Slashdot Mirror
Lower Your Insurance Premiums: Use Linux
Several readers who declined identification have pointed out that this "article over at Interactive Week discusses J.S. Wurzler Underwriting Managers, one of the first companies to offer cracker insurance, charging clients 5 to 15 percent more if they use Microsoft Windows NT in their Internet operations. As insurance companies live and die by their statistics, this is a pretty significant move. The article also has interesting information about tech turn-over in Windows vs. open source shops." However, note that Wurzler is not the only company offering anti-cracking insurance, and the Big Names haven't yet followed this lead, even though they're apparently watching intently. Maybe "treating employees nicely" is at least as important a factor to consider.
"NT is more difficult to install correctly and keep up to date than Linux," Spafford said.
I'd say they're both difficult to install correctly, but that Linux is definitely harder to keep up to date. Despite what CmdrTaco et al like to say about apt-get, to update Linux still requires a fairly competent administrator who keeps up to date on patches and knows which one he or she needs to install. Owing to its manufacturer and the google-eyed media frenzy surrounding Microsoft products, NT bug updates get a lot more press coverage.
I think that in general, Windows' installers are much slicker than the half dozen I've played with for Linux. If Linux could improve one thing about their installers, it would definitely be driver support. The general lack of polish (or glitz as some may see it) of Linux systems puts off a generation of IT managers trough-fed by Microsoft.
Also, since [good] Linux sysadmins are in short supply, companies have to pay more in salaries and fiscal items like that than they would for similarly (if the two can be compared) qualified NT/2000 admins. The insurance savings may be negated by this - but if you can run (notice I don't say "get") a much more secure Linux system for the same price as a Windows NT/2000 server, then Linux is well on the way to competing.
...by the fact that this report about an insurance company charging a premium for use of NT gets turned into a headline that says that if you use Linux, you will pay less?
Or, at least, they can't do those things without government's help or permission.
Government in service of business indeed a great threat -- but business alone is not. One can try to solve this problem either by restricting business, or by restricting government. I am utterly convinced that the latter is the better solution, and the former nearly impossible (and even if not impossible, the attempt makes enemies of those with the resources and the ability to make things with them... never a good thing).
Insurance may work by spreading the risk across the collective population, but that's no reason to let the few bad apples spoil the whole barrel. If a small number of users are making it prohibitively expensive for others to be insured, then we must cut the cancer out at its roots.
We already deny insurance policies for smokers and sky divers. We already deny insurance policies to citizens of New Jersey. (Don't believe me? Read the fine print on any Geico commercial.) These individuals may exercise their rights in choosing to live the damnable lifestyles they live, but that doesn't mean we have to pay for it.
All rights come with responsibilities. Drivers aren't allowed to drive drunk, but that's what system administrators are doing every day by installing Windows. We have laws against this stuff for a reason. It's time to extend them to computers.
Of course there is much more to security then the operating system. But insurances are always based on statistics. They cannot really represent reality for every single case, but for the average case. That's why you pay more car insurance if you are a male, young driver, than an old woman even if you drive one day in a week and never passes the speed limit. What this article shows, probably, is that they gathered statistics and Linux servers had less security problems than NT. I think the credit is not only to the operating system, as you even say, the personel is also very important. But probably they are linked to the operating system as a statistic, that is, people who run Linux servers tend to be more security conscious sysadmins.
Just wondering.
I can say with 99% certainty that your segfault problems on Linux are caused by system overheating and hardware failure. Linux (unlike Windows IIRC) does not try to recover from an invalid hardware state, so running at 90-100% usage for a couple days could easily have caused a fatal hardware error.
Hmm, sounds like he should have used the hotfix tool off Microsoft's website instead of Windowsupdate.
Windowsupdate isn't meant for servers.
No they didn't. They subcontracted content caching out to Akamai in order to make their internet services much less prone to DNS attacks.
Sigh... Your the type of person who gives MCSE a bad name. :(
I also have an MCSE I obtained a couple of years ago, and it's really quite simple to secure an NT box:
#1. Subscribe to NTBUGTRAQ.COM
#2. Read www.microsoft.com/security
Microsoft has provided tools which will notify you when security related hotfixes are released. They have provided tools to automate the installation of hotfixes, as well as automate the configuration of servers.
The DNS issue wasn't a bug in Microsoft's software. They suffered a DoS attack on their web servers, so they subcontracted with Akamai to protect against this. If you don't know who or what Akamai does, that's another problem with your paper MCSE.
What security through obscurity argument? Do you even know what that means?
I don't disagree that the lack of qualified admins is the problem. But the documentation and tools are out there, you just have to use them.
But my main point for responding... You shouldn't consider yourself a qualified admin, because you clearly are not.
I don't know if the insurance price difference is justified or not.
But I think that part of the problem isn't with NT/W2K per se, but with the culture that surrounds MS sys admining. MS tries to make things simple -- and they often seem simple. It's easy to throw stuff up without thinking about it first. And one of the selling points that MS uses in comparisons with Unix/Linux is that W2K is easier.
On a certain level, that means that you get a sysadmin that went to Windows because Unix was too hard. That's a harsh overgeneralization, but I think there's some truth to it.
The problem is that security is hard on any platform. The issues are pretty similar. But if you keep telling people that all of you have to do is click on an icon to set things up, it's not surprising that people click on the icon, take the defaults, and don't think about locking things down.
I mean no disprespect, but on average, people who do not understand how computers work, or how security works into the networked envirnment, would choose windows. There is no reason why windows cannot be as secure as a well locked down linux system, it is just less likly.
I will agree with this if talking about firms with enormously secure, and the reality is that most firms that would actually pony up for "cracking" insurance will be of this calibre: They usually have top notch IT departments. The small shops that account for the overwhelming majority of compromises seldom would get insurance.
I mean no disprespect, but on average, people who do not understand how computers work, or how security works into the networked envirnment, would choose windows. There is no reason why windows cannot be as secure as a well locked down linux system, it is just less likly.
Sorry for the repost but I forgot to put &lt rather than <...I will agree with this if talking about firms with < 100 employees. In that case it is completely true that often Windows is simply what happens to be installed so it is turned into the network infrastructure. However there are a lot of very large companies with very intelligent IT departments that have incredibly secure Windows 2000/NT networks with complete IPSec/SMB signing, Kerberos, certificate authentications, etc. As you mentioned and I will attest, 2000 can be enormously secure, and the reality is that most firms that would actually pony up for "cracking" insurance will be of this calibre: They usually have top notch IT departments. The small shops that account for the overwhelming majority of compromises seldom would get insurance in the first place.
Excellent points, however the fundamental of my position was that saying that the primary decision of the security of a firms infrastructure is what operating system they use is like (and I'll bring this up because there are several other car analogies) giving car insurance based upon the diameter of the tires. I am absolutely certain you could draw a correlation in some bizarre way between different tire sizes and insurance claims, however to use that as the foundation basis for insuring would be quite silly. Just because there is a correlation of something doesn't mean that it's a relevant correlation, or the most pertinent correlation, especially in something as complex as security.
If I read "...and furthermore shops that had installed the latest 2000 hotfixes had their premiums dropped 60%" then it would be credible. The security difference between a shop where the admins keep on top of the systems and one where they don't is huge and decisively paints a picture of the organization. The OS chosen does not (despite the patting on the back by the Linux community it's amazing how often I see scans for Linux vulnerabilities...).
What a ridiculous concept. The security of an infrastructure is far more the people and dedication to keeping on top of issues more than it's the operating system. The recent Solaris/IIS worm took advantage of a year old hole to compromise IIS 5 servers, just as the portmapper/BIND/RPC/POP2/etc. Linux exploits take advantage of ancient (in computer time) and long since fixed holes. Of course it takes a grossly incompetent sysadmin to fall prey to any of these, but unfortunately there are many of those out there.
If there is such a thing as "cracking insurance" (I mean by real insurance firms that aren't just trying to get headlines by making a ridiculous policy) it would be based upon the manpower skills, policies, and possibly the use of outside agents to test the security. The idea that Linux=Secure and NT=Insecure is absurd and simplistic.
Just because your big valuable database has a large loss potential doesn't mean that you get a worse insurance rate.
The difference is in the amount you pay, not the rate.
The article says that a hacking policy costs about $4,000 for $1,000,000 of coverage per year. That means that if you pay them $4000 a year, and get hacked, costing you 15 billion in revenue, they pay you 1 million. If you get hacked and you loose $1.75 in revenue as a result, you get paid $1.75. If you feel that your losses are likely to be on the order of 1 billion, then you can buy 1 billion dollars of coverage for 4 million a year. That 4 million isn't exact, but will be more or less based on risk factors including but not necessarily limited to operating system choice.
So repeat after me, insurance rates and insurance costs are not the same. Indeed, simply because they have more to loose, a big site is likely to be better protected than a small one. Now, the insurance company can measure this in different, more direct, ways, so they probably don't charge you different rates based on sheer size alone. But just because a site has a lot to loose doesn't change the rate.
Oh, I'd agree with you on that, but Slashdot's reasoning seems to be a bit lacking. First off, people creating new systems aren't going to be buying NT. If they're going the Windows route, they'd be buying Win2K. So, this article doesn't affect those people.
Now, if I'm already using NT and don't want to be subjected the extra fees imposed by this pissant company(*), I'd have to switch operating systems. Except that switching to Linux isn't going to be getting me any bigger insurance discount than if I switch to Win2K. So how is this an incentive?
Anyway, I just found it amusing that the marketing arm of VA Linux (read: Slashdot) would post this now, to take away the heat from the SourceForge fiasco. Maybe some people out there remember that The Register ran a story about the exact same thing over a month ago. (You gonna tell me that scads of people didn't submit it then? If so, I've got a secure RedHat server sitting on some New Jersey beachfront property to sell you ;) ).
(*) Why would I refer to them as a "pissant company?" Well, how many insurance agencies are you aware of that have only eight employees? I think everyone here is grown up enough to admit that we'd have never heard of these guys either if not for this one particular policy, a policy that nobody else in the insurance biz seems to be moving to.
Cheers,
Yes, and Java 1.2 is somehow called Java 2. Everybody knows that Win2K is the successor to NT4 in the NT line, but nobody except possibly the same people who say "M$" ever calls it NT instead of Win2K, 2000, Windows 2000, etc. When someone says NT, they're talking about NT4 and earlier. If they're including Win2K, they say NT-based. Anyone can argue semantics about this, but we're talking about real-world usage here.
Cheers,
Sorry, but I don't think the whole eight employees of Wurzler has much of a say-so when it comes to reality.
Besides, why is Slashdot still fighting over Windows NT, the focus of this article? It's about 5 years old now, I'd think that Slashdot would be more worried about Windows 2000.
Also, it doesn't seem the article's author has done much comparing of security patches offered for holes on company web sites, since he chose to only mention NT's, even though there are a lot more for Debian 2.2 and RedHat 7.x, when you take into account how long they've been out. Oh well, what can one expect from Ziff Davis journalism?
Cheers,
..if this is true, I think it may come down to commitment. Unix/Linux sysadmins seem to actually love and are committed to their OS, whilst for NT advocates people it's an on the surface liking.
Secondly, Unix encourages you to play with the nuts and bolts, whereas the closed nature of Windows programs does not encourage exploration. Therefore when things do go wrong, a Unix sysadmin knows where the Usual Suspects may be found and can get things back up quick, whereas a Windows admin is busy phoning MS support.
Thirdly, it may come down to ability. I'm under the impression that to truly claim to be a Unix sysadmin you really have to know your Unix, and thus only the best get to go for such jobs. I have a fairly shallow knowledge of how most things hang together under Unix, but there's no way in hell that I'd claim my knowledge is deep enough to sysadmin Unix systems for a corporate entity, where hacking threats and downtime are serious issues. Whereas an NT admin waves his MCSE qualification around and gets the job regardless of how good he is at it. I'm under the impression that the best use for such a qualification is as toilet paper.
N.B. Before I get flamed, I do know there are some very good, professional, experienced NT admins out there; its just that you guys seem to be hidden from view by the not so good masses.
Donte Alistair Anderson Roberts - hi son!
Karma: Chameleon
There's yet another aspect to lowering insurance premiums in business by switching from Microsoft products to Linux or BSD. As Microsoft moves more and more to coupling your software license registration with particular hardware, that could mean that if your hardware is stolen, you may have to buy another copy of the OS and all the applications, when you buy a replacement PC. If you expect the insurance to cover that added cost, you can expect the premiums to go up with it, too. And if you think Microsoft will readily make exceptions for stolen hardware, then I think businesses will catch on and claim hardware as stolen when in fact it is just sold off to recyclers or employees (who will likely continue using the software if it's from Microsoft).
now we need to go OSS in diesel cars
Yeah, it's a shame that the "liberal elite" insurance industry doesn't support the "conservative just-plain-folk" at Microsoft.
--
Sheesh, evil *and* a jerk. -- Jade
> Despite what these people say, most of the crap that they've been flinging around is just plain baseless. I'll be called a "Microsoft shill" or an "astroturfer", but truth is truth: Microsoft's latest server offerings are extremely secure, scalable, and reliable.
Not to imply that I believe you or anything, but you fit the stereotype to a 't': once MS finally does produce an OS that's stable, scalable, and secure, they'll brag their asses off over finally providing the most rudimentary services that an OS is supposed to provide, and that they should have been providing since day one. They'll probably even claim that they invented those concepts.
--
Sheesh, evil *and* a jerk. -- Jade
This isn't about 'which OS is better' or 'which is more secure'.
Its about statistics, and about more than just the OS.
They found, in their studies, that linux-based shops tended to have less security problems than NT based shops, due to a combination of software, better trained and happier employees, etc.. so they did what insurance companies do.. they said 'if you use linux, we will give you a cheaper premium'.
A real-life example of the same thing.
Auto insurance in Alberta, Canada. If you are under 25, and especially if you are a male under the age of 25, insurance is expensive.
Once you are over 25, it gets much cheaper.
Now... I've been driving since I was 16, and never had an accident. Does this insurance policy imply that I am somehow incompetent? Certainly not... they're just playing at statistics. 80% of their costs come from male drivers under the age of 25, so they make those drivers pay more. Period.
Now pretend young male driver = NT shop, you get the same sort of thing.
I think that the human factor is much more important than the choice of OS. Anyone can put up an insecure box. A secure box takes vigilance to keep it secure.
If I was an insurance company what I would want to know is what the maintenance procedures for a site were, and see documentation that they were being followed.
The point about the technical competence and turnover rates is crucial given these issues - a shop that has low training and high turnover is just not going to have the adherence to proper maintenance methods that a shop with low turnover and skilled employees.
Also, you can automate your patching under *nix and patch many machines without leaving your desk. This is more complicated under NT.
In addition, if you patch an app under *nix, you probably just need to restart that app, not do a reboot.
dave
For the Win2k boxes (6 of them, total - 3 x from end, 2 x database, 1 admin/directory), each is set for daily reboots.
But you don't see this as a problem... Having to do this means that something at a rather fundermental level is badly broken. It might be your setup, it might be your setup, it might be your sysadmin, etc...
It seems to me that Wurlzer has fallen victim to some of the FUD that has been spread by Linux advocates. [snip, a lot of linux bashing]
The problem is, that all statistical surveyes (for what they are worth) I've seen, all say that MS-based Internet servers, percentetwise are cracked more than their marked share would indicate. Much to my surprise, MS-Windows 2000 servers, are disproportionately more cracked, than even MS-WinNT 4.0.
Why it so, I really don't know; is it because; Sys-admins are insecure about applying hot-fixes (will the server come up again after the reboot?)
Skript-kiddies feels more at home on Win-servers?
Win+IIS are generally insecure products?
Windows servers, are generally runned by less competent/lazy people?
Companies running MS-solutions are to cheap to have a decent security policy?
A penguin ate the Hot-fix?
The insurance companies doesn't care why. They are just greedy bastards, who hates to pay out.
Look, if you want to use Linux or *BSD or some other non-mainstream OS
Take a look a www.netcraft.com : Linux is a mainstream Internet OS. Apache (OSS software) is by far the most dominating web-server around.
The way that America works is that people get together and work hard to put out a product, and then they sell it to people.
That exactly what this insurance company is doing; selling a product. Just be glad that it isn't a monopoly, so you can take your business elsewhere.
Go ahead and flame me
Ok. Flame, flame, flame.
[scorch-mode on]
You, sir - you are a MS zealot!!
[scorch-mode off]
Yeah, no Americans have ever contributed anything to Linux or the BSDs.... pffft.
Certainly, any large corporation should both secure themselves to the best of their ability, AND take out a policy.
;)
Reading sites like CERT, l0pht and rootshell is never going to become useless, because at some point they will charge you so much for your coverage that you can no longer afford to remain in buisness. There will continue to be a need for security.
At the same time, I do think that for a short time at least, this will lead to lax security in companies which do purchase these policies. Some of them will doubtless reason that simply because they have purchased this policy they have all the protection they need.
That will last just long enough for them to lose some truly critical data or buisness which will seriously impair their ability to operate. At that time, they will take the money their policy pays out to them and hire a team of badasses to come in and secure their network, because they can't afford to have that happen again, even if someone does throw money at them when it occurs. Money doesn't turn back the clock, at least not yet.
All you security consultants are safe, but you might want to lay in some ramen for the next few months if you just got off a four month vacation.
tough titty (as the kitty is reputed to have said.)
No, I'm not trying to be funny.
--
...that NT shops get charged more because it's obvious they have the money to spend?
...that Linux shops have low-turnover because GNU/Linux "admins" can't get jobs elsewhere?
...that your blatant and igornant anti-Microsoft bias only reinforces Slashdot's reputation as poo?
Either that or statistics show that NT has more security problems, which as bullshit as statistics are, this is what insurance companies live on.
Where'd you get that from?
So what should they post, stuff espousing how they love microsoft, in spite of the things microsoft has done to prove they deserve a lot of the crap they catch? I know some of it (ok, a good bit of it) is BS, but from what the article says, it's obvious that it's not Slashdot making this call.
While it's fun to talk about the technical merits of one OS versus another, I think the economics favor open source. Economics will win in the end. This article adds two interesting points to the economic part of the discussion, risk management via insurance and staffing.
One way businesses manage risk is to insure against loss. That's costly, so you do what you can to save on insurance costs. Hiring people is expensive. Boring stuff, I know, but think about how that fits into an overall cost picture for chosing an operating system for, say, an e-comerce site.
- Less costly operating system due to no licensing costs, no (or very low) initial purchase (the easy to spot costs we've heard about over & over again)
- An operating system that your hard to find technical people prefer to work with (it's cheaper to keep people than to hire new people)
- And add to that, lower insurance costs
It's not just "free" software anymore, it's a broad cost savings strategy. Bottom line stuff like this often makes business people change their minds about purchases they might otherwise have not thought about.
--ddm
You want fair from an insurerer? Insurers do profits, not fairness.
//rdj
No one can understand the truth until he drinks of coffee's frothy goodness.
--Sheikh Abd-Al-Kadir, 1587
If you're running OpenBSD, you don't need cracker insurance.
Er, no. If you're running OpenBSD in the default install, which few if any people do you don't need cracker insurance.
On the other hand, say you forgot to apply the FTP globbing patch to your OpenBSD FTP server, then you probably do.
Piss your co-workers/compeditors/Granny off by 0wning their IIS boxes and emailing the logs to their insurance co...
:-/
"But wait... I run apache on my IIS"
"Dosen't matter" says the insurance co "we won't drop the bill until you put in a reliable TCP/IP stack"
oh well
I believe that NT/Win2k's security problems come down to 3 issues:
Someone you trust is one of us.
And people wonder why they get hacked. If you think you are invincible, you are just asking for trouble :)
Brielle
First, I have seen this in real life, NT looks easy to administer. As a side effect the IT directory decide that anyone can administer it. Wrong. That was the case when I was working in some company as a UNIX and network admin. We did ourself an audit of the publicly accessible web servers and we found that most of them were just a huge security hole: no patch, nothing. When we reported this to the person in charge of the machine, the person didn't even know how to patch it, etc. Security holes ranged from traditionnal buffer overflow to Front Page extension and clueless passwords. That make NT a dangerous toy. Note that most of the fix required a complete reinstall of the system as well. By default, UNIX boxes are most of the time more secure, and since to set it up you meed to have some knowledge it is unlikely to find them administered by clueless users.
Second: security holes statistics shows that NT has more holes discovered. This is a fact. NT can be secured, but it require a lot of work and good skills. People that can do this are more hard to find and more expensive than a senior UNIX admin.
Wurzler does not want to punish people. He wants to optimize his business profits, and for this, like many insurance, raise price based on risks taken. Afterall, doesn't Microsoft do the same: maximizing profit ? Isn't this the American way of life ?
Hub
NT != W2K != XP. You completely missed the party as well as CIS class. NT4 is what this article is talking about (I actually contacted this company a few months ago, I am in MI, and knew of this crap back then). If you are using W2K he does not charge the premium. You'll notice how that little fact was convienently left out. Don't believe me? Call them yourselves, they're on-line and in the yellow pages.
Besides, it's IIS that has the biggest problems with vulnerabilities, NOT NT or W2K themselves. Ever heard of someone cracking into a NT box from within the network? Me neither. It's always some malformed HTML request taking advantage of some cool MS only feature IIS brings to the game.
NT means NT4. W2K is a new animal.
A tiny 8 person company in MI decides to try to make more money off the FUD on NT (they didn't mention W2K, which they do NOT charge more for. I called, did you?) - that's hardly newsworthy except on /. where anything MS is not only fair game but headline making!
W2K might have been based on NT technology but is such a massive rewrite that it's unfair and inaccurate to consider it the same as the 5+ year old NT4.
... right?
Is it fair that anytime we talk about Linux 2.4 that we can chide it for any faults and ommisions present in Linux 1.0? or just any Unix you can name cause Linux is JUST another Unix
Since when is Windows a mainstream server OS for Websites?
The message on the other side of this sig is false.
All insurance companies do that.....
Buckets,
pompomtom
Buckets,
pompomtom
"There's an exception to every rule. Except for some rules"
As someone who has been through this, I assure you that major insurance companies do indeed offer this type of insurance. And as for simplifying the premium based on what OS you use, it goes much deeper than that. I spent two full days with the auditors going over everything from what OS we use to how many servers, what types of firewalls, where do we host, climate controls, how do we dispose of information (both paper and electronic), how much experience the staff has, etc., ad nauseum. The OS a company uses is just one TINY part of the overall pricing.
-
Wurzler found that system administrators working on open source systems tend to be better trained and stay with their employers longer than those at firms using Windows software, where turnover can exceed 33 percent per year. That turnover contributes to another problem: System administrators are not implementing all the patches that have been issued for Windows NT, Wurzler said.
The biggest reason is that unix nuts tend to be better trained (well duh) and that staying on top of patches is critical.I know I could probably find some of my WinNT and Win2000 boxes that need patches - how about the rest of you? I don't run any critical systems on my NT stuff, I only use it for applications where MS has the edge.
-----
So what's the discount for running OpenBSD?
Oh wait, I almost forgot: If you're running OpenBSD, you don't need cracker insurance.
Tarsnap: Online backups for the truly paranoid
I know it's a bit odd to complain about my own post being moderated up, but...
That post was NOT informative. Funny, maybe. Insightful or troll, possibly. But there is no way that post can reasonably be classified as informative.
Tarsnap: Online backups for the truly paranoid
A comment I read a couple months back on /. said it really well.
It's not that Windows servers are run by lazy/incompetent admins, it's that lazy/incompetent admins prefer to run Windows.
They don't have to get much of a clue to be able to walk into a company, say 'yes, I can admin an NT box' and bluff it. Bluffing on almost anything other than NT is Just Not Possible for more than a week IMO. (You might get away for a week saying you're finding your way around, if you're lucky).
Why doesn't the gene pool have a life guard?
Chill out man, you may hyperventilate.
Or are you just trying to be funny?
Sure man, I'm fond of free speech too...
...and free beer, software, love, etc...
Add my two gallons while you're at it.
For a while it seemed like sanity may win out by moderating the post down as troll/flamebait. But then things went back to just buisness as usual.
The point is that Wurzler is essentially rewarding people for using an OS whose scioeconomic philosophy is decidedly un-American.
Oooh, it keeps getting better. Yeah, these Linux zealots are all just a bunch of commies. I see it clearly now.
- ...that NT shops get charged more because it's obvious they have the money to spend?
- ...that Linux shops have low-turnover because GNU/Linux "admins" can't get jobs elsewhere?
- ...that your blatant and igornant anti-Microsoft bias only reinforces Slashdot's reputation as poo?
Well? Have you?--
--
I like to watch.
I've got the feeling that I've just been trolled, but....
Your trying to tie nationalist sentiment to commercial reality. Fine, there's been plenty of campaigns to 'Buy back America', but there are plenty of American companies being assessed. In the end one American company has assessed that another American company produces products that may be slighly riskier than using another American company's products or using a free alternative.
Microsoft isn't the only American company that deserves to be supported by some grassroots 'Buy back America' scheme. I'm sure there are plenty of other companies that produce less risky products that could be supported.
The veterans fought for all of America, not just Microsoft.
---
---
Silence is consent.
This article mentions:
Windows NT/2000
"Open Source" operating systems
What about shops using Solaris (available, but not open), HP-UX, AIX, IRIX, SCO, MacOS (pre OS-X), OS/2, and so on? Are they charged the same as NT or as Open Source(tm)?
My suspicion is that whoever wrote this article has no idea what open source means, other than 'not Windows.' I could be wrong, but it certainly sounds that way.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
One big problem is that many companies hate the intrusiveness of a machinery breakdown insurer. Hartford Steam Boiler won't insure something until their inspectors have been all over it and everything they want fixed has been fixed. Companies with well-run plants get great rates from Hartford Steam Boiler. Others get turned down.
The computer industry has succeeded in pushing failure costs onto their customers, rather than having to insure them. But that may not last forever. It was like that for boilers once, too.
A story about some company saying that Linux is more secure that NT right above a story about sourceforge.net being compromised.
Vintage computer games and RPG books available. Email me if you're interested.
Vintage computer games and RPG books available. Email me if you're interested.
memory leaks here we come!
Failing to check the value returned by malloc is a bad idea. A very common bit of bad judgement that always irritates me, but how on earth would it create a memory leak? In C - probably not, in C++ - more likely (if exceptions and the pre-standard style of new are mixed)
If you are going to troll here, (and who doesn't these days?) please try to give those reading at 0 and -1 something interesting to read.
--
--
You nah, me nah. Screw you guys, I'm going home.
I know this has been touched on somewhat in other comments, but I'll go ahead and post anyway.
Really, people. I wouldn't consider this article to be very indicative of the true stability of various platforms. For instance, Windows NT 4 is a very old NOS. It was released sometime around 1996. And guess what? It sucks in many ways. But most anyone that has used Win2k (I.E. NT 5) in either a workstation or server environment will tell you that is much more stable and secure.
And what of other *nix and open source operating systems? In general, I consider the BSD distributions to be far more secure than you standard, out-of-the-box Linux distibution.
It would be very interesting to see a breakdown of major OS/NOS systems, with a "security level" rating. I wouldn't consider any study noteworthy that didn't include all of the following: Linux, WinNT, Win2k, BSD, OS X, consumer Windows (9x/Me/XP), and proboably Solaris. It is completely unfair to lump all *nix systems together and all Windows systems together.
Thoughts?
-James
Did not know insurance companies offered policies protecting against a hack attack.
Do they also offer insurance against a slashdotting?
"Old Rallydrivers never die - they just fail to book in on time"
At the same time, I do think that for a short time at least, this will lead to lax security in companies which do purchase these policies. Some of them will doubtless reason that simply because they have purchased this policy they have all the protection they need.
No - all of those policies will demand that the purchaser maintain stringent security. Note that the Wurzel is charging more because it is harder to maintain security when using NT; this itself directly indicates that lax security is not encouraged. If/when these policies become widespread, every time there is a break-in, the insurance provider will conduct a study to make sure that the providee measured up to the security standard outlined in the service contract. If they are found not to have been up to the standard, the provider won't cover the cost of the break-in. Any other policy and they'd soon find themselves bankrupt.
This is a VERY interesting point. Imagine, a war between the premier provider of business software in the world against another industry bad boy, the insurance companies. Now THAT would keep me on the edge of my seat. Of course the insurance companies would win, but it would still keep me on the edge of my seat.
Windows advocates are willing to admit that Linux has gotten better over the years
OK. MS's offerings in the past have been shit, 95 was full of holes , 98 crashed continously.
NT4 was not really a server OS. Novell and *nix took the market by storm - how many hospitals were running on a ms base? Exactly - all were on novell and *nix.
Now MS brings 2k in. Ok, it's cool - I'd like to not reboot 8 times when I'm installing the last 8 hotfixes after installing the os, then doing the same shit after installing sp1, but hey at least
Its a shitload more stable than 9x/me, more secure (though it would be nice to be able to enable ip filtering on a per adaptor basis... sigh.)
You said "over the years" - which is exactly my point. The industry isn't going to make an overnight switch to something that is new - and, more importantly, relativley untested.
Naah, thought again about it. You're a dumb fucking hick. The link that you developed between vetran's faces and MS is totally fucked. Gimme some of that shit that you were smoking so that my party next week will be a little more exciting.
Maybe you just watched Pearl Harbor or something, but watch that patriotic rant - especially if you go to any arab countries. Keep in mind that everybody outside your country hates you.
Yay! lets firebomb tokyo again - from the outside in, so we get all those people toasty warm - and set up concentration camps for asians! Or let loose dogs and firehoses on those who have a skin color that is not white.
Yeah - lets also celebrate the day after we nuked two cities full of civilians - we woulda taken kyoto out (1 mill people, the nuke would of have been much more effective there) but the weather sucked! Yay america! innocent slaughter of civilians!
/. is anti-ms because of fucking trolls like you. I have no fucking idea how you got enough karma to post at +2.
The slashdot 2 minute between postings limit: /.'ers since Spring 2001.
Pissing off hyper caffeineated
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
NT Security is quite powerful - especially the relatively unknown command line commands. Which the MCSE teaches you precisely NOTHING about. Regedit classes are really short too.
As for documentation - I beg to differ - wk advanced server comes with quite a bit of documentation on all its features - very, very helpful - I was shocked. It is helpful - but also covers the basics (paper club) But if you include the online documentation from the ms website, you have quite a deal of information.
Also - if you make the OS, you know exactly which hardware was used, which hardware has no issues (and get the ms driver dudes to write approved drivers), which probably explains why their webserver is up 24-7-365. I'm sure they have a pretty much unlimited budget for that too. Besides, they are using data center, and I've heard really, really awesome things about that.
The slashdot 2 minute between postings limit: /.'ers since Spring 2001.
Pissing off hyper caffeineated
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
The slashdot 2 minute between postings limit: /.'ers since Spring 2001.
Pissing off hyper caffeineated
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
If I replace the stereo system in my car with a more powerful, more expensive system, the insurance company will increase my bill. How is this any different?
Windows NT/2000 may not be more powerful, but it is more expensive, and as a result it's more expensive for the insurance company to replace than an Open Source operating system.
So, why would you expect your premiums not to go up based on the expense of your system? Remember, the insurance company must have a sound finance model, and not recognize the actual expense of an insured item just doesn't fit in with sound thinking.
-Medgur
BTW-Excellent troll, not only did you bring in the typical anti-slashdot propoganda, but you even managed to bring in the "American Way" and veterans, all while fooling the moderators.
Comment removed based on user account deletion
Comment removed based on user account deletion
Comment removed based on user account deletion
So you either work in an open source shop or a Windows shop, eh? I'll have to notify my employer. We're violating the rules.
The heart has reasons that reason does not understand. - Jacques Bènigne Bossuet
and the story right below this one
Developers: SourceForge Server Compromised
When death looks you in the eye, smile. Someone needs to cheer him up.
from the shoulda-bought-that dept.
sulli
RTFJ.
Whoa, wtf does military service have to do with computer security? Its absurd to think that a large insurance company with college-educated actuarys would do something like this lightly, considering how popular MS is. They honestly belive that Linux is less likley to be hacked, but this is mostly because of the differences in the people who manage the networks.
Numbers 31:17,18 Now kill all the boys. And kill every woman who has slept with a man,but save for yourselves every virg
I guess sanity does exist at slashdot.
http://saveie6.com/
I only ran a release candidate of W2k so I am pretty much still an NT4 person. Perhaps I will take a look after my employer upgrades. I am a unix operator now so I guess this no longer applies to me. :-)
http://saveie6.com/
I am a mcse (ok, here comes the flames) because I use to have a job supporting NT users and servers. I also know some linux and freebsd.
:-)
The problem is I really don't know how to secure an NT server. My mcse classes taught me nothing, other then how to setup a domain controller. I was told that NT was enterpise ready right out of the box unlike unix so it was already secure. I knew this was total bs. The thing is that there are a million resouces out there on how to secure Unix/Linux and all the configuration settings are stored in text files where you can edit them manually, but in NT its hidden in the registry. How many here actually know what the majority of the registry settings actually do? I found 1 or 2 books dealing with NT security at Borders so the situation is getting better as people discover what some of the settings are.
It would be nice to have future mcse or corporate training courses to have security methods in the circulum. Or even discuss several registry settings so we know a little more on how to customize NT. I believe NT may be secure if its done right. I believe the only time Microsoft's website was ever down was due to a linux(not NT) bug in their outsourced DNS servers. Microsoft uses a seperate company which uses linux for their DNS. I don't buy the security through obscurity arguement. Microsoft loves hiding things to make their products look easier and markets them to the average joe consumer. This may be good for home users but not bussiness users.
I remember a Microsoft semeniar where Bill Gates talked about non techie users installing NT to get work done and how great WIndows is because you don't need an admin to setup a server??
Perhaps thats the problem.
I can imagine the paper clip from MS word poping up whenever someone uses regedit in the WindowsXP.NET.
Basically the summary of problems are, lack of documentation, qualified admins, and the reboot problem is why NT is having some problems. The stability arguement is not that important considering bussinesses are using switches and clustering to make NT work. Got to love those clueless CIO's and phb's who insist on using NT over Unix. Well, if they want to pay 3x fold for an NT solution over a unix one, I guess thats their problem.
http://saveie6.com/
Somewhat a response to ergo98's 'Idiotic' post, but somewhat separate... :)
First off, I thought I read about similar action by a London-based insurance company a few months ago - darned if I can find the URL just now tho.
Nowhere did the article say 'NT=insecure, Linux=secure'. This insurance company is doing what all insurance companies do, which is analyze their claims data and make assumptions, inferences, and policy changes based on this data. Of course inhouse skill, training levels, etc. all play into how secure a box or network is. However, according to this insurance company, their numbers are bearing out that it's more expensive to insure companies using Windows NT. Windows may be merely a symptom of a company that is lax about security in general - hiring inexperienced people, cutting security budgets, etc. But they have enough data to make a correlation between NT and higher insurance costs. (more claims? higher $ claims?)
Auto companies insuring cars will rate a sports car as a higher risk, even though it shouldn't happen that way. It's COMPLETELY down to the driver - just because I drive a red convertible sports car doens't mean that I *ever* speed, but statistically people driving red sports cars have higher accident rates, so they charge higher premiums for that car, because it's an indicator of risk. (Not sure on the specifics - I seem to remember red sports cars being higher, but could never afford one anyway, so it's a moot point for me!)
Interestingly, I was doing some work with an auto insurance company a few years ago that was looking at using people's credit ratings as a premium indicator - apparently, a credit rating is as good, or sometimes better, indicator of an auto insurance policy risk. Dunno if it's being phased in anywhere around here (Michigan) but I seem to remember the initial interest was stemming from research in California.
Back to the point - it's not idiotic at all that an insurance company would use something like software choices to base premiums on. Those choices, statistically, will point to other info about the company that is relevant as well. There will always be exceptions to the rule, but statistically, these will prove out - if they don't, insurance companies won't adopt these. If the numbers work out, they'll move in this direction. It's simple numbers.
creation science book
Jon, As a person working in the insurance industry, I find this line very funny:
But what Wurzler is doing here is essentially punishing people (fining them, as it were) for making a responsible choice to use the products and services offered by one of America's most important flagship companies.
Now maybe the Open Source people will call you a Microsoft shill, but I would have to point out your ignorance of how the insurance industry works. Premiums are determined by risk factors. If you have more risk factors than someone else, you will be paying a higher premium. It is not a punishment or a fine.
Consider this, my little brother pays almost triple what I pay in a 6-month premium. We both drive cars from a flagship American company (Jeep). Is that fair? Should Congress investigate? Does it matter to you that he is single, twenty-one, male, lives in Chicago and has a DUI on his record and I'm married, thirty-two, male, live in the suburbs and have a clean driving record? It should. These are examples of risk factors. This is how the industry works.
Now, if studies have shown that Microsoft products are more open to attack than other systems for any reason, then that is considered a risk factor. If they (underwriters) find that Storm Linux is less secure than all the other distros (I'm not saying it is, just an example) then it would be logical to see Storm users paying more.
Spend a little time looking into how insurance premium rates are determined before screaming 'foul'.
Viv
-----------
Viv
Gmail invites for ip
What if I administer a network full of Windoze 95/98/whatever boxes without security upgrades or service packs of any kind, ... and the whole thing is firewalled by a Linux box, or a FreeBSD box ? do I get charged 15% more or not ?
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
... a website defacement will one day "cost" 10 million dollars to the "victim" company. And, the insurance industry(disease?) will financially back draconian anti-hacking anti-personal rights laws, citing the latest website defacements "cost" as the need for such harsh measures, and after they've passed, they'll still up their rates. All the while, realizing huge profit increases every quarter, while publicly whining about any claims they do have to pay. Everyone will reason that they need insurance, and then you'll have this huge piece of garbage industry backing even more laws that walk all over our rights, when all anyone really had to do in the first place was stay on top of updates and exploits.
And in response to all this, what will our government do? Why, you fight beuracracy with more beauracracy, duh! We'll have the national hacker insurance oversight board, which will "fix" prices for companies, er, consumers, yeah, that's what they'll do, protect consumers, just like Californias benevolent insurance commision. Eventually, it will be mandatory to have such insurance to have a website for a as yet to be devised reason.
Poor predictable humanity, if you'd just look in the mirror occasionaly, you'd be able to realize why you're such easy pickings for the wolves.
Show me an effect without cause and then I'll believe in chaos.
In a way, they are basing it on the admin's. This quote sums it up well:
I know if I wasn't going to be around in a couple of months it would be very easy to "forget" to download and apply each patch as it comes out. Its much easier to just wait for the next service pack. Not that this is a good attitude to have.To understand what's right and wrong, the lawyers work in shifts ...
Personally,
I think they should base this on the relative skill of the admin securing the system. As it is, most NT sysadmins I know/work with are utterly lacking in their ability to keep up to date on security patches/fixes etc.
Then again, I guess their rating is correct, NT is at a higher premium because all those paper waving MCSE's tend to have less security experience overall
(Yah it sounds like flamebait, but this is from my own experience)
Your last name wouldn't be Katz, would it?
How the screaming Hell(tm) is Linux un-American? Because you can get free copies of it? By that logic, anything I get for free down at Wal-Mart makes Wal-Mart un-American. Oh wait, Linus Torvalds isn't an American... I see how this delusion goes... He _must_ be a commie, having grown up that much closer to the old USSR that good old Bill Gates... yeah right...
And just how can an OS have a socioeconomic philosophy? And when was the last time that an American serviceman gave his life for his OS?
Kierthos
(normally I don't respond to such crapola, but I have way too much karma lately...)
Mr. Hu is not a ninja.
You do know how insurance works, right? Odds are, this is an "at-fault" type of insurance, which means that it is probably very carefully delineated what the insurance company will pay off for. If the "minimum security standards" are met, and they still get cracked, the insurance company will pay out an amount dependent on the damages done.
However, if it is the fault of the company that is paying for the insurance, then the insurance company doesn't have to pay.
To liken it to car insurance, you would get paid if you were in an accident that was not your fault (someone else hits you, mechanical defect in the car, whatever), but you wouldn't get paid if you deliberately smashed the car into a tree.
Regardless of any of this, the rates that the insurance company sets (even regardless of what OS you're using) are based on actuary tables governing the chances that a system will get cracked. Odds are that most systems will never get cracked to the extent that an insurance settlement is required. Just as, odds are, most people that have auto insurance will never be in an auto accident. But they still have the insurance in case they need it.
Kierthos
Mr. Hu is not a ninja.
1) How frequently do you have a paid security audit from an outside firm? 2) What sites do you check for security patches and notices for your operating system, database, server software, and management software? 3) What internal risk training does your firm undergo? How frequently do non-IT people have to be refreshed? Are there live exercises? What is awareness within and outside of IT of social engineering attacks? 4) Can you please name the last five major published attacks that targeted a similar OS to yours? What have you done to secure against those attacks? 5) What do you do to keep your IT people pleased to work for you? Who are the people who do your data backups? What background checks were done on these people? What are you doing to keep them happy in their jobs? 6) What is the physical security of your servers? What prevents any person, even "authorized" from walking off with the actual server machines? Any company that can answer these questions will be much better prepared, and deserves AAA* rates.
when I was about to get my drivers license, I was pissed. It turns out that 18 year-old girls pay half of what I had to. I was outraged. Then, I got my license and drove way too fast =p
anyways, I never had any accidents (but quite a few tickets). The worst driver I have ever known was female. She managed to do a u-turn coming out of her driveway, ran into a tree and did $5000 worth of damage.
what is the point of this? Insurance companies go by statistics. A larger percent of males or, in the case, windows nt computers are a larger risk than linux computers. Who knows; maybe it is a result of the operating system; maybe it is a result of the difficulty of configuring linux servers (filter out the complete morons).
anyways, they are just looking at statistics and charging based on those. Stop bitching.
-theman2
ps: I admit to using windows 2000. I keep trying to install linux on my laptop, but can never get around support for different features. One of these days, I will probably become some bonehead winnt admin =)
Will this simply encourage people to use inferior products, knowing that they will receive large insurance settlements if they indeed ever are cracked?
It's kind of like when you need a new car but can't afford one. You leave it parked unlocked with the keys in the ignition, and hope it doesn't get stolen.
Dear Customers,
.NET +40%
In order to enhance our services and better serve you, we will adjust the insurance fee a little bit if your company is using the following:
1) Windows 2000/NT +5%
2) Windows 98/ME +10%
3) IIS +15%
4) Exchange +20%
5) Outlook +25%
6) MSN services +30%
7)
8) DNS server on Windows +60%
9) Continue the Windows subscriptions - you must be an idiot, but also our premium customer +100%
Best Rgds,
Your savior
P.S. all % accumulative, per license.
Its pretty much common knowledge that when companies refer to NT on a corporate scale they mean servers using the NT kernel, which refers to all WinNT OS's, Win2k and WinXP. Sorry if you are late to the party. :)
Mac OS X and Windows XP working side by side to fight back the night.
The problem isn't NT, and if it was, Linux wouldn't be the solution. The insurance surcharge should be for LAZY SYSADMINS with little or no security policies. -ted
It gives the ones making the safer OS a strong selling point, and that's what really matters in the long run.
It seems to me that Wurlzer has fallen victim to some of the FUD that has been spread by Linux advocates. Despite what these people say, most of the crap that they've been flinging around is just plain baseless. I'll be called a "Microsoft shill" or an "astroturfer", but truth is truth: Microsoft's latest server offerings are extremely secure, scalable, and reliable. It seems to me that a lot of these OSS advocates have this "Windows 3.1" mentality about Microsoft. Windows advocates are willing to admit that Linux has gotten better over the years .. why aren't Linux advocates prepared to admit the same thing about Microsoft?
.. I'm just sick of the blatant anti-Microsoft bias that Slashdot displays time and time again.
Look, if you want to use Linux or *BSD or some other non-mainstream OS to host your Web site, then great. That's your choice. But what Wurzler is doing here is essentially punishing people (fining them, as it were) for making a responsible choice to use the products and services offered by one of America's most important flagship companies. The way that America works is that people get together and work hard to put out a product, and then they sell it to people. It is particularly sickening that this news is being reported on Memorial Day, the day that we are supposed to be remembering the sacrifices that our servicemen gave for our way of life. The Wurzler bozos might as well spit in the collective faces of all of our country's veterans of war.
Has anybody considered holding Congressional oversight meetings on these people? It's interesting how they are unwilling to increase premiums on Linux users to deal with security issues and source code forking and the other (very real) risks of using this OS. Instead, what they do is punish people for making the choice that has been proven time and time again to lower the total cost of ownership. Go ahead and flame me
As a white male, I'm not sure what they're trying to accomplish with their hate-mongering disguised as insurance, but I am sure that I'm offended. I'm guessing that Linux rates cheaper for so-called 'cracker insurance' because while setting a Confederate flag as desktop wallpaper or playing a Lynyrd Skynyrd mp3 are trivial tasks with a properly configured recent version of Windows, Linux's lack of an integrated GUI makes these activities somewhat more difficult for the average 'cracker.'
AC's cheerfully ignored
You get this reply:
Sorry, we won't pay.
There is a fix for the problem for which you've been hacked, and it was published before you were hacked, therefor, you've been hacked for your incompotence.
Keep on paying the insurance, though, you never know when you might need it.
Your truly,
Dogbert.
--
Two witches watched two watches.
Which witch watched which watch?
What a ridiculous concept. The security of an infrastructure is far more the people and dedication to keeping on top of issues more than it's the operating system.
Yep. Precisely. Go read the article, and you'll see, right in the middle, a comment about open source systems admins being in average more experienced in their craft. As is very logical, since they often do it as a hobby to start with -- while I've never heard of Windows administration performed as a hobby.
Even if you leave aside the question of whether the Windows OS is as inherently secure as certain free alternatives, as long as it will be 'so user-friendly even a fool could use it', it will statistically be more likely to get compromised.
I find it amusing that Windows' main pro becomes a serious con in that light.
-- B.
-- B.
This sig does in fact not have the property it claims not to have.
I can definitely see the argument that Linux is as hard as Windows to install correctly. I agree if and only if you are coming from one perspective, and not the other. I am a UNIX sysadmin and have much more difficulty in Win32 environments.
Comparing Windows to Linux is misleading. The general OS of Microsoft to comare to Linux is Windows 2000, while "Linux" can mean any distro. The distros I use most are Red Hat and Debian. I can admit that applying an all-encompasing 'Service Pack' can be easier to some, however I find it offers the admin much less control and has a seemingly higher application break risk.
The Slashdot crew seems to really like apt-get as a update mechanism and I have to agree. It is Debian policy to repair and disclose all vulnerabilities and it has been my experience that they are wonderful at doing so. 'apt-get update ; apt-get upgrade' is extremely easy. Redhat's 'rpm -Fvh *rpm' can be less intuitive than an installer but again, it depends what you are used to and I have found it to be effective and have yet to be craked. (Knock on wood)
It may be true that good Linux admins are in short supply, but many efforts are underway to make it easier. Still, I would rather it be somewhat difficult and _correct_ than easier and less controlled.
Insurance companies have to file their rates with each states' department of insurance. They have to be able to justify from loss experience why they charge more for certain risk characteristics than for others. Unfortunately, they can't just charge more because MicroSoft is of the devil. What is interesting about this is that MS will definitely respond if they feel they are losing marketshare because of this. They will pressure the states AND the insurance companies to rethink this "discrimination". I would hazard to guess that ALL of the major insurance companies run MS exclusively (the one I work for does).
I'd rather have a full bottle in front of me than a full frontal lobotomy.
And don't forget, either, what "MSNBC" stands for:
The Microsoft National Broadcasting Comapny
If that doesn't put the fear of God in you, or at least bring loud cries of "Big Brother", I don't know what will.
Well, in a totalatarian system, the government is business. So, in a sense, Big Brother was also business.
Anyway, I have some major issues with 1984 and I could go off on a political rant, but I won't. But, right now I'm in the middle of reading Snowcrash and I am coming to the opinion that the biggest threat to personal freedom is not the government, but big business. Business that seems to be above the law. Or just find ways to simply bypass the law with technological means. Which kind of explains it.
But that's beside the point. I was trying to make a joke. Guess it didn't work. ;-)
1) has no need for insurance
2) has no money left for insurance
3) has no interest in compensation if their systems go down, because they were already completely "secured" from any use
4) has nothing on their systems worth cracking them for (see 3)
5) has been taken over by their security people, as is the fate of anyone who relies on mercenaries ("money is not the sinews of war")
--
Mr. Gates, forgive me for the off-topic rant on your sig, but I'm sick and tired of people misattributing this masterpiece. The song "Fish Heads" was written and recorded by Barnes & Barnes, and was credited as such on MTV (back when they had interesting content). Dr. Demento merely popularized the song by putting it on his compilation albums, just as he did with Weird Al's early works.
Back to your regularly scheduled discussion. ;{)>
Fight for your right to read books!
Huh. Maybe I'm forgeting what MS stands for in "MSNBC".
From how I read the article the company is basing it's insurance rates on the OS running on the *servers*, not the *clients*. The clients could be running anything - even Windows - so long as the servers are running Linux. Given that, any whiner arguing that this 'forces' companies to teach their employees the oh-so-complicated Linux is a blooming idiot. It only does so for the sysadmins, who should be competent enough to master Linux-as-a-server with relatively little pain. If they aren't that competent then they need to be fired. But oh, perhaps that's part of the reason why NT is so easily compromised? It invites the hiring of morons? Any which way you cut it, the insurance company covers both possibilities - bad software *and* incompetent system administrators, all in one fell swoop. Rather canny, actually. Max
My god carries a hammer. Your god died nailed to a tree. Any questions?
What self respecting insurance company would pay out if they could prove that the reason for the crack was due to shoddy security.
Unfortunately, it's everybody's problem. The money attracts more marketing and more product development. NT's problems get fixed by even higher-priced add-ons and alternatives disappear. The market is supposed to punish stupid companies like that, but if everybody's doing it, that doesn't help.
Linux and BSD are somewhat less susceptible to this because Microsoft can't just displace them: they get developed whether or not the developers make money with it. Consulting services for them, on the other hand, make money just like for NT.