Slashdot Mirror

This is a bit of a weird security report site. Notice the following:

http://secunia.com/product/15552/

Apparently my favorite OS has NO security flaws. This would be pretty cool if it were true. It would make those security patches I get every day completely un necessary!

I think such a sweeping claim: " IIS 6 and SQL Server 2005 have never ever EVER been compromised " should not be made on the basis of a single source of evidence!

IIS: http://secunia.com/product/1438/
SQL Server: http://secunia.com/product/6782/

IIS 6 and SQL Server 2005 have never ever EVER been compromised -- both vulnerabilities in IIS were not publicly disclosed. So, AC, like, STFU.

IIS: http://secunia.com/product/1438/
SQL Server: http://secunia.com/product/6782/

IIS 6 and SQL Server 2005 have never ever EVER been compromised -- both vulnerabilities in IIS were not publicly disclosed. So, AC, like, STFU.

Privilege Escalation: There have been lots of privilege escalation vulnerabilities in Windows XP. Here is one, now fixed: Highly critical, System access, From remote.

Why I don't use Real Player is the same reason most people here don't.

But I also manage around 500 computers. I block real player and install MPlayerC with the add ons if someone must play real content.

Why? This is why;

http://secunia.com/search/?search=real+player&w=0& sort_by=date

Security patches out the wazzo - in which they are very slow to patch. Unlike Quicktime, Media Player M$, and others - Real almost always forces you to go to each machine any manually run through the update process. But you must register an e-mail address with each machine before you can do this. They only accept real@aol.com so many times.

With the other media players I can use GPOs, Zen, SMS, and automate the patching.

If you are lucky, they will provide a full installer with the update eventually. But you must navigate using an unsupported browser to find it.

Real players gets removed any time I see it, and the new file name blocked as soon as I find it. Real's in our untrusted zone in IE too.

The article's writer has to deal with "bandwidth'ing-out" issues most likely... I've been there, on "unlimited bandwidth accounts" (b.s. false advertising is more like it on the part of many ISP's, especially in the past).

This doesn't mean the article's data is invalid though... & "upsets the sensibilities" of the fanboys of IE & FireFox/Mozilla apparently, lol!

APK

P.S.=> http://slashdot.org/comments.pl?sid=273931&cid=202 91847

That has a LOT more data that ought to do the same... such as:

  Opera also shows LESS security vulnerabilities than the other 2 of the "big 3" & their most current builds/models/versions:

Opera security advisories @ SECUNIA (0% unpatched):

http://secunia.com/product/10615/?task=advisories

FireFox security advisories @ SECUNIA (43% unpatched):

http://secunia.com/product/12434/

IE 7 security advisories @ SECUNIA (56% unpatched):

http://secunia.com/product/12366/

& more, in terms of memory residency as well... apk

The article's writer has to deal with "bandwidth'ing-out" issues most likely... I've been there, on "unlimited bandwidth accounts" (b.s. false advertising is more like it on the part of many ISP's, especially in the past).

This doesn't mean the article's data is invalid though... & "upsets the sensibilities" of the fanboys of IE & FireFox/Mozilla apparently, lol!

APK

P.S.=> http://slashdot.org/comments.pl?sid=273931&cid=202 91847

That has a LOT more data that ought to do the same... such as:

  Opera also shows LESS security vulnerabilities than the other 2 of the "big 3" & their most current builds/models/versions:

Opera security advisories @ SECUNIA (0% unpatched):

http://secunia.com/product/10615/?task=advisories

FireFox security advisories @ SECUNIA (43% unpatched):

http://secunia.com/product/12434/

IE 7 security advisories @ SECUNIA (56% unpatched):

http://secunia.com/product/12366/

& more, in terms of memory residency as well... apk

The article's writer has to deal with "bandwidth'ing-out" issues most likely... I've been there, on "unlimited bandwidth accounts" (b.s. false advertising is more like it on the part of many ISP's, especially in the past).

This doesn't mean the article's data is invalid though... & "upsets the sensibilities" of the fanboys of IE & FireFox/Mozilla apparently, lol!

APK

P.S.=> http://slashdot.org/comments.pl?sid=273931&cid=202 91847

That has a LOT more data that ought to do the same... such as:

  Opera also shows LESS security vulnerabilities than the other 2 of the "big 3" & their most current builds/models/versions:

Opera security advisories @ SECUNIA (0% unpatched):

http://secunia.com/product/10615/?task=advisories

FireFox security advisories @ SECUNIA (43% unpatched):

http://secunia.com/product/12434/

IE 7 security advisories @ SECUNIA (56% unpatched):

http://secunia.com/product/12366/

& more, in terms of memory residency as well... apk

"So, come back in five or ten years, and we can compare SQL Server 2005 -- maybe it'll be hit with a massive worm next year. Otherwise, either compare broader sets of versions, or older ones." - by SanityInAnarchy (655584) on Friday August 17, @06:43PM (#20268857)

Well? So far?? SO GOOD (absolutely current data as of this date, today, on both per my subject line above):

Vulnerability Report: Microsoft SQL Server 2005:

http://secunia.com/product/6782/?task=statistics

Zero/0 vulnerabilities in its ENTIRE HISTORY, to date (of this post/currently)...

----

July 2007 - Operating System Vulnerability Scorecard:

http://blogs.technet.com/security/archive/2007/08/ 16/july-2007-operating-system-vulnerability-scorec ard.aspx

AND THESE, whole year long, by category...?

WORKSTATION CLASS OS VULNERABILITIES:

http://blogs.technet.com/blogfiles/security/Window sLiveWriter/July2007OperatingSystemVulnerabilitySc or_DB33/image_5.png

SERVER CLASS OS VULNERABILITIES:

http://blogs.technet.com/blogfiles/security/Window sLiveWriter/July2007OperatingSystemVulnerabilitySc or_DB33/image_7.png

It seems that LINUX has had more problems this year, with vulnerabilities BY FAR, than Windows XP SP 2 or Windows Server 2003, period... & last year too, see next section below:

----

Gee, that's NOT TOO DIFFERENT from what I saw @ year start for 2006 here, now is it:

National Cyber Alert System: Cyber Security Bulletin 2005 year end/2006 start Summary:

http://www.us-cert.gov/cas/bulletins/SB2005.html

----

And, as far as your thinking CIS TOOL is malware?

COMPUTERWORLD - CIS tool aims to help federal agencies check Windows security settings:

http://www.computerworld.com/action/article.do?com mand=viewArticleBasic&articleId=9018362&intsrc=hm_ list

SANS - CIS to Release Windows Configuration Assessment Tool: (May 1, 2007)

http://www.sans.org/newsletters/newsbites/newsbite s.php?vol=9&issue=36#sID302

2 respected places seem to state otherwise (though you TRIED to lump this program into the SAME CATEGORY AS SQLSlammer? I would STRONGLY WAGER, that the Slammer worm was NEVER noted to be for purposes of helping you, HELP YOURSELF, & aid in securing your system... as CIS TOOL is/was, per the url's above).

----

You stated these objections:

1.) This tool might be malware - I can only say, PROVE THEN THAT IT IS! (you *NIX guys, you're NOT "too big" on providing visible proofs are you? Judging by how many people have run from this multiplatform valid test of security here that are *NIX users (around 30 now)? That tends to PROVE that & "2nd my motion" on that account!)

2.) This program may send data out I am not aware of - but, you are (they record data for security purposes, most likely noting what areas are typically found WEAKEST ON THE MOST SYSTEMS, per the data they get from this test) first of all, & secondly? Just either:

a. Disconnect your router or PC from the net, yanking the cable IF

http://slashdot.org/comments.pl?sid=264303&thresho ld=1&commentsort=0&mode=thread&cid=20219969

Here's a list of many companies & their results/case studies, using SQLServer 2005 for line-of-business/enterprise class/mission critical objectives & tasks...

http://www.microsoft.com/sql/bigdata/default.mspx

(companies like NASDAQ using Windows Server 2003 + SQLServer 2005 to keep the official record of trades & dissemination of that info. & @ a stable rate of the "fabled 5-9's" of uptime (99.999%) & no history of them being cracked/hacked either...)

SQLServer 2005 vulnerability history @ SECUNIA:

http://secunia.com/product/6782/?task=statistics

(Zero/0 advisories of vulnerabilities...)

APK

P.S.=> That's most of your objections overcome & how/why, & this now too:

http://slashdot.org/comments.pl?sid=264303&cid=202 59631

apk

Don't forget Mac and Linux. The ability to register a custom protocol handler to launch programs in the OS is standard. The ability to reference said protocol handler in a hyperlink is also standard. These problems effect every (major) OS.

MacOSX has had a number of vulnerabilities due to URI handling:

Daring Fireball - Using the 'telnet' URI Protocol to Delete Files
Mac OS X Volume URI Handler Registration Code Execution Vulnerability
Apple Mac OS X SSH URI Handler Remote Code Execution Vulnerability

As long as you can get a browser to pass arbitrary data to an application you will be vulnerable. What needs to happen is that the custom protocol handlers should be white-listed by default requiring the user to explicitly allow a new protocol handler. Any protocol handler not handled directly by the browser should display a dialog to inform the user of the action and permit them to cancel it. The user needs to be aware that they're not clicking on a "normal" hyperlink.

Ultimately I think the only way to really mitigate these kinds of security problems is to sandbox or virtualize the browser, which is actually what MS has done with IE7 in Vista. Vulnerabilities are inevitable so the OS and browser should do what it can to limit the extent of the damage that can be caused.

As TFA mentions, this is a buffer overflow problem. Most buffer overflows can be exploited easily unless additional OS safeguards are in place -- StackGuard, Address Space Randomization, etc., and even then, a determined hacker may still find his way in.

There are a few existing examples of buffer overflows against JPEG2000, and they can be exploited much in the same way the WMF exploit is -- malformed file is read into reader, causes buffer overflow in JPEG2000 library, causing the execution of arbitrary code. Next up: the reader (and system in general) gets compromised to do the hacker's bidding.

> When was the last time you saw Firefox or Safari or Konquror able to be crashed with a malformed web page?

Umm... 9 days ago?

http://secunia.com/advisories/26201/

The vulnerability is caused due to an input validation error within the handling of system default URIs with registered URI handlers (e.g. "mailto", "news", "nntp", "snews", "telnet"). This can be exploited to execute arbitrary commands when a user e.g. using Firefox visits a malicious website with a specially crafted "mailto" URI containing a "%" character and ends in a certain extension (e.g. ".bat", ".cmd")

This command would make firefox go "away"
mailto:test%25../../../../windows/system32/tskill. exe firefox.cmd

Giving up on security? You might want to check out IIS6's security record.

Apache security record since 2003
34 vulnerabilities, 3% serious, 9% unpatched, 3% partially patched

IIS6 security record since it was released in 2003
3 vunlerabilities, none serious, all patched

IIS5 had many security problems, but you need to deal with the present day. IIS6 has had a nearly flawless record since it was released in 2003. And IIS7 builds on that record and adds more modularity and much greater performance (the beta of IIS7 blows away IIS6 and Apache). Nowadays, the only thing Apache really has going for it is price and Microsoft-hatred (on the part an ever-shrinking segment of the IT community).

Giving up on security? You might want to check out IIS6's security record.

Apache security record since 2003
34 vulnerabilities, 3% serious, 9% unpatched, 3% partially patched

IIS6 security record since it was released in 2003
3 vunlerabilities, none serious, all patched

IIS5 had many security problems, but you need to deal with the present day. IIS6 has had a nearly flawless record since it was released in 2003. And IIS7 builds on that record and adds more modularity and much greater performance (the beta of IIS7 blows away IIS6 and Apache). Nowadays, the only thing Apache really has going for it is price and Microsoft-hatred (on the part an ever-shrinking segment of the IT community).

"Is there any compelling reason _not_ to use apache?! o.O"

Security, for one.
Since MS released IIS6 in 2003, it's had a nearly perfect security record, much better than Apache's record since 2003.
IIS6 security record since 2003
3 flaws, none serious, all patched

Apache 2's security record since 2003
34 flaws, 3% are serious, 9% are unpatched, and 3% only partially fixed

That said, I'd guess that most that choose IIS over Apache do it for reasons of ease of use.

"Is there any compelling reason _not_ to use apache?! o.O"

Security, for one.
Since MS released IIS6 in 2003, it's had a nearly perfect security record, much better than Apache's record since 2003.
IIS6 security record since 2003
3 flaws, none serious, all patched

Apache 2's security record since 2003
34 flaws, 3% are serious, 9% are unpatched, and 3% only partially fixed

That said, I'd guess that most that choose IIS over Apache do it for reasons of ease of use.

Yet here we have the first vulnerability in the iPhone and it is promptly patched through a system that will distribute the patches very quickly and easily.

There are multiple holes in Symbian and of course Windows Mobile that remain completely unpatched.

There is this meme that the iPhone is not ready for the enterprise because it doesn't have MAPI and special I-T management tools.

There are many reasons that the Mac is more secure than Windows, but a big reason is that OS X is such a moving target.

The vast majority of Mac users are using the very latest OS and have all the patches applied even though the vast majority of Mac users have no I-T staff and no I-T skills

When the iPhone first shipped and people started hacking it, there was a lot of talk then that every hack may be temporary, a software update could come down through iTunes at any time and reset the game. There is nothing like that protecting any other mobile.

the main source of theo thinking SVN isn't secure, is because that control freak didn't write it himself. which is ironic because openssl and openssh are 2 packages responsible for huge security holes over the years, both of which are his babies.

The OpenCVS project was started after discussions regarding the latest GNU CVS vulnerabilities that came out. Although CVS is widely used, its development has been mostly stagnant in the last years and many security issues have popped up, both in the implementation and in the mechanisms.

Why not have both? Paper is just double-checking the electronic, making it harder to hack in remotely, or change a motherboard or data-cartridge while no one is looking.

In general, polling sites have at least one over-seer from each party. If one of the other guys is trying to shuffle papers ballots around, it's going to be a bit trickier because ballots are big, and hard not to be noticed. They're big compared to a CF card. Big compared to remote known windows exploits.
--
Looking for a C/C++ job in Silicon Valley?

2) An error within the interaction of Flash Player and certain browsers can be exploited to leak key presses to a Flash Player applet. The vulnerability affects versions 7.0.69.0 and prior on Linux and Solaris. It does not affect Flash Player 9.

This isn't a bug in the latest flash plugin... only older ones.

There are two exploits.

Version 9.0.45 (which was released in April 2007?) is still subject to buffer overflows. However, it's not vulnerable to the keystroke logging problem.

Adobe Flash exploit could log keystrokes
By Dawn Kawamoto, CNET News.com
16/07/2007
URL: http://www.zdnetasia.com/news/security/0,39044215, 62028443,00.htm

Adobe has issued three critical security updates, one of which is designed to stop a problem in the way the Flash player interacts with browsers, which could result in users' keystrokes being transmitted to attackers.

Adobe Flash Player 9.0.45.0, 8.0.34.0 and 7.0.69.0, as well as their earlier versions running on all platforms, are affected.

Users loading a malicious vector graphics file format (SWF) in their Flash Player may find attackers exploiting security flaws due to an input validation error in 9.0.45.0 and earlier versions, according to a security advisory from Secunia. Attackers, as a result, can gain remote access to a user's system.

In versions 7.0.69.0 and earlier running on Linux and Solaris, malicious attackers could exploit an error in the interaction between the Flash Player and certain browsers. That could potentially lead to a leaking of keystrokes to a Flash Player applet, Secunia noted. Flash Player 9 is not affected.

Versions 8.0.34.0 and earlier contain a bug due to insufficient validation of the HTTP referrer. As a result, an attacker could execute a cross-site forgery attack. Flash Player 9, however, is not affected.

Adobe recommends that 9.0.45.0 users upgrade to 9.0.47.0 for Windows, Mac and Solaris, or 9.0.48.0 for Linux.

Adobe Flash Player 9 is the recommended solution for the other two versions that contain security flaws.
--
For Your Flash-Based Safety

Lynx might not have known threats at the moment, but Lynx has had it's share of them also. At least two (highly critical) of them listed here:
http://secunia.com/product/5883/?task=advisories

Firefox hasn't released a fix for this, and there is no mention of it on their web site.

Now this blows:

http://secunia.com/advisories/25984/
> Solution:
> Do not browse untrusted sites.
> Disable the "Firefox URL" URI handler.

The first is impractical. The second begs the question, "Sure, How?" Read on:

> Extended Solution:
> The "Extended Solution" section is available for Secunia customers only.
> Request a trial and get access to the Secunia Customer Area and Extended Secunia advisories.

So these guys are publishing zero day security flaws, then making you reach for your credit card. Very grubby.

The CNET article doesn't tell you what the fix is either. Google has nothing. Anyone?

http://secunia.com/product/13223/ Enjoy.

I get a good laugh every time anyone says OS X has "very few" or "hardly any" vulnerabilities. Try telling that to Secunia.

Apparently ALL anti-virus software gives false positives. Most of the users have little technical knowledge, and the software makers want to give the impression their software is more useful than it really is. I've seen numerous false positives on systems I use. One "virus" was a text file, with a .TXT extension, and nothing in it but documentation!

But why is anti-virus software so important? Apparently only because Microsoft profits more when its software is full of bugs and malware, and Microsoft is very adversarial toward its customers.

The true cost of a Microsoft operating system is perhaps 10 times its retail cost, because of the heavy maintenance expenses.

Microsoft's anti-customer behavior: Here are some paragraphs I wrote to someone having problems with temp files taking gigabytes of drive space.

On one computer I checked, temp files were stored in 49 different places, and that includes only temp file folders made by the Windows operating system and not temp file folders made by application software.

Why doesn't Microsoft provide a utility to find all the temporary file folders and delete the files when starting or shutting down the computer? Apparently because the company is heavily engaged in adversarial behavior. Most people don't know that temporary files are a problem, and they certainly don't know where to find them; that was a challenge even for me. The temp files sometimes take so much space that there is not enough free space, and the file system begins running much slower.

The file defragmentation program won't run when there is limited free space. A fragmented file system is much slower. And most people don't even know that the defragmentation program exists, or why they should run it. So, their computers become imperceptibly slower and slower until they buy a new computer.

That's apparently why Microsoft software has so much malware, also. At present, there are 30 known vulnerabilities in Windows XP alone that haven't been fixed. There are 7 known vulnerabilities in the latest version of Microsoft Internet Explorer browser the the company has not fixed.

Some people say Microsoft software is targeted more often because there are so many copies in use. However, it is well known how to write secure software. Apparently Microsoft managers don't let their programmers finish their work.

Many people who don't know how to keep Microsoft products running buy new computers. Every time someone buys a new PC, they buy a new copy of the Microsoft operating system, even if they already owned a copy. So Microsoft makes more money if the company has defective products.

Microsoft gives each new version of Windows a new name, and many people think the new version is a new product. Somehow it has been arranged that people pay the full amount for new versions, instead of an upgrade price.

The New York Times article Corrupted PC's Find New Home also makes that point.

Note that the Apple operating system, OS X, and the Open BSD operating system have very few vulnerabilities. (The Open BSD web site says 2 in 10 years.) So it is possible to make a secure operating system. The volunteers that make the Open BSD system do security reviews of software to make sure vulnerabilities are not released to customers.

We use Microsoft operating systems because of historical reasons, and because it is expensive to change. In actuality, the business very seldom uses software that runs only under Microsoft Windows, and that is only in specific departments, where it would be easy to provide a second computer.

Apparently ALL anti-virus software gives false positives. Most of the users have little technical knowledge, and the software makers want to give the impression their software is more useful than it really is. I've seen numerous false positives on systems I use. One "virus" was a text file, with a .TXT extension, and nothing in it but documentation!

But why is anti-virus software so important? Apparently only because Microsoft profits more when its software is full of bugs and malware, and Microsoft is very adversarial toward its customers.

The true cost of a Microsoft operating system is perhaps 10 times its retail cost, because of the heavy maintenance expenses.

Microsoft's anti-customer behavior: Here are some paragraphs I wrote to someone having problems with temp files taking gigabytes of drive space.

On one computer I checked, temp files were stored in 49 different places, and that includes only temp file folders made by the Windows operating system and not temp file folders made by application software.

Why doesn't Microsoft provide a utility to find all the temporary file folders and delete the files when starting or shutting down the computer? Apparently because the company is heavily engaged in adversarial behavior. Most people don't know that temporary files are a problem, and they certainly don't know where to find them; that was a challenge even for me. The temp files sometimes take so much space that there is not enough free space, and the file system begins running much slower.

The file defragmentation program won't run when there is limited free space. A fragmented file system is much slower. And most people don't even know that the defragmentation program exists, or why they should run it. So, their computers become imperceptibly slower and slower until they buy a new computer.

That's apparently why Microsoft software has so much malware, also. At present, there are 30 known vulnerabilities in Windows XP alone that haven't been fixed. There are 7 known vulnerabilities in the latest version of Microsoft Internet Explorer browser the the company has not fixed.

Some people say Microsoft software is targeted more often because there are so many copies in use. However, it is well known how to write secure software. Apparently Microsoft managers don't let their programmers finish their work.

Many people who don't know how to keep Microsoft products running buy new computers. Every time someone buys a new PC, they buy a new copy of the Microsoft operating system, even if they already owned a copy. So Microsoft makes more money if the company has defective products.

Microsoft gives each new version of Windows a new name, and many people think the new version is a new product. Somehow it has been arranged that people pay the full amount for new versions, instead of an upgrade price.

The New York Times article Corrupted PC's Find New Home also makes that point.

Note that the Apple operating system, OS X, and the Open BSD operating system have very few vulnerabilities. (The Open BSD web site says 2 in 10 years.) So it is possible to make a secure operating system. The volunteers that make the Open BSD system do security reviews of software to make sure vulnerabilities are not released to customers.

We use Microsoft operating systems because of historical reasons, and because it is expensive to change. In actuality, the business very seldom uses software that runs only under Microsoft Windows, and that is only in specific departments, where it would be easy to provide a second computer.

I read the article pretty carefully. I don't see any actual numbers to back up this "debunking".

That's because you are gullible enough to believe the hype, aggravated by your lack of will to perform a basic search for the facts. Here is a bit of debunking from a quick google search.

From Secunia's advisory atatistics:

• Microsoft Windows Vista has 2 unpatched vulnerabilities, highest rated not critical
• Microsoft Windows XP Home has 27 unpatched vulnerabilities, highest rated highly critical
• Microsoft Windows XP Professional has 30 unpatched vulnerabilities, highest rated highly critical
• Apple Macintosh OS X has 5 unpatched vulnerabilities, highest rated less critical
• Ubuntu Linux 7.04 has zero unpatched vulnerabilities
• Ubuntu Linux 6.10 has zero unpatched vulnerabilities
• Red Hat Enterprise Linux Desktop (v. 5 client) has zero unpatched vulnerabilities
• Red Hat Enterprise Linux (v. 5 server) has zero unpatched vulnerabilities

Those are real world facts supported on real world evidence which is freely available to the public. It isn't a random blog entry which is based on god knows what data which is only known by the author and possibly doesn't even exist. So where in fact is there a need to "debunk" a moronic, unsubstantiated claim made by some microsoft employee, specially when there is all that evidence right in front of everyone's face?

I read the article pretty carefully. I don't see any actual numbers to back up this "debunking".

That's because you are gullible enough to believe the hype, aggravated by your lack of will to perform a basic search for the facts. Here is a bit of debunking from a quick google search.

From Secunia's advisory atatistics:

• Microsoft Windows Vista has 2 unpatched vulnerabilities, highest rated not critical
• Microsoft Windows XP Home has 27 unpatched vulnerabilities, highest rated highly critical
• Microsoft Windows XP Professional has 30 unpatched vulnerabilities, highest rated highly critical
• Apple Macintosh OS X has 5 unpatched vulnerabilities, highest rated less critical
• Ubuntu Linux 7.04 has zero unpatched vulnerabilities
• Ubuntu Linux 6.10 has zero unpatched vulnerabilities
• Red Hat Enterprise Linux Desktop (v. 5 client) has zero unpatched vulnerabilities
• Red Hat Enterprise Linux (v. 5 server) has zero unpatched vulnerabilities

Those are real world facts supported on real world evidence which is freely available to the public. It isn't a random blog entry which is based on god knows what data which is only known by the author and possibly doesn't even exist. So where in fact is there a need to "debunk" a moronic, unsubstantiated claim made by some microsoft employee, specially when there is all that evidence right in front of everyone's face?

I read the article pretty carefully. I don't see any actual numbers to back up this "debunking".

That's because you are gullible enough to believe the hype, aggravated by your lack of will to perform a basic search for the facts. Here is a bit of debunking from a quick google search.

From Secunia's advisory atatistics:

• Microsoft Windows Vista has 2 unpatched vulnerabilities, highest rated not critical
• Microsoft Windows XP Home has 27 unpatched vulnerabilities, highest rated highly critical
• Microsoft Windows XP Professional has 30 unpatched vulnerabilities, highest rated highly critical
• Apple Macintosh OS X has 5 unpatched vulnerabilities, highest rated less critical
• Ubuntu Linux 7.04 has zero unpatched vulnerabilities
• Ubuntu Linux 6.10 has zero unpatched vulnerabilities
• Red Hat Enterprise Linux Desktop (v. 5 client) has zero unpatched vulnerabilities
• Red Hat Enterprise Linux (v. 5 server) has zero unpatched vulnerabilities

Those are real world facts supported on real world evidence which is freely available to the public. It isn't a random blog entry which is based on god knows what data which is only known by the author and possibly doesn't even exist. So where in fact is there a need to "debunk" a moronic, unsubstantiated claim made by some microsoft employee, specially when there is all that evidence right in front of everyone's face?

I read the article pretty carefully. I don't see any actual numbers to back up this "debunking".

That's because you are gullible enough to believe the hype, aggravated by your lack of will to perform a basic search for the facts. Here is a bit of debunking from a quick google search.

From Secunia's advisory atatistics:

• Microsoft Windows Vista has 2 unpatched vulnerabilities, highest rated not critical
• Microsoft Windows XP Home has 27 unpatched vulnerabilities, highest rated highly critical
• Microsoft Windows XP Professional has 30 unpatched vulnerabilities, highest rated highly critical
• Apple Macintosh OS X has 5 unpatched vulnerabilities, highest rated less critical
• Ubuntu Linux 7.04 has zero unpatched vulnerabilities
• Ubuntu Linux 6.10 has zero unpatched vulnerabilities
• Red Hat Enterprise Linux Desktop (v. 5 client) has zero unpatched vulnerabilities
• Red Hat Enterprise Linux (v. 5 server) has zero unpatched vulnerabilities

Those are real world facts supported on real world evidence which is freely available to the public. It isn't a random blog entry which is based on god knows what data which is only known by the author and possibly doesn't even exist. So where in fact is there a need to "debunk" a moronic, unsubstantiated claim made by some microsoft employee, specially when there is all that evidence right in front of everyone's face?

I read the article pretty carefully. I don't see any actual numbers to back up this "debunking".

That's because you are gullible enough to believe the hype, aggravated by your lack of will to perform a basic search for the facts. Here is a bit of debunking from a quick google search.

From Secunia's advisory atatistics:

• Microsoft Windows Vista has 2 unpatched vulnerabilities, highest rated not critical
• Microsoft Windows XP Home has 27 unpatched vulnerabilities, highest rated highly critical
• Microsoft Windows XP Professional has 30 unpatched vulnerabilities, highest rated highly critical
• Apple Macintosh OS X has 5 unpatched vulnerabilities, highest rated less critical
• Ubuntu Linux 7.04 has zero unpatched vulnerabilities
• Ubuntu Linux 6.10 has zero unpatched vulnerabilities
• Red Hat Enterprise Linux Desktop (v. 5 client) has zero unpatched vulnerabilities
• Red Hat Enterprise Linux (v. 5 server) has zero unpatched vulnerabilities

Those are real world facts supported on real world evidence which is freely available to the public. It isn't a random blog entry which is based on god knows what data which is only known by the author and possibly doesn't even exist. So where in fact is there a need to "debunk" a moronic, unsubstantiated claim made by some microsoft employee, specially when there is all that evidence right in front of everyone's face?

I read the article pretty carefully. I don't see any actual numbers to back up this "debunking".

That's because you are gullible enough to believe the hype, aggravated by your lack of will to perform a basic search for the facts. Here is a bit of debunking from a quick google search.

From Secunia's advisory atatistics:

• Microsoft Windows Vista has 2 unpatched vulnerabilities, highest rated not critical
• Microsoft Windows XP Home has 27 unpatched vulnerabilities, highest rated highly critical
• Microsoft Windows XP Professional has 30 unpatched vulnerabilities, highest rated highly critical
• Apple Macintosh OS X has 5 unpatched vulnerabilities, highest rated less critical
• Ubuntu Linux 7.04 has zero unpatched vulnerabilities
• Ubuntu Linux 6.10 has zero unpatched vulnerabilities
• Red Hat Enterprise Linux Desktop (v. 5 client) has zero unpatched vulnerabilities
• Red Hat Enterprise Linux (v. 5 server) has zero unpatched vulnerabilities

Those are real world facts supported on real world evidence which is freely available to the public. It isn't a random blog entry which is based on god knows what data which is only known by the author and possibly doesn't even exist. So where in fact is there a need to "debunk" a moronic, unsubstantiated claim made by some microsoft employee, specially when there is all that evidence right in front of everyone's face?