Security Isn't Just Avoiding Microsoft

Jay Singala noted a story which points out "It's time for all the people who have entertained this fantasy to stop deluding themselves. How would life without Microsoft be different? It wouldn't be in any meaningful way for those in charge of network security; there would just be a different vendor peddling the dominant operating system."

Not exactly

[WrongSizeGlass]

If the "market penetration" philosophy were true Unix would have been hacked to bits decades ago. There are a lot more Chevy's around than BMW's, but I bet that more Chevy's are stolen because their "security features" are easier get past rather then just because they're more prevalent.

If the Apple/Windows market positions were reversed (or Linux/Windows for that mater) Windows would still be less secure. Unlocked doors and windows are still less secure even though there are fewer of them (or in our case more of them).

Re:Not exactly

[Gearoid_Murphy]

absolutely, but theres a considerable group of people out there who view animosity towards Microsoft as part of a broader resistance to big corporations, and as a consequence of this, view this resistance as being naive and unfounded. Unix style systems have been around for a long long time and have a well deserved reputation for stability and security, unlike windows products which I, as a computer scientist and software engineer experience as being badly concieved and poorly executed

So someone else takes the fall

[Kymri]

If Microsoft is gone, someone else will have the biggest share of the market and thus make the biggest, most appealing target. It helps that Windows is perceived as more vulnerable (though it can be argued it isn't - not that I hold this position myself), but surely some of that is due to the combination of more attacks against it (more home users and businesses) and a less-than-instant response to security holes.

Whoever the biggest name in a Microsoft-free world was (assuming they were the biggest in a similar kind of space with businesses and home users, not biggest like the bajillion flavors of *nix kind of way), I'm sure things would be the same, and only the details would vary.

Re:Not exactly

[ArchdukeChocula]

>If the "market penetration" philosophy were true Unix would have been hacked to bits decades ago.

It was! Today's script kiddies can't tell grep for the GIMP but back in the day BBSs were filled with philes on hacking UNIX. Most those files are useless now because BSD and Linux developers have worked hard to improved security. (And so have Windows developers, XP is harder to hack then Win95) The point is that any product as complex as an OS will be full of security holes. Sure UNIX may be more secure but as soon as you get lazy and think your safe someone will prove you wrong.

Re:Not exactly

[wframe9109]

That's pretty funny, because from my experience, Unix has had a history rife with exploits and security issues... It *was* hacked to bits long ago. Good job!!!

Despite it's lesser market percentage, we still see exploits for Unix variants, and the services offered within. It's not some sort of impenetrable OS.

Anyhow. Security is in the hands of the user. Someone with half-decent security knowhow will be able to secure a Windows box far better than a newbie running Unix.

More secure?

[Himring]

Since all other OSes/NOSes have/had the model of "everything is denied unless specifically given otherwise" and Microsoft's has always been, "everything is allowed unless specifically given otherwise," to say the least, things would be more secure.

Things were more secure when Netware was the NOS for businesses. Create a user, and they could see nothing unless you flipped a switch. Fire up bitchx and doesn't it say, if using as root, "using bitchx as root is stupid." Su, denial of anonymous access or even read access across the network ... on and on. Please try disabling anonymous access on a windows domain controller. Users, suddenly, cannot see shares, change their passwords, etc. It is a registry setting that has to be left unsecured or else the windows NOS stops working.

This says nothing for the hall-of-shame when trying to remove root access for users on their local boxes.

If not for microsoft, consumers might have saved billions on hardware by removing the microsoft tax. Dozens of smaller companies might still be in business.

If not for microsoft, I might still be managing a Netware NDS which, some dozen years ago now, was a far better directory service for a network than active directory is today, (I can only apply security settings at the domain level?). Oh for the days of right clicking anywhere -- I mean anywhere -- in the tree and setting a differnt password policy....

If not for microsoft, the first thought on computer security might be something other than a virus....

If not for microsoft, the word "rootkit" might not exist?

"Security" does not exist!

[khasim]

At least, that is what TFA says.

Networks in a world in which Apple had won the operating systems wars would still be insecure. What's that, you say? The Macintosh has had far fewer bugs reported and patched than Windows? That's true, but it's a consequence of the minuscule market penetration of Mac OS.

Got that? It's all about market share. There is no such thing as "security".

If everyone's house had no locks, they would be just as secure as if everyone's house had the best locks on the market.

If you put computers on a network and open that network to the outside world via the Internet, you're going to have security problems, regardless of whether you're running Windows, Mac OS, Linux or an operating system you created in your spare time.

I run Ubuntu (Feisty Fawn). By default it has NO open ports. That means that unless a worm can hit the TCP/IP stack, I am invulnerable to them.

He is an idiot. He doesn't even define "security" before he says that it doesn't exist.

My definition is: Security is the process of evaluating threats and reducing their effectiveness.

But once we've done all that, we're left with one unalterable fact: Users will still make errors galore.

You're an idiot.

So if we replace Windows with Ubuntu, and the number of cracked machines goes down from 10,000,000 to only 1,000 ... that doesn't mean that Ubuntu is more secure because 99% of the cracked machines would be Ubuntu.

So, what needs to be done? You must require users to attend formal information security training and awareness programs. No one should be left out.

Why do I get the feeling that this guy just bought stock in a training company?

If that approach was effective, we wouldn't have the problem we have today.

Monoculture.

[Door in Cart]

Sure Windows is a security nightmare, but the real problem is that just about everyone is content to use the same system as everyone else. Diversity is required for culture-wide strength. As much as the internet's proclivity for niche marketing has encouraged everyone to explore their individuality, most of us remain oddly content to behave nearly identical to everyone else. In a hypothetical world where 285 most-used operating systems compete on a wide variety of creatively different architectures, the issue of security of any one of those systems would be greatly diminished, and, as an added bonus, walking in to an average computer store would actually be exciting.

Re:Not exactly

[DevStar]

Where do people get this illusion that Unix systems were secure in the past? As an undergrad we would drive our friends crazy hacking into computers. Just about every Unix program they ran, from mail to finger to rn had security holes you could drive a car through.

The difference back then was no one cared if we broke into a computer. It just didn't make news. Heck, I remember that remote exploits stayed open for years, and no one said a peep. The world was very different back then. Plus there just wasn't much interesting to hack into. People would generally hack into other students accounts -- erase homework, put a bug in a friends assignment, send a goofy email from their professor's account, etc... You didn't have organized crime stealing credit cards, because no one besides geeks used computers.

I know this doesn't fit into your mental model of how Unix was this secure fort in the old days, but you'd better think again. Those of us who were there, know better.

I hate to sound cliche, but as long as we have people programming systems, there will be security holes. And I've worked at enough places to know that no one has a silver bullet.

True

[Fujisawa Sensei]

True, security isn't just about avoiding Microsoft.

But avoiding Microsoft is a good start. :-)

Re:The problem is one of balance

[Anonymous Coward]

"Microsoft is insecure because they try to juggle security, performance, and being idiot-friendly."

No, windows is insecure because they put backwards compatibility over secure design, and as such have perpetuated several major insecure design flaws because fixing them would shatter all their legacy apps.

proper memory protection, and actual multi-user protection would go leaps, bounds, and miles to fixing a large number of their problems.

Dreck!

[99BottlesOfBeerInMyF]

This article is complete and utter rubbish. It makes random claims with no support. For example, "How would life without Microsoft be different? It wouldn't be in any meaningful way for those in charge of network security; there would just be a different vendor peddling the dominant operating system. " makes the assertion that it would not be any different and makes the implicit statement that there would be a single dominant operating system, all completely without any support for either of those statements. First, why would there be a single dominant OS and second, why, if that OS was Linux, would the same problems that occur with MS's monopoly not be completely undermined by Linux's licensing?

Networks in a world in which Apple had won the operating systems wars would still be insecure.

Sure it would, but that's again assuming someone had to "win" and establish a monopoly. No evidence that this is the case has been provided. I know it is hard to imagine a world with multiple OS's and vendors that interoperate via these crazy things called "standards" but that is how most markets operate. Yeah if someone else had an abusive monopoly we'd still have a broken market, that's why we want to restore the market to a non-monopolized state.

If you put computers on a network and open that network to the outside world via the Internet, you're going to have security problems, regardless of whether you're running Windows, Mac OS, Linux or an operating system you created in your spare time.

Except right now if you do that with Linux or MacOS you have a whole lot fewer problems, to the point where it takes no significant time.

User errors have long been the bane of security.

No they're not. Most malware infections by number are still the result of automated attacks with no user interaction. Such malware is harder to write, but it spreads faster and further than other malware. As for user error, sure it will always be an issue, that is no reason to ignore other aspects of security or to implement ways of mitigating user error. You seem to think (like MS) that the user element should be isolated from the security mechanisms. You cannot ignore the user when planning security and the examples you point out are where that is exactly what failed. If the Nazis had planned realistically for what their users would do, they would have built a system that verified which keys were used and that they were unique.

So, what needs to be done? You must require users to attend formal information security training and awareness programs.

Sure if you want to spend the money, go for it. It won't help very much though. Until the security of OS's is up to snuff and simple enough, the training will be mostly ineffective. What is a user supposed to do if they have a binary and aren't sure if it is safe? Windows has basically no mechanism for determining the trust level or for running it in a sandbox if it is not trusted enough. Until it does and it is brought to the user in a functional way, education will help very little. The OS actually has to have an easy way to let the user do what they want, or they will take risks out of laziness.

Education is the last step, but first we need to fix the OS and fix the market to motivate the fixing of the OS's. Right now you need the equivalent of a 4 year degree to have a good chance of safely running a Windows box and accomplishing all the tasks you want to. That is simply not good enough. It needs to be down to a couple hours or training before we will see a widespread difference.

Re:No

[$RANDOMLUSER]

if you get rid of MSIE, Outlook Express, MSN Messenger, and Windows altogether, you could be the worst systems administrator ever and you still wouldn't have 1/10 the security breaches and incidents.

You've almost put your finger on it. It's not the products themselves, but Microsoft's love of having applications do whizzo shit that looks great in demos, but shouldn't be done in the first place. Think Active-X webpages, auto-preview in Outlook, .WMV files that can perform system-level operations, macros that execute on load in Word and Excel, executing code from files when viewing directories in thumbnail mode, etc., etc., etc.

How silly

[WindBourne]

It is NOT about market share. It is about ease of penetration. There are MORE than enough *nix system that if they were easy to crack, than they would be. If nothing else, notice the .php/.asp world. Most php runs on *nix. They are attacked because it has been easy. Fortunately, the damage is limited, but it still allows such things as stealing information including credit cards and individual information via sql injection.

Re:Not exactly

[tbannist]

It's simple. The summary is quite obviously from a microsoft apologist. The author's just trotting out the old fallacy that "things couldn't be any different then they are now". While it is true that there is more to security than avoid Microsoft, there are very legitimate reasons to gripe about Microsoft's security. They've been told repeatedly before they did stupid, stupid things that they were creating security holes and leaving their customers vulnerable. They didn't care and now everyone else has to clean up their mess.

They've earned their damnation as the weakest link of security and if you eliminate the weakest link, the entire chain becomes stronger.

Holy crap, my CISSP value just went down!

[harris s newman]

This guy has one fault: faulty logic. Systems are not being attacked more under Windows because of user error, it's because of the holes in the OS. Training is not the main issue with security today, it's an operating system which continues to have a paradigm of an insecure kernel. Layering is a mantra of security, it's not by Microsoft

Finally, this "theory" should be quantitative, I question if sites which are linux only have the same number of vulnerabilities as Windows only. Why doesn't he give us some examples?

My summary: I am ashamed to have the same certification as the author.

Re:The problem is one of balance

[jedidiah]

No, Windows is the dominant OS because MS-DOS was the dominant OS. That happened because of the association between Microsoft and IBM back when IBM was the computer industry bogeyman.

The "ease" of Windows 3.1 or Windows 95 had nothing to do with it.

Win/DOS was already being pushed by Dell and the rest of his friends.

Re:Not exactly

[Vancorps]

One of my professors in college referred to security as the art of breaking services. He's as correct today as he was then. It would be great to open up the systems and allow anyone to do whatever they want, they're productivity would rise. Unfortunately the world doesn't work that way and we're forced to break stuff to the point where users can only do what they are explicitly authorized to do. This means no taking initiative and probably no learning of the system since I know at least in my organization the only people that know the full system are my coworker and myself. We're the only ones that know what the network is fully capable of which means we have to participate in a lot more meetings to make sure that people do utilize the automated approach instead of manually processing thousands of records.

From my experience with OS X we'd have a lot of the same problems as we do if it switched roles with Windows except we would lose are advanced management and monitoring capabilities. I know OS X likes to transmit everything unencrypted, it drives me crazy especially given that with each release Samba support just seems to get worse.

Of course Solaris and Linux have all the advanced management and monitoring capabilities as that's where they all originated. Tripwire is the savior of all. I'm not sure how the world would be if the two were dominant in the mid-level and home markets. Home users invariably will drop enough security to do what they want without thinking. This is the mentality that Microsoft has been dealing with for years. Of course now MS tries to lock their product down and the likes of Symantec and Mcafee are suing them because it will end their businesses. I don't envy any of their positions, I like being in the middle.

Re:"Security" does not exist!

[mstone]

---- If everyone's house had no locks, they would be just as secure as if everyone's house had the best locks on the market.

I understand what you're trying to say, but there's a certain comedy value in seeing a door that's secured with a Chubb 20mm deadbolt, but framed between a pair of plate glass windows.

If we take 'security' to mean some kind of magic fairy dust you can sprinkle on part of the world to make bad things stop happening, then no.. it doesn't exist. Bruce Schneier discussed the issue at length, and quite eloquently in his book Secrets and Lies. The best approximation of 'security' we can get is a complete and integrated system whose strong points and weak points overlap each other, and whose cost/benefit ratio is proportional to the cost/risk profile of the stuff being protected.

Any such system that's tight enough to meet conventional ideas of 'security' is tough to build, and even harder to maintain. The effort and diligence curves are way above what you can expect from the everyday person on the street.

We can build systems that make it easier for people to do things that promote good security, and harder for them to do things that promote avoidable risk, but that's about the best we're ever likely to manage. Security is measured like system uptime: in orders of magnitude. One-nine security (90%) is easier to achieve than two-nines (99%), with each additional nine being harder and more expensive to tack on. It's very unlikely that we'll ever see the general public acquire the knowledge and discipline necessary to maintain overall five-nines security (99.999%), because somebody just won't think the payoff is worth the effort.

Re:Seriously, editors... ENOUGH ALREADY

[freeweed]

No.

Trolling is going to a NY Nicks' fan forum after they lose a game and posting "SEE!!!! OMG THEY DO SUCK I TOLD YOU!!!". Trolling is hanging out in religious IRC chatrooms and doing nothing but posting links to atheist websites. Trolling is wandering down to the Holocaust museum in Israel and handing out pamphlets saying "hey, maybe Hitler was misunderstood".

Trolling is also getting pissed off because your understanding of security is shallow enough that you take it personally when someone points out that the OS you use isn't as secure as it could be, and yet, because you still need it to play your MMORPGs, trying to scream "OMG SLASHDOT BIAS" in the hopes that someone out there might believe you.

(Incidentally, that last line was also a bit of a troll).

Coming up with a story that completely misses the point about OS security and submitting it here is laughable. The entire point made is that there will always be stupid/ignorant users. The most famous and financially damaging network attacks in history all depended on Microsoft's decision to let every Windows machine listen to needless network traffic by default. You can't argue this. Users had nothing to do with Blaster, SQL Slammer, Code Red, Nimda, (list 100+ worms that made international news when they got released)... at best you could argue that users should be patching systems on a daily basis, but of course you'd be showing just how little experience you've had running a computer system outside of your own home (that's almost flamebait, by the way, even if it's the truth).

The "Windows is only hacked because it's the popular OS" is a myth. It's been debunked thousands of times. Believe me, if it was as easy to hack OS/400, or Linux, or HPUX, people would be doing it in spades - because there's a hell of a lot more juicy information behind those machines. All of Las Vegas runs on OS/400 - that's billions of dollars for the taking. Going after 100 million home users is pointless when you have a nice juicy target like that. As another example, cracking IOS would give you a LOT more power than some piddly country's desktops. Cisco gear is EVERYWHERE.

The common consensus isn't wrong. Hell, these days it's not even the common consensus. But it is accurate to anyone that's had more than a couple of years experience with network security. Or anyone who's had experience outside of running Windows, and trying out a Linux LiveCD one weekend only to give up because it's "too hard". - also Flamebait, yet true.

Re:Not exactly

[jimstapleton]

Even dropping the security blocks for a user doesn't neccessarily kill the security of the system.

I have a friend who isn't really a computer tech (he has me help him with a lot of stuff), but he is in a business where information and confidentiality are major.

Both of use have windows accounts where we are admin, for ease of use. Neither of use have had virus problems on our machines. The trick is, we are both very paranoid. We don't run every program we can download from the net, we don't go to sites that are likely to be dangerous, and if an email looks slightly suspicious, we view the source before reading it.

Conversely, I know plenty of tech savvy people, and not-so-tech savvy people who have had viruses on their windows machines, with or without admin, simply because they do whatever they please, without thinking of the danger. It's more or less the computer equivalent of crossing the street without looking both ways, or buying a house in the worst neightborhood in town, and thinking that the locks on the doors will be all that's needed to keep you safe.

That being said, I'm happy I switched to FreeBSD where I don't /have/ to log in as administrator to get most of my stuff done without difficulty.

Re:Not exactly

[BewireNomali]

more chevys are stolen because most stolen cars are used for parts (note: i'm not certain if more chevies than bmws are stolen as i did not check. merely working with parent's example). more chevys on the road means more chevies need parts which means there is a good black market for chevy parts. this is why honda/acura vehicles are high on the stolen list year after year IINM. In other words, your example doesn't indicate that bmws are more secure - in fact it reinforces what has always been said - windows' prime weakness is ubiquity.

i'm in no position to know how more secure apple is than windows until: osx is not tied to custom hardware and has windows' current market share across thousands of hardware configs - and the established knowledge base of how to pick and exploit weaknesses in the software is made readily available.

Re:Not exactly

[PitaBred]

Yes. But the Unix philosophy is a very secure foundation. Lots of components, each do just one job, and do it well. We can secure those, and then the whole chain becomes secure. With the undocumented API's and other crap that Windows has in it, not to mention it's monolithic and completely integrated design ("I swear, we can't remove Internet Explorer, it's integral!"), it's got many more places where things can and do go wrong, and "fixes" ripple throughout the system. Would you rather try to secure a screened in bunkhouse that has a bad lock, or a concrete building that has a bad lock?

Security isn't Binary.

[Vellmont]

The article, and many of the comments seem to think a system is either Secure or Insecure. I.e. it's either Perfect or Imperfect. The article talks about every system having holes, blah blah blah.

I'm sorry to say, but security isn't about having a perfect solution. It's a mistake many people make in the IT industry because on a low-level, you can perfectly solve small problems. Many people think this scales up to larger, more complex problems. It doesn't.

My point is that security is a continuum. Pointing out that all systems have flaws doesn't mean that Windows is just as secure/insecure as some alternate reality OS that doesn't exist but in the mind of the article writer.

Re:Not exactly

[Vancorps]

That is a valid criticism as Windows is only now just barely coming into its own in regards to least privilege accounts. With that said, I setup a common computer for all my roommates to use. They all have their own logins with just basic user access. The machine has gone for three years without any instruction from me and not one virus, not even any spyware beyond cookies of course. My roommates are definitely the type to just click blindly which is definitely a problem. I'd say my experience is a bit of luck combined with reduced privilege accounts. When something needs to install I just right-click and runas my install user.

On my work computer its the same way, it takes a little more effort here but its worth it the day I tear open a suspicious email. Of course I do this in a VM so something funky happens and the network starts flooding I just shut off the VM and then all is well as the VM reverts on reboot. The tools are out there to play safely, more people just need to learn to use them.

I would do the same thing if my management computer were Linux based. VMs make great playgrounds. EMC/VMWare making Virtual Server was very wise in my mind as I am now looking at deploying some virtual machines for production use based on the benefits I've seen in that product. That means licensing some of the even cooler stuff they offer. Good for them.

The problem is Window's insecure architecture.

[QuietLagoon]

A simple application like the IE web browser is tightly integrated into the operating system in order to get around anti-trust laws. How dumb is that?

Perhaps Windows is attacked so much because it is the most popular operating system. However, those attacks succeed so frequently because the security architecture of Windows is so poor.

Re:Not exactly

[the_womble]

There is also no reason why the market leader has to be dominant. The market leader could have 30%, another two big players 20% each and the remaining 30% split among the rest.

That way we get rid of the monoculture, which is a security disaster.

Good vs Bad.

[khasim]

Any such system that's tight enough to meet conventional ideas of 'security' is tough to build, and even harder to maintain. The effort and diligence curves are way above what you can expect from the everyday person on the street.

Possibly. But that doesn't take into account bad security designs.

As with my Ubuntu example, just having a default install have no open ports is a HUGE step in reducing the threat to that box.

Security is measured like system uptime: in orders of magnitude. One-nine security (90%) is easier to achieve than two-nines (99%), with each additional nine being harder and more expensive to tack on. It's very unlikely that we'll ever see the general public acquire the knowledge and discipline necessary to maintain overall five-nines security (99.999%), because somebody just won't think the payoff is worth the effort.

Pretty much. Once you have a good security model, getting it to be MORE effective may take effort that the average person isn't willing to put into it.

But I never care about "uptime" as a measure of security. The system can be very insecure, but still never crash.

I prefer looking at data compromised vs data lost. If you maintain your system so well that you lose data more frequently by accidentally deleting it without a backup than the number of times you've been cracked, that's the best you can really hope for.

Just be so secure that your users (even if that is just you) will do more damage to their data than outside attackers will.

Re:Not exactly

[Spazmania]

Where do people get this illusion that Unix systems were secure in the past? As an undergrad we would drive our friends crazy hacking into computers. Just about every Unix program they ran, from mail to finger to rn had security holes you could drive a car through.

In 1995, most of the US military facilities on the Internet had no firewall. I still remember logging on to the MS Lan Manager servers at work from home using Samba over a 28.8 modem and exporting X-Windows to Sun workstations 600 miles away. That was the normal level of information security and both Windows and Unix met it.

In 2007 the expected level of information security is rather different. In 2007, Unix and Linux have adapted to the new requirements and excelled at meeting them while Windows works only moderately better than it did in 1995.

So you're right, but you're wrong. Unix and Linux consistently met or exceeded the appropriate level of security at the time. That the target moves doesn't change the fact that they keep on hitting it. Windows, on the other hand, hasn't hit the target for the better part of a decade now.

Re:Not exactly

[guruevi]

I know that Unix had a bunch of holes that we used to like to exploit, back when computers were a scientific gadget that you saw only in universities and big companies. Heck, I remember all e-mail servers by default being an open relay and usually left that way so we could send e-mail around the world. But we also had Windows, with the same exact security holes back then.

In the mean time though the Unix environments had a LOT of improvements towards security as time progressed. The problem with Microsoft however was that it kept everything closed and no-one could improve or fork to get a more secure version while Unix/BSD/Linux had a lot of forks that went later back into mainstream and forked again, rebuilt from scratch etc.. Over the same time period, Microsoft Windows has thus been slower in developing a more secure and stable version of their products and that what's the industry, geeks and everybody else is blaming Microsoft for. Back in the day, they gained mainstream market and just as they did with IE/NS once they had their mainstream desktop goals, they stopped improving because they didn't need to anymore (what really improved from 95-ME? (5 years) or from Server NT4-2003? (7 years?) or from XP-Vista? (4 years?), I don't mean just fixes, but real groundbreaking (security) improvements like Apple when they switched to Darwin or when Torvalds decided to rebuild from scratch for 2.6).

Re:Not exactly

[Chris Burke]

Well it's a matter of how you frame it.

"It wouldn't be in any meaningful way for those in charge of network security; there would just be a different vendor peddling the dominant operating system."

That's actually true in broad strokes, if you think of what a network administrator's job is relative to security. They maintain the system, keep up to date with what vulnerabilities exist, test any patches and apply them, and respond to any DoS or virus attacks that occur. They deploy spam filters and virus checkers, and keep up to date on patches for them. This won't fundamentally change -- there are still vulnerabilities for *nix whose fixes will need to be tracked -- so really they are doing the same thing with a different vendor.

In a less general "what is the nature of your job" sense, the above is absolutely not true. For instance the only reason we have a virus scanner on our *nix mail servers is to prevent viruses that depend on MS Outlook. While we've lost entire volumes to corruption by Windows viruses, nothing like that has happened to our *nix file servers. And whenever something like this happens, it means over-nighters for the sysadmins. Ask them if having to come in less often on a Saturday night is a "meaningful" change in the way they work.

There are two common couter-arguments to this. The first is the marketshare argument -- MS software isn't any more buggy, it's just more used and thus targeted more. This makes sense at first blush, but anyone putting forth this argument must explain why IIS is hacked more than Apache. Clearly there is more to it than the number of targets.

The second, more desperate argument is the "all software has bugs" mantra. I'll just be honest -- people who argue this are either idiots or extremely lazy programmers. Of course all software has bugs, the question is how many and why. All food has bugs in it, but don't tell me you can't distinguish between food with below the FDA standard for bugs and food that vastly exceeds that amount. Only a fool confuses "bugs exist" with "the quantity of bugs is the same". Only a fool thinks that you can't design a system to be more secure. The problem isn't that Microsoft's programmers just introduce more bugs, it's that the inherent design of Windows and associated software that makes it bug-prone. The worse your design, the more careful you have to be to avoid bugs. Avoiding bugs, and designing the system so that it is inherently more secure and bugs are easier to avoid, is what good programmers strive to do. You can never do it perfectly, but only lazy idiots think that means you can never succeed at all.

Well whatever. All I know is that once I got my father off Explorer and Outlook and onto Firefox and Thunderbird, I stopped having to clear spyware off his computer every single time I visited. Anecdotal for sure, but it's good enough for me.

Re:More secure?

[jt2377]

"If not for Microsoft, consumers might have saved billions on hardware by removing the microsoft tax. Dozens of smaller companies might still be in business."

No such thing as Microsoft tax. There are many companies offer PC without OS or pre-loaded with Linux.(Dell have been doing it for age) Apple is the one with tax. Can you get a Mac without OS X? Typical FUDs. BTW, there are many articles posted on slashdot about how to get refund from Dell for your unwanted Windows. There are more than dozens of ISVs still in business offering Windows apps. You probably mean dozens of small companies working in *nix market. That market was killed by OSS software. Go blame OSS!

Re:Email virus

[intchanter]

An issue with this point of view is that there is no intrinsic difference between code and data, as code is just data that has semantic meaning in the context of a physical or virtual machine.

In order to protect against exploits in "data", the data format must be defined in such a way that it can contain no actions, the operating system and/or hardware must provide a mechanism for quarantining blocks of memory from execution (check out Data Execution Prevention or DEP), and the applications must be written in to allow the protections to work.

The latter is one of the issues with DEP adoption, as some applications use programming tricks for performance or other reasons that blur the distinction, such as self-modifying code.

The process of securing computer systems against malformed data is happening, but like many things, it won't be without its trade-offs.

Lack of OS diversity is the problem

[Quevar]

Bingo!!! Mod up the parent.

Computers would be safer if there was not a dominant OS. If there were equal shares of Windows, Mac OS, and Linux/Unix, then none of them would be as subject to attacks. They would all have flaws, but each one would have different flaws, so viruses and malware could not hit all of them. There would be less attacks per OS and viruses would not be able to spread.

The problem with security is that computers are such a mono-culture entirely based upon Windows. Many viruses attack every version of MS OSes from Windows 95 through XP. That is the problem with security. It's the same issue in biology that genetic diversity is a good thing. Computer do not have it since 80+% of computers run Windows. The best thing that could be done to improve security is to diversify the operating system of all computers. Relying on one company to produce a safe experience has proven to not work.

The article is kind of pointless

[WebCowboy]

If the "market penetration" philosophy were true Unix would have been hacked to bits decades ago.

There is some credence to the "market penetration" argument, because Unix systems WERE "hacked to bits" decades ago, when they were the dominant networkable operating system. Of course, there are always other factors that come into play, and ultimately nothing trumps a robust design for security (which is why BSD and Linux servers running Apache are hacked far less often than Windows/IIS despite haveing a much larger market share).

The article is kind of pointless because it answers the wrong question: there is nothing interesting about what would be different if a corporation other than Microsoft held a monopoly position in mainstream computing software--we all know that nothing would be materially different. If Apple was the monopolist you KNOW it would sit on its laurels and we'd probably have been stuck with MacOS9-based OS until security and stability problems go so baf that they'd have to do something radical. MS' competition is better because it HAS offer something better to be able to survive against the 800 pound gorilla.

If one were to imagine life without a MONOPOLY rather than life without Microsoft the situation would be VASTLY different. Just like genetic variation in a species of wildlife population provides some insurance against extinction, having a diversity of inter-operable computing platforms would provide inherent security against system-wide compromise. Right now, global computing infrastructure is a sickly monoculture that is vulnerable to electronic pandemics.

I think that without Microsoft there is an equally plausible alternative outcome to the one presented in the article: If no one player were to achieve market domination in a timely fashion we'd see growth slowdown and perhaps shakeup, as we did in the home computer hardware market in the 1980s. In order to survive, the remaining players would have to cooperate in terms of observing protocols and standards. One way or another, the market must achieve interoperability, and it happens either by one vendor achieving monopoly or by several vendors cooperating at a certain level.

That is what happened on the hardware side in fact--there was a shakeout, a major player emerged (IBM) and before it achieved an assured monopoly the likes of Phoenix and Compaq reverse-engineered the design and inadvertently created a vendor-neutral open systems specification. Today there is no hardware monopoly in the PC market, and hardware is cheap, plentiful and quite reliable overall. Within the silicon and circuits the designs are radically different, but they all have standard internal bus slots, external peripheral connectors and generally are all able to run the same software.

I'll always wonder why software didn't follow the same path, especially given the culture under which much of it was developed. In the 1970s hobbyists and upstart competitors were inspired by the Altair design to create the S100-bus standard platform around it, even with resistance from MITS against the whole effort. At the same time software enthusiasts and entrepreneurs were sharing software and working towards interoperability (much to the chagrin of BillG at the time). I'm not sure why the software wouldn't follow the path of hardware in terms of this gravitation towards interoperability.

We're actually setting the stage today for another opportunity to establish true interoperability--standards such as POSIX,SUS,LSB are well established (though still too often ignored) and Linux, MacOS and BSD share enough similarities that the idea is becoming feasible. The oft-criticised nature of open source to "re-invent the wheel" is key to making this a success--of course the other half of that success is to make sure all these new wheels will roll on the same set of tracks. I think it is looking promising that more and more Free software developers are starting to take that into consideration.