Linux vs. Windows Security Mystery

Of all the many winning advantages Linux has in its favor, security is surely one of the more widely known examples.

Why else, indeed, would we see security experts in mainstream publications recommending it over Windows for online banking purposes?

That, indeed, is part of the reason it was so disappointing to see Linux get completely ignored in a recent NSA report entitled "Best Practices for Keeping Your Home Network Secure."

The report is filled with various suggestions oriented toward Windows and Mac users -- just as one would expect, given that they're by far the majority today. What stands out, though, is that for Windows users, the NSA simply recommends upgrading to Windows 7 or Vista, making no mention at all of the far-more-secure Linux option that's available.

More than a few ripples were created in the waters of the Linux blogosphere.
'NSA Says No to Linux'

Some interpretations seemed truly bizarre.

"NSA Best Practices Recommend Windows Over Linux For Security" read one headline on ITProPortal, for example.

Similarly, "NSA says no to Linux in best practice advisory" read another on TechEye.

‎ This, despite the fact that Linux wasn't mentioned at all in the NSA report.
'What a Twist of Words'

Bloggers, as per their wont, made note of that fact quickly.

"Wow what a twist of words," wrote Ken in the comments on the ITProPortal story, for example. "The NSA article does not even mention Linux. What the NSA article says is this: 'Both Windows 7 and Vista provide substantial security enhancements over earlier Windows workstation operating systems such as XP.'

"So the NSA is really saying that the newer Windows is better than the old Windows. Duh!!!!" Ken added.

‎It wasn't long before PCWorld weighed in with an indignant, "Windows Vista for Better Security? I Don't Think So," and the conversation took off from there.

Down at the blogosphere's Punchy Penguin saloon, Linux Girl was bombarded with comments.
'Merely a Reflection of Reality'

"NSA recommending Vista for home security is merely a reflection of the reality of monopoly in the retail space," blogger Robert Pogson offered. "In the USA probably as few as 2 to 3 percent of users use GNU/Linux, so a recommendation is almost useless."

Those who are serious about security "are already aware of SELinux, a product of the NSA," Pogson added. "The NSA is merely recommending that folks move on from XP, a poor OS poorly supported by M$. Folks who would heed that advice probably do not even know GNU/Linux exists."

It is "possible that some of M$'s donations may also have suppressed mention of GNU/Linux," Pogson concluded. "But who knows?"
'The Security Swiss Cheese of XP'

Consultant and Slashdot blogger Gerhard Mack took a similar view.

"You can't knock them too badly," Mack agreed. "The best numbers I have seen show Linux at half the numbers of Apple (Nasdaq: AAPL) -- a small number to begin with."

The NSA "has sponsored Linux security projects in the past, so they are definitely not anti-Linux," he pointed out.

Vista, meanwhile, "brought along some features to allow more apps to run as non-administrator and some features (UAC) to annoy people who buy products from people who can't be bothered with good security patches," Mack added. "Win 7 is just a more stable/less annoying Vista, and I'll take either of them over the security swiss cheese of XP."

So, "I'm with the NSA on this one because the sooner XP is just a memory, the better off we all are," Mack concluded.
'You Need to Know What You're Doing'

"The problem with Linux is you really need to know what you're doing for it to be secure," asserted Slashdot blogger hairyfeet.

The NSA's recommendations, then, are "no surprise, as they know that 99.995 percent of the population is not CS grads or kernel hackers or programmers," hairyfeet opined. "These people will NEVER use CLI -- hell, Windows' control panel scares them. You honestly think they are gonna learn Bash?"

Hyperlogos blogger Martin Espinoza wasn't so sure.
'Irresponsible at Best'

"When I see the federal government recommend the products of one of its actual constituents, I am annoyed but not surprised," Espinoza told Linux Girl in a link-filled email. "Remember when Bush's boy Ashcroft gave Microsoft (Nasdaq: MSFT) a free pass after the DOJ found that they had illegally abused their monopoly position? (And have you noticed where Ashcroft is now?)

"It comes as no shock to see the NSA failing to promote Linux when the federal government is clearly a friend to Microsoft, and vice versa," he said.

"And let us not forget the well-foreshadowed speculation that Vista may contain an NSA back door," Espinoza pointed out. "Since there is no way for an independent reviewer to know that the code they are reviewing is what is actually being distributed with Windows or via Windows (or Microsoft) Update, clearly it is irresponsible at best to utilize Windows in any case where security is important."
'NSA - New Spending Authority'

Barbara Hudson, a blogger on Slashdot who goes by "Tom" on the site, wondered about the target audience for the NSA's report.

"Home users will never even see this, never mind read it," Hudson explained. "Business users? If they haven't switched by now, a pdf bearing the NSA's imprimatur isn't going to count for a hill of beans next to the considerations of software that can't be migrated from XP, or the costs and time of migrating desktop users to a new version.

"Besides, most of those installations will be taken care of over the next few years by simple attrition or migrating the users to tablets," she added.

"So who *was* the real target audience? I would have to say it's the boss of whoever at the NSA ordered this written, to 'show they're doing something' so they can justify their paycheck," Hudson suggested. "After all, haven't your tax dollars always been used for NSA -- New Spending Authority?

"Now please excuse me," she concluded, "while I go tell the neighbors that those black helicopters are just a coincidence."

A Fine Financial App Once You Clear the Setup Hurdle

HomeBank is a personal financial management application that's a lot like keeping a ledger. This banking tool does not dwell in the realm of accounting techie talk. Instead, it is easy to enter money you spend and track money you deposit. Installing is easy, but the setup process can get quite tedious. However, once you're finished, it's benefits become clear.

Keeping track of personal and business finances is one of the most essential tasks I do daily on my computer besides researching and writing about the Linux platform. Lately I am assigning much more of that task to HomeBank to keep my banking transactions in order.

Do not confuse this personal accounting system with a banking institution of the same name, based in Martinsville, Ind. HomeBank, the Linux app, dates back to the 1995 Amiga computers. HomeBank, the banking community, has evolved since 1885 and has no connection beyond its name to the open source personal accounts manager, which is available in 50 languages on the GNU/Linux, FreeBSD, Microsoft (Nasdaq: MSFT) Windows, MacOSX platforms. It is based on GTK2.

I mentioned the HomeBank app last year in a quick comparison of personal finance tools for Linux. Since then, I have expanded my familiarity with the HomeBank package. It is a much better solution for personal finance management than the Linux leading GNUCash and Skrooge. It also competes with KMyMoney and Grisbi.

What makes HomeBank a more-preferred app for me? It is not bogged down in the double-entry accounting procedures that GNUCash uses. Thus, HomeBank's learning curve is much less steep. It also offers a bevy of transaction filters, graphs and reporting tools to help me more easily analyze my finances in detail. Skrooge is a prettier app to use. But it lacks a lot of the reporting finesse available in Homebank's Feb. 24 release of version 4.4.
Not Perfect

I would rave more loudly about HomeBank if it had an easier setup routine. The process takes time to configure the accounts -- double the time involved if you use it to manage multiple accounts involving both income and expenses.

The setup issue is much like the proverbial glass being half empty or half full. HomeBank is very adaptable to individual needs. But it takes time to tweak it your way. The program lacks the ability to completely import banking records from other program exports. It also is devoid of pick-and-choose menuing options to populate account with transaction categories. You have to do these tasks manually.

HomeBank also cannot connect update banking records in real time. I can live without the ability to access my banking transactions from within the program. That weakness, though, could be a deal-killer for you.

This also means that you cannot use HomeBank to directly schedule monthly bill payments. But online banking via a bank's website is an acceptable alternative that I prefer.
Good Stuff

Despite its awkward setup routine, HomeBank has numerous benefits. For example, it is easy to get and install without the hassles of manual installation. You can find packages in the leading distro repositories. These include Fedora, Mandriva, openSUSE and Ubuntu.

Its small footprint makes its the default choice in memory-resident distros such as Puppy Linux. This is a big deal for me. I dual boot into both Ubuntu and Puppy Linux on my full range of desktop, laptop and netbook computers. But so far, I haven't found a HomeBank version for my Android-based tablet.

Unlike other accountant-strength banking apps, using HomeBank is a lot like keeping a ledger. This banking tool does not dwell in the realm of accounting techie talk. Instead, it is easy to enter money you spend and track money you deposit.

The numerous features in HomeBank let me stop tracking in a spreadsheet my business income sources. The flexibility in creating categories and reports lets me do that money managing in HomeBank.
Using It

HomeBank is based on two key bookkeeping concepts. Under the Accounts portion of HomeBank, you enter transactions resulting from savings and checking activities. The second concept is transaction tracking. Each withdrawal and deposit event creates a tracking ledger record of sorts.

This is where the laborious setup process pays off. You have to create a list of people and companies that send you money and that get your payments. You can skip some of the specific payee details. But then you get less of an overview of your financial picture.

Details you will not want to ignore include categories that describe each transaction you enter. For example, you can manage recurring transactions, like those dreaded monthly bills, by listing them as an archived item for payment at a specified time. Do this through the Edit / Archives menu. This archive feature also doubles as transaction templates. For instance, create a new transaction and automatically fill out the necessary fields by selecting an appropriate archive.
Data Done

HomeBank saves your data in a wallet file. This is a two-step process. In step one you create a new wallet with File/New and then fill it with accounts, payees and categories.

You can also add some optional details, much like a properties panel for a file. But doing so just adds to the setup overhead.

In step two you add accounts with Edit / Accounts and press the Add button. Then enter a descriptive name and the account number and the bank's name.

You can make this portion part of the program's budget analysis function by clicking the check box. Do not forget to enter the account's balance. A neat feature lets you add an authorized overdraft amount the program can monitor. Do this for each bank account you want to manager.

Follow a similar process to add payees with Edit / Payees and the Add button. Choose the categories and create subcategories that fit your spending patterns. You can make categories for various income sources. Just check the Income box.
Budget Watchdog

I especially like HomeBank's budget-watching capability. Using the Edit / Budget menu option, I can list my budget for various categories. I can set spending limits for a full year or monitor my spending monthly.

Another nifty feature in HomeBank is its ability to handle reporting and charting capabilities. For instance, I can easily take reports about my financial statistics, budget and overdrawn status. This is quick and simple. Select the Reports menu or press the appropriate button in the main toolbar.

The Statistics Report breaks down my transactions by category and type. It also filters my transactions by specific criteria as well as shows them as a bar or pie chart.

The Budget report shows me a bar chart overview of my budget. I can also narrow the results to a specific period of time. The Overdrawn Report analyzes my balance during a set time span as a line chart.

A special Car Costs feature is available. But it takes more manual set up to use. The advantage is an added tool to analyze car-specific costs and fuel consumption.
Bottom Line

HomeBank is well worth the time you spend configuring the account details. Its interface is starkly simple. Yet it provides a powerhouse of reporting and monitoring options.

The main drawback is its limited import and export capability. For instance, it can import data only in OFX/QFX/CSV formats. Exports are limited to the QIF format. Another limitation is only being able to export payees and categories but not full accounts. This makes switching from one financial app to another a bit cumbersome.

Has Ubuntu Linux Lost Its Luster?

Linux on the desktop "still has lower numbers than the margin for error, yet does the community ever ask itself, 'What are we doing wrong, and what is the other guy doing right?'" asked Slashdot blogger hairyfeet. "NO! Instead it must all be an 'M$ conspiracy,' and if people would just 'embrace the power of CLI' -- which I swear I had a Linux guy actually say to me like it is the force or something -- why then things would be all hearts and roses."With its focus on usability, Canonical's Ubuntu is held up by many as the best Linux distribution of all time, and its Distrowatch rankings tend to reinforce that belief. Not only is the distro currently the most frequently downloaded from that site, but all the many ground-shaking changes it has announced promise to keep it exciting well into the future.

For those of us who love Ubuntu, then, it was both distressing and perplexing to read Bruce Byfield's recent blog post entitled, "Ubuntu: Where Did the Love Go?"

Growing concerns and criticisms about Ubuntu's relationship with the open source community at large are Byfield's focus, and he comes up with a variety of possible reasons. Chief among them, however, is "the gap between the expectations created by Ubuntu and Canonical in their early days and their increasing tendency to focus on commercial concerns," he writes.

"Instead of being the model corporate member of the community that it first appeared, today Ubuntu/Canonical increasingly seems concerned with its own interests rather than those of FOSS as a whole," Byfield explains. "No doubt there are sound business reasons for the change, but many interpret it as proof of hypocrisy."
'Ubuntu's Made Some Dumb Choices'

More than 50 comments quickly appeared on Datamation, where Byfield's column was first published, and it wasn't long before the Slashdot crowds got wind of the topic as well -- to the tune of some 760 or so comments more.

"Ubuntu's made some dumb choices recently in GUI layout and package selection," wrote GameboyRMH on Slashdot, for example. "Not huge issues, but they are PITA issues and that's what's caused a lot of Ubuntu hate.

"Also over the years people have been getting increasingly pissed off at the fact that Ubuntu is a bleeding-edge distro and updates tend to break stuff," GameboyRMH added. "Because of these issues a lot of people have been switching to Debian."

On the other hand: "If people don't like Ubuntu they don't have to use it," noted shellbeach. "There's a billion and one distros out there, catering for any whim or fancy in the world ... and if not, you can always roll your own. If Ubuntu changes enough to be unpopular with end users, then some other distro will catch on and we'll all be praising that one."
'There Was Never Any Love'

While geeks were busy offering more such thoughts on the matter across the Linux blogs, iTWire's Sam Varghese was moved to publish a post with his own take. Its title? None other than the provocative "Ubuntu: There Was Never Any Love to Start with."

"People who write about FOSS are often prone to see the whole phenomenon through misty eyes, and portray the people involved as do-gooders first and foremost," Varghese opined. "This is patently untrue -- every open source project has been begun by someone who wanted to scratch his or her own itch; that it helps others is just collateral."

More comments ensued from there until it became difficult to find discussions of any other topics going on in the Linux blogosphere. Linux Girl donned her best fire-retardant cape and set out to learn more.
'The Real Face of Ubuntu'

"Ubuntu has only itself to blame," asserted Barbara Hudson, a blogger on Slashdot who goes by "Tom" on the site.

"Look at the heavy-handed attempt to get developers to sync their release cycles with Ubuntu's -- this goes against the 'it will be released when it's ready' philosophy of most open-source projects, including the linux kernel," Hudson pointed out. "This was a marketing-driven demand that got what it deserved: a total rebuff."

Despite the fact that it's been around for more than six years, "Ubuntu simply doesn't look like it has a clear vision of what it wants to be when it grows up, or a path to profitability," she added.

Regarding the Unity netbook interface, for example, "jumping into the shrinking netbook market with both feet is one way to be a tiny fish in a small pond," Hudson asserted.

Bad decisions "driven by short-sighted marketing," in other words, are "the real face of Ubuntu," Hudson concluded.
'Canonical Has Done More'

Slashdot blogger hairyfeet saw it differently.

"This shows just another reason why the best thing Canonical could do is to just fork the whole thing away from the 'community' and go off on their own," hairyfeet told Linux Girl. "I mean, here you have the community having a fit about Canonical and them not sharing upstream, yet this simple fact is upstream doesn't want to go where Canonical is leading!"

Linux on the desktop "still has lower numbers than the margin for error, yet does the community ever ask itself, 'What are we doing wrong, and what is the other guy doing right?'" hairyfeet asked. "NO! Instead it must all be an 'M$ conspiracy,' and if people would just 'embrace the power of CLI' -- which I swear I had a Linux guy actually say to me like it is the force or something -- why then things would be all hearts and roses."

That, however, "is a lie, and Canonical and Shuttleworth KNOW this, which is why they are trying to create the first 'Linux for humans' instead of Linux for CS nerds," hairyfeet added. "Canonical has done more to make Linux accessible to the masses than has EVER happened before."
'It Just Doesn't Matter'

Perhaps the most philosophical musings, however, came from consultant and Slashdot blogger Gerhard Mack.

"In the end it just doesn't matter," Mack told Linux Girl.

"Ubuntu has had a large effect on the FOSS ecosystem and many usability changes have moved upstream, where all of the other Linux distros now have access to them," Mack explained. "If Ubuntu pushes things too far in ways that their customers don't want, there will be another distro to take their place."