Linux/Unix Tops Charts for Vulnerabilities in 2005 438
BeanBunny writes "I realize that this topic is almost as volatile around here as Intelligent Design, but I think this is interesting nonetheless. US-CERT has released their year-end vulnerability summary. According to InformationWeek.com, Linux/Unix (including Mac OS) had almost three times the number of OS-specific vulnerabilities reported last year compared to Microsoft Windows. Obviously, statistics are meaningless without the proper conjecture, speculation, and opinionation, so let the debate begin again over which OS is really more secure."
One Take (Score:5, Insightful)
Who knows how many Windows vulnerabilities there are known to Microsoft? Can you say "Vested Interest"? They certainly have tried to have divulging them criminalized as an act against national security, never mind warning customers of all sizes that they may have been compromised while Microsoft fiddled away at a patch for the past six months.
I take this sort of revelation with a grain of salt and give it as much weight.
many eyes only make for strong code when the code can be seen
Yes, indeed. (Score:5, Insightful)
Linux (Red Hat to be specific) reported AND HAD ALREADY fixed similar JPG/GIF/PNG flaws more than 2 years before microsoft ACKNOWLEDGED that they had similar flaws. It may have been the same bug, or not, but still, similar bugs, FAR different timetables. And these are both companies right? One did base itself on code that it didn't try to lynch you for viewing, modifying or making your own. Hint: it wasn't microsoft.
--------------
What does it take for open source (being open to all) to report a flaw?
Finding it of course.
What does it take for a huge software house with stock to shill... errrr.. sell (since product sales do not a stock value raise anymore).
Reporting few security flaws. "Proving" successful implementations are the norm... (via bought studies of course, and occasional true stories, if they ever are unbiased).
--------------
And of course, having worked inside an IT house, I'm quite familiar with how they work... especially M$ partners. I've never seen a SINGLE one ever report a vulnerability... whether our fault or the customer's or anyone's. Until it was fixed, or exploited, we NEVER EVER reported them... standard policy.
~D
BeanBunny is a known troll (Score:5, Insightful)
OFF TOPIC -- Good suggestion here, CowboyNeal! (Score:5, Interesting)
Why not make this one of a subscriber's privileges?
Re:OFF TOPIC -- Good suggestion here, CowboyNeal! (Score:5, Interesting)
Re:BeanBunny is a known troll (Score:5, Insightful)
To really get a picture of how the OSes themselves stack up in comparison to one another with respect to vulnerabilities, try Secunia. [secunia.com] They list vulnerabilities, and how severe a vulneraiblity is, and why a given vulnerability is a problem, along with other interesting and relavent info about vulnerabilities.
Re:Suuuuure (Score:5, Informative)
All of them?
I know your point: that the INITIAL discovery and exploit is not typically found by looking at the code. But to fix vulnerable code, one must FIND and edit it. The point is, once an exploit is discovered, there are many people who can locate the faulty code and fix it fast.
Open Source is a good thing. Really, what is the down side of source code availability?
Comment removed (Score:4, Insightful)
Re:Suuuuure (Score:3, Interesting)
Re:Suuuuure (Score:4, Funny)
The inability to maintain a monopoly by using scare tactics?
Re:Suuuuure (Score:4, Informative)
All the bugs I find and report which result in Advisories [shellcode.org] are as a result of source code auditing [debian.org].
It looks like I made the CERT list a couple of times, e.g. uw-imapproxy [us-cert.gov].
But these bugs are trivial things in applications which are either "extra", or not typically installed.
Fixing bugs in programs is important, but having a list of 500 simple buffer overflows in rarely used games (for example) on Linux says nothing about the relative security of Linux vs. Windows.
The worlds are too different, comparing every application included in Debian, say, against Windows would only make sense if you installed every single shareware/freeware/optional piece of software on the windows machine - and that clearly isn't a real world scenario.
Re:Suuuuure (Score:4, Funny)
You should look at the list. http://www.us-cert.gov/cas/bulletins/SB2005.html [us-cert.gov] Hardly any are "rarely used games", unless "Multiple Vendors Linux Kernel Asynchronous Input/Output Local Denial Of Service" is the latest FPS...
Re:Yes, indeed. (Score:3, Interesting)
On a unix system, if you find something, anything, with serious enough flaws, often you can just rm it or chmod -x it until a new version is available. It'll break some things, for sure; but you have to weigh up whether the
How about pointing out... (Score:5, Insightful)
I'm sure all the GM, Toyota and Honda cars between 1970 and 1990 put together had more design flaws than the Ford Pinto, but this comparison is not relevant.
Re:How about pointing out... (Score:5, Insightful)
In other words:
There are at least 12 distinct operating systems in their list - Solaris, Cisco, SCO Unixware, OpenBSD, FreeBSD, NetBSD, HP-UX, AIX, HP Tru64, MacOS X, Linux variants like SuSE, Debian, Gentoo, RedHat (I counted Linux as one, even though most of the vulns. are found in their specific configuration/management tools). Add an arbitrary number of applications: KDE and GNOME, that in itself has more apps that are counted for Windows, every free SQL database server, mail server, (LotusDomino for Christ's sake!), imap client, ftp client, ftp server, etc...
Now we have a comparison of a single operating system (Windows) + apps running on it with at least 12 distinct operating systems + 10x the number of apps that was counted for windows. The result is rather surprising: there are JUST 4x more bugs in 12 operating systems + 10x more apps than in windows + windows apps alone! This result is much more unfavorable for Microsoft than to any Unix/Linux OS!
Of course, the fallacy of the comparison is that it suggests that Linux or Unix is an Operating System. For someone who does not look at the details, it might seem that installing a specific Linux or Unix operating system is more risky - hey, there are more bugs found in Linux/Unix, that's what the article says! In fact, the opposite is true, if you look at the details.
Not that the comparison is useful in any way - why are Safari bugs counted at all? Safari runs on OS X only, so you can't just dump safari bugs into linux/unix bugs category (how retarded is that?). Why are bugs found in SuSE YAST counted as Linux bugs? They have nothing to do with linux or unix - they are specific to one operating system: SuSE linux (the same applies for all the bugs counted in Debian, RedHat, Gentoo, etc.) Not to mention the duplications: Eric Raymonds "Fetchmail POP3 Client Buffer Overflow" is counted 5 times for linux and BSDs. There are duplications for windows as well though. In other words, this list or comparison is pretty much unusable.
Re:How about pointing out... (Score:4, Insightful)
To be fair, Windows is not the monolithic program you suggest. Windows NT is different from Windows 98. Windows 98 is different from Windows ME. ME is different from 2000. 2000 is different from XP. XP is different from 2003. Each has a similar, but different, code base with their own bugs.
To Microsoft's advantage, Window's code similarity means that a bug found in Windows 2003 can be traced and squashed in Windows 2000 and XP. This results in the bug being removed in all flavors of Windows simultaneously. However, that would be impossible with the various *nixes.
Either way, I agree with Mark Twain. There are lies, damned lies, and statistics.
Re:How about pointing out... (Score:3, Informative)
If there is a security hole with Konquror browsing files on KDE then KDE issues a patch and it should mostly work on all of the various systems it runs on.
Re:How about pointing out... (Score:3, Insightful)
Re:How about pointing out... (Score:5, Informative)
Re:How about pointing out... (Score:3, Informative)
See this story over at Groklaw [groklaw.net]
Worse than that (Score:3, Informative)
Re:How about pointing out... (Score:5, Informative)
Re:How about pointing out... (Score:5, Insightful)
If you look at all holes in the Linux kernel and base GNU utils vs. all holes in the Windows kernel and in the Windows core OS, you'll notice that Windows has many, many more. And the ones that Linux has are things like "temporary file permissions vulnerability" whereas Windows has ones like "arbitrary user from the network can flash your bios with the byte sequence 'lolololol pwnd'". Personally, I'd rather have someone read my sudoers file than hose my BIOS, but hey... at least windows has cool games or something.
Re:How about pointing out... (Score:3, Insightful)
There are also some, like the shell:// vuln that was attributed to firefox, but was actually a vulnerability in the core windows os and therefore wasn't exploitable through firefox on any other platform.
Re:How about pointing out... (Score:5, Insightful)
I was originally going to have a disclaimer stating that these numbers are accurate probably to within +-30, but since they were so close, I don't think it's necessary. One observation I've noted is that the Linux vulnerabilities are spread over a far greater variety of applications. Another thing worth noting is that it looks like Windows can not easily be effectively secured as long as security updates are done as they are currently. Most linux distros (Red Hat/Fedora, Suse, Debian, Gentoo, etc.. off the top of my head) provide a central repository that will update everything on your system for you. This appears to be a much more optimal method of applying updates. If nothing else, these results show that not just core functionality, but also supporting functionalities must be kept up to date and are just as much of a security problem, if not more so. Linux distributions support such update methodolgies natively, Windows does not.
It appears that Linux is the winner here no matter how you look at it, and we didn't even begin to look at severity or the time from disclosure to time patched (which isn't available using the information in the report, but my inclination is to say that open source wins hands down here, call me biased if you will). For the files that I referenced and modified to get these numbers, you can get the windows list here [krenzel.info] and the first linux list here [krenzel.info] (the one with 784 exploits, not 669). These lists are not 100% accurate as I'm sure the regexs I used missed some things, or were too greedy in other cases. I also did some manual pruning that wasnt appropriate to be done with regexs, which I'm sure wasn't 100% accurate either, but these lists are close.
Regards,
Steve
Re:Mod Parent Up (Score:3)
A single worm is unlikely to affect such a large proportion of users, since they will be spread out among different unixes and different distributions of linux etc..
Windows on the other hand, has a few distinct versions which are easily identifiable and easy to target in exploits.. The dcom worms for instance, differentiated between XP and 2000 and used appropriate parameters.
Re:One Take (Score:3, Interesting)
Not only that; the comparison is Linux/Unix including MacOS... How many kernels are we talking about here? There's the Linux kernel, 3 different BSD kernels, the MacOS kernel based on BSD (I assume it's different enough to count as a separate kernel, don't really know), HP-UX, AIX, SCO Unixware, Solaris (just check the vulnerability list) and probably some other Unix variants I forgot to mention compared against one OS. Yeah, sure, there's different Windows versions out there, but all Windows XP "distros"
Re:One Take (Score:5, Funny)
(source) [imdb.com]
Even worse, the way the stats are grouped!!!! (Score:3, Informative)
Basically UNIX (BSD, Solaris, AIX, IRIX, SCO, OS X), and ALL LINUX distributions are counts as ONE (1) bin, against MS Windows!!! So, have basically EVERY popular mainstream operating system other then Windows in one bin and windows in another, and you are trying to toute THAT as a stat that Windows has less flaws then Unix/Linux? S
perfect place to discuss, though! (Score:5, Insightful)
It may be a volatile topic, but where better to discuss the reality, validity, etc., of these purported vulnerabilities?
Get your education here (hopefully) so you can address the confrontations at work, from your friends, etc. when they accuse you of evangelizing an OS more vulnerable than Windows!
Look for answers to:
I'm sure this is a partial list, and I don't know the answers to these points, but I'd like to.
Re:perfect place to discuss, though (Score:3, Funny)
How about we don't and just say we did, better yet, whichever side you agree with, it won the debate.
Re:perfect place to discuss, though (Score:5, Insightful)
Since this is a dupe debate (it happens ALL the time) why not just link to the previous list of comments? I'm not even going to read TFA, because these useless debates have gotten to be a waste of time. There's no winning this debate - we're all losers for having editors who think that this is "news".
Here's a quick answer: (Score:5, Interesting)
I counted the lines and there are 2,329 lines.
Here's an example of 10 of them:
# BZip2 File Permission Modification
# BZip2 File Permission Modification (Updated)
# BZip2 File Permission Modification (Updated)
# BZip2 File Permission Modification (Updated)
# BZip2 File Permission Modification (Updated)
# BZip2 File Permission Modification (Updated)
# BZip2 File Permission Modification (Updated)
# BZip2 File Permission Modification (Updated)
# BZip2 File Permission Modification (Updated)
# BZip2 File Permission Modification (Updated)
Yep. BZip2 is listed 10 times, but the reference to each of them reads the same:
And then they list 10 different distributions. Hmmmmm
So, one problem in BZip2 == 10 counts of "problems".
Re:Here's a quick answer: (Score:5, Interesting)
cat usoft.txt| sed -e 's/(U|updated)//g' | sort | uniq | wc
747 lines
cat unix.txt| sed -e 's/ *(Updated) *//g' | sort | uniq | wc
1050 lines
That brings them almost in line with each other. Of course, we could do a half-assed job of cutting things down to just the OS to remove concerns about all the bundled apps;
cat usoft.txt| grep Microsoft | sed -e 's/(U|updated)//g' | sort | uniq | wc
160 lines
cat unix.txt| egrep '((K|k)ernel)|(GNU)|(XFree86)' | sed -e 's/ *(Updated) *//g' | sort | uniq | wc # GNU/Linux, not Linux!
167 lines
Of course, any of this would be far too much work for the author of the article.
Re:Here's a quick answer: (Score:3, Insightful)
sed -e(expression) 's(search)/(U|updated)(search regex)/(empty replacement text)/g(global)'
So:
1
2
1 (Updated)
1 (updated)
2 (Updated)
Becomes: (through sed)
1
2
1
1
2
Becomes: (through sort)
1
1
1
2
2
Would drop to simply: (through uniq)
1
2
And then "wc" c
Re:Here's a quick answer: (Score:3, Funny)
From the FA: (Score:5, Insightful)
In other words, these findings are absolutely useless.
Also, even if they DID filter out updates and break out individual vulnerabilities, you would still have to know for how many days each vulnerability remained unpatched to have any useful information.
As this oh-so-well-written website told me the first time I clicked on this story, "Nothing to see here. Move along."
So what's new? (Score:2)
Anything new compared to the earlier article in the Washington Post [slashdot.org]?
Re:So what's new? (Score:3, Funny)
=)
Whats funny is (Score:2, Insightful)
Re:Whats funny is (Score:2)
Along with the total numbers... (Score:5, Insightful)
Re:Along with the total numbers... (Score:2)
Severity would also help. It would be good to know which were local exploits vs remote exploits and if the exploit was because of a certain option turned on or off. I know there are several OS exploits in FreeBSD, but if your are not running bind or ssh you wont be affected.
Talking ab
Re:Along with the total numbers... (Score:5, Informative)
It's also not intelligent to group together all Unix derived operating systems, as they all follow completely different security structures, development paradigms, and grouping them is simply serving to inflate already misleading numbers. The fact is that the only thing this list clearly shows is that open source projects are much better at following up on security problems(noting all of the updates), and that there are far more applications that run under *nix than under Windows once you account for all of the at least semi-popular open source projects.
Regards,
Steve
Dupe (Score:3, Informative)
Already hashed over in depth on GrokLaw (Score:5, Informative)
This is old news. PJ has done a pretty thorough job debunking this one on Groklaw [groklaw.net].
TFA sums it up: (Score:5, Insightful)
In effect: This information is completely useless for comparing operating systems.
Re:Already hashed over in depth on GrokLaw (Score:4, Insightful)
Now PJ is a security expert?
No. But she has access to a lot of people who are very informed.
It's amazing what the community can do when organized by a good leader.
Vulns you won't see listed (Score:3, Insightful)
In the Linux section there would be a similar block for : "Clueless user -- caused hard drive format"
Yeah. That was wanton. Sure, okay. I agree. It's probably true that most OSS vulns are reported to public forums while most MS vulns probably get identified in house and rolled into a patch. Maybe. In 6 months or so after the devs have had fun with it for a while.
Re:Vulns you won't see listed (Score:3, Interesting)
the thing about the list.... (Score:3, Informative)
Re:the thing about the list.... (Score:2)
Re:the thing about the list.... (Score:2)
Ok, so if you throw out all 141 "updated" occurrences in the Microsoft section, that leaves 671 (812-141=671). If you throw out all 1437 "updated" occurences in the linux/unix secion, that leaves 891 (2328-1437=891). Subtracting Apple OS X (130) and Sun Solaris (77), Linux/Unix ends up with less vulnerabilities than Windows (891-130-77=684).
Re:the thing about the list.... (Score:3, Insightful)
The proper thing to do if someone wants to argue about whether or not the inaccuracies are technically balanced is to categorize them (multiple listings, updates, more than one OS in Linux, 3rd part apps) and then ask them to be moot or, if that's denied, cede them outright.
Then you can move on to the real topics... if there are any left.
Re:the thing about the list.... (Score:3, Interesting)
Top 10 by bugs listed -
* GNU GZip Directory Traversal 13
* Multiple Vendors LibXPM Bitmap_unit Integer Overflow 13
* Multiple Vendors Linux Kernel Multiple Vulnerabilities 13
Oh good grief... (Score:3)
One possible take (Score:2, Insightful)
BUT (Score:2)
Also, with as many DIFFERENCES as there are between, say Apple, Sun, SCO, Linux
If you wanted to be more specific, then add up vulnerabilities for EACH
The bigger question (Score:2)
Distribution patches (Score:2)
Re:Distribution patches (Score:2)
Do you realize just what you're saying? (Score:2, Insightful)
This is beyond any doubt, very very true. But before you call me a Microsoft Shill (I'm not, I use Debian myself), allow me to explain:
If one goes to www.linux.org, and searches for all GNU/Linux distros without a filter, they will see that there are 370 distributions. If that includes unmaintained ones, that number grows to 417. And that does not include all of the other Unixes, such as the BSD group, and, like the article pointed out, Mac OSX.
No
only 3x ? (Score:2, Insightful)
And the "linux" and "osx" ones are "Unix/ Linux Operating Systems"
Seeing as "windows" ones are Windows and "linux" and "osx" are Linus, OS X, Solaris, IRIX, AIX, HPUX, Tru64, *BSD, SCO, etc., etc., I think 3x is not too bad as there are more than 3x the number of distinct operating systems.
That's without even looking at what might be classified as "application" versus "os" vulnerabilities in each category.
Re:only 3x ? (Score:2)
So looking at the data set what other inconsistencies do you see which don't line up with the actual reality of the situation?
Regardless of the validity of the article... (Score:4, Insightful)
Even if a vulnerability is reported and then fixed quickly, the fact remains that it could've been used for dozens or hundreds (or more) exploits *before* it was reported.
It's not just a matter of "see, look how quickly we can bail water out of the boat." There's also the question of how many holes were in the hull to begin with.
I'm not saying that any particular platform is put together better than any other, just that it is a topic worth discussing.
Maybe if they would filter out the duplicates... (Score:2)
Dear Slashdot, (Score:5, Funny)
I'm offended by the latest comparison of and . The linked article offers no measurable insight, and is exactly the kind of flamebait that bores the
Please change your editorial practices to fit my tastes better.
ComplaintGen (R) - 2006
Re:Dear Slashdot, (Score:5, Funny)
Slashdot EeziPost (TM) MK 1.1.01
#NB: For obvious reasons, the first option is ENABLED by default - remember to turn off if you are NOT responding to a dupe
[ ] Another: [ ] Dupe [ ] Slashvertisment [X ] WTF [ ] $editor is a dork
[ ] Frist psot [ ] $link_to_GNAA [ ] $link_to_goatse [ ] $random_drivel
[ ] I Haven't RTFA, but... $random_self_opinionated_comment
[ ] [$Slashdot_reader] writes, "[$pundit] wrote an article about [$Technology_we're_not_currently_fond_of], based on conjecture and personal opinion. Does this mean that [$Technology_flavor_of_the_month] is taking over?
[ ] Slashdotted already!. I bet their server runs on $topic_item too!
[ ] I am not qualified to respond to this article, but I will give you my insight anyway..
[ ] Here's a plug for my blog / Web site disguised as an insightful comment (I need the ad revenue)
[ ] Next they'll be patenting 'A method of replying to a Slashdot posts using a form containing pre-defined response options'
[X] Mod Parent [X] up [ ] Down
[ ] Fsck: [ ] Sony [ ] SCO [ ] Micro$oft [ ] DMCA [ ] DRM [ ] MPAA [ ] RIAA [ ] Google [ ] Bush [ ] You all
[ ] I for one welcome our new $topic_item overlords
[ ] Imagine a beowulf cluster of those
[ ] In Soviet Russia, $topic_item owns you!
[ ] Meh!
[ ] You must be new here!
[ ] Netcraft confirms $topic_item is: [ ] dead [ ] dying
[ ] But have the inventors thought of what will happen if $random_amateur_insight
[ ] You insensitive clod
[ ] Torrent, anyone?
[ ] Here's a link to a patch: $random_linux_distro_url
[ ] "Yeah, but does it run Linux?"; if($summary has 'linux') add " Oh, wait..."
[ ] Profit!!
[ ] Tinfoil hat at the ready
[ ] Still no cure for cancer
[X] "()*%£^" No Carrier
Too Big of a Bucket (Score:3, Insightful)
Another issue is that most Linux distro's ship a LOT of application code, like 2000 to 6000 packages, which is waaaay more than Microsoft ships with Windows. That there is an "OS" vulnerability for some rarely used application in a large Linux distro is just not comparable to the smaller set of code that Microsoft is willing to take responsibility for.
It is just irresponsible for CERT to be publishing distored numbers like this.
Crispin
Let the flamewar begin (Score:3, Insightful)
Anyway, I've used a number of different operating systems and I've realized something. Computer security isn't so much the operating system you select, it's how diligent you are in keeping it secure. If you keep the system patched, behind a decent firewall, are careful with the software you run, and don't use the root/Administrator account for normal usage, you'll probably not have any issues with your computer. Granted, there are plenty of examples otherwise, but I'm referring to the standard user or sysadmin.
The problem comes in for users that don't understand that they need to keep their system protected more than it is out of the box. Some linux distros and Windows get it right by having automatic updates (if you need to disable these, you can easily enough).
Overall, there ARE good things and bad things about each operating system, but not much matters if the user isn't going to take some type of responsibility to keep their own system updated and protected.
Bogus (Score:2)
Windows has fewer vulnerabilities... (Score:2)
This proves nothing.
And why are Mozilla vulnerabilities listed under unix/linux but not under Microsoft Windows? Last I checked, Mozilla ran on Windows too.
Groklaw commentsx (Score:3, Informative)
Second, the Unix/Linux list duplicates items, counting a vulnerability more than once in the list. For an example, note that it lists Eric Raymond Fetchmail POP3 Client Buffer Overflow (Updated). However, the same vulnerability is listed, under the same title, four times. That's because it was reported in the week of August 10-15, again in the week of August 17-23, in September 6-13, and the week of November 9-16. Worse, for any comparison purposes, the same vulnerability is also reported as Fetchmail POP3 Client Buffer Overflow, so in reality one vulnerability is listed 5 times, making the total of 2328 meaningless unless you carefully comb through it to weed out duplications.
Kind of makes a numerical count of reported security problems pointless. (BEGIN SARCASM) Of course, the Linux/Unix security holes are much more serious than are Windows security holes because automated worms. viruses, etc. attack Linux/Unix machines but not Windows computers.(END SARCASM)
Betcha more got fixed too (Score:2)
Vulnerabilities are only vulnerabilities IF... (Score:2, Insightful)
These articles only make the majority of the public even dumber.
It makes me think of the line from Billy Madison where the teacher proclaims "...At no point in y
Uh-oh. (Score:2)
Or maybe that was the sound of thousands of Slashdotter keyboards blazing...
At any rate, this is interesting because it once again prompts the lot of us to dig up the tired old argument, "Just because more vulnerabilities are being found doesn't mean the system is less secure." As I'm certain others before me have already stated countless millions upon billio
Re:Uh-oh. (Score:2)
So given those suppositions to remove all the usual tired arguments... what's left? What else can we say about the data aggregated in the list?
The best I could come up with was that public reporting is a basic tent of OSS so it
Believe what you want (Score:2)
Anyway, believe whatever source you want. All I know is that while IT departments across the country raced through their holiday "vacations" to roll out unofficial patches to fix the WMF vulnerability, I sat at home drinking egg nog and watching South Park.
By the way, we need a better lexicon. "Vulnerability" sounds too bad and too good at the same time. A DoS that crashes gtk-gnutella is one thing, and needs a much softer word to describe it - perhaps "imperfection". A des
you have to understand the proper context (Score:2)
meanwhile linux is an nihilistic meaningless ramble. do you think god plays dice with operating systems? i for one do not
one day armageddeon will come and flood the internet with worms and virii and kill the babel of linux nodes. vista will record two copies of every software package, beta and release, and releas
"OS Vulnerability" vs "Application Vulnerability" (Score:5, Interesting)
Want one example? The CM Cyrus IMAP server [us-cert.gov] sure as heck isn't installed on my Mac OS X system, and I doubt I'd ever install it. I don't think I'd install it on my Linux box, either. If I did install it, and there was a bug in it, I sure as hell wouldn't consider that bug an "OS" problem, would you ?
And I'd be willing to make the same distinction for Microsoft, as well, at least so long as the application error isn't in a default-installed DLL or in an always-installed application, like... oh, Internet Explorer, for example. I'm not so sure I should fault Windows because the Eternal Lines web server has some sort of issue. There's the OS, then there are the apps that run on top of the OS.
So really, the counting and analysis are so broken that it's hard to even discuss. Call me back when individual distros and specific OS kernel builds are broken out into separate counts. Call me back when non-default-installed or at least not-commonly-used applications are broken out ( i.e. I'll give you web servers and browsers normally used with any platform as part of the OS ), but I don't think Linux in general is less secure because Joe's Custom Server has a bug in it. I'd like to see some *useful* summary of this information, please...
What debate? (Score:2)
Move along.
How come is a PHP hole only a Unix hole? (Score:2)
How Funny (Score:2)
I almost think that that *nix should do the windows approach and come with 2multiple "sets"; the base OS CD and then one or more types of apps CD (as a different thing).
Sadly, I think that posts from groups like CERT like this does as much damage to cert's reputation as it doe
Yet, oddly... (Score:2)
Plus, when the hell are people going to stop grouping ALL distrubutions of Linux into one category... how many major distrubutions by different vendors are out there? 18 or somthing like that, and hundreds of smaller distros... There is only ONE Microsoft. Compare Windows to any single distribution... and then we w
Couldn't this be because... (Score:2)
3x vulnerabilities, 6x operating systems (Score:2)
I have to wonder about the purpose of this article, as it ought to be fairly easy to run
And the good news (Score:2)
2,328 bugs found is 2,328 bugs fixed. (Score:4, Funny)
Important points not mentioned (Score:5, Insightful)
-amount of risk caused by vulnerability
-percentage of high-risk vulnerabilities per OS
-time taken to patch vulnerability
-whether the vulnerability is in some tiny obscure piece of shareware or in a VERY common software (such as MSIE)
Statistics aren't so useful with such lack of completeness.
Of course that page isn't there to be a useful guide for statistics on vulernabilities, but the Slashdot article seems to be portraying it as such...
windows and intelligent design (Score:3, Insightful)
I think everyone knows how out of context the article is, which only shows the deceiptful intent of those responsible for it being written.
Taking things out of context is a known action of those having intent to deceive.
Now if there were laws against such that applied to marketing.... We'd all have better things in life, cept for the deceptive.
But for those of us who do know to see past the BS... we are better off, depending on how deep the BS goes, and sometimes its gets rather deep.
lies, damn lies, and statistics... (Score:3, Insightful)
Anyone with half a clue and experience with both OSes in a production environment already knows the truth, but there's some points for those who actually believe some of the shit that seems to be deemed newsworthy...
smash.
Puh-lease (Score:5, Insightful)
Good idea, bad implementation (Score:4, Insightful)
Number of bugs +
Number of bugs with known exploits x 5 +
Number of bugs with known exploits x the number of days the exploit was in the wild before the bug was patched.
Then multiply the whole thing by an risk factor (1-5) based on how much harm it can do.
No lumping multiple OSs. Each one should get it's own card. Lumping applications bundled with the OS is reasonable but skews things too. For an accurate comparison, only bugs in features common to all platforms and bugs in non-optional components should be counted.
The way the current ranking they use works you could have 50 non-exploitable, local user only, file permission modifying bugs in 100 different Lunix distributions and it would count as 5,000 bugs. Similarly you could have one remote attack that completely takes over a Windows box with known exploits which remained unpatched for 100 days and it would count as 1 bug. The score would be 5,000 to 1 in favor of Windows which is about opposite from what it should be in this example. These are completely meaningless numbers.
I don't know how the OSs would stack up given an accurate reporting but I would be interested to see.
Rubbish (Score:3, Informative)
How about comparing just ONE operating system to ONE other operating system? Like Windows XP to Solaris/SPARC? Or Windows Server to FreeBSD 5.x branch?
Meaningless numbers (Score:3, Interesting)
Why do I say that the aggregate numbers are meaningless?
1) They count "updates" to vulnerability reports as vulnerabilities, so there are many vulnerabilities that appear to be counted 5-10 times in the "UNIX" list, and 2 times in the "Windows" list. My guess is that these "updates" are individual OS reports, meaning that a single vulnerability in a cross-platform application would be reported as 2 Windows vulnerabilities and 10 UNIX vulnerabilities. CERT should break out each OS into its own counts in order to correct for this. Eliminating duplicate reports isn't good enough, because there are many OS-specific reports, and it doesn't make much sense to count vulnerabilities specific to Solaris AND Mac OS X AND Linux AND HPUX etc., in a single number, since you run only one OS as a time.
2) They count reports of multiple vulnerabilities as a single vulnerability, which means that OS's that release fewer updates, each of which patch multiple vulnerabilities (e.g. Apple, Microsoft) as having far fewer vulnerabilities than OS's that release specific patches for each vulnerability. Strangely, this punishes OS vendors that rapidly address and release patches for vulnerabilities, and reports vendors that are less responsive. CERT should count a single announcement that covers multiple vulnerabilities as if each vulnerability were reported individually.
3) They include third-party application vulnerabilities in the counts, and the number of those reports dwarfs the number of actual OS vulnerabilities (90-95% of the vulnerabilities listed aren't in the OS's). CERT should separate bugs in the OS's from optional third-party application bugs. Many of the vulnerabilities are in extremely obscure applications, and while uses of those applications might want to know about these issues, it's hardly a reflection on the OS' security if there's a 'Wojtek Kaniewski EKG Insecure Temporary File Creation & SQL Injection' in some project's "contrib" directory, which is hardly comparable to 'Sun Solaris ARP Handling Remote Denial of Service' or 'Microsoft DirectX DirectShow Arbitrary Code Execution'.
4) Their OS coverage is quite spotty. For example, if an application runs on all OS's (e.g. Mozilla, bzip) and has a vulnerability that applies to all OS's, sometimes they're reported only for Windows, sometimes only for UNIX, sometimes for both, sometimes with many repetitions and sometimes only once. While this would require CERT to do some analysis (i.e. actually read the reports), they should consistently recognize cross-OS issues and remove them from the OS-specific lists and report them in the multiple operating system list.
Since each of these issues appears to introduce error rates that are an order of magnitude larger than the useful data, there's nothing meaningful data left.
Of course, people have pointed these problems out about these CERT reports for many years. Still, since we have these same pointless discussions every year, CERT should make some basic changes to make these reports somewhat meaningful. Their previous years' list (http://www.us-cert.gov/cas/bulletins/SB2004.html [us-cert.gov]
Vulnerability vs Exploit (Score:4, Informative)
There is a difference between a vulnerability and an exploit. A vulnerability is just a potential weakness, a chink in the armor so to speak, but potential weaknesses cannot be taken advantage of unless it is exploited. It is thus the number of exploits that is the primary consideration when speaking of security.
Of course, Linux will have a large number of visible vulnerabilities! It is open source and anybody with two eyes and a passing knowledge of C should be able to find vulnerabilities almost everywhere. However, are those vulnerabilities actually exploitable? In most cases, Linux security alerts consist entirely of possible vulnerabilities and in most cases also, those vulnerabilities are quickly patched up and repaired; well before any practical exploits are written for it.
The case is not the same with Microsoft Windows. Because Windows is closed-source, the only way to demonstrate a vulnerability in Windows is to actually write an exploit for it! Thus, whenever a vulnerability has been discovered for windows, you can bet your Momma's last penny that there is a very good chance of the existence of a working exploit for it.
How many vulnerabilities are there in Windows we do not know of because we cannot examine the source? Judging from the number of exploits (written by people without access to Windows source code, by the way) we can infer with good accuracy that the total number of vulnerabilities in windows should be several times that of the number of exploits. I am too lazy to make a count but perhaps someone with the inclination can create a matrix showing Vulnerabilities vs exploit vis a vis Windows vs Linux. If we assume that the ratio of exploits to vulnerabilities is the same for both operating systems, what would be the estimate of the number of vulnerabilities in windows? If we further include the fact that Linux is open source while Windows is not, what would be the estimated number of exploits in Windows?
That would make an interesting study.
It is Linux's open-source nature that gives it the disadvantage when a simple-minded count of the security alerts for Windows versus the number of security alerts for Linux is made. But keep in mind that almost all security alerts for windows are not of vulnerabilities but of practical, demonstrably working, and potentially already widespread exploits. Most security alerts for Linux are of vulnerabilities.
In any discussion of security between Linux and Windows, the crucial distinction between vulnerability and exploit should be clearly enunciated.
Cause it's a dupe? (Score:4, Informative)
Re:Cause it's a dupe? (Score:2)
What?? And abandon a perfect instance of flamebait!?!?
Re:way to lump them together (Score:2)
I'm no Microsoft apologist, but it takes a certain combination of arrogance and ignorance to assume that your side is absolutely right, and the other side is absolutely wrong (both in terms of opinions, and how the opinions are presented). Everyone has a valid point to make. All that matters is how the points are interpreted.
more than 5 (Score:2)
That means the "UNIX/Linux" category is at least 10 OSes. On top of that, there is this gem:
The end-of-year vulnerability score should be taken with a grain of salt, however, since US-CERT doesn't filter out updates (so one actual vulnerability can be counted numerous times) nor does it break out individual vulnerabilities from warnings that cover multiple bugs (as in the many Mac OS X vulnerability listings).