Slashdot Log In
MS Security Chief Says Windows is Safer Than Linux
Posted by
Zonk
on Fri Feb 11, 2005 10:53 AM
from the some-press-is-better-than-no-press dept.
from the some-press-is-better-than-no-press dept.
Kip Winger writes "Mike Nash, Microsoft's Chief Security Executive, has made claims that Windows is more secure than Linux. In a recent online chat, he staunchly defended Microsoft's record on security, basing part of his argument on how Windows Server 2003's 15 patches in the past year are far less than what RedHat or SuSE have had to endure." He also mentioned the recent purchase of Sybari and their Antivirus product.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
What about (Score:5, Insightful)
Re:What about (Score:5, Insightful)
And yes, this is flamebait. M$ can't (or won't) secure a paper sack, much less an operating system. More patches from Linux vendors means they're actually working on the freaking problem.
Parent
Re:What about (Score:5, Funny)
Parent
I think that I can say for most people here... (Score:5, Insightful)
Microsoft is basing that claim by number of patch distributions, not by size for severity, cute. So, just because they (usually) wait up to a month to release a patch, somehow they are better FUD never had so much meaning. I'd be outraged, but words like this are so expected.
Re:I think that I can say for most people here... (Score:5, Insightful)
So, you state the words spoken between the lines, M$ is saying "forget our track record, forget what we said before, and ignore everything happening on our desktop systems; our server r0x0rs!", or something to that effect.
It's easy to say that one version of a server OS, that is becoming less and less like its' notoriously hole-ridden desktop bretheren, is so much better than *anything* the competition can offer. It's much harder to actually do something about it; considering they've been saying essentially the same thing for several years now, they're not much closer to achieving the goal of a "trusted, secure" OS.
Parent
Re:Apples/Oranges (Score:5, Insightful)
not to mention microsofts tendency to roll up multiple patches into one, something redhat/suse can't do because they don't know which packages you have installed, so bugs that affect different packages can't be compbined.
Parent
Re:Apples/Oranges (Score:5, Informative)
Parent
Saying things makes them true. (Score:5, Interesting)
Or at the very least, you might at least fool some people enough to continue to give you money.
All true (Score:5, Funny)
I connect my fresh installed XP system directly to the internet and I can go months before I get any malicous programs on my computer.
hmm, or do I have that backwards?
Credibility and Redmond? (Score:5, Insightful)
Re:Credibility and Redmond? (Score:5, Insightful)
Worst of all, though, is that if Information Week or any other "I'm an important IT person and I read industry publications" magazine carries a story on the front page that says "Microsoft Security Chief: Windows More Secure Than Windows," than 3-4 days after they saw the story (and maybe not even read it), your average PHB will just remember the "You know, I seem to remember recently that someone came out and said Windows was more secure than Linux. I don't remember how they proved it or where I saw it, but I distinctly remember it..."
Which is why I do think there's value in a vigorous response and a careful analysis of the claims in an effort to make sure we're ready to vehemently argue against this insanity.
Parent
Request new Slashdot Section (Score:5, Funny)
Not Surprised (Score:5, Insightful)
What does everyone think he's supposed to say? Windows security is inferior to linux? He'd lose his job.
From TFA... (Score:5, Insightful)
This actually brings up an interesting point. Does Windows have less bugs (I know, I know) than these Linux distros? Or are Red Hat and Novell more proactive to fix the bugs they do have? Unfortunately, my guess is most PHBs would think the former.
And later.. (Score:5, Funny)
Windows and Red Hat (Score:5, Informative)
no patches available? (Score:5, Insightful)
Notably, the RedHat and Suse links list a higher number of vulnerabilities, but also state that there are ZERO unpatched security holes.
Surprisingly, the Windows 2003 product still has unpatched holes.
User experience (Score:5, Interesting)
1. reboot computer - It'd hung running something the rhymes with Titborrent.
2. Login prompt -log in
3. Get a start button, click on it to start a browser
3a. lose focus as MS is saying AVG isn't turned on. (It's not?)
4. Hit start again to get a browser
4a. Lose focus again as AVG says it's not working.
5. Press start to start a browser.
5a. Lose focus as the UPS monitoring tool adversises that it's HERE! PRESENT! ACCOUNTED FOR!
6. Press Start to get a browser.
6a. Lose focus AGAIN as MS spyware gives me a status update.
7. go over to the iBook, it doesn't Constantly Interrupt Your Train of Thought At Every Opportunity!
If Internet Explorer is any indication ... (Score:5, Insightful)
Second, comparing Internet Explorer (IE) and Firefox indicates that Windows is likely more bug ridden than major open-source software like Linux. I have used both IE and Firefox. From my experience of visiting thousands of pornographic sites laden with naked women beckoning you to "enter" their site (and other things), I can definitely say that IE is chock full of security problems. After 1 week of pornographic surfing with IE, my entire system (browser and OS) becomes infected with malware -- to the point that I must reload Windows. I have yet to experience the same problem with Firefox.
The only thing that I hate about Firefox is that it is very slow, probably due to the fact that my computer system has limited DRAM and that Firefox must swap to disk more often than IE. Such is the price that I must pay to enjoy porn.
just think (Score:5, Insightful)
Mandatory Access Controls (Score:5, Informative)
Yes Fedora currently has SELinux in the default install. Unfortunately they have had to use a fairly permissive policy because too many applications and libraries don't properly respect the sort of security bounds that ought to be in place. Right now SELinux on Fedora is like user account permissions on Windows. While it is technically there, the majority of applications simply aren't written with it in mind (eg. all those Windows apps that need to run as Administrator), so in practice it doesn't do much.
SELinux is done though, and Fedora has integrated it in nicely (including into the rpm system). What is needed now is for all those open source developers out there to realise that there is a new level of security, other than just filem permissions, that they need to consider and respect. If they can just restrict where they write files to, and what files they want to access to the minimum required that would be great. If they can compartmentalize operations so that each can run as a seperate process with least privilege all the better. This is work that needs to be done though.
Once such things are seriously in place all this harping by Microsoft about "Windows being more secure" will be so obviously the hot air that it is that we won't even have to worry about it anymore.
Jedidiah.
Linux Vs Windows (Score:5, Insightful)
Just do a search for Sendmail Vulnerabilities on google.
Result =
Results 1 - 10 of about 143,000 for Sendmail Vulnerabilities. (0.39 seconds).
for Microsoft
Result =
Results 1 - 10 of about 364,000 for Microsoft Exchange Vulnerabilities. (0.18 seconds).
You can have this discussion for days on end, and really, what the *nix community has up on the M$ community is knowledge and ability. No, there arent any viruses that are successfully written for *nix. Spyware isnt even remotely a concept to a linux user. And most vulnerabilities get patched as quickly as they are given POC. Does this mean that linux users patch any more or less than Windows users, no. But we do it more effeciently and with greater success.
Stability wise , come on. Ive got a redhat 7.3 box that baring powerfailures hasnt been rebooted in over a year. Its a good box, it would probably take an Arkady Rossovich low yeild nuke on its head and still live, and I dont know of any windows box thats able to admit that.
Yet another example (Score:5, Informative)
Sure, WINDOWS only had 15 patches in the last year however. IE6 had how many (at least anotehr 18-24), Remote desktop connection on 2k3 Server had 2 security fixes, IIS had about 6 patches....
Need I continue?
Fact is, yes, Windows had 12 updates in a year, but it's components had many more.
And also looking at the time from exploit discovery to fix, not lookin good for them there either.
The numbers game: thanks Microsoft! (Score:5, Funny)
(1) Don't write a patch, since that admits failure or insecure products.
or
(2) Wait a long time before writing and committing a patch, so you can do it as "one big patch" (otherwise known as, haha, a Service Pack!).
Thanks Microsoft! Just your STATEMENTS make systems less secure (nevermind your engineering).
Re:Of course the don't include... (Score:5, Interesting)
Secunia totals are...
Server 2003; 5 unpatched of 44
Office; 2 unpatched of 7
Exchange 2003; 1 unpatched of 3
IIS 6; 1 unpatched of 3
SQL Server 2000; 1 unpatched of 10
Total; 10 unpatched of 67
Justin. /. should let me use tabs. So there.
Apologies for the crap formatting,
Parent