Slashdot Mirror
Windows Developers Agree: Linux More Secure
theblackdeer writes "eWeek has an article up about an Evans Data Corp survey that the majority of Windows developers agree that linux is a more secure OS. "Linux scored high for innate security among respondents, more than two- thirds of whom 'use or target Windows with their code.' Indeed, only 23 percent of the developers were primarily Linux developers.""
What's next?
Linus Torvalds agrees, VB is pretty cool.
RMS agrees, Microsoft Visual Studio .NET is the best tool available for J#.NET
What do they base this perception or opinion on? Actual roll-up-your-sleeves analysis or the "features list" on their distro's box? Its kinda vague.
Sehr geehrter Toilettenbenutzer!
I don't see how a VB programmer can speak with any authority about the security of servers since that is most likely not their primary job function. I'd rather hear what Windows admins think (preferrably ones who also admin Unix systems).
I administer a large network of both Windows and Unix server. Yes, I patch my Windows systems more often, but that is because patches are brought to my attention more often (via email as well as released more often _and_ they are easier to apply. Get SMS into the works and patching servers/desktops is even easier.
I see no reason to apply every security patch Microsoft (or Sun or Red Hat) releases, a large number of them are for apps/services I don't utilize. Not patching them immediately (or ever) doesn't necessarily compromize my security model, nor have I had any issues in the past re: this scheme. Good luck exploiting a hole in WMP on my servers.
As for which is more secure, its hard to say. That is really up to the administrator. I can make a Windows server more secure than most Linux installs out there.. but nothing is inherently secure.
In other news, 3/4 of all carpenters polled agree that plastic tubing is better then metal tubing for plumming.
Which market share are you counting? Market share of desktop computers is my guess. Overall though, comptuers cover a lot more territory. Embedded systems make up more computers than desktop systems. (Appearently some cars have 70 computers!) Even that isn't the right market to count though, becuase programers work on future releases. What a programer works on today is a reflection of what the future market will look like.
However all the above is wrong, because it is based on market share. Professional programers work on what they are paid to work on. If a product that will only have 2 sales needs 25,000 linux programmers, while 75 different products each with 1000 windows programers and sales of one million, your market share for linux is tiny, but the share of programers is 25%!
I have often wondered why windows is less secure. Could it be that a larger installed base means more exposure to security issues?? (ie. popularity = more exploits?)
If that is the case one would assume that if linux grows in popularity it will begin to get exponentially more volume as it's *unskilled* user base grows.
Is the difference between security merely a product of linux admins being more excellent or more fanatical than windows admins?
Until someone answers these questions I won't start *blaming* MSFT for bad security. It could simply be inevitable that a popular system has more exploits.
~fooo
When will people realise that security is not about products and operating systems. Security is a process that is ongoing and evolving.
"When I grow up, I want to be a weirdo"
I would not agree that Linux is more secure. I would however say that linux is less vulnerable as a desktop. I saw some numbers on slashdot somewhere (I'm not gonna look) that said that more linux servers are hacked than windows servers EVEN if windows is less secure due to the fact that there are more linux SERVERS than windows servers out therre. Now the same is true for desktops... more windows desktops are hacked than linux desktops because of the numbers. Bigger target = more attacks.
In short... more people looking for holes = more holes. A hole is not a hole until it is discovered. If nobody looked for windows holes it would be the most secure OS in the world! But this is not the case it is the opposite of course.
Vulnerability != Security, there is much more to it. Comparing windows security to linux is similar to comparing Walmarts shoplifting security to a local stores. Many people will say stealing from walmart is easy but when it comes to the local store fewer people will know.
/home/www/cgi-bin doesn't exist, where to I put it? And how do I tell what the URL of my linux box is? I don't think Dell put a URL in when I bought the machine, can I get one a Best Buy?
i'm surprised nobody has mentioned that in the previous weekend Microsoft took out a full page in a lot of the English papers (Guardian on saturday, Observer on sunday at least) telling people how to update their computers to guard against viruses etc. wasn't an advert (no pictures, just text) but a warning, like some kind of product recall notice.
andy
Your question is actually more critical of Windows security than the results of the survey: you doubt that the Windows developers surveyed can (or will) actually assess and report software security..
The end result is that either Windows developers know their software is insecure on an insecure platform, or that they are not qualified to make that distinction, and by default their software is untrusted and insecure.
--- Nothing clever here: move along now...
This summary, and the article it links to, both seem to paint the picture that there are two distinct sets of developers in the world, those that target Windows and those that target Linux (or other open source platforms). This is just simply misleading, as I don't think it's the case at all.
First of all, most people who write code for a living have little control over what target OS they are developing for. These things tend to be dictated by the business that the company is in, or their clients, or the decisions of upper management, or historical reasons, etc. Most developers write code for Windows at work because that's where most software development happens, not because that's really their choice.
And just because you code for Windows at work doesn't mean you don't use Linux or participate in open source development at home or in your free time.
I guess what I'm getting at here is that I'm not surprised at all that Windows developers thought Linux was more secure, as a lot of them probably have used Linux or use it at home in some form (such as for a firewall.) In other words, you can't just break software people up into "Windows people" and "Linux people" and expect the members of each set to view their target OS as more secure, more stable, etc. People develop software for Windows for lots of reasons -- "it's a day job", "that's what the client demanded", "it's just corporate policy", etc. I guess what I'm saying is that this article doesn't really prove much, other than the fact that a lot of people think Linux is secure, but we knew that much already. Or simply: "Sure I write code for Windows for $DAYJOB, but that doesn't mean I think Windows is secure, and I use FreeBSD for my firewall at home."
I'll do better than that. How about the address and root password of a public Linux box. As seen in Linux Journal. Please feel free to log in and play around -- that's what it's there for. (I'm hoping that the fact that this is a second level comment in a not-posted-just-this-second article will help keep the poor box from getting slashdotted.) Sure, it's SELinux, not quite the same as an off-the-shelf RH boxed set, but what does Windows offer that's anywhere near this level of security?
Um it aint going to do a lot if the perl instance runs under User-Mode Linux and in a chroot jail - effectively a poor man's VM with features enough for secure hosting. I looked for it on Windows, but unless I buy VMware, not such feature.
You bring up some valid points, especially the embedded systems issue. I don't think that I was wrong, I was simply pointing out how wildly innacurate this (could be/is) as well as what could be interpreted from the given dataset. My assertions are no wilder than the ones that the surveyers made, just different.
Commies can review the Windows source code, while I cannot. M$ refuses to let me on the grounds that I will find security problems.
Products and operating systems are unique by nature, each with their own benefits and drawbacks. Any good security arrangement will avoid Windows like the plague.
Security as a process is important, but a strong foundation will make static security possible.
You can't judge a book by the way it wears its hair.
Too bad that Oskar Schindler wasn't Jewish, dumbass.
My bicyles