Slashdot Mirror

Don't blame me ... I use Opera.

You people modded someone down for postings facts from a respected site for security on all platforms that you cannot dispute, which is quite lame. Shame on you losers here at slashdot is about all a body can state. I will add on SQL Server 2005 as well (another 0 unpatched flaw bearing Microsoft product which is often used in combination with IIS & Windows Server 2k3):

SQLServer 2005 @ SECUNIA:

http://secunia.com/product/6782/

Affected By 0 Secunia advisories
Unpatched 0% (0 of 0 Secunia advisories)

"Computer security isn't hard science? Someone should point Linus to the Orange Book or the Common Criteria." - by deblau (68023) on Monday October 01, @09:38PM (#20818531) You're NOT kidding, & here's the data that backs your statements up, as well as some figures to let the LINUX crowd think about & to "argue with", as facts/hard quantified data findings!

====

WINDOWS SERVER 2003 (ENTERPRISE):

http://secunia.com/product/1174/

Affected By 135 Secunia advisories
Unpatched 8% (11 of 135 Secunia advisories)

----

IIS 6:

http://secunia.com/product/1438/

Affected By 3 Secunia advisories
Unpatched 0% (0 of 3 Secunia advisories)

(& WHY NOT TOSS SQLServer 2005 into the mix as well, since it is often combined with those other 2 MS products above for websites, shall we?)

SQLServer 2005:

Affected By 0 Secunia advisories
Unpatched 0% (0 of 0 Secunia advisories)

====

vs.

====

LINUX 2.6 KERNEL (not including possible shell/usercode portions):

http://secunia.com/product/2719/

Affected By 132 Secunia advisories
Unpatched 10% (13 of 132 Secunia advisories)

----

Apache 2.2x:

http://secunia.com/product/9633/

Affected By 5 Secunia advisories
Unpatched 20% (1 of 5 Secunia advisories)

====

Argue with the numbers... numbers from a respected site as regards security, which is OFTEN cited here @ /., no less...

APK

"Computer security isn't hard science? Someone should point Linus to the Orange Book or the Common Criteria." - by deblau (68023) on Monday October 01, @09:38PM (#20818531) You're NOT kidding, & here's the data that backs your statements up, as well as some figures to let the LINUX crowd think about & to "argue with", as facts/hard quantified data findings!

====

WINDOWS SERVER 2003 (ENTERPRISE):

http://secunia.com/product/1174/

Affected By 135 Secunia advisories
Unpatched 8% (11 of 135 Secunia advisories)

----

IIS 6:

http://secunia.com/product/1438/

Affected By 3 Secunia advisories
Unpatched 0% (0 of 3 Secunia advisories)

(& WHY NOT TOSS SQLServer 2005 into the mix as well, since it is often combined with those other 2 MS products above for websites, shall we?)

SQLServer 2005:

Affected By 0 Secunia advisories
Unpatched 0% (0 of 0 Secunia advisories)

====

vs.

====

LINUX 2.6 KERNEL (not including possible shell/usercode portions):

http://secunia.com/product/2719/

Affected By 132 Secunia advisories
Unpatched 10% (13 of 132 Secunia advisories)

----

Apache 2.2x:

http://secunia.com/product/9633/

Affected By 5 Secunia advisories
Unpatched 20% (1 of 5 Secunia advisories)

====

Argue with the numbers... numbers from a respected site as regards security, which is OFTEN cited here @ /., no less...

APK

"Computer security isn't hard science? Someone should point Linus to the Orange Book or the Common Criteria." - by deblau (68023) on Monday October 01, @09:38PM (#20818531) You're NOT kidding, & here's the data that backs your statements up, as well as some figures to let the LINUX crowd think about & to "argue with", as facts/hard quantified data findings!

====

WINDOWS SERVER 2003 (ENTERPRISE):

http://secunia.com/product/1174/

Affected By 135 Secunia advisories
Unpatched 8% (11 of 135 Secunia advisories)

----

IIS 6:

http://secunia.com/product/1438/

Affected By 3 Secunia advisories
Unpatched 0% (0 of 3 Secunia advisories)

(& WHY NOT TOSS SQLServer 2005 into the mix as well, since it is often combined with those other 2 MS products above for websites, shall we?)

SQLServer 2005:

Affected By 0 Secunia advisories
Unpatched 0% (0 of 0 Secunia advisories)

====

vs.

====

LINUX 2.6 KERNEL (not including possible shell/usercode portions):

http://secunia.com/product/2719/

Affected By 132 Secunia advisories
Unpatched 10% (13 of 132 Secunia advisories)

----

Apache 2.2x:

http://secunia.com/product/9633/

Affected By 5 Secunia advisories
Unpatched 20% (1 of 5 Secunia advisories)

====

Argue with the numbers... numbers from a respected site as regards security, which is OFTEN cited here @ /., no less...

APK

"Computer security isn't hard science? Someone should point Linus to the Orange Book or the Common Criteria." - by deblau (68023) on Monday October 01, @09:38PM (#20818531) You're NOT kidding, & here's the data that backs your statements up, as well as some figures to let the LINUX crowd think about & to "argue with", as facts/hard quantified data findings!

====

WINDOWS SERVER 2003 (ENTERPRISE):

http://secunia.com/product/1174/

Affected By 135 Secunia advisories
Unpatched 8% (11 of 135 Secunia advisories)

----

IIS 6:

http://secunia.com/product/1438/

Affected By 3 Secunia advisories
Unpatched 0% (0 of 3 Secunia advisories)

(& WHY NOT TOSS SQLServer 2005 into the mix as well, since it is often combined with those other 2 MS products above for websites, shall we?)

SQLServer 2005:

Affected By 0 Secunia advisories
Unpatched 0% (0 of 0 Secunia advisories)

====

vs.

====

LINUX 2.6 KERNEL (not including possible shell/usercode portions):

http://secunia.com/product/2719/

Affected By 132 Secunia advisories
Unpatched 10% (13 of 132 Secunia advisories)

----

Apache 2.2x:

http://secunia.com/product/9633/

Affected By 5 Secunia advisories
Unpatched 20% (1 of 5 Secunia advisories)

====

Argue with the numbers... numbers from a respected site as regards security, which is OFTEN cited here @ /., no less...

APK

"IIS on a Windows 2003 server? That is one of the better and most secure combinations you can have today! Seriously, don't fool yourself. IIS 6 and 7 have a record of almost none critical exploits. In comparation with Apache it simply shimnes. And Windows 2003 is rock solid." - by El Lobo (994537) on Wednesday October 03, @05:58AM (#20834769) You're NOT kidding, & here's the data that backs your statements up!

SECUNIA DATA REGARDING WINDOWS SERVER 2003 + IIS 6.x,

vs.

LINUX KERNEL 2.6x (just the kernel mind you, NOT the shell also) + APACHE 2.2x KNOWN VULNERABILITIES:

====

WINDOWS SERVER 2003 (ENTERPRISE):

http://secunia.com/product/1174/

Affected By 135 Secunia advisories
Unpatched 8% (11 of 135 Secunia advisories)

----

IIS 6:

http://secunia.com/product/1438/

Affected By 3 Secunia advisories
Unpatched 0% (0 of 3 Secunia advisories)

====

vs.

====
LINUX 2.6 KERNEL (not including possible shell/usercode portions):

http://secunia.com/product/2719/

Affected By 132 Secunia advisories
Unpatched 10% (13 of 132 Secunia advisories)

----

Apache 2.2x:

http://secunia.com/product/9633/

Affected By 5 Secunia advisories
Unpatched 20% (1 of 5 Secunia advisories)

====

These fools can spout whatever b.s. they want to, &/or 'mod you down' as funny & what not (I.E.-> "How shitty Windoze & IIS are" etc. et al) but, in the end?

WELL - Let them argue with THOSE numbers above from a respected site for security they often cite here @ /. no less...

APK

"IIS on a Windows 2003 server? That is one of the better and most secure combinations you can have today! Seriously, don't fool yourself. IIS 6 and 7 have a record of almost none critical exploits. In comparation with Apache it simply shimnes. And Windows 2003 is rock solid." - by El Lobo (994537) on Wednesday October 03, @05:58AM (#20834769) You're NOT kidding, & here's the data that backs your statements up!

SECUNIA DATA REGARDING WINDOWS SERVER 2003 + IIS 6.x,

vs.

LINUX KERNEL 2.6x (just the kernel mind you, NOT the shell also) + APACHE 2.2x KNOWN VULNERABILITIES:

====

WINDOWS SERVER 2003 (ENTERPRISE):

http://secunia.com/product/1174/

Affected By 135 Secunia advisories
Unpatched 8% (11 of 135 Secunia advisories)

----

IIS 6:

http://secunia.com/product/1438/

Affected By 3 Secunia advisories
Unpatched 0% (0 of 3 Secunia advisories)

====

vs.

====
LINUX 2.6 KERNEL (not including possible shell/usercode portions):

http://secunia.com/product/2719/

Affected By 132 Secunia advisories
Unpatched 10% (13 of 132 Secunia advisories)

----

Apache 2.2x:

http://secunia.com/product/9633/

Affected By 5 Secunia advisories
Unpatched 20% (1 of 5 Secunia advisories)

====

These fools can spout whatever b.s. they want to, &/or 'mod you down' as funny & what not (I.E.-> "How shitty Windoze & IIS are" etc. et al) but, in the end?

WELL - Let them argue with THOSE numbers above from a respected site for security they often cite here @ /. no less...

APK

"IIS on a Windows 2003 server? That is one of the better and most secure combinations you can have today! Seriously, don't fool yourself. IIS 6 and 7 have a record of almost none critical exploits. In comparation with Apache it simply shimnes. And Windows 2003 is rock solid." - by El Lobo (994537) on Wednesday October 03, @05:58AM (#20834769) You're NOT kidding, & here's the data that backs your statements up!

SECUNIA DATA REGARDING WINDOWS SERVER 2003 + IIS 6.x,

vs.

LINUX KERNEL 2.6x (just the kernel mind you, NOT the shell also) + APACHE 2.2x KNOWN VULNERABILITIES:

====

WINDOWS SERVER 2003 (ENTERPRISE):

http://secunia.com/product/1174/

Affected By 135 Secunia advisories
Unpatched 8% (11 of 135 Secunia advisories)

----

IIS 6:

http://secunia.com/product/1438/

Affected By 3 Secunia advisories
Unpatched 0% (0 of 3 Secunia advisories)

====

vs.

====
LINUX 2.6 KERNEL (not including possible shell/usercode portions):

http://secunia.com/product/2719/

Affected By 132 Secunia advisories
Unpatched 10% (13 of 132 Secunia advisories)

----

Apache 2.2x:

http://secunia.com/product/9633/

Affected By 5 Secunia advisories
Unpatched 20% (1 of 5 Secunia advisories)

====

These fools can spout whatever b.s. they want to, &/or 'mod you down' as funny & what not (I.E.-> "How shitty Windoze & IIS are" etc. et al) but, in the end?

WELL - Let them argue with THOSE numbers above from a respected site for security they often cite here @ /. no less...

APK

"IIS on a Windows 2003 server? That is one of the better and most secure combinations you can have today! Seriously, don't fool yourself. IIS 6 and 7 have a record of almost none critical exploits. In comparation with Apache it simply shimnes. And Windows 2003 is rock solid." - by El Lobo (994537) on Wednesday October 03, @05:58AM (#20834769) You're NOT kidding, & here's the data that backs your statements up!

SECUNIA DATA REGARDING WINDOWS SERVER 2003 + IIS 6.x,

vs.

LINUX KERNEL 2.6x (just the kernel mind you, NOT the shell also) + APACHE 2.2x KNOWN VULNERABILITIES:

====

WINDOWS SERVER 2003 (ENTERPRISE):

http://secunia.com/product/1174/

Affected By 135 Secunia advisories
Unpatched 8% (11 of 135 Secunia advisories)

----

IIS 6:

http://secunia.com/product/1438/

Affected By 3 Secunia advisories
Unpatched 0% (0 of 3 Secunia advisories)

====

vs.

====
LINUX 2.6 KERNEL (not including possible shell/usercode portions):

http://secunia.com/product/2719/

Affected By 132 Secunia advisories
Unpatched 10% (13 of 132 Secunia advisories)

----

Apache 2.2x:

http://secunia.com/product/9633/

Affected By 5 Secunia advisories
Unpatched 20% (1 of 5 Secunia advisories)

====

These fools can spout whatever b.s. they want to, &/or 'mod you down' as funny & what not (I.E.-> "How shitty Windoze & IIS are" etc. et al) but, in the end?

WELL - Let them argue with THOSE numbers above from a respected site for security they often cite here @ /. no less...

APK

It's security vulnerabilities in old versions of Flash Player that make them vulnerable to malicious files. Here's one of the more severe ones: http://secunia.com/advisories/26027. It doesn't matter if the file has no executable content when the reader has a buffer overflow that can be exploited with a malicious file. Strictly speaking, the exploit is executable machine code.

The issue of executable or scriptable content in media files is something different. As other people pointed out, WMVs can have script a web event, like opening a browser to a certain page, but in that case, a malicious website would be exploiting your browser. The media player is just a vector to open that web page.

The truth of the matter, of course, is a) chroot is used as a security tool, whether misguidedly or not, b) superuser can break out of chroot, anyone who thinks otherwise is misguided or misinformed, c) when used in the sequence

• bind to a privileged port
• chroot
• drop superuser privileges
• interact with untrusted entities via protocol X (where X could be HTTP, DNS, whatever)

But Outlook 2003 uses the aforementioned control, with the same effect I mentioned.

Not according to these vulnerability reports. If it was possible to call the standard Microsoft HTML control securely these problems could not have occurred, because there would be no mechanism in the embedded control to elevate privileges:

http://secunia.com/advisories/11572/
http://secunia.com/advisories/11067/

In addition, this appears to be a similar flaw in the Word HTML control they switched to:

http://secunia.com/advisories/12041/

Source? I'm still waiting for the "Microsoft admits command-line parsing is terrible" document you mentioned.

It was in the recent IE versus Firefox row. Microsoft claimed that it was up to Firefox to handle anything IE threw at it, because it wasn't possible in principle for IE to sanitize what it sent to programs to ensure that they would never misinterpret malicious embedded quotes. They were right, in that Firefox should handle anything that IE threw at it, but they don't provide a general way to allow a program to both handle arbitrarily complex file names AND handle malicious input containing embedded quotes. The general solution seems to be to have the programs special-case internet explorer, so that if the first argument looks like a URL they treat embedded quotes as either literal or an error, and don't allow multiple arguments. The problem is that while this solves that special case it doesn't provide a way for them to be called securely from any other application.

There are a couple of solutions for this. One is to provide a separate EXE to be used for untrusted sources, and register that... but then that limits what can be passed to the program in a URI from the command line, Windows Explorer, internally, or from other trusted programs (such as scripts or applications using your program for display). Microsoft could resolve that by providing a separate set of bindings for

I expect that's more ports than Linux has open by default, but still, it's not terrible.

I consider file and print sharing a terrible thing to leave open.

(and, yes, four is more than zero - which is what any UNIX variant with pretensions to security has open)

on public networks, Vista will close off all ports on that interface.

Correct me if I'm wrong here, but I believe it does it using a firewall, not by having the services bound only to internal ports or not running at all. My point is that this makes the firewall a part of the normal operation of the system, not an extra layer of security.

But Outlook 2003 uses the aforementioned control, with the same effect I mentioned.

Not according to these vulnerability reports. If it was possible to call the standard Microsoft HTML control securely these problems could not have occurred, because there would be no mechanism in the embedded control to elevate privileges:

http://secunia.com/advisories/11572/
http://secunia.com/advisories/11067/

In addition, this appears to be a similar flaw in the Word HTML control they switched to:

http://secunia.com/advisories/12041/

Source? I'm still waiting for the "Microsoft admits command-line parsing is terrible" document you mentioned.

It was in the recent IE versus Firefox row. Microsoft claimed that it was up to Firefox to handle anything IE threw at it, because it wasn't possible in principle for IE to sanitize what it sent to programs to ensure that they would never misinterpret malicious embedded quotes. They were right, in that Firefox should handle anything that IE threw at it, but they don't provide a general way to allow a program to both handle arbitrarily complex file names AND handle malicious input containing embedded quotes. The general solution seems to be to have the programs special-case internet explorer, so that if the first argument looks like a URL they treat embedded quotes as either literal or an error, and don't allow multiple arguments. The problem is that while this solves that special case it doesn't provide a way for them to be called securely from any other application.

There are a couple of solutions for this. One is to provide a separate EXE to be used for untrusted sources, and register that... but then that limits what can be passed to the program in a URI from the command line, Windows Explorer, internally, or from other trusted programs (such as scripts or applications using your program for display). Microsoft could resolve that by providing a separate set of bindings for

I expect that's more ports than Linux has open by default, but still, it's not terrible.

I consider file and print sharing a terrible thing to leave open.

(and, yes, four is more than zero - which is what any UNIX variant with pretensions to security has open)

on public networks, Vista will close off all ports on that interface.

Correct me if I'm wrong here, but I believe it does it using a firewall, not by having the services bound only to internal ports or not running at all. My point is that this makes the firewall a part of the normal operation of the system, not an extra layer of security.

But Outlook 2003 uses the aforementioned control, with the same effect I mentioned.

Not according to these vulnerability reports. If it was possible to call the standard Microsoft HTML control securely these problems could not have occurred, because there would be no mechanism in the embedded control to elevate privileges:

http://secunia.com/advisories/11572/
http://secunia.com/advisories/11067/

In addition, this appears to be a similar flaw in the Word HTML control they switched to:

http://secunia.com/advisories/12041/

Source? I'm still waiting for the "Microsoft admits command-line parsing is terrible" document you mentioned.

It was in the recent IE versus Firefox row. Microsoft claimed that it was up to Firefox to handle anything IE threw at it, because it wasn't possible in principle for IE to sanitize what it sent to programs to ensure that they would never misinterpret malicious embedded quotes. They were right, in that Firefox should handle anything that IE threw at it, but they don't provide a general way to allow a program to both handle arbitrarily complex file names AND handle malicious input containing embedded quotes. The general solution seems to be to have the programs special-case internet explorer, so that if the first argument looks like a URL they treat embedded quotes as either literal or an error, and don't allow multiple arguments. The problem is that while this solves that special case it doesn't provide a way for them to be called securely from any other application.

There are a couple of solutions for this. One is to provide a separate EXE to be used for untrusted sources, and register that... but then that limits what can be passed to the program in a URI from the command line, Windows Explorer, internally, or from other trusted programs (such as scripts or applications using your program for display). Microsoft could resolve that by providing a separate set of bindings for

I expect that's more ports than Linux has open by default, but still, it's not terrible.

I consider file and print sharing a terrible thing to leave open.

(and, yes, four is more than zero - which is what any UNIX variant with pretensions to security has open)

on public networks, Vista will close off all ports on that interface.

Correct me if I'm wrong here, but I believe it does it using a firewall, not by having the services bound only to internal ports or not running at all. My point is that this makes the firewall a part of the normal operation of the system, not an extra layer of security.

"Microsoft has been telling bald-faced lies about their security for at least a decade. What's different this time?" - by jcr (53032) on Friday September 21, @11:08AM (#20696607)

I see you say "Microsoft lies", well... what about you "Pro *NIX" Penguins & "bsd devils" here on slashdot?

It was hilarious in this thread also where others from the "Pro-*NIX" camp here @ /. tried to say "Apache is more secure than IIS" &, lo and behold in the 2 url's below:

----

APACHE UNPATCHED KNOWN VULNERABILITIES LIST (9%):

http://secunia.com/product/73/?task=statistics

IIS 6.x UNPATCHED KNOWN VULNERABILITIES LIST (0%):

http://secunia.com/product/1438/?task=statistics

----

Let's also move onto & take a look @ SQLServer 2005 also, shall we??

SQLServer 2005 UNPATCHED KNOWN VULNERABILITIES LIST (0%):

http://secunia.com/product/6782/

----

Let's NOT stop there either... take a peek @ Microsoft Office 2007!

Microsoft Office 2007 UNPATCHED KNOWN VULNERABILITY LIST (0%):

http://secunia.com/product/13228/

----

Given all that data (& yes, IE sux, & IE7 even needs more work in terms of security, but that is what Opera & FireFox are for imo)? It amazes me the b.s. you people here @ /. often spout, like "Windoze blows" etc. when clearly, it is a fine set of products MS produces for the MOST part...

IE is really the LAST area/product from MS that need some work it seems/is all!

APK

P.S. => Also, see this URL where over 30++ /.'ers ran from a challenge regarding Windows vs. Linux security, in a thread post here on /., regarding "Hardening Linux" no less:

SLASHDOT POST ABOUT "HARDENING LINUX":

http://it.slashdot.org/comments.pl?sid=267599&threshold=-1&commentsort=0&mode=thread&cid=20203061

(That's where no *NIX person here on this site @/., & other sites oriented around both LINUX &/or BSD could not do a better job on a valid multi-platform test of security (based on best practices for each OS platform than a Windows Server 2003 user could!))

The *NIX folks were challenged on this site, who stated things along the lines of:

"(Insert *NIX variant here) is more secure OR securable than Windows"

& that's when I simply challenged them to that test in CIS TOOL... not a single one exceeded my score on Windows Server 2003 fully custom hardened for security. See this image which backs my score:

http://img.techpowerup.org/070828/APK_AToutLeMonde_85.185CISToolScorePhotoProof.jpg

"CIS TOOL" (by the center for internet security) has been noted as a tool to help secure yourself by BOTH Computerworld & SANS (sites often cited here on /. no less, regarding security data):

Here is the outline for achieving that 85.185 score on CIS TOOL, for Windows users:

http://forums.techpowerup.com/showthread.php?p=375355#post375355

It works & so much so, it tends to "silence the F.U.D." spreaders here on /. about Windows vs. Linux (even SeLinux &/or BSD variants as well) regarding securability of them all!

Again, for all their 'talk', not a single *NIX person here beat that score, failing to "put up, or shut up". Nobody from /. has exceeded that score a Windows Server 2003 user achieves on i

"Microsoft has been telling bald-faced lies about their security for at least a decade. What's different this time?" - by jcr (53032) on Friday September 21, @11:08AM (#20696607)

I see you say "Microsoft lies", well... what about you "Pro *NIX" Penguins & "bsd devils" here on slashdot?

It was hilarious in this thread also where others from the "Pro-*NIX" camp here @ /. tried to say "Apache is more secure than IIS" &, lo and behold in the 2 url's below:

----

APACHE UNPATCHED KNOWN VULNERABILITIES LIST (9%):

http://secunia.com/product/73/?task=statistics

IIS 6.x UNPATCHED KNOWN VULNERABILITIES LIST (0%):

http://secunia.com/product/1438/?task=statistics

----

Let's also move onto & take a look @ SQLServer 2005 also, shall we??

SQLServer 2005 UNPATCHED KNOWN VULNERABILITIES LIST (0%):

http://secunia.com/product/6782/

----

Let's NOT stop there either... take a peek @ Microsoft Office 2007!

Microsoft Office 2007 UNPATCHED KNOWN VULNERABILITY LIST (0%):

http://secunia.com/product/13228/

----

Given all that data (& yes, IE sux, & IE7 even needs more work in terms of security, but that is what Opera & FireFox are for imo)? It amazes me the b.s. you people here @ /. often spout, like "Windoze blows" etc. when clearly, it is a fine set of products MS produces for the MOST part...

IE is really the LAST area/product from MS that need some work it seems/is all!

APK

P.S. => Also, see this URL where over 30++ /.'ers ran from a challenge regarding Windows vs. Linux security, in a thread post here on /., regarding "Hardening Linux" no less:

SLASHDOT POST ABOUT "HARDENING LINUX":

http://it.slashdot.org/comments.pl?sid=267599&threshold=-1&commentsort=0&mode=thread&cid=20203061

(That's where no *NIX person here on this site @/., & other sites oriented around both LINUX &/or BSD could not do a better job on a valid multi-platform test of security (based on best practices for each OS platform than a Windows Server 2003 user could!))

The *NIX folks were challenged on this site, who stated things along the lines of:

"(Insert *NIX variant here) is more secure OR securable than Windows"

& that's when I simply challenged them to that test in CIS TOOL... not a single one exceeded my score on Windows Server 2003 fully custom hardened for security. See this image which backs my score:

http://img.techpowerup.org/070828/APK_AToutLeMonde_85.185CISToolScorePhotoProof.jpg

"CIS TOOL" (by the center for internet security) has been noted as a tool to help secure yourself by BOTH Computerworld & SANS (sites often cited here on /. no less, regarding security data):

Here is the outline for achieving that 85.185 score on CIS TOOL, for Windows users:

http://forums.techpowerup.com/showthread.php?p=375355#post375355

It works & so much so, it tends to "silence the F.U.D." spreaders here on /. about Windows vs. Linux (even SeLinux &/or BSD variants as well) regarding securability of them all!

Again, for all their 'talk', not a single *NIX person here beat that score, failing to "put up, or shut up". Nobody from /. has exceeded that score a Windows Server 2003 user achieves on i

"Microsoft has been telling bald-faced lies about their security for at least a decade. What's different this time?" - by jcr (53032) on Friday September 21, @11:08AM (#20696607)

I see you say "Microsoft lies", well... what about you "Pro *NIX" Penguins & "bsd devils" here on slashdot?

It was hilarious in this thread also where others from the "Pro-*NIX" camp here @ /. tried to say "Apache is more secure than IIS" &, lo and behold in the 2 url's below:

----

APACHE UNPATCHED KNOWN VULNERABILITIES LIST (9%):

http://secunia.com/product/73/?task=statistics

IIS 6.x UNPATCHED KNOWN VULNERABILITIES LIST (0%):

http://secunia.com/product/1438/?task=statistics

----

Let's also move onto & take a look @ SQLServer 2005 also, shall we??

SQLServer 2005 UNPATCHED KNOWN VULNERABILITIES LIST (0%):

http://secunia.com/product/6782/

----

Let's NOT stop there either... take a peek @ Microsoft Office 2007!

Microsoft Office 2007 UNPATCHED KNOWN VULNERABILITY LIST (0%):

http://secunia.com/product/13228/

----

Given all that data (& yes, IE sux, & IE7 even needs more work in terms of security, but that is what Opera & FireFox are for imo)? It amazes me the b.s. you people here @ /. often spout, like "Windoze blows" etc. when clearly, it is a fine set of products MS produces for the MOST part...

IE is really the LAST area/product from MS that need some work it seems/is all!

APK

P.S. => Also, see this URL where over 30++ /.'ers ran from a challenge regarding Windows vs. Linux security, in a thread post here on /., regarding "Hardening Linux" no less:

SLASHDOT POST ABOUT "HARDENING LINUX":

http://it.slashdot.org/comments.pl?sid=267599&threshold=-1&commentsort=0&mode=thread&cid=20203061

(That's where no *NIX person here on this site @/., & other sites oriented around both LINUX &/or BSD could not do a better job on a valid multi-platform test of security (based on best practices for each OS platform than a Windows Server 2003 user could!))

The *NIX folks were challenged on this site, who stated things along the lines of:

"(Insert *NIX variant here) is more secure OR securable than Windows"

& that's when I simply challenged them to that test in CIS TOOL... not a single one exceeded my score on Windows Server 2003 fully custom hardened for security. See this image which backs my score:

http://img.techpowerup.org/070828/APK_AToutLeMonde_85.185CISToolScorePhotoProof.jpg

"CIS TOOL" (by the center for internet security) has been noted as a tool to help secure yourself by BOTH Computerworld & SANS (sites often cited here on /. no less, regarding security data):

Here is the outline for achieving that 85.185 score on CIS TOOL, for Windows users:

http://forums.techpowerup.com/showthread.php?p=375355#post375355

It works & so much so, it tends to "silence the F.U.D." spreaders here on /. about Windows vs. Linux (even SeLinux &/or BSD variants as well) regarding securability of them all!

Again, for all their 'talk', not a single *NIX person here beat that score, failing to "put up, or shut up". Nobody from /. has exceeded that score a Windows Server 2003 user achieves on i

"Microsoft has been telling bald-faced lies about their security for at least a decade. What's different this time?" - by jcr (53032) on Friday September 21, @11:08AM (#20696607)

I see you say "Microsoft lies", well... what about you "Pro *NIX" Penguins & "bsd devils" here on slashdot?

It was hilarious in this thread also where others from the "Pro-*NIX" camp here @ /. tried to say "Apache is more secure than IIS" &, lo and behold in the 2 url's below:

----

APACHE UNPATCHED KNOWN VULNERABILITIES LIST (9%):

http://secunia.com/product/73/?task=statistics

IIS 6.x UNPATCHED KNOWN VULNERABILITIES LIST (0%):

http://secunia.com/product/1438/?task=statistics

----

Let's also move onto & take a look @ SQLServer 2005 also, shall we??

SQLServer 2005 UNPATCHED KNOWN VULNERABILITIES LIST (0%):

http://secunia.com/product/6782/

----

Let's NOT stop there either... take a peek @ Microsoft Office 2007!

Microsoft Office 2007 UNPATCHED KNOWN VULNERABILITY LIST (0%):

http://secunia.com/product/13228/

----

Given all that data (& yes, IE sux, & IE7 even needs more work in terms of security, but that is what Opera & FireFox are for imo)? It amazes me the b.s. you people here @ /. often spout, like "Windoze blows" etc. when clearly, it is a fine set of products MS produces for the MOST part...

IE is really the LAST area/product from MS that need some work it seems/is all!

APK

P.S. => Also, see this URL where over 30++ /.'ers ran from a challenge regarding Windows vs. Linux security, in a thread post here on /., regarding "Hardening Linux" no less:

SLASHDOT POST ABOUT "HARDENING LINUX":

http://it.slashdot.org/comments.pl?sid=267599&threshold=-1&commentsort=0&mode=thread&cid=20203061

(That's where no *NIX person here on this site @/., & other sites oriented around both LINUX &/or BSD could not do a better job on a valid multi-platform test of security (based on best practices for each OS platform than a Windows Server 2003 user could!))

The *NIX folks were challenged on this site, who stated things along the lines of:

"(Insert *NIX variant here) is more secure OR securable than Windows"

& that's when I simply challenged them to that test in CIS TOOL... not a single one exceeded my score on Windows Server 2003 fully custom hardened for security. See this image which backs my score:

http://img.techpowerup.org/070828/APK_AToutLeMonde_85.185CISToolScorePhotoProof.jpg

"CIS TOOL" (by the center for internet security) has been noted as a tool to help secure yourself by BOTH Computerworld & SANS (sites often cited here on /. no less, regarding security data):

Here is the outline for achieving that 85.185 score on CIS TOOL, for Windows users:

http://forums.techpowerup.com/showthread.php?p=375355#post375355

It works & so much so, it tends to "silence the F.U.D." spreaders here on /. about Windows vs. Linux (even SeLinux &/or BSD variants as well) regarding securability of them all!

Again, for all their 'talk', not a single *NIX person here beat that score, failing to "put up, or shut up". Nobody from /. has exceeded that score a Windows Server 2003 user achieves on i

Maybe I am confused, but how do you explain this?

Secunia lists only one open vulnerability for Vista, which has to be executed by a local user.
http://secunia.com/product/13223/?task=advisories

IIS 6 Vulnerability Report since 2003:
Three vunlerabilies, none classified as "highly" or "extremely" critical, all patched.

Apache 2.x Vulnerability Report since 2003
33 vunlerabilies, 3% classified as "highly" critical, 9% unpatched, 3% only partially patched.

Sorry, I know if offends the delicate sensibilites of slashdotters, but IIS6 has a virtually perfect record since its release.
You spouted a lot of speculation that IIS6 has tons of undisclosed flaws, but you've provided zero evidence. If there are so many flaws, why have they not manifested themselves? Microsoft is better on security than they were in the past, whether you like it or not. Deal with it.

IIS 6 Vulnerability Report since 2003:
Three vunlerabilies, none classified as "highly" or "extremely" critical, all patched.

Apache 2.x Vulnerability Report since 2003
33 vunlerabilies, 3% classified as "highly" critical, 9% unpatched, 3% only partially patched.

Sorry, I know if offends the delicate sensibilites of slashdotters, but IIS6 has a virtually perfect record since its release.
You spouted a lot of speculation that IIS6 has tons of undisclosed flaws, but you've provided zero evidence. If there are so many flaws, why have they not manifested themselves? Microsoft is better on security than they were in the past, whether you like it or not. Deal with it.

See for yourself:

SQL Server 2005 - http://secunia.com/product/6782/?task=advisories

IIS6 - http://secunia.com/product/1438/?task=advisories

Vista too is looking good so far too, but it's very new, and only time will tell - http://secunia.com/product/13223/?task=advisories.

See for yourself:

SQL Server 2005 - http://secunia.com/product/6782/?task=advisories

IIS6 - http://secunia.com/product/1438/?task=advisories

Vista too is looking good so far too, but it's very new, and only time will tell - http://secunia.com/product/13223/?task=advisories.

See for yourself:

SQL Server 2005 - http://secunia.com/product/6782/?task=advisories

IIS6 - http://secunia.com/product/1438/?task=advisories

Vista too is looking good so far too, but it's very new, and only time will tell - http://secunia.com/product/13223/?task=advisories.

Poor security makes money for Microsoft because Corrupted PC's Find New Home in the Dumpster.

protect against cross-site scripting attacks

protect against cross-site scripting attacks

protect against cross-site scripting attacks

protect against cross-site scripting attacks

To be fair, there IS a story here, which is that Cisco only just acknowledged this officially.

Service Provider types (the operators of routers whose successful attack would actually affect anyone in the real world) have been well aware of this. But as others have pointed out, if you don't trust your admins, and you're not running proper logging and a proper audit trail of admin sessions already, you've got bigger problems than this.

"And JFTR: Opera fanboys (the few that I've encountered) are worse than Linux, Mac and Amiga fanboys combined." - by cp.tar (871488) on Friday September 07, @06:25AM (#20505367)

Ok, but how can we NOT be, when facts like this are available, that note Opera's superiority?

To wit (quoting another user here, who had misconceptions about multithreaded design of Opera, OR even other browsers, for example):

"I'd like a multi threaded browser" - by Bert64 (520050) on Friday September 07, @05:19AM (#20505053)

Opera runs 8 threads here (per taskmgr.exe &/or process explorer) in the Windows model!

Hey... check it yourself! Taskmgr.exe &/or Process Explorer (microsoft tools) can show you this all, easily...

---

Some added "FYI" for those of you comparing FireFox/IE/Opera (this one is about security, super-important in today's online world, especially):

Opera security advisories @ SECUNIA (0% unpatched):

http://secunia.com/product/10615/?task=advisories

FireFox security advisories @ SECUNIA (43% unpatched):

http://secunia.com/product/12434/

IE 7 security advisories @ SECUNIA (56% unpatched):

http://secunia.com/product/12366/

---

Also, as far as speed comparisons? This is one that ALSO EXTOLLS OPERA's SPEED/EFFICIENCY BENEFITS over FF &/or IE here, & ON MULTIPLE OS PLATFORMS:

BROWSER SPEED COMPARISONS ON MANY TASKS & MULTIPLE OPERATING SYSTEM PLATFORMS:

http://www.howtocreate.co.uk/browserSpeed.html

And, especially on Win32 OS', the most used PC platform/OS there is... & that one has MANY MORE evidences on many more types of browser activities, than this one that tests Opera 9.50's superiority in JavaScript parse & process (which this report on Opera here @ /. today, is about, ONLY):

http://nontroppo.org/timer/kestrel_tests/

---

The best parts are, OPERA IS FREE (as in BEER), & Opera has ALL of the features a body can need, WITHOUT using addons (though it has that via Opera widgets), & YET, Opera is LIGHTER ON MEMORY than FireFox &/or IE typically!

(You can check memory residency yourselves by loading FF, & Opera (& IE for Windows users) & test memory size occupancy via taskmgr.exe (or similar tools like Process Explorer) yourselves & see what I mean... I did so with FF 2.0.0.6, IE 7.x, & Opera 9.23.)

---

Opera also passed the "ACID2" test, for standards compliance (it is not alone here, but is over IE & FF, & it was the 6th browser to do so):

http://it.slashdot.org/it/06/03/12/1416222.shtml

---

And, Opera had features (like tabbed browsing) that other browsers (major 2 others in IE/FF) copied from it... note the article below!

FIREFOX MYTHS:

http://mywebpages.comcast.net/SupportCD/FirefoxMyt hs.html

Yes, Opera had tabbed browsing before IE &/or FF, & other features as well.

Opera comes FULLY LOADED features-wise, with a built in email client, IRC client, RSS client, & more + yet eats less RAM than others, & addons only bloat IE &/or FF even more memory-occupancy-wise. (AND YES, Opera has addons as well in "opera widgets" (like .xpi addons for FF)...

APK

P.S.=> The order in which both dev tools &/or browsers passed ACID2 compliance, is as follows: Safari #1, Prince #2, Shiira #3, Konqueror #4, OPERA #5, iCab #6 ... Thanks here goes to rh0 (member 1

"And JFTR: Opera fanboys (the few that I've encountered) are worse than Linux, Mac and Amiga fanboys combined." - by cp.tar (871488) on Friday September 07, @06:25AM (#20505367)

Ok, but how can we NOT be, when facts like this are available, that note Opera's superiority?

To wit (quoting another user here, who had misconceptions about multithreaded design of Opera, OR even other browsers, for example):

"I'd like a multi threaded browser" - by Bert64 (520050) on Friday September 07, @05:19AM (#20505053)

Opera runs 8 threads here (per taskmgr.exe &/or process explorer) in the Windows model!

Hey... check it yourself! Taskmgr.exe &/or Process Explorer (microsoft tools) can show you this all, easily...

---

Some added "FYI" for those of you comparing FireFox/IE/Opera (this one is about security, super-important in today's online world, especially):

Opera security advisories @ SECUNIA (0% unpatched):

http://secunia.com/product/10615/?task=advisories

FireFox security advisories @ SECUNIA (43% unpatched):

http://secunia.com/product/12434/

IE 7 security advisories @ SECUNIA (56% unpatched):

http://secunia.com/product/12366/

---

Also, as far as speed comparisons? This is one that ALSO EXTOLLS OPERA's SPEED/EFFICIENCY BENEFITS over FF &/or IE here, & ON MULTIPLE OS PLATFORMS:

BROWSER SPEED COMPARISONS ON MANY TASKS & MULTIPLE OPERATING SYSTEM PLATFORMS:

http://www.howtocreate.co.uk/browserSpeed.html

And, especially on Win32 OS', the most used PC platform/OS there is... & that one has MANY MORE evidences on many more types of browser activities, than this one that tests Opera 9.50's superiority in JavaScript parse & process (which this report on Opera here @ /. today, is about, ONLY):

http://nontroppo.org/timer/kestrel_tests/

---

The best parts are, OPERA IS FREE (as in BEER), & Opera has ALL of the features a body can need, WITHOUT using addons (though it has that via Opera widgets), & YET, Opera is LIGHTER ON MEMORY than FireFox &/or IE typically!

(You can check memory residency yourselves by loading FF, & Opera (& IE for Windows users) & test memory size occupancy via taskmgr.exe (or similar tools like Process Explorer) yourselves & see what I mean... I did so with FF 2.0.0.6, IE 7.x, & Opera 9.23.)

---

Opera also passed the "ACID2" test, for standards compliance (it is not alone here, but is over IE & FF, & it was the 6th browser to do so):

http://it.slashdot.org/it/06/03/12/1416222.shtml

---

And, Opera had features (like tabbed browsing) that other browsers (major 2 others in IE/FF) copied from it... note the article below!

FIREFOX MYTHS:

http://mywebpages.comcast.net/SupportCD/FirefoxMyt hs.html

Yes, Opera had tabbed browsing before IE &/or FF, & other features as well.

Opera comes FULLY LOADED features-wise, with a built in email client, IRC client, RSS client, & more + yet eats less RAM than others, & addons only bloat IE &/or FF even more memory-occupancy-wise. (AND YES, Opera has addons as well in "opera widgets" (like .xpi addons for FF)...

APK

P.S.=> The order in which both dev tools &/or browsers passed ACID2 compliance, is as follows: Safari #1, Prince #2, Shiira #3, Konqueror #4, OPERA #5, iCab #6 ... Thanks here goes to rh0 (member 1

"And JFTR: Opera fanboys (the few that I've encountered) are worse than Linux, Mac and Amiga fanboys combined." - by cp.tar (871488) on Friday September 07, @06:25AM (#20505367)

Ok, but how can we NOT be, when facts like this are available, that note Opera's superiority?

To wit (quoting another user here, who had misconceptions about multithreaded design of Opera, OR even other browsers, for example):

"I'd like a multi threaded browser" - by Bert64 (520050) on Friday September 07, @05:19AM (#20505053)

Opera runs 8 threads here (per taskmgr.exe &/or process explorer) in the Windows model!

Hey... check it yourself! Taskmgr.exe &/or Process Explorer (microsoft tools) can show you this all, easily...

---

Some added "FYI" for those of you comparing FireFox/IE/Opera (this one is about security, super-important in today's online world, especially):

Opera security advisories @ SECUNIA (0% unpatched):

http://secunia.com/product/10615/?task=advisories

FireFox security advisories @ SECUNIA (43% unpatched):

http://secunia.com/product/12434/

IE 7 security advisories @ SECUNIA (56% unpatched):

http://secunia.com/product/12366/

---

Also, as far as speed comparisons? This is one that ALSO EXTOLLS OPERA's SPEED/EFFICIENCY BENEFITS over FF &/or IE here, & ON MULTIPLE OS PLATFORMS:

BROWSER SPEED COMPARISONS ON MANY TASKS & MULTIPLE OPERATING SYSTEM PLATFORMS:

http://www.howtocreate.co.uk/browserSpeed.html

And, especially on Win32 OS', the most used PC platform/OS there is... & that one has MANY MORE evidences on many more types of browser activities, than this one that tests Opera 9.50's superiority in JavaScript parse & process (which this report on Opera here @ /. today, is about, ONLY):

http://nontroppo.org/timer/kestrel_tests/

---

The best parts are, OPERA IS FREE (as in BEER), & Opera has ALL of the features a body can need, WITHOUT using addons (though it has that via Opera widgets), & YET, Opera is LIGHTER ON MEMORY than FireFox &/or IE typically!

(You can check memory residency yourselves by loading FF, & Opera (& IE for Windows users) & test memory size occupancy via taskmgr.exe (or similar tools like Process Explorer) yourselves & see what I mean... I did so with FF 2.0.0.6, IE 7.x, & Opera 9.23.)

---

Opera also passed the "ACID2" test, for standards compliance (it is not alone here, but is over IE & FF, & it was the 6th browser to do so):

http://it.slashdot.org/it/06/03/12/1416222.shtml

---

And, Opera had features (like tabbed browsing) that other browsers (major 2 others in IE/FF) copied from it... note the article below!

FIREFOX MYTHS:

http://mywebpages.comcast.net/SupportCD/FirefoxMyt hs.html

Yes, Opera had tabbed browsing before IE &/or FF, & other features as well.

Opera comes FULLY LOADED features-wise, with a built in email client, IRC client, RSS client, & more + yet eats less RAM than others, & addons only bloat IE &/or FF even more memory-occupancy-wise. (AND YES, Opera has addons as well in "opera widgets" (like .xpi addons for FF)...

APK

P.S.=> The order in which both dev tools &/or browsers passed ACID2 compliance, is as follows: Safari #1, Prince #2, Shiira #3, Konqueror #4, OPERA #5, iCab #6 ... Thanks here goes to rh0 (member 1