Slashdot Mirror
Windows Developers Agree: Linux More Secure
theblackdeer writes "eWeek has an article up about an Evans Data Corp survey that the majority of Windows developers agree that linux is a more secure OS. "Linux scored high for innate security among respondents, more than two- thirds of whom 'use or target Windows with their code.' Indeed, only 23 percent of the developers were primarily Linux developers.""
What's next?
Linus Torvalds agrees, VB is pretty cool.
RMS agrees, Microsoft Visual Studio .NET is the best tool available for J#.NET
What do they base this perception or opinion on? Actual roll-up-your-sleeves analysis or the "features list" on their distro's box? Its kinda vague.
Sehr geehrter Toilettenbenutzer!
quote.com
Please report on your progress.
Couple thoughts on this:
-Poor sampling of programmers
-The world of developers is aiming at Linux as it's install base will grow.
-Linux is a better platform to program for.
I'm sure there's more idiosyncracies to find in this report, but these are just my $.02
--My sig is having emotional problems today so it won't be in.
I don't see how a VB programmer can speak with any authority about the security of servers since that is most likely not their primary job function. I'd rather hear what Windows admins think (preferrably ones who also admin Unix systems).
I administer a large network of both Windows and Unix server. Yes, I patch my Windows systems more often, but that is because patches are brought to my attention more often (via email as well as released more often _and_ they are easier to apply. Get SMS into the works and patching servers/desktops is even easier.
I see no reason to apply every security patch Microsoft (or Sun or Red Hat) releases, a large number of them are for apps/services I don't utilize. Not patching them immediately (or ever) doesn't necessarily compromize my security model, nor have I had any issues in the past re: this scheme. Good luck exploiting a hole in WMP on my servers.
As for which is more secure, its hard to say. That is really up to the administrator. I can make a Windows server more secure than most Linux installs out there.. but nothing is inherently secure.
Where do people think OSX comes in on the security spectrum?
Is the lack of mainstream press about OSX exploits because of the smaller userbase, or are there just not exploits?
And if there are no exploits, is this because of, again, the smaller userbase or is OSX truly a hardened OS?
Dissertation on the uselessness of Linux zealots
A spectre is haunting the world -- the spectre of the Linux zealot.
What the Linux zealot is will appear evident to whoever has experienced or came in contact with the discussions which daily rage the Web disguised as news, e-mails, reference material, etc. The Linux zealot, is nothing but an animal wandering unceasingly in virtual and true reality (which moreover he treats in the same way) claiming to be an authority on the Linux operating system, an out-and-out guarantor for everyone's freedom, opposed to any safeguard of intellectual works (for a Linux zealot, the expression "copyright" is tantamount to sin against the Holy Spirit: there is no kind of expiation); in fact, he champions software freedom as a fundamental point for world evolution.
But first and foremost, the Linux zealot is a deeply dangerous being as he claims to be the guardian of truth, and looks with suspicion (when it goes off well) or scorn (for the rest of cases, i.e. most of them) those people who simply think differently from him.
But what's Linux? A Linux zealot will never give an authentic answer to this kind of question. He won't, not because he doesn't want to (even if this is the case), but because this question has been answered already, somewhere else by someone else. Linux is nothing but an operating system. The Linux zealot will claim that it is a different operating system from all other ones. But this is not the case. Because an OS is an OS, its main function is to manage the resource of a machine we will call "computer" from now on, for comfort of description. By the term "computer" we mean what is commonly meant by this expression, i. e. the system of hardware resources which are fixed to a certain purpose, be it home use, business use, or server management. Linux is an operating system. Like Windows, MS-DOS, OS/2, etc. There is no difference, in this sense, between Linux and other operating systems. Linux manages a computer, no more, no less. So do MS-DOS, Windows and OS/2. What the Linux zealot self-importantly and arrogantly highlights, is the fact that Linux is a free operating system, i.e., it is made available free of charge to the end user. This of course isn't true at all, but the Linux zealot believes it. Linux is freely distributable, not free of charge. This means that the kernel and everything included in the operating system's minimal requirements can be freely distributed, not that they must be distributed free of charge. This is the first great misapprehension of the Linux zealots, who find their claim challenged by facts: if the essential parts which make the operating system, and some additional software, are freely distributable, they should explain the reason of the costs -- not prohibitive but certainly notable -- of the most popular Linux distributions, Red Hat and SuSE foremost. And most of all, they should explain the fact that companies like Red Hat are regularly listed on the stock exchange, and Mr. Linux Torvald enjoys a rather high standard of living. These benefactors of mankind, these software alternatives, these computer non-conformists (so much non-conformist as to be terribly conformist in their non-conformism) naturally justify the distributing companies' profits with excuses like "but there's a printed manual", "but the bundled software is qualitatively and numerically superior compared to the most popular distribution". "but it is easier to install" and other unspeakable nonsense. "On the other hand" they say "if someone wants Linux, they can just as easily download it from the Internet". Sure. Download it from the Internet. But how long must you stay connected, if you regularly pay an Internet bill, to complete the download of an updated version of a decent distribution of an operating system? So what? Is Linux free? No. Linux is not free, same as nothing downloaded from the Internet is free, unless you have access to an University server or can in whatever way scrounge a connection. If you ask a Linux zealot
In other news, 3/4 of all carpenters polled agree that plastic tubing is better then metal tubing for plumming.
The Cincinnati Bengals defeat the Arizona Cardinals 3 - 0 with a field goal with 0:03 left in overtime.
Really people. Comparing Linux security to Windows security is like comparing the Bengals to the Cardinals.
I have often wondered why windows is less secure. Could it be that a larger installed base means more exposure to security issues?? (ie. popularity = more exploits?)
If that is the case one would assume that if linux grows in popularity it will begin to get exponentially more volume as it's *unskilled* user base grows.
Is the difference between security merely a product of linux admins being more excellent or more fanatical than windows admins?
Until someone answers these questions I won't start *blaming* MSFT for bad security. It could simply be inevitable that a popular system has more exploits.
~fooo
When will people realise that security is not about products and operating systems. Security is a process that is ongoing and evolving.
"When I grow up, I want to be a weirdo"
I would not agree that Linux is more secure. I would however say that linux is less vulnerable as a desktop. I saw some numbers on slashdot somewhere (I'm not gonna look) that said that more linux servers are hacked than windows servers EVEN if windows is less secure due to the fact that there are more linux SERVERS than windows servers out therre. Now the same is true for desktops... more windows desktops are hacked than linux desktops because of the numbers. Bigger target = more attacks.
In short... more people looking for holes = more holes. A hole is not a hole until it is discovered. If nobody looked for windows holes it would be the most secure OS in the world! But this is not the case it is the opposite of course.
Vulnerability != Security, there is much more to it. Comparing windows security to linux is similar to comparing Walmarts shoplifting security to a local stores. Many people will say stealing from walmart is easy but when it comes to the local store fewer people will know.
/home/www/cgi-bin doesn't exist, where to I put it? And how do I tell what the URL of my linux box is? I don't think Dell put a URL in when I bought the machine, can I get one a Best Buy?
i'm surprised nobody has mentioned that in the previous weekend Microsoft took out a full page in a lot of the English papers (Guardian on saturday, Observer on sunday at least) telling people how to update their computers to guard against viruses etc. wasn't an advert (no pictures, just text) but a warning, like some kind of product recall notice.
andy
Your question is actually more critical of Windows security than the results of the survey: you doubt that the Windows developers surveyed can (or will) actually assess and report software security..
The end result is that either Windows developers know their software is insecure on an insecure platform, or that they are not qualified to make that distinction, and by default their software is untrusted and insecure.
--- Nothing clever here: move along now...
This summary, and the article it links to, both seem to paint the picture that there are two distinct sets of developers in the world, those that target Windows and those that target Linux (or other open source platforms). This is just simply misleading, as I don't think it's the case at all.
First of all, most people who write code for a living have little control over what target OS they are developing for. These things tend to be dictated by the business that the company is in, or their clients, or the decisions of upper management, or historical reasons, etc. Most developers write code for Windows at work because that's where most software development happens, not because that's really their choice.
And just because you code for Windows at work doesn't mean you don't use Linux or participate in open source development at home or in your free time.
I guess what I'm getting at here is that I'm not surprised at all that Windows developers thought Linux was more secure, as a lot of them probably have used Linux or use it at home in some form (such as for a firewall.) In other words, you can't just break software people up into "Windows people" and "Linux people" and expect the members of each set to view their target OS as more secure, more stable, etc. People develop software for Windows for lots of reasons -- "it's a day job", "that's what the client demanded", "it's just corporate policy", etc. I guess what I'm saying is that this article doesn't really prove much, other than the fact that a lot of people think Linux is secure, but we knew that much already. Or simply: "Sure I write code for Windows for $DAYJOB, but that doesn't mean I think Windows is secure, and I use FreeBSD for my firewall at home."
I'll do better than that. How about the address and root password of a public Linux box. As seen in Linux Journal. Please feel free to log in and play around -- that's what it's there for. (I'm hoping that the fact that this is a second level comment in a not-posted-just-this-second article will help keep the poor box from getting slashdotted.) Sure, it's SELinux, not quite the same as an off-the-shelf RH boxed set, but what does Windows offer that's anywhere near this level of security?
Um it aint going to do a lot if the perl instance runs under User-Mode Linux and in a chroot jail - effectively a poor man's VM with features enough for secure hosting. I looked for it on Windows, but unless I buy VMware, not such feature.
Commies can review the Windows source code, while I cannot. M$ refuses to let me on the grounds that I will find security problems.
Products and operating systems are unique by nature, each with their own benefits and drawbacks. Any good security arrangement will avoid Windows like the plague.
Security as a process is important, but a strong foundation will make static security possible.
You can't judge a book by the way it wears its hair.
Too bad that Oskar Schindler wasn't Jewish, dumbass.
My bicyles