The Hornet's Nest: Making A Recommendation
Alan: Does it make sense to store all of my personal data on a jump drive or SSD and plug-in/unplug the drive only when I need to access that data? Or is that just the action of paranoia with little benefit?
Charlie: Yea, you can do a lot of things like that if you’re really paranoid. I don’t think it’s worth the effort. If I exploit your browser and you don’t have your external drive plugged in, I can wait until you plug it in to steal your personal data.
Alan: You’ve won two Mac notebooks from Pwn2Own so far. Are you using either of those? What's the configuration of your primary system?
Charlie: I usually work on a pretty old MacBook that I've upgraded the hard drive on. Its been the computer that I had both times at Pwn2Own and its been in many countries with me like Korea, Japan, Australia, Malaysia, and of course, Canada. Hardware-wise, it’s pretty much stock--1.83 GHz Core Duo, 2 GB RAM. When I'm at home, I hook it up to a big 24" monitor. As for the winning notebooks, I only use my MacBook Air from last year when I’m doing a big fuzzing run or testing something. I don’t know what I’ll do with my new MacBook Pro, but I definitely won’t retire my trusty MacBook.
Alan: So, if you had to make a recommendation, Mac, PC, or Linux? Or do you find them to be equally (in)secure?
Charlie: I'll leave Linux out of the equation since I know my grandma couldn't run it. Between Mac and PC, I'd say that Macs are less secure for the reasons we've discussed here (lack of anti-exploitation technologies) but are more safe because there simply isn't much malware out there. For now, I'd still recommend Macs for typical users as the odds of something targeting them are so low that they might go years without seeing any malware, even though if an attacker cared to target them it would be easier for them.
Alan: Sure, the risk = threat x vulnerability x consequence concept. Macs have low threats but high vulnerability while Vista is the other way around. I recently switched to a Mac myself and wrote about it for Tom's Hardware (and had a lot of angry readers). Like you mentioned earlier, we want to support vendors with the most secure software, but it’s not easy to always figure out which software is the most secure and sometimes the real-world risk is lower with a vulnerable platform with fewer threats.
So for our readers, what are some tips for running a "secure" PC/Mac/Linux machine?
Charlie: For all OS's, make sure you keep your system up to date. That’s the best thing you can do. On a PC, I'd recommend running some AV software to help clean up when things go bad. Otherwise, just be smart, pay attention, and hope for the best. It is possible to really lock down your computer (running noscript for example) and make it safer, but in my opinion it’s not worth the trouble and the loss of functionality you experience.
Alan: Thank you for your time. One last question, who’s your pick for the NCAA tournament?
Charlie: I’m one of the few geeks who like sports. Even though it’ll never happen, I’ll go with my “local” team, Mizzou.
