Microsoft Windows: A Lower Total Cost of 0wnership 524
bahamutirc writes "Dave Aitel of Immunity, Inc. has written an excellent report detailing the lower Total Cost of 0wnership Microsoft Windows has over Linux. Dave takes a unique approach in comparing the two operating systems, and the results are not surprising. The paper was submitted to Bugtraq today and is available in PDF and Open Office."
A 189 KB PDF file... (Score:1, Informative)
Mirror (Score:3, Informative)
And no, this isn't a joke, although it is kind of entertaining!
MD5:
19bd158b9e471db49acd91f0493b81ec *tc0.pdf
5ca7eb699b94967ee2d255c021e1686f *tc0.sxw
Re:0wned? Please... (Score:5, Informative)
Looks like you didn't RTFA (Score:3, Informative)
Pretty interesting, though it could be argued that the article is biased/flaimbate.
Re:0wned? Please... (Score:3, Informative)
Not that it is proper terminology, but it is a lot more fun than being an anal, angry arse about every pleasant or immature phrase spoken in one's vacinity. Then again, I tend not to underestimate someone for the phrases they use. This can be a terrible mistake.
Re:A 189 KB PDF file... (Score:5, Informative)
Re:Astroturf? (Score:4, Informative)
Hidden costs (Score:2, Informative)
Re:TCO's can be written to defend either case (Score:5, Informative)
thanks for the laugh (Score:1, Informative)
Score - Dave: 1 Most slashdotters: 0 (Score:5, Informative)
If you think it means Total Cost of Ownership, as it relates to some BS middle-to-upper-management measurement, then you didn't RTFA.
That is all.
Explanation of the joke (Score:2, Informative)
By Lowest Total Cost of 0wnership (spelled with a zero), they mean that Windows is easier to "0wn" i.e. hack into.
0wning (with a zero instead of an O) a computer is high-falutin' jargon meaning that you have hacked into it and can do as you please.
So the point here (joke explained): that the cheapest, easiest system to hack is Windows. That's not exactly a joke (since it's true), but it's a joke since they're using the Total Cost of Ownership metric...just redefining Ownership to be 0wnership (with a zero).
Why is it spelled with a zero? That's because that's the way (cue menacing music) the hackers do it.
Clever paper, but too clever for people who don't use the terminology. Extra points for the in-jokes.
No astroturf here. Well done!
wow (Score:5, Informative)
Dumb Asses (Score:2, Informative)
0wned = hacked
Owned = purchased
High cost of 0wnership = good thing
High cost of Ownership = bad thing
Now RTFA again.
For Non-acrobat or OOo Readers (Article Text) (Score:5, Informative)
Microsoft Windows: A lower Total Cost of 0wnership
August 12, 2004
Introduction
Microsoft has long asked third party analysts for accurate assessments of the total cost of ownership of Microsoft Windows deployments, especially against the Linux deployments commonly going into all segments of the market. However, Immunity, Inc. as a third party assessment provider has, until now, not done a thorough analysis, using Immunity proprietary data to tell the true story about the costs of Open Source.
Other sources of 3rd party information can be found here: http://www.microsoft.com/mscorp/facts/default.asp [microsoft.com]
The point of contact for this paper is Dave Aitel, Vice President of Media Relations, Immunity, Inc. He can be reached at mailto:dave@immunitysec.com [mailto]. Further information on Immunity, Inc. is available at http://www.immunitysec.com/ [immunitysec.com] .
Executive Summary
Based on our analysis, Microsoft Windows has one half the Total Cost of 0wnership (TC0) of modern Fedora Core Linux based technologies.
Immunity's Methodology
Immunity has four major services: Training on exploit development and vulnerability analysis, Application Security Consulting, the CANVAS assessment product, and the Immunity Vulnerability Sharing Club. In each of these, the costs to penetrate (0wn) systems based on Microsoft Windows Technologies was compared to the costs against a modern Linux system. In general there are three aspects to 0wning a system. These three things, Vulnerability Detection, Exploit Development, and Attack Execution, were used by Immunity to determine the costs to 0wn the different operating systems in configurations encountered during Immunity engagements. As Immunity is not in the rootkit (http://www.rootkit.com/ [rootkit.com]) writing business, this paper does not cover the costs of maintaining 0wnership over a given OS.
Vulnerability Detection
There are several factors that affect how difficult it is to find vulnerabilities on a target platform. Some of these are listed below. Immunity's judgments are drawn from our current collection of remote 0day in the VSC, countless 0day in custom applications for Immunity Consulting customers across many different operating systems and over 80 remote exploits in CANVAS.
Portability of common exploit development tools
IDA-Pro, the premier disassembler and reverse engineering tool (a database and a disassembler together make for a powerful combination) is able to disassemble both Linux and Windows binaries, but only runs on Windows. A Linux version is, however, rumored to be in the works.
PDB (Python Debugger), Immunity's newest tool in the armory, is available only for Windows (although the client is available on both Linux and Windows). This tool allows for many advanced scripts to be run, widely automating the exploit development process.
Ollydbg (Visual Debugger), is far superior to GDB in many ways needed for exploit development. In addition, windbg and Softice provide valuable options for debugging at the kernel and user level.
The TC0 advantage is clearly obvious for the Windows platform.
Availability of Fish
Finding a vulnerability is like finding a fish. If the pond is overfished, it's harder to find them. Hackers are rather evenly split between running Linux and running Mac OSX. As much as few professional NASCAR drivers drive Dodge Neons, a negligible amount of skilled hackers use Windows as their primary OS.
Not to mention, many Win32 fish are given out for free by Microsoft when releasing patches. (See
Pseudo-Latin (Score:1, Informative)
Re:0wnership? (Score:1, Informative)
Re:0wnership? (Score:4, Informative)
The word "sic" means "thus." Nothing more, nothing less.
Re:Errrrrmmmm... (Score:2, Informative)
Our exploit code is all custom written by Immunity - so it plays nicely with the engine itself and, we like to think, is better than things like Metasploit. (Which makes sense, since we have 4 people on full time salaries to do so!)
There's a lot of other stuff to it, but let me just say that cutting and pasting is certainly something that is not a part of our development process, for many reasons.
Re:WTFATTA? (Score:3, Informative)
This one does..... (Score:3, Informative)
It mentions nothing about Total Cost of Ownership.
It does, however, mention Total Cost of 0wnership, which is completely different....
Re:Cost of Ownership of a PC (Score:2, Informative)
Your sig explains it all... (Score:5, Informative)
Well, you seem to be pretty bad at getting jokes. The article isn't about cost of ownership, it's cost of 0wnership.
Re:Apple can't supply the F500... (Score:3, Informative)
It is a wonderful machine (lacking only redundant power supplies and the damn hardware RAID card listed in the options). However, Apple cannot meet demand. And while that sounds great for Apple, it sucks ass for companies that depend on their servers.
Re:Pseudo-Latin (Score:1, Informative)
Spelling Mistake (Score:2, Informative)
Re:Apple can't supply the F500... (Score:3, Informative)
Re:Nice (Score:3, Informative)
Hell, you don't need Mandrake! XP will make itself unbootable!
True story - recently had an XP system with NTFS boot partition. It would not boot; gave an error message about corrupt NTFS. A call to Microsoft confirmed that this was "by design". Evidently booting on a corrupted NTFS partition may make data unrecoverable.
"Well, then, how do I recover it?"
"Reload with the recovery disk."
"Hmmm, you realize that the recovery disk, from this OEM anyway, overwrites everything, don't you? How do I recover the data?"
"There is no way."
Bringing up a Linux live disk with NTFS read capability got all the user's data back. Memory and disk diags showed no problems, so I used the recovery disk, reloaded user data and it's been running 2 weeks now.
Re:Nice (Score:2, Informative)
Sweeping generalizations (Score:3, Informative)
Linux and Windows are from very different worlds of administration and troubleshooting. In general, I have found Linux to be easier to troubleshoot (with exceptions). Most mature Linux applications give one actually useful error messages (much more useful than similar messages from Windows software). The time I take to troubleshoot such a product is very low.
There are exceptions (XFree86 comes to mind) where error messages such as permission or disk space errors are not transparent or easy to comprehend. Of course this has improved heavily in the last four years, but X is still one area where I really don't relish troubleshooting. Not long ago, I spent 2 hours troubleshooting an XFree86 problem where the mouse and/or keyboard stopped working when I moved the hard drives from one computer to another (everything worked elsewhere). I eventually figured it out with the help of Google, but it was not easy.
But these problems are rare. In general the problems I have had on Windows software *are* harder to troubleshoot and repair.
Mac? (Score:2, Informative)
http://www.architosh.com/news/2004-01/2004c-012
Let's face it (Score:2, Informative)
I wonder if this will motivate /.ers to read the article before posting.
Re:Your sig explains it all... (Score:3, Informative)
Re:My other computer... (Score:3, Informative)
saw him in it at directx meltdown last month.
Re:WTFATTA? (Score:3, Informative)
-
Re:Apple can't supply the F500... (Score:3, Informative)