Slashdot Mirror
Security Affecting Microsoft's Bottom Line
kidlinux writes "The Globe and Mail has an article discussing the impact of viruses and security flaws in Windows. Apparently Microsoft has bounties out on virus writers. 'The campaign reveals just how much of a threat to Microsoft's bottom line security flaws now represent.' The effects of various worms and security issues are becoming visible in financial terms - having to deal with the security issues keeps Microsoft from closing new deals, and governments and businesses are starting to look at the alternatives, such as Linux. 'For the first time, it seemed, flaws in Microsoft's software were translating into flaws in the company's business model.'"
Microsoft has such ridiculous control over the market that it would take an act of God (namely Bill Gates) to bring it down. Like discontinuing support for its OS's. Commence flaming.
The Braying and Neighing of Barnyard Animals Follows.
Time to protect the monopoly. Once in that phase, funds are diverted away from R&D and into protectionism -- the great money pit.
Is it really easier or more cost-effective to change the world (pay bounties for crackers, lobby for prtctionist laws) than to change your business practices (write more secure software)?
This had better be a temporary endeavor conducted in parallel with major shifts toward better busines practices, or MS is starting the downward spiral.
Security failures are beginning to hit Microsoft hard not because of the enterprise, but because of home/personal installations.
Whereas a competent MCSE or IT director will have properly secured a corporation's machines against remote exploits (a properly designed network, even if none of the machines had been patched, should've been able to stay free of worms like Blaster and Welchia, for example), home users have been thrust into the unfortunate situation of running an enterprise OS (anything from the NT family), with no experience on securing it, and often, no knowledge that it needs to be secured at all.
Windows NT-based operating systems listen on so many ports, and are designed so wide open, because they are meant to sit inside a secured corporate network. Though Microsoft's unification of the NT and personal trees of Windows starting with XP gave personal users much of the speed and stability they had been lacking for so long, it also gave them security issues they should not have been expected to deal with.
This is why, though NT-based OSes have had widely publicized security flaws for years, their flaws are now in the spotlight.
Microsoft's recent steps to finally globally disable the Windows Messenger service and enable the firewall by default are a late, but necessary, effort to help bridge this divide.
If microsoft had put more of there bottom line in the past into the security of windows, this wouldn't be such a concern now, would it?
And why did you staple the trout to the RAM?
Actually, MS doesn't want people talking about security holes they find in MS software:
l t. asp?url=/technet/columns/security/essays/noarch.as p
, 00 .asp
http://www.microsoft.com/technet/treeview/defau
http://www.pcworld.com/news/article/0,aid,63784
As Steve Jobs once said, "Every security scheme that is based on secrets eventually fails."
A lot of people realize that most of their new software will run on the .NET runtime virtually eliminating (probably) most of the programming vulnerabilities that exploits take advantage of (buffer overflows, unchecked casts, etc).
why run from Vincenzo?
This is what happens when you let marketing run the company :) Shiny new graphics in this version! More features you don't need! Security? nope.
If OpenBSD can produce a secure distro for FREE, why can't Microsoft with all the resources available to them? Marketing never thought that it was important. End users are finally starting to realize that it doesn't need to be this way.
At this point, it's a little late to go back and design security into a system which never had it.
Of course, there goes my job security...
I use Macs to up my productivity, so up yours Microsoft!
Instead of writing more secure code or locking down system services by default, MS is going after the people who write viri. How is this going to fix the (in)security problem? Do they think this is the last generation of assembly hackers? Bah. Every day I'm reminded of why the Voluntary Human Extinction Movement is a good idea. Just remember that one day MS will be one of the many corporations that provides sponsered funding for your child's or grandchild's school.
That's a difficult one.
Stability used to be a major reason for avoiding MS operating systems. Win9x crashed frequently, others didn't.
As of Windows 2000 SP1, they managed to pretty much eliminate that problem. It took them about 5 years, but they got there in the end.
Possibly by the time Longhorn SP1 comes out, in about 2006, they will have pretty much sorted out the security problem. I guess it will still require stupid amounts of memory and CPI time compared to other systems, but that is becoming less of an issue as it gets cheaper.
Speaking about the "cash bounties" campaign Microsoft is offering:
The campaign reveals just how much of a threat to Microsoft's bottom line security flaws now represent.
The campaign reveals just how much extra cash Microsoft has lying around and is willing to put up to make the buying public think it gives two shits about security.
The article says that Microsoft need to put a priority on customer satisfaction. Is that really possible? Over the years, my experience with Microsoft is that they pride themselves on being a "take no prisoners" and "shoot the wounded" type of company, always looking forward to the next challenge, never taking time to fix and support older products. When I once asked when some severe bugs were going to be fixed in one of their current compilers, I was told that they were never going to be fixed, the programmers had already been reassigned to the next big project. From a bottom line point of view, it made sense, but it showed a total disregard for their customers.
Mea navis aericumbens anguillis abundat
I see the bounties as a cheap way to fix the security bugs... microsoft offers $500,000 for someone to find the author of the bug, then M$ gets them in a contract to either fix their software or go to jail... NICE!
stuff |
If Microsoft were really serious, they would pay the bounties to people who find their flaws.
IMHO, this is a Good Thing (tm). If security issues start affecting the MS bottom line, then they will start taking security seriously. Microsoft is not evil, they're just greedy. Hit them in the bank account, and they will notice. Losing a few $100 million in random lawsuits is not a big deal to MS. Losing desktop market share (especially in the home market) is a huge deal.
The impact on Microsoft's bottom line only reflects the impact on their customers' bottom lines. Well crafted EULAs may exempt MS from liability, but they can't exempt themselves from a deservedly bad rep created by poor security in their software.
If the wind blows right, sometimes shit does roll uphill.
What company do you work for?
0) you assume that a system admin has time to address the daily patches that were coming out at the peak.
1) patches take time to test and apply. You might be able to break a users computer (as long as it's not the company heads), but you can't break the server.
2) MS charges $$$$ for the systems which give you the ability to maintain many systems.
3) things get behind the firewall. Probably a lot less since these worms, but they do get behind the firewall.
MS is paying for bad decisions.
* Trust. Trust will work on the internet. Nobody would click ok without reading what the message says.
* Sandbox, VB don't need no stinking sandbox
* No user permission separation
If Microsoft buys Symantec, they can create a "real options" type scenario.
Microsoft creates insecure software. Microsoft-owned Symantec secures networks which runs insecure Microsoft software. End result: PROFIT!
Too bad the anti-trust laws would probably break the whole deal up.
I claim first use of "Error No. 0B" - or "No. 0B error." It'll be the new ID 10T!
(In this post, I am going to describe two or three reasons that I believe Microsoft will soon become a regular industry player, and will no longer rule at the top.)
Think that putting a bounty on virus writers is going to solve the problem? That's the trouble with you, billg, you think you can buy your way out of all your problems. Heck, if I had as much money as you, I could buy my way out of anything, too. The only trouble is that your mighty empire is slipping through your fingers, and because of what I'm about to say, you cannot fix it, no matter what you do.
Many companies have realized that using free software, and contributing to that software, both in fixes and in features, provides many advantages, such as independance from a vendor. If you think about it, suppose you get a contractor to add a room to your house and he does a crappy job. You could fire him and get someone else to do it. But when you use proprietary Microsoft programs, there is nobody but Microsoft that can fix them. While this may not have been an issue over the past 20 years or so, this is becoming a very critical issue.
Not only does the proprietary status of your software prevent others from finding and fixing its problems before they cost billions, but you continue to do everything in your power to isolate your software from anything else out there. Other companies want their software to interoperate with the competition, but you just want to embrace and extend. Why do you do that? If your software is so good, why can't you make it friendlier with your competitors' stuff? I know the answer: It's because you're insecure. You know that perhaps the biggest thing that kept people using your software was the fact that they were locked in to it and were forced to upgrade repeatedly.
By doing what I just described, you tightened your fist as much as you could on this software, but now governments, corporations, and individual users are beginning to look elsewhere in significant numbers. This is the beginning of the end of your monopoly. Soon, you will no longer rule at the top, but will be just another player in an industry. I'm sure it was fun while it lasted, though.
From the Slashdot story: "Apparently Microsoft has bounties out on virus writers."
Offering a bounty is no substitute for providing secure software. Maybe the OpenBSD team would help teach Microsoft how. Or, is someone in the U.S. government interested in having security vulnerabilities in the software everyone uses? There are just too many; is Microsoft really that sloppy?
Who was using Microsoft security vulnerabilities before they became public knowledge?
OpenBSD's motto: "Only one remote hole in the default install, in more than 7 years!"
Microsoft's motto: "Extremely serious flaws that allow an attacker complete control, every week."
Something is fishy about this. It is not that difficult to write secure software. If the extremely well-funded OpenBSD team can do it, the poor Microsoft people should be able to do it, too.
Rewards are a lot cheaper than devoting facilities to developing secure code.
Newt-dog
My Doctor prescribed daily nasal saline irrigation, hehe
Why don't they just go ahead and have a clean, reimplementation of Windows started while they work on Longhorn? By the time they have Longhorn out a clean reimplementation could be at least ready as an Alpha or maybe a Beta.
Click here or a puppy gets stomped!
Its more the Corprate Market they are worried about... You know the Corps that buy preinstalled machines and then change the OS to thier corp standard so they have paid for multiple licences...
If the Corp world switches from MS products people will start learning and wanting to use the same in thier home environment so a migration will start toi occur.. This will take a long time.. but its a threat that needs to be dealt with from MS's perspective...
For the most part... People hear Linux is more secure and is making up alot of ground on MS's products.. But they don't see it first hand... once they are exposed to it.. the likely hood of a user switch is greater once they are exposed.
I am glad MS is starting to feel threats poping out at them from many angles.. I hope it continues as well... They are attacking the the symptoms of the problem.. not the problem itself... I am sure after a while they will realise that its cheaper and easier to fix thier secuirty model than to use the legal system to fix thier problems for them.
Who needs WiFi when we can have Packet Over Sheep! http://datacomm.org/PoS-InternetDraft.txt
MS kept going because their stock was high enough to attract people who thought mostly of making lots of money, integrity and skill be damned. They were happy to grind out feature after feature without worrying too much about how sloppy the feature itself was, or the code that implemented it. The high stock price also kept investors happy, knowing the value would go up and they coudl sell to the next greedy sumbitch. A nice pair of positive feedback circles.
... I did not anticipate the water temperature lowering the saturation limit. This is really interesting!
Sooner or later the stock would hit its limit, mainly because of market saturation. Then there would be no increasing revenues, investors would find it harder and harder to unload, and as the stock price stabilized, the opportunistic employees would bail, and new employees would be harder to get.
What amuses me is this new wrinkle, that crappy software has put an extra limit on their market, causing market saturation early. Like adding sugar to hot water, you can only get so much in before it saturates
In addition to investors and opportunistic employees both bailing because the stock price has stabilized, I bet there are a lot of employees who are not happy being assigned to the boring tedious job of auditing old code, hunting down security flaws, and so on. These people have gottne used to adding useless features without any concern for reality, and that was fun. Dredging the muck for security holes is not. I wonder how many employees are bailing because the work has changed.
A nice accelerator to the two feedback loopbacks. Just because feedback is reinforcingly negative does not mean the slope is uphill!
Infuriate left and right
Why don't they just go ahead and have a clean, reimplementation of Windows started while they work on Longhorn?
2 reasons. First, support for legacy apps has to be included in any new OS Microsoft developes. Second, imagine how long that would take to complete. It took what, 5 or 6 years, for the NT kernel to be able to reliably run 95/98/ME apps. Imagine the press release, "Longhorn to arrive in 2009".
Starting over would render close to a decade of work worthless. That kind of suggestion is hard to justify.
----
Squirrel
What this means is
It's a great thing for them, it's a great thing for the RIAA, it's a great thing for the MPAA (sp?). It's a shit lousy thing for you. But they are going to give you a secure platform. Makes you wonder if they couldn't have planned things any better.
The difference between Canada and the USA is that in Canada healthcare is a right and gun ownership is a privilege.
They have $50 billion in the bank, as ready cash. There are a lot of unemployed programmers, and if they wanted to outsource to India and China, there are a whole lot more even cheaper.
It might take a year or two, but they could squash future bugs if they wanted to. And yes, I know about the mythical man month and adding manpower to a late project, but this is not a single project, it is hundreds of small projects.
Microsoft is still not serious about fixing security holes. They never will be.
Infuriate left and right
With the first machine, I connected to the Internet and was infected with Welchia about 24 minutes later.
With the second machine, it was FIVE MINUTES.
In neither case did I even have enough time to get the latest patches (over 25mb of standalone patches + IE SP1 + SP4) before I was infected with a virus.
It's just plain ridiculous -- What happens when Joe Average User connects his computer he just bought from a local computer store (who I doubt would have installed the patches on every machine going out the door)? How is he supposed to know what to do?
Wouldn't they be better off spending that $250,000 on another programmer-year or two of code audits?
This whole business with bounties for virus writers is just an attempt at misdirection: draw the public's attention to the people writing the viruses instead and away from the fundamental flaws they're exploiting.
It's important that the public realize that the security holes exploited by the virus writers are also exploited in less public and more nefarious ways.
--Bruce Fields
My first rule of software design: "Anything backwards compatible with a kluge is, by definition, a kluge." A secure reimplementation of Windows would, by necessity, break most existing software. Microsoft developers are not stupid; they have many top-notch technical people. Unfortunately they are hindered by their legacy architecture, and product design driven by Marketing, not Engineering. I beleive most of the security holes can be traced to product misfeatures, not programming bugs.
"Freedom means freedom for everybody" -- Dick Cheney
All you guys celebrating this release and thinking it marks the begining the end of for Microsoft have got your head in the clouds.
There is no way MS would publish this information unless doing so is in their interest. They could had have played the same old games with accountants and auditing, etc, etc to hide this information if they had wanted to.
But no, they pretty much came right out with it and most of you have been taken hook, line and sinker. All this is not about any real pain that MS is feeling. No, it is about providing another justification for Palladium aka NGSCB "enscub" aka Next Generation Secure Computing Base.
MS can now point to how a lack of security is hurting their bottom line so whater bogus Palladium schemes they come up with to sell as increasing security (rather than just stealing control of your computer and divvying it up between MS, the MPAA and the RIAA) so of course Palladium will really provide better, more secure system becaue MS's ass is on the line too, see it if even says so in their SEC filings!
When information is power, privacy is freedom.
Funny, my corporate deployed laptop, following standard practice, set ME up as admin. I understand this is standard practice for WinNT-family (mine is Win2k) deployments, in general.
With that ONE practice, the single greatest/easiest chunk of security - separation of user from admin, is gone.
From what I understand, quite a bit of Windows software actually depends on this practice, and can't run without admin priviledges. So regardless of who takes the blame, Microsoft or the Windows Culture that has grown up around their products, there's an architectural-level problem, here.
The living have better things to do than to continue hating the dead.
The famous MS instability is often a fault of the insane amount of crappy obsolete hardware that is still attached to machines. I recently heard someone bitch on how none of the P4 boards had an ISA slot for his modem and now he had to upgrade and he didn't want to. (oh and they exist)
Was he right? Well according to MS and linux and the makers of that board, yes. (don't know about the bsd's) People should be able to use old software from the dos era and hardware that belonged in a pc two generations old. (human generations). Apple would have told him to get stuffed.
Who is right?
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
there wouldnt be anywhere near as many virii and worms and crap about.
The design of windows means that it is insecure.
A really great way to make windows more secure:
Make it so that by default, windows is installed with an administrator (who you cant actually login to from the login prompt without extra effort) and 1 or more "regular users".
a "regular user" basicly has access to all normal stuff (i.e. anything thats not a risk to the system) but if they want to do something thats "risky" (e.g. if they or something they are running wants to add something to "load this at startup") they need to enter the Administrator password first. If they dont, the action is denied (for example, windows returns a "cant open file for writing error" or a "cant write registry key error" or whatever as appropriate.
Some things that should be "restricted":
1.putting any file in c:\windows\system or its sub-folders (such as c:\windows\system\drivers). Also modifying, deleting, changing etc those same files.
2.adding a program to the "this program starts at startup" list (this would also cover drivers, services etc)
3.modifying key Windows Sockets settings (for example, like how some Spyware inserts itself into those places to hook winsock)
4.perhaps there are other key settings that could be blocked (for example, access to certain control panels or changing the display settings or whatever)
and 5.there should be a way for someone (with the administrator password) to specificly add extra things to the "block list" (e.g. someone could show settings as to how to stop spyware crap from changing the homepage of M$IE)
Some benifits:
1.Viruses, Worms, Trojan Horses and other crap wouldnt be able to just "silently" install themselves (since it would say "c:\documents\your settings\temp\abc123.tmp.pif wants to write to c:\windows\system\dontdeletethisorwindowswontwork. exe. If you want to allow this, type in the administrator password"
2.Spyware (e.g. Gator, New.Net etc) wouldnt be able to install without specific authorization (for example it would say "c:\downloaded files\newnetinstaller.exe wants to modify winsock settings and install its own custom crap. If you want to allow this, type in the administrator password"
3.On shared computers (e.g. family PCs or kids PCs), the parents could be the only ones that know the administrator password (and therefore prevent the kids from changing the settings)
4.On computers e.g. work machines or machines in labs at schools, the sysadmin would be the only one that knows the administrator password and therefore e.g. you dont get people installing kazza or whatever.
Thats not to say that my system would prevent installing new software, it would only prevent it if:
1.the new software wants to modify important windows settings.
2.you dont have the administrator password.
and 3.when the install program gets the error back from windows "cant open file" or whatever, the install will fail in a way that makes the program unusable.
Basicly, this would be a benifit since:
1.if some program wants to do something behind your back (e.g. virus or spyware), you can be notified and more importantly block it.
and 2.you can be sure that the users of your machine arent installing anything that messes with the settings or messing with them themselves.
Some might say it would cause problems but I dont believe so.
For example, if a kid brings home a new game from school (that he has "borrowed" off a mate or more likely these days gotten that mate to burn him a copy of) and wants to install it, the kid puts the disk in and runs the installer. Then, if it needs to install system things (for example, new DirectX), the box asking for the password will come up and the kid will have to wait for the parents to give the OK before it can be run.
Another benifit is that if the user has to enter the password, its likely that (unless they are so cluless that they think that the "any" key is the
If non-computer people can corrupt the usage of hacking, then non-medical people can corrupt medical terminology to their own purposes.
Besides, you understood what was meant, so where is the problem?
And even more, I think it was Andrew Jackson, President of the US around 1820 or 1830, who said "It's a poor mind that can only think of one way to spell a word."
Infuriate left and right
I have. Compare them to AT&T Research Labs, Bell Labs, or some of IBM's facilities. and I am not exactly impressed by the quantity or quality of the work I see on Microsoft's R&D site. Compare the budgets of those organizations. Where does all that money go? Are they the most inefficient R&D organization on the planet?
Also, I am less than pleased about the P/R regarding the Sloan Digital Sky Survey. Yes, Microsoft has made some significant contributions for presentation of the data gathered by the project. Nice spin for P/R purposes, but where were they the first 5+ years of the project? All of the processing, in that time period, was done by Alpha's running Digital Unix at Fermilab.
"To those who are overly cautious, everything is impossible. "
I doubt it. A complete rewrite is the only way to clean up the cobled together mess of intentionally spagetti coded junk they have purchased and stolen. The might be able to do that in a year or so, but it would not be Windblows it would be OSX1 or some other varient of BSD with an ugly and non-intuitive Redmond themed desktop.
They can complain all they want about it not being cost effective to fix bugs. I think they are going to find out the hard way that it's not cost effective to own crap.
Friends don't help friends install M$ junk.
Windows Update is fine if you've just got 1 system. Now, imagine you've got to patch 30,000 systems in 700 offices in 43 states, and you don't have any access to the main keyboard. And you can't use automatic updates because IT has to vet the patches before they're installed to make sure they won't make inoperable third-party software which your business depends on being operational.
You make excellent points.
However, how often do Microsoft patches break third-party software? This is a serious question, because I have no idea. Is it a common occurance?
I would have suspected that Microsoft tests their own patches comprehensivly before releasing them so they would be ready for immediate deployment.
Actually the MS patches do break 3rd party applications fairly often. Eg I have personally had an NT service pack break the exchange server that was the back end to the company PABX. Not good when the company's main business is Call Centre. One of the other issues i have is that quite often these patches require a reboot. On systems where you are contractually obliged to have 99.9% uptime, you have to schedule the reboot - with our clients we have to give 7 days notice. For this reason we have just about completed moving all our critical services to linux boxes. At least when you have to patch a service you dont need to reboot just restart the service. Seb
For every microsoft platform we deploy, we need to purchase centralized anti-virus software, proxy server filtering software, auditing software, intrusion detection software....and the list goes on and on.
Granted, we have never had a hack related outage, because we keep up with patches and anti-virus updates, but the added cost of the security packages certainly does eat into our budgets.
In a k-12 school, we run many 3rd party apps that don't run on Linux, so we really can't switch to that yet (think desktop...not server). We are, however, really considering migrating slowly to OS X to avoid the added "security software tax" that comes with the Microsoft products.
-ted
Well this past spring and summer, he said he saw a drop in service calls by an amazing 85%. Those remaining calls were either hardware or the three windows boxes he had to maintain because of that customer demanded it, they owned the kiosks, he just provided service so he was making money on the service call.
When the "Work of the Week" started, the other guy lost at least 30 customers that switch to using our client because they were getting complaints from their ISP that their boxes were being used in DDOS attacks from the competitor's product. In last week business journal, our client's competitor has filed for chapter 11.
Now, chances are they were having cash flow problems, the manufacture of their product is also having problems, however I know that our client has been able to undercut his competor by 20% in price because and he is still reporting increased profits of 10% after slashing prices. That's how much his TCO has lowered on service calls in the last nine months.
I know in our consultancy that using Apples with OS X have lowered our costs and increased productivy over Windows dispite their higher initial cost. Why? most of our units are about 4 - 5 years old and are now in use by administrative staff and going stong. That, and we make about $400 a week from the company on the second and fifth floors for fixing their computers.
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
The most popular server software for ISPs is FreeBSD, a BSD variant. It's great software, and very capable.
One company uses NetBSD for dedicated mail servers.
We don't hear much about these uses, because the software just works. That's why it is seldom in the news.
There is a program that allows you to remotely install patches across your domain, and guess what, it's free from MS. I'd say most intelligent MS trained IT personell should know about it.
Quite frankly I don't think an IT person should be patching a system in another state. What happens if it goes down? Do they have to fly out or is there someone else they have on staff to fix it?
-]Phreak Out[-
For an email client my wife uses Outlook Express and has a Hotmail account. She gets very little mail and almost no spam -- maybe one a month and it goes to the Junk Mail folder (my Hotmail account fills with email worm infection attempts every 2 to 3 hours, which is the price I pay for redirecting all incoming mail to "slashdot@rjamestaylor.com" to my Hotmail account. I figured if a worm went through Hotmail it would be checked for viruses. Unfortunately, that is true ONLY if you are using the Web Client to attempt to download an attachment. If you use OE, they don't bother to check the attachments.
Earlier this week my wife told me the computer is running really slow. I told her to press Ctrl-Shift-Esc to bring up the Windows Task Manager and she replied "something popped up but went away." I told her not to hit Esc twice (my assumption being that she had). She tried it again -- "nothing happened this time." Crap I thought - we've got Klez, or some other virus that kills WTM and other attempts someone may use to discover/remove it.
Turns out she received a spam that had Kelz and also used the iframe expoit -- and when the email was displayed in the Preview folder, *splat*, Agent Smith began infecting our machine's programs.
So, on my weekend I get to disinfect my home computer because I failed to install an Anti-Virus program. But really, I was let down by Microsoft 3 times:
- Windows is architected for ease of development and not security in the Internet{worked} Age
- Windows XP Home, which required a huge series of patches to be installed upon initial installation (I bought the full version for my OS-less homebuilt PC), yet did not have anything to stop Klez. (In fact, this is puzzling -- I thought a patch fized the iFrame exploit...and my system was and is fully pached. ???)
- MSN Hotmail doesn't check attachments as they arrive, only when yoy request the emal for download in the Web client. But OE is made to interface directly with Hotmail!
I am in the process of downloading Lycoris. Maybe Lindows. Probably WineX and Cross-over plugins, too. (Yes, I'll pay.) I'm going to test those two distributions on my wife and son. If either pass the test, that will be our OS at home on the desktop. I may try SuSE and Mandrake, but I like Lycoris/Lindows' "KISS & MAKEUP" (Keep It Simple Stupid and Make it Act Kinda Equivelent to Understood Patterns).-- @rjamestaylor on Ello
Look at Apache's popularity, yet it doesn't even come close to the security nightmare IIS is. Yes, popularity is part of the problem but it certainly isn't the main or only factor.
There's been a lot of MS bashing in this thread; some justified and most just pure bile. A lot of people have pointed out that Linux systems are not vulnerable in the same manner that MS systems are, and that it's all due to bad code design and terrible programmers who steamrolled security in the name of features.
.conf files, no having to know things like DNS servers or what display adapters work in X and all them "whatchamacallits."
I think in many of the arguments here, a critical fact has been overlooked. Users of MS products generally want the features that allow for the problems we've seen in the past to crop up. The average user wants automation; they don't want to configure software, or have to understand how the system does what it does, they (here it comes) just want it to work. It's this attitude that has fueled MS' design process; they build software that the end user can turn on and have "just work." No fiddling, no
I think that if similar products existed in a Linux environment, we'd still be seeing a lot of the same problems, simply because the level of automation required to satisfy the typical user is inherently insecure. I am willing to concede that a suite of applications built on Linux could be more secure, and that Microsoft definitely has a problem in that the flaws in their system are very deep, however: I can recall a number of occasions where I've seen articles here on Slashdot that announce "security hole in (whatever) allows root access! Come get your patches...." If Linux held sway in the desktop world, why would we expect the typical user to be any more willing or able to patch their OS than if they were using MS systems? Granted, there's fewer holes, but they're still there. If typical user never patches their default OS install, then why shouldn't we expect mass root exploits?
Don't get me wrong; I'm not wholeheartedly defending MS. They could have done things better, but I'm not ready to jump on the "Linux is more secure" bandwagon. I firmly believe that if similar applications had been developed for Linux to meet the same demands that MS has answered, we'd still be seeing problems.
Three words:
Software Update Services