don’t want the machine to boot into run level 5. However, there are times when you do want the GUI for administrative purposes (even though you can fully administer a Linux server from the command line). Because you can run the startx command from the command line at run level 3, you can still start up X Windows and have your GUI as well. With Windows, you are stuck at the Graphical run level unless you hit a serious problem.

10 common security mistakes that should never be mad

By Chad Perrin

The following is a list of security mistakes I see all the time. They're not just common, though—they're also extremely basic, elementary mistakes, and anyone with a modicum of security knowledge should know better than to make them.

1) Sending sensitive data in unencrypted e-mail
Stop sending me passwords, PINs, and account data via unencrypted e-mail. Please. I understand that a lot of customers are too stupid or lazy to use encryption, but I'm not. Even if you're going to give them what they want, in the form of unencrypted sensitive data sent via e-mail, that doesn't mean you can't give me what I want—secure communications when sending sensitive data.


2) Using "security" questions whose answers are easily discovered
Social security numbers, mothers' maiden names, first pets, and birthdays do not constitute a secure means of verifying identity. Requiring an end user to compromise his or her password by specifying a question like that as a means of resetting the password basically ensures that the password itself is useless in preventing anyone who is willing to do a little homework from gaining unauthorized access.


3) Imposing password restrictions that are too strict
I've seen an unacceptable number of cases where some online interface to a system that lets you manage your finances—such as banking Web sites—impose password restrictions that actually make the interface less secure. Six-character numeric passwords are dismayingly common, and the examples only go downhill from there. See "How does bad password policy like this even happen?" for another example in more detail.


4)Letting vendors define "good security"
I've said before that there's no such thing as a vendor you can trust. Hopefully, you were listening. Ultimately, the only security a corporate vendor really cares about protecting is the security of its own profits and market share. While this may prompt a vendor to improve the security of its products and services, it sometimes prompts exactly the opposite. You must question a vendor's definition of "good security," and you must not let vendors tell you what's important to you.


5) Underestimating required security expertise
People in positions of authority in corporations often fail to understand the necessity for specific security expertise. This applies not only to nontechnical managers, but to technical IT managers as well. In fact, standards working groups such as the one that produced the WEP standard often include a lot of very smart technologists, but not a single cryptographer, despite the fact they intend to develop security standards that rely explicitly on cryptographic algorithms.


6) Underestimating the importance of review
Even those with security expertise specific to what they're trying to accomplish should have their work checked by others with that expertise as well. Peer review is regarded in the security community as something akin to a holy grail of security assurance, and nothing can really be considered secure without being subjected to significant, punishing levels of testing by security experts from outside the original development project.


7) Overestimating the importance of secrecy
Many security software developers who make the mistake of underestimating the importance of review couple that with overestimation of the importance of secrecy. They justify a lack of peer review with hand-waving about how important it is to keep security policies secret. As Kerckoffs' Principle—one of the most fundamental in security research—points out, however, any system whose security relies on the design of the system itself being kept secret is not a system with strong security.


8) Requiring easily forged identification
Anything that involves faxing signatures or sending photocopies or scans of ID cards is basically just a case of security theater—putting on a great show without actually providing the genuine article (security, in this case) at all. It is far too easy to forge such second-generation (or worse) low quality copies. In fact, for things like signatures and ID cards, the only way for a copy to serve as useful verification is for it to be a good enough copy that it is not recognized as a copy. Put another way, only a successful forgery of the original is a good enough copy to avoid easy forgery.


9) Unnecessarily reinventing the wheel
Often, developers of new security software are re-creating something that already exists without any good reason for doing so. Many software vendors suffer from Not Invented Here disease and end up creating new software that doesn't really do anything new or needed. That might not be a big deal, except that new software is often not peer reviewed, it makes security mistakes that have already been ironed out of the previous implementation of the idea, and it generally just screws things up pretty badly.
Whenever creating a new piece of software, consider whether you're replacing something else that already does that job and whether your replacement actually does anything different that is important. Then, if it is doing something important and different, think about whether you might be able to just add that to the already existing software so you will not create a whole new bundle of problems by trying to replace it.


10) Giving up the means of your security in exchange for a feeling of security
This is a mistake so absurd to make that I have difficulty formulating an explanation. It is also so common that there's no way I can leave it out of the list. People give up the keys to their private security kingdoms to anyone who comes along and tells them, "Trust me, I'm an expert," and they do it willingly, eagerly, and often without thought. "Certificate Authorities" tell you who to trust, thus stripping you of your ability to make your own decisions about trust; Webmail service providers offer on-server encryption and decryption, thus stripping you of end-to-end encryption and control over your own encryption keys; operating systems decide what to execute without your consent, thus stripping you of your ability to protect yourself from mobile malicious code.
Don't give up control of your security to some third party. Sure, you may not be able to develop a good security program or policy yourself, but that doesn't mean the program or policy shouldn't give you control over its operation on your behalf.

10 Firefox extensions you can't live without

By Jack Wallen

One of the nicest aspects of Firefox is the ability to add extensions. And there are plenty to choose from. Some do little more than alter the aesthetics. But you'll find others out there that you can't browse without. No matter what your purpose in browsing, there is a killer-app extension just waiting for you. Let's take a look at my top 10 extensions.


1) Morning Coffee
This extension allows you to set a group of Web sites that will open (each in its own tab) with the click of a button. This will save you from having to roam through your bookmarks (while drinking that first cup of wake-me-up in the morning) to view your favorite sites. And you don't have to limit yourself to personal browsing, either. I also use this extension to open up all the Web-based admin tools for sites I administer. You can even set sites up to open only on certain days (or every day). So news junkies or overworked administrators rejoice: This extension will make your browsing life a little easier.


2) NoScript
This is one of the best tools for making sure your browsing experience is secure. With NoScript, you can disable active content from any site you don't trust. Unless you configure it to allow JaveaScript, Java, and other executable scripting to run from a site, NoScript will completely block the script, keeping you browser safe from known and unknown exploits. And don't think because you are using FireFox in Linux that you're perfectly safe! Use this extension regardless of platform.


3) ColorfulTabs
If you're like me, you generally have a LOT of tabs open in Firefox. Sometimes this isn't a problem. But there are times when the tabs can get a bit overwhelming and need a bit of organization. To help with this, ColorfulTabs gives each open tab a different color, making it easier to distinguish between them. With this simple extension, you can color-code tabs either randomly or according to URL. You can also set tabs to fade. Another fun feature is that you can set a background image for tabs.


4) BBCode
This helpful extension adds BBCode, HTML, and XHTML symbols and formatting to the context menu. BBCode also allows you to add up to 10 custom tags to your menu. This extension shows itself when you're in a forum and you right-click a text area where you can select the tag you want to add from the menu. This extension will make your forum work quite a bit easier, as well as faster.


5) Buggybar
This extension is invaluable to Bugzilla power users. With this extension, you will have a Bugzilla Chrome sidebar available which will readily show all bugs that relate to a bug list you have created. As of version 0.2, Buggybar works with all instances of Bugzilla.


6) Clear Cache Button
I don't know about you, but I always set up my browsers to clear their cache at exit. But what about those times you want to clear the cache but not exit the browser? Instead of navigating through the menu structure, you can add this simple extension. It provides a button that gives you complete cache clearing with a single click.


7) TimeTracker
Okay, this is not really a tool that will aid or better your browsing experience. In fact, this little extension will remind you how much time you spend browsing. I have found this little gem useful in a number of circumstances. Whether you are in need of a quick five-minute break from number crunching or you just need to know how much time you spend on a specific Web site, TimeTracker will keep track of how long you browse. What is nice about this is that the tool times across sessions. So when you close the browser, the timer stops, and when you open the browser back up, the timer starts again. You can reset the timer by right-clicking the status bar timer and selecting Reset.

8) iMacros
This extension automates pretty much anything you do in Firefox. From opening up sites to filling out forms and even administration work -- you can automate it with iMacros. The iMacros extension has a sidebar that shows favorite macros. It also has a record feature that allows you to create macros by simply clicking Record, going through the motions of the macro to be created, and clicking Save. These macros can be as complex as you need them to be. When you want to run them, you simply navigate to the macro in the iMacros sidebar and click the Play button. The only downfall I have found with this tool is that you can't assign key combinations to run macros. Other than that, this extension is a must-have for power browsers.

9) Fasterfox
This extension does one thing: It makes Firefox load pages faster. Speed of page loading can be increased by allowing simultaneous connections and prefetching. This extension is currently in the experimental stage because of the release of Firefox 3. To install it, you have to log into a Firefox account to download. The extension is worth the hassle. The speed increase is noticeable.

10) BlogRovR
We all read blogs. From my TechRepublic Open Source blog to the countless other blogs available, we all read them daily. And this takes time. Instead of wasting time going to the blogs, let this handy extension fetch them for you. You do have to sign up for an account using this extension (they promise they won't spam you.) and you will be asked to install another sidebar (Stickies), which is not necessary. Once you have this installed, you just enter the blog URL, and BlogRovR will begin fetching the information for you. Warning: If you have NoScript installed, you have to allow the BlogRovR page to run scripts or it won't be able to fetch pages for you.


So that's my list of 10 extensions, from various categories, that will make your Firefox experience better. Some of these extensions are for power users and some are for everyone. Don't hesitate to go beyond this list and search forthat perfect add-on that will make your daily browsing better.