Slashdot Log In
Microsoft Says Vista Has the Fewest Flaws
Posted by
samzenpus
on Thu Jan 24, 2008 12:45 AM
from the eye-of-the-beholder dept.
from the eye-of-the-beholder dept.
ancientribe writes "Microsoft issued a year-one security report on its Windows Vista operating system today, and it turns out Vista logged less than half the vulnerabilities than Windows XP did in its first year. According to the new Microsoft report, Vista also had fewer vulnerabilities in its first year than other OSes — including Red Hat rhel4ws, Ubuntu 6.06 LTS, and Apple Mac OS X 10.4 — did in their first years."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
How are they logged? (Score:5, Insightful)
Methodology has issues (Score:4, Interesting)
Re:Methodology has issues (Score:5, Informative)
The report is available here [technet.com], and states that the comparison specifically excludes components from Red Hat such as server components, gimp, OpenOffice, etc:
It'd be nice if it listed the exact components installed on Red Hat, but at least it attempts to cull the component set to something more reasonable for comparison.
Parent
Re:Methodology has issues (Score:5, Insightful)
Most will issue a security advisory when there's a bug in apache, mysql, postgres, sqlite or all of these types of things. Microsoft doesn't issue an advisory about a bug in Oracle. On Linux, the distros take responsibility for a much much wider range of software than Microsoft does on their platforms.
Parent
You also forget something else DRIVERS! (Score:5, Insightful)
Where are you drivers in linux? Where do you download them? Why you don't, they are IN THE KERNEL!
So Linux "The kernel" does a lot more then MS does with its core OS because MS still asks you to download a ton of drivers. This is part of their strategy, it allows them to shift blame to the driver instead of their OS. If you really got a problem with MS software and actually have some support (check your MS license, you pay for the software, there is no support) then your first job will be to convince them the bug lies with them and not some combo of drivers that you had to install.
That is why these MS reports are so silly, you really can't compare the two "distro's". MS Vista does far less then a Linux based distro like Ubuntu BUT they don't have a bare kernel they distribute but even if it did it does far less then the linux kernel.
So what are you comparing?
Also not that security bugs in Vista affect EVERY vista user because all the installs are the same. A linux distro bug in PHP affects only those who use PHP on their linux distro. MS funded research has in the past made lists of security bugs in linux where they counted the same bug multiple times for each distro it was in. That is kinda like saying "Just look at our competitors cars, they made 1 million of them and 1000 of them had the same fault. Meanwhile our 1 model has just one fault, the brakes don't work. We are BEST!"
MS, FUD at its best.
Parent
Re:Methodology has issues (Score:4, Insightful)
Parent
Re:Methodology has issues (Score:4, Funny)
I'm sorry, but I'm quite certain that a full Debian install would include Emacs.
Parent
Number of vulnerabilities -- who cares? (Score:5, Insightful)
For the last time, you just can't add up the number of vulnerabilities in separate products from different authors and expect to glean any meaningful information from numerology thereon. This is especially true when contrasting one closed-source product from a vendor with questionable security reporting practices (say, Windows), and an open-source product where every single flaw of any level of significance is public knowledge (say, Ubuntu Linux).
I'm tired of seeing such claims about vulnerability tallies parroted in Slashdot summaries without the least bit of skepticism regarding their relevance. This sort of thing has already been debunked a million times over on this site. Come on, editors, a little quality control would be nice...
Re:Number of vulnerabilities -- who cares? (Score:5, Funny)
You must be new here.
Parent
Well, sure there're few flaws seen - (Score:5, Funny)
In related news, BeOS showed few vulnerabilities this year...
Re:Well, sure there're few flaws seen - (Score:5, Funny)
Parent
Exploiters focusing on Mature & Established OS (Score:5, Insightful)
Give it time...
Besides, now that Microsoft has set 2009 for the new "Windows 7" release target date, it seems that Vista may be the new short-lived 'Windows Me'.
Passed every test (Score:5, Funny)
"Denied'
Copy file
"Denied"
Launch Firefox
"Denied"
Verdict OS completely secure.
Sounds plausible... (Score:4, Funny)
Absolute flaws reported doesn't work (Score:5, Insightful)
Report says Ubuntu is better! (Score:5, Funny)
Page 12 - Windows Vista Fixed 36 vulnerabilities
Page 14 - Ubuntu fixed 406 vulnerabilities affecting Ubuntu 6.06 LTS.
Look how many vista have left to find!!
Re:Report says Ubuntu is better! (Score:4, Interesting)
Parent
Statistics (Score:5, Insightful)
Wow, Worse Than I Thought (Score:5, Funny)
Nobody uses Vista? (Score:4, Interesting)
I don't mind people being critical of anything, but please be honest in your critique. And whatever you do don't use Apple as an example of "the way things should be".
I'm sure this will be tagged flamebait or troll. That's kind of ironic when I'm replying to all these guy's tagged 'informative' who say "Nobody uses Vista" when they are obviously providing false information. If pointing out a blatant lie makes me a troll so be it.
Only 1 Flaw (Score:5, Funny)
Quick rebuttal to Appendix A (Score:5, Interesting)
Q: Linux distros contain many more optional applications than Windows - that is Apples and Oranges - how can any comparison be valid?
Actually, Windows Vista and Windows XP have different components too. Windows Vista Ultimate includes Media Center for example, which was not in Windows XP Professional. From a user perspective, I think it is Apples and Apples. Whichever OS is chosen, I believe most people will install the default set of components and use that. If vulnerabilities are in those components, they will be exposed and need to take mitigating action.
I did, however, try to even the playing field as much as possible by excluding optional Linux-distro components and excluding even some default components for which there is no obvious counterpart. In contrast, on the Windows analysis, I included any component that shipped with the product. I think the comparison is valid and useful.
From my basic CentOS 4 system:
$ rpm -q -a | wc -l
1104
Even on a (stupid) vulnerability count, even with a reduced package setup, the number of packages on a RHEL/CentOS system dwarfs the number of programs that come with Windows. You can't even compare against Jeff's Windows numbers because he looks into how critical each vulnerability is on Windows (good) but not on any Linux setup (bad). If the real concern is user exposure, then vulnerabilities in all packages makes sense, but only if you count vulnerabilities in common Windows packages to, like Acrobat Reader, Photoshop, Office, and even games like WoW.
My biggest beef is that Jeff fails to include his compiled vulnerability database. Even though he writes on his methodology and sources, there is no way to easily verify his claims. This is the 21st century and there's something called the Internet. There's no excuse to not provide the raw data, and I certainly don't have enough interest to make guesses and recreate the data for such a flawed analysis anyway.
Next time at least provide a list of analyzed RPMs and DEBs!
Ridiculous comparison... (Score:5, Insightful)
Microsoft are in the best position to find holes in vista, having the source code. They have no incentive to report them, and will just fix them silently. OSX is in the same boat but to a lesser degree, and with ubuntu/redhat all the issues will make it into the public domain. The only vista issues which make it public, are ones discovered by third parties, which are probably less than the number found internally because internal developers have access to the source, access to the original devs and a more intimate knowledge of the inner workings.
Then you have to consider functionality, vista comes with one web fairly old web browser, one mail client, a rudimentary text editor, a single-protocol im client, a trivial drawing program, a simple media player with a small number of codecs and a few very simple games... Ubuntu/RHEL come with multi protocol im clients, a full office suite, a larger number of slightly less simple games, a larger and more capable set of networking tools, scanner software, fully capable drawing software, a much larger set of hardware drivers bundled by default, and lots more besides...
It's like trying to compare the rudimentary "peoples cars" produced in the former USSR, with only rudimentary features and a largely hidden safety record, to the luxury cars being produced in the west around the same time... Try comparing a Zaporozhet to something like an E-type Jaguar.
Re:Fewest Admitters = Fewest Flaws (Score:4, Insightful)
Parent
Re:Fewest Admitters = Fewest Flaws (Score:5, Interesting)
But to paraphrase the Drake equation [wikipedia.org], of the total Vista installs, how many have been hit by crackers? How many of those were honeypots, caught by virus scanners, or otherwise detected? How many exploits found by crackers have been used in highly targeted attacks and kept secret?
All I can think of is the remote TCP/IP exploit [microsoft.com]. As some of you may recall, that exploit existed in all versions of Windows. And Vista supposedly has a "completely rewritten TCP/IP stack" (source [microsoft.com]).
"I have a bad feeling about this."
Parent
Re:Fewest Admitters = Fewest Flaws (Score:5, Insightful)
Parent
Re:Fewest Admitters = Fewest Flaws (Score:4, Insightful)
Parent
Microsoft Says Vista Has the Fewest Flaws (Score:5, Funny)
Parent
Re:Fewest Admitters = Fewest Flaws (Score:5, Insightful)
Parent
Re:Fewest Admitters = Fewest Flaws (Score:5, Interesting)
Go grep the executables. You'll find the standard BSD copyright notice inside.
Parent
Re:Fewest Admitters = Fewest Flaws (Score:4, Interesting)
If electricity comes from electrons, does morality come from morons?
Parent
Re:Fewest Admitters = Fewest Flaws (Score:5, Interesting)
Microsoft never had a proper overall design for windows, and it shows... Early versions were simply hacked together in completely haphazard ways, things were built quickly with no forethought. As a consequence, there is lots of kludgy legacy code kept around for backwards compatibility, including many duplications where an old method was considered fundamentally flawed and unfixable, and discouraged from being used by new apps, but is still kept round for backwards compatibility, one such example is the lanman password hashing.
If they completely ditch backwards compatibility, they could remove all this old cruft and start again with a proper clean design, but as usual they're taking a half-assed poorly thought out approach.
Parent
Re:Fewest Admitters = Fewest Flaws (Score:5, Insightful)
Power users will be annoyed with UAC right from the start. It's okay if it asked only for deep system changes, but printing to a network printer? I'd like to see a poll of how many people still have UAC enabled.
Vista needs some serious horsepower whether you have the eyecandy enabled or not. The eye candy causes a big increase, but I had to upgrade my machine's 1GB of RAM to reach a reasonable level of performance even with Aero turned off, in order to run any intensive apps like Eclipse or Photoshop.
Just you wait until you buy that fancy new Blu-ray drive only to discover that Windows refuses to output DRM'd HD video to your monitor because it has no HDCP support. Vista has DRM that reaches deep into the subsystem, and when companies begin to take advantage of those features (by flagging Windows Media files appropriately), I bet you'll be surprised at what Vista refuses to let you do.
I use Vista at work because my laptop came with it, and if I could start over again I'd wipe it and go with XP. The wireless behavior is terrible, NetBIOS-based file shares are still spotty, the file explorer refuses to remember my preferences, files sometimes end up mysteriously undeleteable, and the new Minesweeper sucks. Windows 2000 people were against XP when it came out, but most folks came around and XP is now one of Microsoft's most solid operating systems. Vista is receiving much more flak than XP ever did, and while it might end up improving in the end, the negative press has left a pretty big scar.
Parent
Re:Fewest Admitters = Fewest Flaws (Score:5, Insightful)
How many of those were kernel patches, and how many were related to other applications?
Parent
Re:Fewest Admitters = Fewest Flaws (Score:5, Insightful)
And how many of these patched flaws were discovered by the developers of those applications? Which in RH's case means the issue is published, but in MS's case would not be published.
Parent
Re:Fewest Admitters = Fewest Flaws (Score:5, Insightful)
That's what I think this is all about. Microsoft can publish whatever number they want as the number of "vulnerabilities" to make itself out as the "good guy" while distributions of Linux put it all on the pavement so everyone can see what has been fixed or will be soon.
Parent
mod parent up (Score:5, Insightful)
Parent
Re:Fewest Users = Fewest Flaws (Score:5, Interesting)
I've been using Vista x64 for about two months now on a Dell m1330 with 4GB of RAM. There's more NON-security bugs than I could shake a stick at. Bluetooth has multiple "Hi, I've stopped working and you're screwed till a reboot" bugs, and they seem largely related to a bigger bug Vista has in failing to handle shutting drivers down when suspending in such a way that they wake up when you wake up the laptop. So it occasionally affects LAN, Wifi, etc...
The interface has more glitches than I can count, Aero is TREMENDOUSLY slow compared to the usual 2D accelerated display (a disappointment since compiz is FASTER than 2D acceleration), and these are just the issues I can remember. I know I've hit more, but I can't recall them right now. I've not gone looking for security bugs, but I'd bed the only "security" part that's near bug free is the one that handles the DRM and anti-piracy functions. I've no doubt from the rest of the experience that the part that secures me and my data is full of holes.
I'm actually kinda worried what will pop up once they start getting more users on it after SP1 comes out. Good thing I never use IE, refuse to use Outlook, and never directly connect to the internet with Windows.
Parent
Re:Fewest Users = Fewest Flaws (Score:5, Interesting)
Parent
Re:Fewest Users = Fewest Flaws (Score:5, Insightful)
Parent
Re:Fewest Users = Fewest Flaws (Score:4, Informative)
1. Slashdotters have maintained for years that userbase size has(almost) no relation to the number of exploits an OS gets. MS fanboys would claim that OSX and Linux had fewer exploits because they had a much smaller userbase, and they'd be ripped to shreds by slashdotters that would accuse them of engaging in logical fallacy. Your statement that Vista has fewer flaws because it has fewer users goes directly against long held slashdot doctrine. And yet other slashdotters appear to be agreeing with you, which raises the question of just how closely slashdotters held that doctrine. Seems it was only a closely held belief when needed to defend OSX and Linux from MS fanboys.
2. Your premise is wrong anyway. The report says that Vista has fewer flaws in its first year than did XP, some version of Red Hat, and OSX 10.4 did in their first years (and it's not even close). But Vista actually has MORE users in its first year than all of those OSes did in their first years (and has more users than OSX and Red Hat, period). XP had a greater userbase percentage in its first year, but fewer actual users because the number of computers was 5 times smaller back when XP was released.
Incidentally, Here are some Dec 2007 OS userbase share stats according to web hits [hitslink.com]:
XP: 76.9%
Vista: 10.5%
OSX: 7.3%
Linux: 0.6%
Parent
Re:Fewest Users = Fewest Flaws (Score:5, Insightful)
Some people have posted this on Slashdot. To maintain that there is a single "Slashdotter" point of view is just a straw man. For ANY point of view you can find hundreds of posts by "Slashdotters" supporting OR contradicting it.
MY PERSONAL point of view is that the statistics presented are suspicious. Previous MS press releases (aka "independent reports") have counted the same error multiple time, have counted bugs in applications bundled with Linux against OS bugs in Windows, etc.
Parent
Re:Fewest Users = Fewest Flaws (Score:5, Funny)
Parent
Re:Fewest Users = Fewest Flaws (Score:5, Insightful)
It's a shame that I haven't bothered to find out how the moderation system works yet, otherwise my praise to you, Sir, would be in hard karma currency.
Parent
Re:Fewest Users = Fewest Flaws (Score:5, Insightful)
This contrasts significantly with the majority Windows user base, most people are first greeted by Windows because their computer came with it pre-installed.. They generally don't know much about programming and certainly aren't responsible for programming the operating system they're using. They buy software which they learn just well enough to get by; But there are also many Windows users who are quite savvy.. and many of those have downgraded to the arguably more suitable Windows XP OS.
So even though Microsoft can easily cook the numbers. Let's look at a few more realities. In the world of open source, there is no hiding your vulnerability tally - because everyone sees the code and can check it. There is no such thing as the creative multiple patching of entire subsystems which are counted as a sole vulnerability. Which is very easy to do when you hide your source code from the public.
Microsoft is a company who has a real marketing benefit for showing (read: or pretending) that the overall number of vulnerabilities is lower over the first year. When this creative-counting is already under scrutiny, as there is no held standard for counting vulnerabilities and there is especially no transparency in how Microsoft validate what is a serious vulnerability and what is not.
Now since Windows recycles so much code, you can also argue that of course Vista would have less vulnerabilities than XP, after all the entry-level security bugs should all be caught by now, with only newer features having the baptism of fire. This is why userbase makes a difference.
Also webhit tallies from a particular research service provider are useless, as linux machines tend to power the web - and not surf it. (When you're powering a website, e.g. banking, you are more concerned about vulnerabilities than say a mother who just bought her family a computer. So in this example - coders are actively looking for bugs, go figure they find more - that's what happens when you look for something.)
Finally slashdotters do argue that exploits are targetted at larger OS market shares (naturally they want the largest possible penetration.) They don't however say that the bug count is similarly controlled: Bugs found = number of unfound bugs * proficiency of the people looking for them.
Also your figures for computer adoption are incorrectly used. (as was most of your data - you tend to convey more from the data than what it factually states.)
Parent
Re:bullshit (Score:4, Interesting)
My recommended method is no method at all: there is no simple, reliable way of determining user base for operating systems. Even the concept is meaningless.
For example, there probably have been more Linux-based routers (like the WRT54G) sold than Mac desktops and laptops; does that mean Linux has a bigger user base?
Parent
Re:Bad metric (Score:4, Insightful)
Parent
Re:Bad metric (Score:5, Interesting)
That sounds great until you realize that even by the most conservative estimates, more people are ALREADY using Vista than are using all versions of OS X and System 9 combined. Even if you throw in all the *nixes combined, there are still more Vista users.
Vista also automatically drops reports of problems directly to Microsoft, and isn't dependant on users to supply bug reports or problems like OS X, so when problems occur, MS usually knows before the users or the makers of the software that is causing problmes.
So ya, nobody is using Vista, in comparison to XP that is. However compared to the SlashDot and Mac industry, Vista is a massive OS deployment, lets hope OS X can catch up to Vista someday... (Geesh)
Oh, and I love the argument, that Vista was preinstalled and 'forced' on users. Strangly, the people that purchased these systems and rolled back to XP are 90% documented, and aren't counted as Vista installs.
And this is not any different than the people that purchased new Macs and had to have 10.4 installed because of the application compatibility problems with Leopard. (Which ironically has more compatibilty and application problems than Vista, and yet only supports 1/1000th the software or hardware.) (Geesh Again)
Parent
Re:Bad metric (Score:5, Informative)
Security problems are not bugs that an automatic bug reporter reports. Neither, for that matter, can automatic bug reporters report usability problems. You're also making the false assumption that Microsoft honestly reports all the bugs they discover. For most of the reports, they probably don't even bother tracking it down. For the ones that they do track down, we already know that if they can fix it quietly and lie about it, they do.
For me, Vista is about as good as XP in terms of applications crashing and BSOD. But Vista usability and security are a nightmare, and no bug statistics are going to tell you that. Vista is a software disaster.
Parent
Kudos to Microsoft (Score:5, Interesting)
I wasn't exactly expecting a flood of praise for Microsoft on slashdot, but you're completely spot on. Not one of the posts seems to be non-critical. We (as in, "people who know anything about computers") have been begging Microsoft to design their products with security in mind for a long long time now - rather than their usual practice of making grandiose statements about how security is job #1 and turning out the same old schlock as always.
With Vista, they actually seem to have done this. Even though they've added a lot of crap nobody wanted along with the crap that some people wanted, they've managed to do it without introducing loads of security problems. Remember, this is a mainstream product from a commercial software company where everything is subject to a cost/benefit analysis.
So it seems that the cost/benefit analysis has actually come down in favour of writing safer code even though it probably takes longer. This is great news for everybody who has to, in one way or another, deal with the problems caused by exploited PCs.
Parent