MS Security Chief Says Windows is Safer Than Linux 713
Kip Winger writes "Mike Nash, Microsoft's Chief Security Executive, has made claims that Windows is more secure than Linux. In a recent online chat, he staunchly defended Microsoft's record on security, basing part of his argument on how Windows Server 2003's 15 patches in the past year are far less than what RedHat or SuSE have had to endure." He also mentioned the recent purchase of Sybari and their Antivirus product.
What about (Score:5, Insightful)
Re:What about (Score:5, Insightful)
And yes, this is flamebait. M$ can't (or won't) secure a paper sack, much less an operating system. More patches from Linux vendors means they're actually working on the freaking problem.
Re:What about (Score:5, Funny)
Re:What about (Score:4, Funny)
Re:What about (Score:5, Insightful)
What about some of the biggest issues in recent history like blaster or code red? Both were patched by Microsoft well in advance of their outbreak. Irresponsible PC users cause a lot of the major security issues in this connected world; you can't put all the blame on Microsoft.
Re:What about (Score:3, Interesting)
Re:What about (Score:5, Insightful)
While the patches for Windows includes faults in, precisely, Windows (which is what I'm guessing that he's referring to by saying "15 patches"), the patch count for Linux distros include patches for all programs in the distro. That includes not only the core parts of the operating system. In the @RISK newsletter I'm recieving from SANS, I see almost only patches for more seldomly used software, such as ncpfs, Konversation, Dillo, xdvizilla, mpg321, and so on.
Considering how a Linux distro probably contains at least 10 times as many software packages as a Windows installation (the vast majority of which are optional to install), I can't see how it would be in Microsoft's favor that they're issuing one third as many patches as Linux distributors do.
Re:What about (Score:3, Insightful)
And it's also not fair to say "It's only the default install" that counts. If I go to SuSE or Red
Re:What about (Score:3, Insightful)
I mean, you get a RedHat install, go online, apply the patches, and then get to work doing whatever it is you want to do.
Now let's go to Microsoft land.
...Install Office, go online, install updates...
You install XP (if it isn't pre-installed), plug it into a firewall, configure firewall, go online, install updates, and then... and then...
[repeat for x pieces of software by miscellaneous different software manufacturers]
And FINALLY get down to doing whatever wor
Re:What about (Score:3, Insightful)
It's still their problem, and that's why they issue patches. It's nothing to worry about, however.
Re:What about (Score:3, Insightful)
Didn't have to go hunting for that one, but then, you only patched one piece of software with it (ok, three, since IE and WMP are part of Windows).
But what about everything else that is installed on your system? When the GDI+ vulnerability was announced, how many programs did you have to update in different locations (are you even sure you updated them all?).
That's one way to do it. Or, if you don't like wasting time, just go wi
Big difference (Score:5, Insightful)
Windows users can't without jumping through MAJOR hoops. (Microsoft claims it is not possible at all, but software like Win98Lite showed people otherwise).
Windows - We cannot install Windows without installing IE.
RedHat, Gentoo, whatever - Lynx, Galeon, Firefox, Mozilla - What browser do you want to use today? Or maybe you don't want any at all! You can make that choice.
A big difference (Score:3, Interesting)
This was NOT the case with the Windows Firewall (which is po
Re:What about (Score:3, Informative)
Also I think that Linux is more securable than Windows. It is not a matter of not being a target, it is a matter of having more modularization in your system so that it is more possible to reasonably secure the computer against attackers and protect critical data in the event that a service is compromised.
Re:What about (Score:5, Insightful)
I agree, but the point is that it is still like comparing apples and oranges.
Better, lets look at the sum of the security vulnerabilities in the following software (with Server 2003):
Server 2003
MS Office (often gets installed on servers)
Internet Explorer
SQL Server
MS Exchange
ISA Server
Etc.
Now we have a fair comparison. These are all shipped by Microsoft and are about as likely to be installed on Windows Servers as the parallel software is to be on Linux servers.
Additionally lets look at vulnerability counts and their severity rather than patches released. That may provide a better picture.
By this logic... (Score:3, Insightful)
What really matters in the end is:
1) The seriousness of exploits
2) The quantity of exploits
3) The imposition placed on IT people in applying patches to fix exploits
If you release a lot of patches but they are readily applied without causing downtime, etc, then that's not a big problem. If a few exploits are found but the exploits are huge gaping holes, that's bad for every
Re:What about (Score:5, Interesting)
Re:What about (Score:5, Insightful)
What microsoft miss, is empirically and objectively your system is in a much higher danger of ACTUALLY getting hacked or virussed or whatever.
Lets see. Comparison time. When was the last virus outbreak that trashed linux systems world wide.
oh
Anyway, to be more fair, the other point is that most of these security bulletins for linux have been of the 'running nethack as root could break system' type pap that doesnt actually increase the chance of a break in in any sensible way. This is compared to the preponderance of serious worm inducing flaws in windows.
Microsoft can bleat as much as they like, and look I'll be honest, props for the fact that modern windows is probably safer than older windows, but this doesnt distract from a simple home truth:
Linux , Solaris and BSD is your best bet for a secure system. VMS if your a complete paranoid freak.
Statistics trumps rhetoric everytime
Re:What about (Score:5, Insightful)
If you're gonna use that angle, then you have to provide the data, or at least point to a source.
Re:What about (Score:4, Informative)
Since Microsoft brought up server operating systems, let's compare Microsoft Windows Server 2003 Enterprise Edition with IIS 6 and Red Hat Enterprise Linux 3 Advanced Server with its default suite of servers (apache, etc.)
For WS2003-EE, microsoft.com reveals [microsoft.com] 12 security bulletins for 2005:
In addition, Secunia lists [secunia.com] 5 unpatched security holes and 1 partial fix:
So it looks like the WS2003-EE/IIS6 combination has been subject to 12 patches in 2005 caused by 16 vulnerabilities with an average criticality of 2, plus 6 unpatched or partially patched vulnerabilities with an average criticality of 4.
Since I'll be getting rid of KDE and Mozilla vulns with RHEL because they're not really used on back-room servers, I'll toss out the IE and HTML Help ones here. That leaves 8 updates patching 10 security holes and an average severity of 2, plus 5 unpatched holes of low severity (mostly local).
Now on to Red Hat Enterprise Linux 3 Advanced Server, for which redhat.com lists [redhat.com] 22 advisories for 2005 (more abbreviated list format):
So so far in 2005, RHEL3-AS has been hit with 22 patches, consisting of 53 individual vulnerabilities of unknown criticality (they didn't say). Taking out the ones effecting packages that aren't part of the base system (that don't really have any match on a backroom Windows server), that still leaves 14 updates fixing 41 vulnerabilities. Secunia, however, shows [secunia.com] none unpatched.
The Secunia site has some good comparative charts, showing that from 1993-today, WS2003 has been hit with fewer problems, with a fewer percentage remotely exploitable, but with a highe
Re:What about (Score:5, Insightful)
a fair comparison would be only counting the patches to the kernel (~5 ?), critical software you can't remove (not sure), and i'd say apache (~ 2-3 ?), and then only the really critical ones (not in useless features that no one use and are disabled by default) (0)
don't get me wrong, i cringe every time there's a security bulletin for the linux kernel, it's a PAIN to fix. even worse than windows in my opinion (since linux servers aren't rebooted as often, you're never sure if the system will come back up properly due to changed lilo/kernel build options/little evil fairie)
Re:What about (Score:5, Informative)
It's got the great advantage of being able to boot any kernel you have, as long as it can access the partition. Screwed up configuration, kernel with a bad filename, etc, all don't matter when you can load any kernel you want from grub's command line.
It's a bit strange in some things, like that it counts disks starting at 0 and not 1, but overall it's quite nice when you get used to it, and it's definitely a lot better than LILO when something unexpected happens.
Re:What about (Score:5, Informative)
It can also boot Windows on an IDE drive that isn't primary master too, something that Windows can't seem to manage by itself.
Re:What about (Score:4, Insightful)
By that count, assuming a Linux distro is doing the right thing and not enabling any daemons unless the user tells it to do so, the number of vulnerabilities in Linux distros should be pretty close to zero. The number of vulnerabilities in Windows would still be 15.
It is not LILO.... (Score:5, Informative)
Usually a bigger issue is that you installed some critical service but forgot to enable it either by dropping symlinks into
When one of my servers needs any new services installed or kernels patched, I actually schedule reboot testing. In fact essentially all of my reboots are due to this testing. It does cut into uptime but it means that when I need it, it will be up.
Re:It is not LILO.... (Score:5, Insightful)
Doesn't everyone do this? Are people really so adamant about having that stupid 300 day uptime that they don't bother doing any testing?
I found the secret long ago that to maintain maximum customer-facing uptime, you never have a single server perform any task. Instead, you use multiple load-balanced servers, with enough redundancy and survivability to handle one server going down for a scheduled reboot. Th euptime on the individual servers becomes nearly meaningless, as the service uptime is what is really important.
Re:What about (Score:5, Insightful)
With Windows on the other hand, everything is a severe and serious vulnerability because if some company, or university, or just your typical hacker finds something, it definitly works and can be exploited simply because they found it. It couldn't have been found without them actually executing the exploit.
There are a million other things though to take into consideration, like what you said about how RH and Suse have tons of other software bundled with them. An interesting thing is that RH, Fedora, and Suse are all (according to secunia) patched from all known vulnerabilities. Windows XP Home and Pro both have 18 unpatched vulnerabilities, at least one of them being "highly critical", and Windows 2003 also has 5 unpatched (out of 44). Software will have bugs, we should try our best to code securely, but its never going to work 100%. What is more important is not how many patches were sent out, but how many haven't been taken care of yet. In RH and Suse's case, they seem to be just fine, but Windows has tons of open flaws. OSS also tends to get patches out way quicker. Whats even cooler is that if RH patches something, then Suse can just use that, and vice versa, talk about efficiency.
Regards,
Steve
Re:What about (Score:3, Interesting)
The problem is, as a couple studies have shown, nobody is actually looking at that code except those that are trying to find exploits. It's not like the vast armies of Open Source coders (guffaw) are constantly combing and re-reading 10-year-old code looking for things they can randomly improve. How many of those coders are actually skilled, experienced, and intelligent enough to both fully understand th
Re:What about (Score:5, Insightful)
"Year-to-date for 2005, Microsoft has fixed 15 vulnerabilities"
"Red Hat Enterprise Linux 3 users have had to patch 34 vulnerabilities"
"SuSE Enterprise Linux 9 users have had to patch over 78 vulnerabilities"
Lets read these carefully, because MS are masters of spin. And we know that nothing they say on these topics arent carefully constructed to *sound* like they mean the same thing, but arent in fact the same thing.
MS says they have patched 15. This is not the same as the number that *need* to be patched, how many are still unpatched.
He says the other 'have had to patch' all this really says that the have been patches for 78 things. The only information we can glean (assuming the numbers are correct) is that that the number of things that have been fixed, also no info on what hasnt been fixed, or how many are outstanding.
So really MS isnt technically comparing the same things.
Please also see this comment [slashdot.org] for another shade of this, being OS patches vs app patches.
Re:What about (Score:3, Informative)
Secunia shows 3 vulnerabilities [secunia.com] for IIS6.
Which version of Apache? Secunia shows different stats for Apache 1.3 than Apache 2 with the later showing more regularity.
Your numbers are off. And the numbers alone don't tell the whole story. You'd be better off doing a bit more digging be
Antispyware (Score:3, Informative)
Re:What about (Score:3, Funny)
I think that I can say for most people here... (Score:5, Insightful)
Microsoft is basing that claim by number of patch distributions, not by size for severity, cute. So, just because they (usually) wait up to a month to release a patch, somehow they are better FUD never had so much meaning. I'd be outraged, but words like this are so expected.
Re:I think that I can say for most people here... (Score:5, Insightful)
So, you state the words spoken between the lines, M$ is saying "forget our track record, forget what we said before, and ignore everything happening on our desktop systems; our server r0x0rs!", or something to that effect.
It's easy to say that one version of a server OS, that is becoming less and less like its' notoriously hole-ridden desktop bretheren, is so much better than *anything* the competition can offer. It's much harder to actually do something about it; considering they've been saying essentially the same thing for several years now, they're not much closer to achieving the goal of a "trusted, secure" OS.
Re:4, insightful? I think not.. (Score:3)
Re:Apples/Oranges (Score:5, Insightful)
The Red Hat advisories include vulnerabilities for Perl, emacs, xpdf, vim, PHP, acroread, ruby, etc.
Red Hat has vulnerabilities for multiple programming languages, multiple mail servers, multiple PDF viewers, and so on. Many of the Linux vulnerabilities are for programs that have Windows versions, but aren't reported as such. Many other Linux vulnerabilities are for programs that aren't included on Windows at all, and are therefore not reported (I don't see any Adobe Acrobat vulnerabilities for Windows).
So comparing the two pages as if they represent equal things is ridiculous.
Re:Apples/Oranges (Score:5, Interesting)
Re:Apples/Oranges (Score:5, Insightful)
not to mention microsofts tendency to roll up multiple patches into one, something redhat/suse can't do because they don't know which packages you have installed, so bugs that affect different packages can't be compbined.
Re:Apples/Oranges (Score:5, Informative)
Re:Apples/Oranges (Score:5, Insightful)
With all of these different tools, and the admin's freedom to install only the tools he/she feels are needed, the Linux world ends up having to create separate security updates for separate tools, where Microsoft tends to release gargantuan security packs that are really a whole mess of patches rolled into one package.
On a similar note, most of the Linux tools come from all sorts of sources operating more or less independently. This would make it all but impossible for you to find a file that includes security updates for both, say, wu-ftpd and Apache.
And the list goes on. The reality is, the model for releasing seucurity updates in Windows is vastly different from the model for releasing them in Linux, and one is natually going to create at least one order of magnitude more discrete security updates. (If I started seeing updates for my software on Linux only as often as I was seeing security updates from Windows, I would think that something is seriously wrong.) What Mr. Nash really needs to be comparing is the relative advantages of the two different models of releasing security updates.
But of course, you're not going to see that since such an analysis can't be plotted in an Excel spreadsheet.
Re:Apples/Oranges (Score:3, Insightful)
Of course it is.... (Score:3, Funny)
No Real Surprise... (Score:3, Insightful)
Knowing this, their only option is to claim that they have the best software.
Re:No Real Surprise... (Score:5, Insightful)
History also shows that any lie that is repeated enough becomes indistinguishable from the truth.
This is true in politics, it's true in entertainment and it's true in business.
Re:No Real Surprise... (Score:3, Informative)
History also shows that any lie that is repeated enough becomes indistinguishable from the truth.
The Big Lie was invented by the French in the 12th century and made infamous in modern times by the Germans. I don't think the problem is uniquely American.
Saying things makes them true. (Score:5, Interesting)
Or at the very least, you might at least fool some people enough to continue to give you money.
That's exactly how the Bush administration works (Score:3, Insightful)
"If you can just manage to say something that gets picked up by major news organizations, then it might make it come true.
Or at the very least, you might at least fool some people enough to continue to give you money."
Correct. It's called PR, and it works. Microsoft does it all the time, spewing out completely false or misleading statements knowing those will get the headlines. Corrections get buried on page 17.
The Bush administration has carried this out to a fine art. They make a grandiose annou
All true (Score:5, Funny)
I connect my fresh installed XP system directly to the internet and I can go months before I get any malicous programs on my computer.
hmm, or do I have that backwards?
Re:All true (Score:3, Informative)
While Windows popularity does increase it's attractiveness for malware writers, I don't think that is the only reason. Look at Apache vs. IIS. Apache has something like 69% of the market while IIS has about 21% (Feb 2005 Netcraft numbers). Better than a three to one ratio. Yet look how many viruses/worms there are from each. Hint: my (really quick) research showed about 14-16 (depends on how you coun
That reminds me ... (Score:3, Funny)
Credibility and Redmond? (Score:5, Insightful)
Re:Credibility and Redmond? (Score:5, Insightful)
Worst of all, though, is that if Information Week or any other "I'm an important IT person and I read industry publications" magazine carries a story on the front page that says "Microsoft Security Chief: Windows More Secure Than Windows," than 3-4 days after they saw the story (and maybe not even read it), your average PHB will just remember the "You know, I seem to remember recently that someone came out and said Windows was more secure than Linux. I don't remember how they proved it or where I saw it, but I distinctly remember it..."
Which is why I do think there's value in a vigorous response and a careful analysis of the claims in an effort to make sure we're ready to vehemently argue against this insanity.
FUD (Score:4, Insightful)
- if you compare RedHat/SuSE then you have to compare it to Windows Server + complete BackOffice + complete Visual Studio + complete MS Office and you still are not close enough...
- I'd be interested in average time to fix critical bugs...
- also number of known un-fixed cricital bugs will be interesting (incl. IE on Windows)
Request new Slashdot Section (Score:5, Funny)
Not Surprised (Score:5, Insightful)
What does everyone think he's supposed to say? Windows security is inferior to linux? He'd lose his job.
From TFA... (Score:5, Insightful)
This actually brings up an interesting point. Does Windows have less bugs (I know, I know) than these Linux distros? Or are Red Hat and Novell more proactive to fix the bugs they do have? Unfortunately, my guess is most PHBs would think the former.
Re:From TFA... (Score:3, Informative)
Actually, I think a more important question is, how significant of a security risk are the respective bugs?
The claim is that MS had less vulnerabilities than various Linux distros. Yet, I'd be willing to bet many of the Windows security holes are big enough to drive a truck through. Remote exploits and the like. If th
Re:From TFA... (Score:3, Insightful)
The fact that you can break linux down into kernel, library, and application bugs, and with Windows you really can't.
Also, did MS also include patches to WinAmp, mIRC, etc? Of course not. They package one window manager, one filesystem, one kernel, one webserver, one sql server, one browser. Even at a patch per package ratio, they are losing.
Re:From TFA... (Score:3, Insightful)
The other big thing about the difference in the number of patches is that a windows patch may actually patch a number of libraries, where as with Linux each would be a different patch.
I do agree that overall Linux distributions do tend to have more patches than windows, but that's largely because Linux distrib
And later.. (Score:5, Funny)
Quoted from the article... (Score:3, Insightful)
What is a 'resonable metric'? Is that one that only provides the results that one wishes to see or is that a metric provided by a reputable security organization that is known for being extremely truthful and accurate in its results?
Windows and Red Hat (Score:5, Informative)
Windows and Red Hat - some statistics (Score:3, Informative)
Red Hat currently, 0 out of 133 Secunia advisories
Based on flaws in 64 different packages out of a total of 477 packages.
Lets compare that against the Windows Server 2003 Enterprise edition. All of these defects are against the core Windows operating system. You have to go to the other Microsoft
Proactive vs. Reactive (Score:3, Insightful)
When Microsoft releases a patch it's usually because thousands of users have already been complaining about something and they have to address it in a reactive mode. In Linux, someone makes a discovery of a security flaw, contact's the vendor, and it's usually patched within a couple of days. Note that within that discovery, everyone is still happy as a clam because there haven't been 50,000 trojan's trying to exploit it.
no patches available? (Score:5, Insightful)
Notably, the RedHat and Suse links list a higher number of vulnerabilities, but also state that there are ZERO unpatched security holes.
Surprisingly, the Windows 2003 product still has unpatched holes.
Re:no patches available? (Score:3, Insightful)
Even with the bundle with the os to conquer strategy, MS carries much less. The fair comparisson would to compare the security of MS Office + all MS Servers + MSDN + other things.
Re:What really matters (Score:3, Insightful)
The exploits are not all that matters: What exploits are in the wild? What exploits are unpatched? What exploits are self-reported (found by the developers themselves)? What services are affected by the exploit? What is the exploit's payload and how does it impact the use of the machine?
When trying to determine whether one OS is more secure than another, I think you need to look at a
typical MS solution (Score:3, Insightful)
Solution: Have your Security Chief claim that your products are more secure than the competition.
User experience (Score:5, Interesting)
1. reboot computer - It'd hung running something the rhymes with Titborrent.
2. Login prompt -log in
3. Get a start button, click on it to start a browser
3a. lose focus as MS is saying AVG isn't turned on. (It's not?)
4. Hit start again to get a browser
4a. Lose focus again as AVG says it's not working.
5. Press start to start a browser.
5a. Lose focus as the UPS monitoring tool adversises that it's HERE! PRESENT! ACCOUNTED FOR!
6. Press Start to get a browser.
6a. Lose focus AGAIN as MS spyware gives me a status update.
7. go over to the iBook, it doesn't Constantly Interrupt Your Train of Thought At Every Opportunity!
You need to configure this option... (Score:5, Funny)
HTH.
Re:User experience (Score:3, Insightful)
Here, you can buy this house that has everything working, looks nice, great house, 300k, or you can buy this house right next door, the plumbing is shot, the kitchen needs to be redone, the flooring is 15 years old and needs to be replaced, and you can have it today for the bargain basemen
Normal Activities (Score:3, Insightful)
People are funny.
Microsoft is a corporation. It needs a base of support to exist. Pausing in its creation of "new and improved!" products to backtrack and actually fix anything is not additive to the bottom line (profit).
Therefore, MS will never fix anything. They will merely use PR to promote their products. If falsehoods are created and spread, they will focus on the person who created that lie, not the legal individual Microsoft. (Corps. are equivalent to living people in most states but that's a rant for another time.)
Q.E.D., nothing to see here. Move along.
If Internet Explorer is any indication ... (Score:5, Insightful)
Second, comparing Internet Explorer (IE) and Firefox indicates that Windows is likely more bug ridden than major open-source software like Linux. I have used both IE and Firefox. From my experience of visiting thousands of pornographic sites laden with naked women beckoning you to "enter" their site (and other things), I can definitely say that IE is chock full of security problems. After 1 week of pornographic surfing with IE, my entire system (browser and OS) becomes infected with malware -- to the point that I must reload Windows. I have yet to experience the same problem with Firefox.
The only thing that I hate about Firefox is that it is very slow, probably due to the fact that my computer system has limited DRAM and that Firefox must swap to disk more often than IE. Such is the price that I must pay to enjoy porn.
just think (Score:5, Insightful)
Mandatory Access Controls (Score:5, Informative)
Yes Fedora currently has SELinux in the default install. Unfortunately they have had to use a fairly permissive policy because too many applications and libraries don't properly respect the sort of security bounds that ought to be in place. Right now SELinux on Fedora is like user account permissions on Windows. While it is technically there, the majority of applications simply aren't written with it in mind (eg. all those Windows apps that need to run as Administrator), so in practice it doesn't do much.
SELinux is done though, and Fedora has integrated it in nicely (including into the rpm system). What is needed now is for all those open source developers out there to realise that there is a new level of security, other than just filem permissions, that they need to consider and respect. If they can just restrict where they write files to, and what files they want to access to the minimum required that would be great. If they can compartmentalize operations so that each can run as a seperate process with least privilege all the better. This is work that needs to be done though.
Once such things are seriously in place all this harping by Microsoft about "Windows being more secure" will be so obviously the hot air that it is that we won't even have to worry about it anymore.
Jedidiah.
Re:Mandatory Access Controls (Score:3, Insightful)
Immutable files on BSD require the same kind of care... but remember, Windows has this problem in a far worse way, because Microsoft's need to remain compatible with apps that ran on the old DOS-based Windows means that they have to accomodate programs that assumed they
One of the problems with the Linux name. (Score:3, Informative)
A better metric (Score:3, Insightful)
How about:
(# installations w/ active malware, spyware, trojans or viruses)
(# installations)
This seems a much fairer criteria with respect to the notion of being "more secure." And one, IMHO, I imagine isn't very favorable to MS.
The sad thing is... (Score:3, Insightful)
Because M$ is more reputatable than Red Hat or Novell, the general public will much more likely consider their claims to be true. Oh well. At least it makes for a good laugh for us
Linux Vs Windows (Score:5, Insightful)
Just do a search for Sendmail Vulnerabilities on google.
Result =
Results 1 - 10 of about 143,000 for Sendmail Vulnerabilities. (0.39 seconds).
for Microsoft
Result =
Results 1 - 10 of about 364,000 for Microsoft Exchange Vulnerabilities. (0.18 seconds).
You can have this discussion for days on end, and really, what the *nix community has up on the M$ community is knowledge and ability. No, there arent any viruses that are successfully written for *nix. Spyware isnt even remotely a concept to a linux user. And most vulnerabilities get patched as quickly as they are given POC. Does this mean that linux users patch any more or less than Windows users, no. But we do it more effeciently and with greater success.
Stability wise , come on. Ive got a redhat 7.3 box that baring powerfailures hasnt been rebooted in over a year. Its a good box, it would probably take an Arkady Rossovich low yeild nuke on its head and still live, and I dont know of any windows box thats able to admit that.
Yet another example (Score:5, Informative)
Sure, WINDOWS only had 15 patches in the last year however. IE6 had how many (at least anotehr 18-24), Remote desktop connection on 2k3 Server had 2 security fixes, IIS had about 6 patches....
Need I continue?
Fact is, yes, Windows had 12 updates in a year, but it's components had many more.
And also looking at the time from exploit discovery to fix, not lookin good for them there either.
There's not a chance of being safer... (Score:3, Informative)
So long as installers run without requiring passwords, and I have to give my daughter administrator privileges to run Disney games, Windows is in for a lot of hurt in the security domain because there's really no way to control what users, and by proxy the programs they run, muck with.
I mean, it's so bad right now that whole markets spawned to supply band-aids for the lack of basic protections (anti-virus, anti-spyware), and to rebuild broken systems as quickly as possible (ghost). That's pathetic, particularly since Microsoft had the ability to do a much better job of securing their systems since the release of Windows NT in 1993, and it's been mainstream since XP. It's not that they couldn't do it, it's that they didn't.
The numbers game: thanks Microsoft! (Score:5, Funny)
(1) Don't write a patch, since that admits failure or insecure products.
or
(2) Wait a long time before writing and committing a patch, so you can do it as "one big patch" (otherwise known as, haha, a Service Pack!).
Thanks Microsoft! Just your STATEMENTS make systems less secure (nevermind your engineering).
There's a story about... (Score:3, Funny)
The lecturer was, apparently, talking about the problems in writing mission-critical embedded devices, and at one point he asks his audience: "You all write embedded systems software. Tell me honestly; if your company wrote the software for a 747, how many of you would actually feel comfortable on board one?"
One hand goes up.
"You, sir! You're so confident in your software you'd trust your life to it?"
"Hell, no," comes the reply. "But any plane running my team's software would never crash, because it'd never get off the ground..."
I am confident in the level of safety given by running Windows on a mission-critical device.
Article is missing the last half of the quote (Score:5, Funny)
You're all doing the math wrong... (Score:3, Insightful)
Humor aside, counting patches is about as good of a way to determine security as counting car crashes to determine what is the safest car.
This is so 90's (Score:3, Insightful)
Any given OS, in the hands of an expert, is just as stable or secure as the next. There's just no way to effectively prove otherwise. The test domain to definitively prove which OS is truly the most secure is incredibly huge. As long as human beings code it, it's insecure. There is no version of Unix or Linux that has a higher Evaluation Assurance Level [commoncriteriaportal.org] than Windows 2000. That doesn't necessarily mean that any novice could actually secure it either.
Reality is that Windows has a huge number of desktop installations and it's used by a large number of people that can't even open up Notepad or a command prompt if you asked them to. Those same people couldn't even install Linux so it's not reasonable to even suggest. So, how are they supposed to have any idea about security? Most of them can barely get online. It's no fluke that AOL and Windows are as popular as they are - they're easy to use and they have a small learning curve.
Furthermore, Linux and Windows are so different that's almost ridiculous to even compare them. They solve different problems, they both have their strengths and weaknesses, and other than the fact that they're both operating systems they don't have much else in common. In many ways comparing those two systems is like comparing an F-16 to a Leer jet - they both fly; they both have wings; they both have cockpits, throttles, and tails; they're both airplanes but they don't look the same; they don't have the same internal components; they aren't operated the same; and they aren't made for the same purpose.
Security arguments are out of style. It's safe to say that no major software maker is intentionally designing insecure software. Move on. Innovate. Come up with something original.
Comment removed (Score:3, Insightful)
Re:It's all about patch management (Score:3, Insightful)
If you can't figure out how to script a remote update, you shouldn't be making the decisions about which updates to apply.
For an example of triviality, run an hourly cron on a remote machine that does "rpm -Fvh
Re:It's all about patch management (Score:3, Informative)
GP is Yet Another Silly Windows Cluebie (YASWC).
People still don't get it (Score:3, Informative)
If you want to compare bug numbers, it's only realistic when you count the number of bugs in the kernel compared to the windows base OS.
Testing only shows the existence... (Score:3, Insightful)
You can't really claim that one piece of software is more stable or secure than another by using the number of vunerabilities fixed as the only argument. According to this flawed logic, I could write a large piece of software, run one test, work fine for that one test, and claim that mine is more stable than another piece of software that has been thoroughly tested and has had bugfixes.
I guess Nash has also forgotten the old saying that testing can only show the existence of bugs, not the absense.
stating the obvious (Score:3, Insightful)
umm... yeah. BIG SURPRISE, FOLKS.
MS employee says Windows is safer because... (Score:5, Funny)
Re:MS employee says Windows is safer because... (Score:3, Funny)
Yes, but he's got a great future in sales and marketing! Actually, he probably IS in sales and marketing.
Re:In other news.... (Score:3, Funny)
Re:Microsoft is indeed safter than Linux* (Score:3, Funny)
There's nothing baffling about pulling the ethernet plug.
Re:If I was getting paid a lot (Score:3, Funny)
Re:Of course the don't include... (Score:5, Interesting)
Secunia totals are...
Server 2003; 5 unpatched of 44
Office; 2 unpatched of 7
Exchange 2003; 1 unpatched of 3
IIS 6; 1 unpatched of 3
SQL Server 2000; 1 unpatched of 10
Total; 10 unpatched of 67
Justin. /. should let me use tabs. So there.
Apologies for the crap formatting,
Re:Its as secure as you make it. (Score:3, Insightful)
I can install Debian, or Gentoo, or whatever else is popular this week, on a machine with a direct internet connection, without worrying about crap getting into it.
However, if I try to do that with a Windows box, it gets broken into in minutes! And I know because I tried, several times to install Win2K on a friend's computer and get the patches before the virus got to me. I failed. It was infected each time, between 1 to 5 minutes from booting. That's completely unac