Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Businesses Google Microsoft Software The Internet Apache

Microsoft's IIS is Twice as Likely to Host Malware? 163

Posted by Zonk from the consider-the-source dept.
eldavojohn writes "According to Google, Microsoft's server software is at least twice as likely to host viruses or malware. The reason why? 'Google reports that IIS is likely used to distribute malware more often than Apache because many IIS installs are on pirated Windows versions which aren't configured to automatically download patches. (Even pirated Windows versions can automatically receive security fixes, however.) Our analysis demonstrates how important it is to keep web servers patched to the latest patch level,' Google notes."
This discussion has been archived. No new comments can be posted.

Microsoft's IIS is Twice as Likely to Host Malware? More

Microsoft's IIS is Twice as Likely to Host Malware?

Comments Filter:

  • Help me out (Score:5, Insightful)

    by mingot ( 665080 ) on Friday June 08, 2007 @01:25PM (#19441453)
    Patches? Patches for what? Has IIS had any remotely exploitable holes since version 5? Or are these machines that get owned via some other method and then just happen to have IIS so it is used to serve the malware? So really, this has more to do with unpatched windows than IIS? Or am I missing something?

    • Re: (Score:1, Redundant)

      by Ngarrang ( 1023425 )
      It is a combination of both Windows and IIS for being at fault. Microsoft releases patches for both, and neither are apparently being applied by the servers in question.

      • Re: (Score:2, Insightful)

        by goldspider ( 445116 )
        "Microsoft releases patches for both, and neither are apparently being applied by the servers in question."

        So in other words, it's the inattentive sysadmins that are at fault. Why do you blame Windows and IIS then?

        • Re: (Score:2)

          by gmuslera ( 3436 )
          Yes and no. A lot are pirated windows, and some patches are not available for them. Is not in the linked article, but in i.e. http://blogs.zdnet.com/security/?p=266 [zdnet.com] you can see a bit more of info.
        • 'Why do you blame Windows and IIS then?'

          Because inattentive sysadmins is not the common factor, windows isn't even the common factor; IIS is. There are plenty of apache installs on windows but those servers aren't being exploited. There are inattentive sysadmins using every system, if there are more in the windows webserver market (despite the fact that windows and IIS aren't dominant players in that market) then there is a flaw in these systems that attracts them. That flaw might be a design methodology th

        • Re: (Score:2)

          by hdparm ( 575302 )
          MS should be blamed for Windows design which is the reason for enormous number of various ways to fuck the computer up. They should also be held responsible for mass-production of MCSE-type engineers, who don't know much about what they do. You're right - it's not Windows that should be blamed.

          • Re: (Score:2, Funny)

            by mrsteveman1 ( 1010381 )
            I agree, I'm currently on my way to getting a CCSP at the moment, and there are people in the college classes i take who barely understand how a windows domain works, let alone network systems and authentication.

            Recently one of them was trying to connect to the VPN at his job, which is part of a windows domain, and it wouldn't work because he hadn't authenticated against the schools wireless login yet and obviously wouldn't be able to connect to anything. The wireless auth system basically just grabs users

        • Re: (Score:2)

          by rbanffy ( 584143 )
          It points out IIS admins are twice as lazy or half as clever as other sysadmins.

          Since they go for less money, that's hardly surprising ;-)
      • Modded as a troll? Why? I was answering the posters question. Unless, of course, I was moderated down by a sysadmin of an IIS server. Geesh. Some people have no clue how to use mod points.

    • Re: (Score:3, Insightful)

      by spellraiser ( 764337 )

      Yes, it's probably due to unpatched Windows. They use the term web server, which is ambiguous in that it can mean both the server software and the machine it runs on. In this case they most likely mean the machine. After all, isn't it common knowledge that it's important to keep all your software updated and patched, not least the OS?

      • Re: (Score:1, Troll)

        by mingot ( 665080 )
        Ah. So google's researchers came to an obvious conclusion: The most popular operating system being run by people who can't be bothered to patch it is prone to being used to distribute malware.

        Bravo.

        • Re: (Score:3, Informative)

          by mhall119 ( 1035984 )
          Actually the research shows that despite Apache being the more popular web server, IIS had more instances of hosting malware.

          • Re: (Score:2)

            by mingot ( 665080 )
            Right, and all that says is that a lot a windows boxes got owned and are using IIS to distribute malware. If IIS did not exist we'd STILL have more apache web servers than anything else and some OTHER webserver (probably the meanest and leanest that can easily be distributed inside of the malware itself) would still be responsible for distributing the bulk of the malware.

            My irritation with the article and how it is presented in the summary here is that it seems to show that apache is somehow more secure

      • Re: (Score:3, Funny)

        by AKAImBatman ( 238306 ) *
        See! The same thing is going to happen to Macs and Linux as soon as they become popular! Because popularity means that these OSes will get pirated more. Which will lead to more infections of unpatched systems. Even though Linux is "free" (as in beer) and Mac OS X only works on legitimate Mac Hardware. Because free... and official hardware...

        Wait...

        What was I saying again?
        • Why is Linux always referred to as free as in beer? It's GPL'd and there are distros (Debian anyone) that are free as in freedom to the core. Where does this come from?

          • Re: (Score:2, Informative)

            by Anonymous Coward
            Because many of us think BSD is truely free, while the GPL imposes restrictions on what you can do with it, so isn't 'free' in our book. Different folks have different definitions of freedom. I'm sure yours is different than mine.

            • Re: (Score:2, Insightful)

              by ericrost ( 1049312 )
              The GPL doesn't restrict what you can DO with any piece of GPL'd code, it restricts you from restricting others from using your work in the same way you used the work of the thousands of developers who made the GNU system and the Linux kernel.

              Share and share alike. Otherwise one bad apple spoils the freedom for everyone.
          • Because I was making a point? Specifically, that Linux is freely available to install, use, upgrade, and patch. Which would make the reason for the unpatched Windows machines (i.e. piracy) irrelevant. That's why the distinction was important in this case.

            Oh, sorry. I was supposed to give the standard Slashdot response, wasn't I? Ok...

            *WHOOOOSH!* :P

    • Re: (Score:1, Informative)

      by drinkypoo ( 153816 )

      Has IIS had any remotely exploitable holes since version 5?

      yes [eeye.com]

      • Re: (Score:3, Insightful)

        by Henry V .009 ( 518000 )
        That was a hole in version 5. Please try again. The question was: "Have there been any since version 5?"

        • Re: (Score:2, Informative)

          by drinkypoo ( 153816 )

          That was a hole in version 5. Please try again. The question was: "Have there been any since version 5?"

          Since, definition 1: "from then till now (often prec. by ever): He was elected in 1978 and has been president ever since." Dictionary.com FTW! [reference.com]

          Perhaps you should learn to speak English before you criticize mine. I answered the question asked.

          The word you people want is "after", not "since". As my friend Tom says, correct me if I'm wrong, but be damned sure I'm wrong.

          Thank you, please drive through.

        • Re: (Score:2, Informative)

          by kernelpanicked ( 882802 )
          No actually if you had read the link the other poster gave you, it affects 5 and 6. Now that I'm on Secunia I've got another link for ya. Total security advisories for IIS6 (3) http://secunia.com/product/1438 [secunia.com]. Impressive, but not nearly as perfect as you would like to think.
      • I'm the last one to defend Microsoft, but that is an exploit for version 5. The question was since version 5 (i.e. version 6).
      • That bug was from 6 years ago. If that is the best you can find MS must be doing a pretty good job.

    • Re: (Score:3, Informative)

      by eli pabst ( 948845 )
      Has IIS had any remotely exploitable holes since version 5?

      At least one in version 6:

      http://secunia.com/advisories/21006/ [secunia.com]

      Which is actually fairly impressive, but then again you'd really only need one remote vulnerability if you are trying to compromise completely unpatched systems.

      • Re: (Score:2)

        by mingot ( 665080 )
        This requires uploading a maliciously constructed asp file to a directory where there is script execute privilege. If I can upload script and have it run on a web server (any web server) doesn't that mean I've already pretty much got her pants down?
        • Nope. Apache, etc. run chrooted and with minimal external privileges. I don't believe that you can configure IIS6 the same way, and at very least, it's not configured as such out of the box like most Linux distributions have it. It's a much more dangerous bug than you'd assume.
    • Has IIS had any remotely exploitable holes since version 5?

      What about the WebDAV issue that was used to break into DoD systems just before the Iraq war?
      • I'll point to the *since version 5* part and also point out that they wouldn't have been likely to be using Windows 2003 before the Iraq war or using Windows XP for such a purpose... unless you have a link to clarify...
    • If the flesh eating virus attacks my hand and then has access to my arm as a result of the fact that my nervous system decided to give everything easy access to each other, then that arm desrves to get taken! CHOP THAT BABY OFF AND HEAD FOR THE NECK I SAY!!

      If they wanted the apps to remain separate and sandboxed, they should have done so to begin with. Slap on the hand and one in the face to Microsoft for not doing so.
    • 'Has IIS had any remotely exploitable holes since version 5?'

      Who knows? All I know is how many of the remotely exploitable holes Microsoft has managed to patch since version 5. As far as I can tell they haven't managed to patch any and based upon the real world results it looks like IIS is being remotely exploited left and right.

    • Actually, this statistic means more than might be obvious. According to netcraft [netcraft.com] there are around 65,588,298 servers running Apache on the Internet (53.76% of all web sites), and 38,836,030 servers running IIS on the Internet (31.83% of all web sites). Now, we can safely assume that all of those servers running IIS are running Windows since IIS only runs on Windows. Apache runs on many different operating systems, but it's logical to assume that most Apache server are not running Windows.

      This means that

      • Re: (Score:2)

        by figleaf ( 672550 )
        I don't think you understand any the links that you posted. None of them are remote exploits in IIS. Its just some exploits that can be hosted on IIS.
        This is like blaming Apache for problems in Java Server Pages.
    • So really, this has more to do with unpatched windows than IIS? Or am I missing something?

      Did you even read the summary?

      It says the malware is because of pirated versions of windows that don't get updated with security fixes.

      Without reading the article you can use logic to assume the following 2 reasons:

      1. You can't run IIS on anything but Windows OS
      2. Windows OS isn't free so the users resort to piracy

      Now in that respect, you could in theory have a pirated Windows Advanced Server 2003 running Apache if you
    • Bigger question, does this article mean the "security through obscurity" argument people throw at systems like OS X is bullshit? Apache servers outnumber IIS, yet IIS gets twice as owned.

      • Re: (Score:2)

        by mingot ( 665080 )
        Hate to reply so late, but you do understand that just because IIS is hosting malware does NOT mean that IIS got owned. It means that WINDOWS got owned. BIG difference. If the majority of windows machines that got owned were running apache then it would just be apache serving malware. This study speaks more to how well people keep their operating systems patched than it does to the quality/security of apache/iis. But that's not how it is presented.

  • No kidding /sarc (Score:4, Insightful)

    by N3WBI3 ( 595976 ) on Friday June 08, 2007 @01:27PM (#19441511) Homepage
    The problem is anyone out there who can install windows services considers themselves a knowledgeable sys-admin. Sure there are technical reasons why LAMP tends to be more secure than IIS but more often than not it comes down to poor configuration (running unneeded services, poor network security, poor hardening standards), lazy maintenance (not checking logs, updating software), and a lack of understanding threats (not keeping up with cert).

    Linus once said of Gnome that when you design assuming you're users are idiots in the end thats all the users your going to have. Find an experienced competent admin who has cut his teeth in the real world and not in a MCSE bootcamp and you should be ok.

    • Re:No kidding /sarc (Score:5, Interesting)

      by porkThreeWays ( 895269 ) on Friday June 08, 2007 @02:10PM (#19442263)
      I know everyone's going to start hating on you... but it's really true. The dirty little secret MS doesn't like to talk about in their TCO studies is that they usually rely on the fact Microsoft consultants make on average the least out of almost every consulting field. One study showed 30 dollars an hour! If you are paying your "experts" next to nothing how expert can they really be?

      Your quote at the end really rings true. I have yet to meet an IIS admin whom understands the HTTP standards at all, let alone something as complex as debugging chunked encoding issues. If you can't telnet to port 80 and get usable output, you have no business being a web server administrator. However, the windows culture encourages quite the opposite. If you can't solve a problem with a wizard, does the problem actually exist?

    • It's amazing how M$ security problems are always the user's fault when you ask a M$ person. Case in point, you blame the problem on ignorant, lazy and stupid users:

      ... it comes down to poor configuration (running unneeded services, poor network security, poor hardening standards), lazy maintenance (not checking logs, updating software), and a lack of understanding threats ... Find an experienced competent admin who has cut his teeth in the real world and not in a MCSE bootcamp and you should be ok.

      I'm

      • Re: (Score:2)

        by N3WBI3 ( 595976 )
        It's amazing how M$ security problems are always the user's fault when you ask a M$ person. Case in point, you blame the problem on ignorant, lazy and stupid users:

        Firstly I am not an MS person I am a Unix admin but in a previous job I did both (and hated every minute I had to support windows). Secondly I am not blaming users I am blaming *ADMINS* how need to be held to a much higher standard.

        I'm going to leave alone how you just called most M$ customers idiots. Why would consider someone lazy because t

      • Re: (Score:2)

        by dedazo ( 737510 )
        So let me see if I get this right. If I have a "Windoze" server I fail to patch and it gets p0wn'd then "M$" is to blame, correct? But if I'm running Linux and I have an OpenSSH exploit that I fail to patch, then... who is at fault? Me? Yours? The easter bunny?

        I'm going to leave alone how you just called most M$ customers idiots.

        Maybe that's because he didn't. Oh, wait. I see what you did there. That's very clever!!

        Why would consider someone lazy because they are forced to do all the work it takes to ke

        • So let me see if I get this right. If I have a "Windoze" server I fail to patch and it gets p0wn'd then "M$" is to blame, correct?

          Well, considering that Microsoft has been denying many users the right to patch, yes.

          But if I'm running Linux and I have an OpenSSH exploit that I fail to patch, then... who is at fault? Me? Yours? The easter bunny?

          Well, your distribution should make it easy to update, and most fasttrack security updates, so either you or your distributor.

          • Re: (Score:2)

            by dedazo ( 737510 )

            Well, considering that Microsoft has been denying many users the right to patch, yes.

            The "study" simply theorizes that pirated versions of Windows are to blame but offers no proof of that whatsoever. In any event, you can still patch pirated versions of Windows XP, AFAIK. Though I fail to see why Microsoft should be forced to provide updates to people who pirate their software.

            Well, your distribution should make it easy to update, and most fasttrack security updates, so either you or your distributor.

            A

            • The "study" simply theorizes that pirated versions of Windows are to blame but offers no proof of that whatsoever. In any event, you can still patch pirated versions of Windows XP, AFAIK. Though I fail to see why Microsoft should be forced to provide updates to people who pirate their software.

              Well, because spreading viruses is a security risk to nonpirated versions of Windows too? Also: Windows Genuine Advantage makes it much harder to get updates if you're pirated.

              As opposed to Windows Update, for example?

              It takes the average FOSS program less than a day--at the very longest, a week--to patch its critical programs, because of the many eyes thing. Microsoft takes up to a month, because of things like Patch Tuesday.

  • > (Even pirated Windows versions can automatically receive security fixes, however.)

    Well, the ones who either patched or didn't download the WGA fix, anyway.
  • Those of you in the front row would be advised to watch for falling chairs.
    • Actually I'd say this is great PR for Microsoft.

      Personally I thought it'd be much worse than just "twice" as bad. Maybe I've been buried under too much anti-MS FUD from reading Slashdot...

  • Big Surprise (Score:5, Interesting)

    by ThinkFr33ly ( 902481 ) on Friday June 08, 2007 @01:32PM (#19441591)
    First, there is not nearly enough information provided by Google to come to any real conclusions.

    It could be that IIS is more likely to become infected than Apache and then be used to distribute malware, or it could be that malware purveyors are more likely to host their malware on IIS. Or it could be a combination of both.

    They also fail to mention what versions of IIS we're talking about, as that makes a huge difference. IIS 5.x had more holes than a cubic mile of swiss cheese. IIS 6, on the other hand, appears to be rock solid [secunia.com] and actually has fewer vulnerabilities than Apache.

    Second, the fact that Google is a direct competitor to Microsoft is an obvious reason to find their conclusions dubious, at best. They have plenty of reasons to bash Microsoft at every possible opportunity.

    • Re: (Score:2)

      by mingot ( 665080 )
      Actually, 5 was pretty solid. I really think you need to get back to 4 for it to turn into shit.
      • 5 was okay, as long as you disabled all the older ISAPI extensions, which I tended to do, I usually only left asp.dll and later the .net support... all my current servers are win2003/iis6 now, so less of an issue.

    • Re: (Score:3, Insightful)

      by daeg ( 828071 )
      When you compare IIS 6 to the comparable Apache version (2.2), they both have the same number of advisories [secunia.com]. Note that Apache 2.2 has an unpatched very low risk vulnerability when run on Windows. Interestingly, Apache supports more platforms yet has less bugs considering one of the three bugs only targets one operating system.

      I don't question their results, although I'd suspect there are also a high number of Cpanel hosts slammed full of malware, too.
      • I'm not sure comparing IIS 6 to Apache 2.2 is particularly fair. Apache 2.2 was released in December of 2005. IIS 6 was released in March of 2003. It has had about 2 more years for people to attack it and find bugs.

        • Re: (Score:2)

          by daeg ( 828071 )
          Ah, good point, I was off on my release dates on both accounts.

          It'll be interesting to look at IIS vs. Apache vs. Other servers once they reach the same general level of maturity/usage.
          • Indeed.

            A more fair comparison would be to compare two versions that were released at around the same time and have about the same overall usage.

            I'm not sure there is quite a perfect match in this respect between IIS and Apache.

            That said, it's hard to deny that Microsoft has completely turned around on security, at least with respects to some of their newer products. IIS 6, ISA Server, and Vista have all (at least so far) shown to be far more resilient to attacks than anything Microsoft has done before.
  • Aahr. There be unpatched pirate servers here.

  • Genuine question (Score:3, Insightful)

    by feranick ( 858651 ) on Friday June 08, 2007 @01:36PM (#19441681)
    Please don't flame me for this, it's a genuine question: Does Apache download and apply patches itself automatically? Or are sys administrators more careful and quicker to apply patches as soon as they are released?

    • Re: (Score:3, Interesting)

      by Nibbler999 ( 1101055 )
      Apache won't auto-update but the distribution (assuming linux here) will provide automatic updates if configured for it.

    • Re: (Score:2)

      by jimicus ( 737525 )
      It's not as simple as that.

      Unlike much of Windows, Linux systems are extremely modular. Apache has literally dozens if not hundreds of modules which can be enabled or disabled more or less at the will of the sysadmin.

      A security hole in a specific module which is part of the core Apache distribution will be described as a hole in Apache - but that's a bit disengenous because it only affects systems which have that module loaded. If it's distributed in a separate package to the main program by the Linux di
  • It may be true, but it is in the name of FUD.

    What are the motivations behind Google even doing this survey/report? Some will say because Google does no wrong and that they are doing it for the betterment of the web, but I smell a few ulterior motives. Hell, even the author of the article smells that same stench when he says, and I quote:

    While I can't quibble with the data per se, I find it interesting that Google used this survey to promote Apache over an Internet product made by its chief competitor.
  • I use it on a honeypot server, leaving linux and apache as my real machine.

  • Comment removed (Score:5, Insightful)

    by account_deleted ( 4530225 ) on Friday June 08, 2007 @01:42PM (#19441799)
    Comment removed based on user account deletion

  • Slashdot sucks? (Score:2, Insightful)

    by dedazo ( 737510 )
    Are the people who run Slashdot really this dumb? Or are they simply FUDing for ad impressions? They don't really care what the submission says, who is sending it or who initiated it, as long as it's juicy? What time is it? It's 2:00 PM?

    Notice I placed a question mark after each one of my phrases so I cannot be held responsible for them. You know, just asking questions, like Fox News and their "Hillary Clinton turns tricks?" headlines.

    Speaking of that, there's a hilarious Jon Stewart skit on YouTube abo

    • Re: (Score:2)

      by suv4x4 ( 956391 )
      Notice I placed a question mark after each one of my phrases so I cannot be held responsible for them. You know, just asking questions, like Fox News and their "Hillary Clinton turns tricks?" headlines.

      I'm running a macro when I visit slashdot that replaces "?" with "(of course this is total bullshit and we know it)."

  • Original source link (Score:3, Informative)

    by Anonymous Coward on Friday June 08, 2007 @01:45PM (#19441833)
    Posted anonymously for your enjoyment:

    http://googleonlinesecurity.blogspot.com/2007/06/w eb-server-software-and-malware.html [blogspot.com]

  • So how much would operating system vendors have to pay the firewall/viris scanner people to add a feature to the firewalls that clearly identified the operating system and web server of the site that was attempting to download a viris/keylogger.

    Envision this pop up with appropriatly named guilty parties.
    ---
    Alert: WebServer: MosaicC64 running on AmigaOS_1.5.6 is attempting to infect your computer !!
    Anti-Viris-Firewall: Bad Application (XXPdeleteAllYourStuff) found in web stream from site
    all.bad.stuff.com: Bl

  • Probably XP Pro (Score:3, Insightful)

    by jafiwam ( 310805 ) on Friday June 08, 2007 @01:48PM (#19441891) Homepage Journal
    This is probably XP Pro machines that get infected by means other than the webserver.

    Once someone has control, they can pretty easily start the service and stick malicious files in the default root in IIS.

    You don't need a remote hole to get numbers like this.

  • 49/49 (Score:4, Informative)

    by jshriverWVU ( 810740 ) on Friday June 08, 2007 @01:51PM (#19441947)
    If you look at the actual article, it shows an even split. 49% IIS 49% Apache 2% other:

    Pie Graph [blogger.com]

    • Re:49/49 (Score:5, Insightful)

      by sqlrob ( 173498 ) on Friday June 08, 2007 @01:58PM (#19442057)
      The instances were evenly split, but since Apache is more common that IIS, you should see more Apache.
    • Yay, someone who actually read the article and noticed that yet another Slashdot story is deliberately misleading. No big surprise there. If anyone cares to look of the 70,000 domains distributing malware 49% were IIS and 49% were Apache. The "twice as likely" is pure spin based on overall market share and presumably designed to hide the fact that Apache is being used to push out just as much malware as IIS.

      • Yay, someone who actually read the article and noticed that yet another Slashdot story is deliberately misleading. No big surprise there. If anyone cares to look of the 70,000 domains distributing malware 49% were IIS and 49% were Apache. The "twice as likely" is pure spin based on overall market share and presumably designed to hide the fact that Apache is being used to push out just as much malware as IIS.

        It's not deliberately misleading unless you have a rather strange misunderstanding about statistics. Of course market share matters.

        Basic Conditional probability [wikipedia.org]:

        Probability of {Malware given that running IIS} = P{Malware and running IIS} / P{Running IIS}.

        So the Slashdot summary was correct: P{Malware given that you're running IIS} is twice as big as P{Malware given that you're running Apache}.

  • From what I've seen users who pirate software (like IIS) are not so interested in patching even if the option is available. It's usually not for running production-level hosting anyway. They're just happy the pirated software works and don't want to "rock the boat" so to speak in case a Microsoft patch would detect and deactivate that software.

    However when said user is frustrated because of inability to use a specific feature of the pirated IIS software then they go looking for patches, service packs and

  • I work for a company that identifies hacked sites that house phishing attacks. We have analyzed tens of thousands of sites. It was a surprise to me, but over 90% of hacked sites out there are running Linux/Apache -- not Windows/IIS as most people would suspect. The problem is that there are too many people out there install the free version of open source software, but don't have the ability to apply the patches. Since known vulnerabilities are well documented and kits exists to scan these weaknesses, Linu
    • Comment removed based on user account deletion

  • Version of IIS? (Score:2, Interesting)

    by leather_helmet ( 887398 )
    Agreed with the other posts that IIS 5.x was rather shitty and was a lot more vulnerable than Apache, etc.

    With the release of IIS 6, security was significantly improved & according to various stats out there, IIS 6 is actually stronger than Apache in a lot of areas. We are running IIS & have had several intrusion attempts but our systems have been pretty solid; Humble admission, we did get hacked once but it was our negligence more than anything else.

    Having admin'ed both Apache and IIS servers, I

  • I think the research really mean is the administrators behind those softwares are the weak links, not the software. Those bad administrators use pirated windows servers and refuse to update are the most dangerous and damaging guys around.
  • So a bunch of thugs pirate Windows and start serving malware via IIS? So how do we know the discs they installed with weren't pre-infected with malware or that they didn't INTENTIONALLY put up servers for the purpose of serving malware? This story is coming from a competitor of Microsoft who has every reason to bash their products. It is probably a total crock anyway.
  • What with the lack of MS hate? Is google on the shitlist now too or something? I haven't seen so many comments bashing an article that pokes at MS ever...
    • You're thinking about the old Slashdot. This is the new Slashdot. The New Slashdot loves Microsoft, loves Bush, loves everything bad in this world. It's like Ronald Reagan's election--it was at that point that the world had surely gone insane. And the worst part is: the new Slashdot can't be stopped.

  • Shouldn't be a surprise but for other reasons (Score:3, Interesting)

    by JohnnyComeLately ( 725958 ) on Friday June 08, 2007 @03:20PM (#19443543) Homepage Journal
    The fact they're IIS and pirated seems to be moot, the point is many people just don't feel like "proving" to M$ that their version isn't pirated and give up trying to do security updates. I have one computer, out of about 9 or 10 I own at home, that has XP loaded on it. When I put it online and try to patch it, it does it's "Authenticity Check" and fails saying it was not a valid install. I know I bought a copy of XP specifically for this computer since it was for a businesses' use (and hence, tax deductible as an expense). Since it's never going to be on-line I said, "Screw it" and didn't bother with trying to update it. I'm sure many home owners are in the same boat...except they keep it online.

    Maybe they'll come around like they did on Win2K. They said they stopped supporting updates and I noticed no nags on my laptop for a really long time...lately I've noticed M$ is pushing security updates to it again. This is a computer I almost pulled from the "on line" array when it got infected twice by MySpace and YouTube....but I got it cleaned up through a few programs and a couple hours...

    • The fact they're IIS and pirated seems to be moot, the point is many people just don't feel like "proving" to M$ that their version isn't pirated and give up trying to do security updates
      You don't need to prove anything. You can still get security updates if you fail a WGA check. The only thing failing a check stops you from getting are things like WMP.
  • I mean, windows users are 99% more likely to be hosting malware.
  • The real reason why is that Malware purveyors know good software when they see it and, thus, they prefer to use Microsoft software.

    That's my story, and I'm sticking to it!

Slashdot Top Deals

Decaffeinated coffee? Just Say No.

Close