The Annual US-CERT FUD Festival 152
Joe Barr writes "Joe Brockmeier and I have teamed up in a story on NewsForge to point out how the mainstream and trade press misrepresent the annual summary of vulnerabilities from US-CERT. They're doing it again this year to make it appear as if it is more secure than UNIX/Linux. Pamela Jones did a similar report at Groklaw over the weekend." From the article: "One figure represents the vulnerabilities found in Windows operating systems: XP, NT, 98, and so on. The other represents a total figure not just for Solaris, AIX, HP-UX, the BSDs, and Linux, but for a hundred different versions of Linux. The sum of all the unique vulnerabilities from all the Linux distros does not equate to the sum of vulnerabilities in any single Linux distro, and one could say the same about the various versions of Windows. That's why it is a completely meaningless exercise to discuss those totals as if they present an accurate picture of the relative security of Windows and Linux. " We've reported on the US-CERT list already this year. NewsForge is a sister site to Slashdot.org, both of whom are owned by OSTG.
Well.. (Score:1, Insightful)
No, but it sounds like they're adding the vulnerabilities to represent Linux. Much as they're adding the unique Windows vulnerabilities to represent Windows.
Should Compare A Single Version Of Windows Too (Score:5, Insightful)
The numbers are unimportant (Score:5, Insightful)
Shouldn't we be asking the more pertinent question: why do all the various operating systems have so many vulnerabilities? When it comes to such things, this shouldn't be a competition. OS builders should be striving for zero tolerance to vulnerabilities and there shouldn't be an quibbling over the number that exist.
Re:Well.. (Score:4, Insightful)
the thing about the list... (Score:4, Insightful)
If you throw out all 1437 "updated" occurences in the linux/unix secion, that leaves 891 (2328-1437=891). Subtracting Apple OS X (130) and Sun Solaris (77), Linux/Unix ends up with 13 more vulnerabilities than Windows (891-130-77=684), but it's for more operating systems, so it may be fair to divide that 684 further.
The Register fell for it too (Score:2, Insightful)
But it is true, engage intellect and you can see at a glance how useless the figures are.
- No ranking by severity levels, or weighting of overall score by severity
- No individual OS scores
I can't see how this 'report' is useful to anyone except marketing droids who work for Microsoft.
Patch Time (Score:4, Insightful)
Take a deep breath and count to ten... (Score:5, Insightful)
What is "it"? Slight tinge of paranoia here, maybe?
Let's review the score here:
- It does not matter what material is published, the fact of the matter is that every Windows PC in the world regularly has visible and non-trivial security issues, while on Linux and OS/X these issues are generally theoretical.
- People's perceptions of Windows are very simple: it's a piece of crap that they use because it came with the box and everyone else uses it.
- The relative security of Windows vs. the World is not a deciding factor in most people's use of Windows. It's largely a captive, neutered market.
- For people who actually do care, no amount of statistics can change the visible and perceived situation. When I choose to ban Windows in my company, it's not because I read some website or article. It's because I'm sick and tired of removing spyware from people's PCs.
Complaining about these statistics is to give them credibility. Those who chose on the basis of security will ignore this data, and those who chose on other criteria won't care about this data.
Take what the CERT says with a grain of salt... (Score:5, Insightful)
Re:the thing about the list... (Score:2, Insightful)
Great. Where's me phone? Ah.... "Hey Bill, how much are you willing to pay
Re:Downright Disingenuous (Score:3, Insightful)
Re:Skewed? Oh yeah... (Score:3, Insightful)
It would be interesting to see all of the Windows application vendors lumped into the "Microsoft security flaws" category in a similar manner. I've seen quite a few Windows applications from all sorts of software vendors with issues this last year and noticed they weren't listed. While one might argue at first that this would be unfair because of all of the commercial products available for Windows, I'm not sure Windows wouldn't still have an advantage. Just go to sourceforge.net and start counting up all the projects available there that could be lumped into Linux "security flaws."
Looking just at core operating system applications, Fetchmail doesn't make the cut. In fact, it's inappropriate to include GCC in there since I'm certain they didn't include Microsoft development environment tools in the Microsoft count. An apples-to-apples comparison isn't appropriate and perhaps for those uneducated technical journalists that like to make comparison stories, a kernel-to-kernel, browser-to-browser (e.g. IE vs. Mozilla vs. Opera), office suite to office suite, and other category-based comparison is the only appropriate approach.
I wonder: Definition of security vulnerability? (Score:2, Insightful)
Re:The numbers are unimportant (Score:4, Insightful)
Now on the topic of this bug counting, if windows is lumped together then linux should be to some degree too, but on the same order of magnitude. A half dozen distros, maybe even mirror the windows counting a little more and make some of those distros be older but still supported ones. Also, the various unixes and linux are entirely different beasts. Just because they try and present a somewhat compatible user interface and APIs doesn't mean that they should be grouped into one object when counting bugs.
Bitching contest and formal request (Score:2, Insightful)
Formal request:
Someone needs to count the vulnerabilities in:
1) XP
2) Minimal SUSE linux install
3) XP with specific of Apps, servers, etc.
4) SUSE linux with specific Apps, servers, etc.
Give us these numbers and then we have something to talk about.
Re:Downright Disingenuous (Score:5, Insightful)
Re:Should Compare A Single Version Of Windows Too (Score:4, Insightful)
well... you're half right. I'd say it's better to lump 95/98 together and NT/2000/XP together since most of the later versions of windows are pretty much the same thing on the inside...
however, it's really unfair to quantify the vulnerabilities for any OS as a whole. There are so many facets of any computer system that many vulnerabilities don't affect most people.
Saying that a exploit for Apache affects the entire linux/unix/osx install base is an unfair statement. Desktop linux users probably don't have apache running or a bug in X11/xorg won't affect most *nix servers. Likewise, a bug in MSSQL or web services won't directly affect most XP users, although a bug in explorer will affect nearly every windows user (who's running an affected version of explorer).
You can't even really create lists of vulnerabilities that affect "server" versus "desktop" users, either, because just because something is a server doesn't mean they're necessarily running every server daemon they can.
There needs to be a list of servertypes (ie: web, email, file, database, etc exclusively) showing not only the quantity of vulnerabilities but also the severity of said vulnerabilities. Perhaps even a table separating different applications.
I mean, you shouldn't really lump every proftpd vulnerability with every other ftp server software. All it takes is one bad egg to poison the overal results.
This Is Good News! (Score:3, Insightful)
Yeah the spin is ugly, but if the *nix's "stick to their knitting" this too shall pass.
They do the same thing when they talk about Mac's too. The last time I saw figures (which was a couple of years ago) Apple was far and away the #1 shipper of laptops by brand. But, they would compare ALL laptops shipped by all brands to come up with Apple's "miniscule" market share.
The reality was that Apple was creaming the Windows-based brands. They would do this with all of the various market segments apple competed in. Funny how they don't do it with MP3 players.
OT Comment:
I never understood why anyone who branded computers wanted their numbers in the market research. It just gives HP a target to destroy.
What a bullshit "article" (Score:3, Insightful)
The "article" is not an article but rather an opinion piece. For example:
Microsoft wants you to read the headlines as "Windows 3X safer than Linux." (If Microsoft is being quiet about the US-CERT numbers, it's because the company is too busy trying to come up with a fix for the Windows Meta File (WMF) vulnerability.)
The authors apparently know what Microsoft wants, even though they admit the company hasn't commented on the summary of vulnerabilities. I guess the authors assume the MS marketing department is working on this bug fix, which at the time the article was posted was fixed (but no patch had been released).
Reading further, the authors reference the "Technical Cyber Security Alerts", saying, "That's quite a different picture than the one the Microsoft press machine wants you to see." Once again MS is referenced, even though they had nothing to do with the summary of vulnerabilities and have issued no press release on the matter.
MS is mentioned twice though the company has not issued any press releases or new ads reflecting these numbers. On the other hand, the article repeatedly mentions the press:
Everywhere you look in the trade press today, you'll find glowing misrepresentations...
...many scribes sympathetic to the Microsoft cause go out of their way to make sure the real picture never emerges...
...you'd think that the mainstream tech press could get it right when reporting on security...
...scribes in the trade press are once again playing the US-CERT FUD game...
Shame on them for purposely -- or ignorantly, as the case may be -- misleading their readers.
Yet in the links below the article there is only one direct link to an example of how the press has been misleading their readers.
Guys, if you're going to write something, call it an article, then post it to Slashdot, at least try to be a little more objective. I think most people are tired of MS vs the world now...it's so last year (this year it's Google vs the world). People are interested in performance, ease of use, security - getting the job done. Who has time for these pissing matches?
The piece does fit on a site named "NewsForge". Why report the news when you can manufacture it?
Agreed! (Score:4, Insightful)
I vote for the "solves-my-problem-but-not-yours" distribution, which is clearly the best.
Incidentally, I am also in favor of settling on ONE (1) tool for all mechanical uses.
I favor the two-handed hewing axe, but I might be persuaded to vote for the claw hammer.
What an admittance! (Score:0, Insightful)
You really had trouble figuring out what the article is about?
Shame on you! Admitting this at Slashdot too! All of these intellectual people here making a note of your name and marking it with a mental note of 'moron'.