Slashdot Mirror
Linux Distributions Respond to Forrester
dave writes "GNU/Linux vendors Debian, Mandrake, Red Hat, and SUSE have joined together to give a common statement about the Forrester report entitled "Is Linux more Secure than Windows?". Despite the report's claim to incorporate a qualitative assessment of vendor reactions to serious vulnerabilities, it treats all vulnerabilities are equal, regardless of their risk to users. As a result, the conclusions drawn by Forrester have extremely limited real-world value for customers assessing the practical issue of how quickly serious vulnerabilities get fixed."
WTF? Why does anyone buy shit from these people.
The executive management of the agency that I work for pays Meta $500/hr to evaluate project plans... they always rubber stamp whatever answer the execs want.
I'm sorry, but I simply can't believe that a research company, a company DEVOTED TO RESEARCH, would come out with biased opinions influenced by money.
...but will they listen?
And who paid for the Forrestor study?? Not Red Hat they haven't got the cash. Probably another Microsoft funded event.
The most dramatic thing from my point of view is that SuSe, Red Hat, Mandrake and community based Debian all got together to formulate a common reply. This is the BEST news we could ever hope for - a common on unified front - no forking when it comes to security.
The story posted here is a direct quote from the response made by the Linux representatives to the report. I think that a greater effort should be made to get news from more impartial sources or to at least warn the reader that what he is reading is from an obviously biased source regardless of whether or not it is true.
_____
Thank you.
...try this, from good o'l News.com: Moving to Linux May Not Save Money -- Yet .
This wasn't just plain terrible, this was fancy terrible. This was terrible with raisins in it. - Dorothy Parker
(site loads slowly. here we go in case of /.'ing)
GNU/Linux vendors Debian, Mandrake, Red Hat, and SUSE have joined together to give a common statement about the Forrester report entitled "Is Linux more Secure than Windows?". Despite the report's claim to incorporate a qualitative assessment of vendor reactions to serious vulnerabilities, it treats all vulnerabilities are equal, regardless of their risk to users. As a result, the conclusions drawn by Forrester have extremely limited real-world value for customers assessing the practical issue of how quickly serious vulnerabilities get fixed.
The security response teams of GNU/Linux distributors Debian, Mandrakesoft, Red Hat and SUSE have assisted Forrester in gathering and correcting data about vulnerabilities in their products. The gathered data was used at Forrester for a report that became titled "Is Linux more secure than Windows?". While the Linux vulnerability data that is the basis for the report is considered to be sufficiently accurate and useful, Debian, Mandrakesoft, Red Hat and SUSE, from now on referred to as "We", are concerned about the correctness of the conclusions made in the report.
We believe that it is in the interest of our usership and the OpenSource community to respond to the Forrester report in the form of a common statement:
We were approached by Forrester in February 2004 to help them refine their raw data. Forrester collected data about the vulnerabilities that affected Linux during a one year period and looked at how many days it took us to provide fixes to our users. Significant efforts have been put in not only making sure that the underlying dataset for the Linux vulnerabilities was correct, but also to articulate the special technical and organisational care taken in the response processes in the professional Open Source security field. This expertise is greatly appreciated by our usership since it adds a high value to our products, but we see that most of this value has been ignored in the methods used for the analysis of the vulnerability data, leading to erroneous conclusions.
Our Security Response Teams and security specialized organisations of respectable reputation (such as the CERT/DHS, BSI, NIST, NISCC) exchange information about vulnerabilities and cooperate on the measures and procedures to react to them. Each vulnerability gets individually investigated and evaluated; the severity of the vulnerability is then determined by each of the individual teams based on the risk and impact as well as other, mostly technical, properties of the weakness and the software affected. This severity is then used to determine the priority at which a fix for a vulnerability is being worked on weighed against other vulnerabilities in our current queue. Our users will know that for critical flaws we can respond within hours. This prioritisation means that lower severity issues will often be delayed to let the more important issues get resolved first.
Even though the Forrester report claims so, it does not make that distinction when it measures the time elapsed between the public knowledge of a security flaw and the availiability of a vendor's fix. For each vendor the report gives just a simple average, the "All/Distribution days of risk", which gives an inconclusive picture of the reality that users experience. The average erroneously treats all vulnerabilities as equal, regardless of the risk. Not all vulnerabilities have an equal impact on all users. An attempt has been made to allocate a severity to vulnerabilities using data from a third party, however the classification of "high-severity" vulnerabilities is not sufficient: The mere announcement of a vulnerability by a particular security organisation does not necessarily make the vulnerability severe - similarly, the ability to exploit a weakness over the network (remote) is often irrelevant to the vulnerability's severity.
We believe the report does not treat the open source vendors and single closed source vendor in th
Then, there is the relevence of bugs. SE-Linux makes many otherwise serious glitches a mere nuicense. As do other modules in the LSM.
There is no chroot() in Windows, to the best of my knowledge. This also changes the severity of a bug from catastrophic to irritant, in Unix.
Finally, Nessus and SAINT are more often used to scan Unix boxes than Windows ones.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Well the good news is that the people that actually care about this study are the people that understand its shortcomings and inaccuracies.
In the long term, businesses still care about cutting costs, and linux is the way to do that.
Does anybody know of a case where someone has been attacked through a Microsoft vulnerability between the time of its going public and the release of the patch? The most often encountered scenario seems to be people who never upgrade getting attacked because hackers have reverse engineered the patches.
Don't vendors sell things?
Any box in the wrong hands can become unbelievably secure, regardless of the OS.
What would be a very interesting read would be to have sys admins lock down the box (perhaps those do consulting for corporations) and then test how well they're set up.
Granted, it's up to the admin at that point so have many admins on different boxes.
For the most part, Linux is used in the back rooms for such things as fileserving, printserving, and (especially critical for many companies) webserving. A failure on any one of these machines results in a significant risk of loss of data, company secrets, and company network infrastructure.
A breakin on a Windows system results in the loss of local data (whose value cannot be adequately assessed, but can be assumed to be less than the sum total of all data on the servers).
It is a little like assessing the risk of terrorism in transportation. The sheer number of automobile accidents far outweighs any risk of death due to terror attack on the highways. So too is the unlikelihood that a major terrorist attack will occur in the US skies or US rail system. However, an attack on rail cargo would be far more devastating than a similar attack on the highway system. Rail provides a very high bandwidth for cargo delivery but is also restricted to an unroutable track, so any attack on rail would essentially wipe out a very significant method of cargo transportation. On the other hand, traffic can be rerouted around any localized road problem minimizing the impact of any highway attack.
Windows is ubiquitous on the desktop, but on these desktops are very small amounts of data compared to the large amounts located on servers. A loss due to breakin would be necessarily less significant than a similar breakin on a Linux server.
I have been pwned because my
"Microsoft Corp., however, fixes security problems the quickest"
how can they claim that since Micro$oft receives bug reports that are not publicly announced???
It is easy to announce the bug along with the patch after having it hidden for 6 months...
No one buys reports from these companies to actually learn anything. The primary purpose these companies serve is to give companies objective sounding quotes to pepper their marketing material with and to convince risk averse managers that they are safely following the largest herd.
-_-
When I started reading the mail I first thought that debian, redhat, suse and mandrake had got together to make faster pacthes to their vulnerabilities :)) Well no, I was wrong, they are just writing a response letter together :(
Time to go back to sleep and dream of Distributions uniting forces.
I have no sig and I want to scream
How well do you trust a companies research when they use telemarketers to try and sell it to you? I had a Forrester woman call me well over 50 times in one year about buying their reports. And of course if you pay them for a custom report, a service they offer, I'm sure your extant point of view could certainly be objectively supported.
-_-
Man, these guys should work together on something.
But when you "unbiased, fair reporting, with due impartiality to both sides of an argument", why does Slashdot immediately spring to mind?!
I'm amazing. You aren't. SUCK IT
Probably another Microsoft funded event.
you would be correct
From the article:
"In 2003, Microsoft Corporation commissioned Forrester Research, Inc., to conduct a study to measure the potential market of people in the United States who are most likely to benefit from the use of accessible technology for computers."
My wife doesn't believe me, but I was up on Robson in Vancouver, BC and saw a dead ringer for UBL about a month before 9/11.
Not that I'd have any idea what ultra-orthodox UBL would be doing on Robson. It doesn't seem like his kind of place.
I have been pwned because my
[Update: Apr 6 at 7:58pm CDT... Martin Schulze from the Debian team added some more information.] Javier Fernandez-Sanguino Pena composed a survey in 2001[*] and discovered that it has taken the Debian security team an average of 35 days to fix vulnerbilities posted to the Bugtraq list. However, over 50% of the vulnerabilities where fixed in a 10-days time frame, and over 15% of them where fixed the same day the advisory was released! For this analysis, all vulnerabilities were treated the same, though. He has rerun the survey based on vulnerabilities discovered between June 1st 2002 and May 31st 2003 and found out that the median value of delays between the disclosure and releasing an advisory including a correction was 10 days (average is 13.5 days). Again, for this analysis advisories were not classified with different priorities.
Hey why aint gentoo on the list? I guess they're still compiling their response ,p
(PS I love gentoo, so don't go flaming me!)
[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.
answer: NO
Michael's asshole is wide open for anyone's use.
uh, sounds like a different study to me, jackass
I think that the point that he was trying to make is that Microsoft *has* given Forrester money for a report in the recent past.
>Yes, let's instead listen to the unbiased people
> at Debian, Mandrake, Red Hat, and SUSE. Surely
> their opinions on this issue are less biased
> than those of the research company.
Damn straight I will. Why? Because one group
represents the best interests of a bunch of fat
asses who got rich off the rest of us, and the
other not only represents the best interests of
my community, it IS COMPOSED OF MY COMMUNITY.
If you can't tell the difference, then you
have my pity, and I give you some free (as in
air) advice: Go to Microsoft's Channel 9 website.
You'll be much happier there. Honestly.
All you'll find here is a bunch of strange people
that have a crazy idea that a thing like
freedom is more important than quick $$, or that
believe it is in their own best interests to work
together than to try to $crew everyone else over.
BTW, next time you see Billy, be sure to tell
him to keep wasting his money propping
up the sock puppets, but be sure to send
enough lubrication to the sock puppets. It must
hurt like hell to be a sock puppet for Billy.
From tests conducted at an observatory overlooking the skies of Los Angeles, researchers have concluded from the gathered data that the sky is indeed red.
Buried in all the hoopla, they never tell you that all the smoggy red photos were taken at around the time sunsets happen.
Statistics and numbers in general can be thrown any which way to serve the purpose of the writer. It's an unfortunate side-effect of being biased by nature. Even if someone were to WANT to be impartial, they'll often offer a slant merely by presenting data a certain way.
It's difficult to find people to trust when money is on the line somewhere. With Microsoft's track record and its acknowledged need for "Trustworthy Computing" (a marketing term), it's difficult to take their word. Unfortunately, with that money, they have enough marketing power to buy research, and flood biz execs with enough propaganda...and when they constantly hear that kind of information from what they'd consider mainstream sources, they start to believe it as fact.
Now that's dangerous.
Just waiting for the slashbots to start lining up with the "But Linux is a kernel" argument, saying vulnerabilities in Apache etc do not mean Linux is vulnerable, but vulnerabilities in IIS make Win vulnerable.
These same slashbots will then talk about how "Linux is ready for the desktop". Not Gnome, not KDE but Linux.
Make up your minds. Either its an OS, or its a kernel. You cant pick and chose which one depending on the situation. If its a kernel, the Linux will NEVER be ready for the desktop. Gnome may be ready, KDE may be ready, but Linux will never be ready. If its the entire OS, then it is responsible for the vulnerabilities in Apache, sshd.
If Gnome is ready for the desktop, then Gnome on BSD is just as ready as Gnome on Linux, which is just as ready as Gnome under Cygwin.
Oh, and a terminal is NOT a usable desktop environment for your average end user. vi does not count as a word processor.
Its about time there was a mod score -1 Slashbot.
"...SuSe, Red Hat, Mandrake and community based Debian all got... no f..king... security."
-Linux supporter "darthcamaro" comments on the conclusions of the Forrester study, to general agreement on Linux advocacy enclave Slashdot
"Hey Microsoft, you guys have funded studies for us before. I know Linux is being a problem for you and we just so happen to be doing a study to see which OS is better, yours or theirs. Would you be interested in funding us once more? -nudge nudge, wink wink-"
Well the good news is that the people that actually care about this study are the people that understand its shortcomings and inaccuracies.
The bad news is the PHBs don't understand the study, but will try to make business discussions after reading it anyway. PHBs don't need to understand it, they're the boss.
With any luck, the businesses that employ PHBs will go under, but that is a long, slow, and painful process.
I hate Liberals and Conservatives.
If you are a Liberal or a Conservative, then HAVE A NICE DAY!
Courage.
It is obvious the only way to truly secure a machine is to kill the users. There are more windows users than Linux users, therefore, it is easier to secure a Linux than it is to secure Windows. This also clearly explains why OpenBSD is one of the most secure OS's. Of course, the most secure system is StoxOS&TM which currently has no users and is perfectly secure.
"To those who are overly cautious, everything is impossible. "
...so of course you are Insightful. If you had thrown in some comment about Open Source being good for the environment, then you would have gotten +5.
Which are all completely justified and wonderfully written exposes of the brilliance of Linux!
You mindless sheep, think of something new? please?
Like most linux geeks, I too believe that linux is much more secure than windows, but when asked why, I can only give some rant about how the open source methodology is superior and promotes faster response times to vulnerabilities. Either that, or I point to all the recent windows virus outbreaks.
But if linux were on every desktop, I'll bet you'd be getting a few emails every day with attachments like "your_paper.sh" that most of us would trivially delete, but many would stupidly run (and these are the same users who would login as root to check their email).
It wouldn't be fair to use instances like this (albeit they're not common yet) to show that linux is more vulnerable than windows.
Therefore, I believe that by quantifying the vulnerabilities and response time, Forrester is on the right track, they just need to take into consideration this response, and find a better method of quantifying the data.
In this day and age, nobody seems to ever admit doing wrong.
I prefer the "u" in honour as it seems to be missing these days.
There are three types of lies: lies, damn lies, and statistics.
The idea is that these vulnerbilities don't have equal impact at all. Lets examine some of the unix security vulns i've seen in the last few months.
3 or 4 games, unsafe handling of common scoreboard files producing exploits.
WHAT THE HELL? That's Unix security for you... even GAMES that have vulns get attention. Windows only gets remotely exploitable vuln attention.
Consider how many windows programs use shared registry keys, consider how many read/write to common temp folders, or common locations on disk. Have any of the probably hundreds of overflows involved in reading a temp file from C:\Winnt\Temp been taken into consideration with WIndows? Heck no, nobody even cares. Windows too many remote vulns to even pay attention to stuff like that.
Consider gzip's unsafe handling of temporary files. I wonder how many Winzip/Windows Compressed Folders have? NOBODY HAS EVEN LOOKED.
O.S. Security is a factor of many things. Sure, the quality of code written is important. However, the most important factor is the administrative staff managing the O.S.
Additionally, an O.S. can be more secure than another but there is no such thing as 100% secure OS.
Security patches can be released the second a vulnerability is identified. The OS is only as secure as the people managing it. If the people managing the OS fail to patch the OS, the OS is going to be insecure even if the entity that engineered the OS is dilligent about patching their product.
Puh-leez. The relatively few vulnerabilities that are discovered are normally patched within a *very* short time, just long enough to verify the bug, find the vulnerability, contact the code authors, and test the fix.
3 days from the first vulnerability report is typical, as shown when OpenSSH and Apache have shown obscure but potentially nasty vulnerabilities.
Microsoft gets as long as they want to play with it, becuase CERT and other security organizations do not publish the vulnerability until the vendor approves it. This has gone on for *years* with some of the underlying Microsoft graphical display system vulnerabilities, which are regularly circulated among the alt.2600 crowd of script kiddies but have never been published by CERT despite numerous reports because Microsoft has not published a patch and given their vendor blessing.
The Forrester report is dead wrong in half a dozen distinct ways, including the vast under-reporting of Microsoft vulnerabilities because no one *expects* it to be secure, and thus doesn't bother to report.
Go google it for yourself though.
Yes, because Mandrake, Red Hat et al exist solely for the community. They have no commercial interests, they do everything out of the goodness of their heart. Red Hat is more concerned about the community then its shareholders.
Lets go further, Red Hat exists solely for the promotion of peace on earth and the protection of the little people. It believes that Linux will end world poverty and stop wars.
"Is Linux more Secure than Windows?" *cough*Bullshit*cough* signed, Noah Meyerhans, Debian Vincent Danen, Mandrakesoft Mark J Cox, Red Hat Roman Drahtmueller, SUSE
I remember reading a report from one of these big research firms (I think) in 1997. It was a report first published in 1994. It talked about how Apple would own the desktop (90% probablility), NeXT would be a power player (90% probability), and how GuptaSoft would drive most IT application (90% probability).
Funny, the report was ALL about WRONG. Nothing was close to reality. How did they get it SO WRONG?
In another situation, I was directed by Management to ask one of these big research firms about embedded database products. At the time they didn't have any expertise in that area. However, they found a kid internal to the company that was willing to learn so they could write a report. It seemed silly and convoluted. Here's a guy without the necessary understanding or expertise, and in a few weeks he's going to learn and gather enough information to write a report? A Report that other people will use to make decisions? Crazy!
In the end, I concluded that these reports are useless "on the ground". They're only useful for those who wish to pretend that they've done adequate research.
So my short answer is: These research firms exist to just cover butts and promote positions. Any IT management personnel that subscribe to their services should be FIRED. It's negligent to cite their reports; it's negligent to use them as a resource. If you need expertise, hire a consultant with REAL expertise, not a generic and biased report. If you want a biased report, the sales guys will come to you for free.
Check out http://uptime.netcraft.com/up/graph/?host=www.forr ester.com
At least they aren't running IIS on Windows 98!
Power tends to corrupt, and absolute power corrupts absolutely.
I'm staying with Linux and my money goes with Linux. After two years of running Linux I've not been hacked once, I've not gotten ONE SINGLE VIRUS, I've not had to look at one single pop-up add that I didn't want to look at, I've not had to look at one single BSOD, I've not had to reboot one single time unless I chose to.
I don't have to spend all my time in a panic worried about patches and viruses and other such nonsense. Neither do my friends and family, I converted them to Linux too. Now I don't have to worry about them either.
What does Windows offer me that I can't do with Linux? Nothing. Why should I use Windows which is constant trouble and extremely high maintenence and is a constant cash drain, versus the ONE TIME PURCHASE (if I choose to purchase v. free download) of a Linux distro, in my case Suse, that is mine, with no strings attached and will cost me no further money, ever?
Once I own the $89 Suse distro I never have to spend another penny on it or any other software, ever. It works. It's secure. Anyone that says it isn't is a stupid SOB or a liar or both.
I remember once I installed OpenBSD on an old SparcStation 1+ (that's 25Mhz) with a 1gig scsi drive. I was new to it, and so when the install process asked what "security level" I wanted to install at, I installed at one below the most secure. It was very strange. Very hard to get anything done, it had no path.
I changed the security level to "normal" because I just got freaked out by how strange it was; I only wanted to see if I could get the box running at all, and the heightened security level was making life difficult.
So the real study that someone should do, is how "ease of use" affects "security". Because that's where the real deal is at. It's just like having to go through the lines at the airport - the more secure we need to be, the more of a pain it is for everyone.
There is definitely an inverse relationship between "ease of use" and "security". Seeing as how there is a big focus on making Linux easy to use, or at least it seems to me that there is; I get the feeling that people won't accept Linux if it's not as easy to use as Windows or OS X, I wouldn't be surprised to see Linux security, or "user friendly" Linux security suffer a little bit.
But still, Linux has been designed from the outset with security in mind; other user-friendly OS's are designed for ease of use. It's going to take some time, but we are slowly going to move in the right direction. If Linux is a secure OS now, and some consultancy group says that it isn't, then the trick would be to make it LESS secure by making it more user-friendly, and immediately, consultancy groups and analysts will be saying that it is secure. But that's a sacrifice that's not really worth it. However, unfortunately, given the open nature of Linux, and that fact that it can go in many directions, we will probably see Linuxes that are less secure than they could be because of the focus on user-friendliness. So I guess that means that analysts are going to change their minds? I wouldn't be surprised.
It's fair given administrators who only patch based on official distribution releases. It seems to not care that they are making Linux companies responsible for a lot of 3rd party software such as Apache. It stands to reason that their average patch release would be slower if they're maintaining thousands of applications. It's more important that they release OS updates and core software updates quickly. Their customers have to take some responsibility for updating 3rd party software even if it does come on the same CD as the distro.
Perhaps of more concern to administrators should be the nondisclosed vulnerabilities found by researchers such as eEye that are not patched. I can't find the link now, but eEye alone has dozens of vulnerabilities they've let MS know about, but haven't been patched for sometimes hundreds of days. eEye is just being courteous by non disclosing the bugs until MS fixes them. By using the disclosure time as a 'start time', Forrester is ignoring lead time developers get. It's my experience following Bugtraq and Full Disclosure mailing lists as well as many OSS projects that most major OSS developers respond quicker to their lead time before disclosure.
Forrester is completely ignoring vulnerabilities that are not public knowledge, which is misrepresenting the problem.
The global economy is a great thing until you feel it locally.
i stopped when i saw the line- Yankee group. Just did a quick skim and there was our favorite analyst spouting off something- what a Didiot!!
Wonder how one can compare the number of vulnerabilities of a complete GNU/Linux distributions against Windows!
Cause /.ers keep denying the evidence is real
I just thought of this. It's a fine line between how secure you want something to be, and how much of a pain it is. It's the whole 9/11 thing. Too much security is a bad thing, because it shuts down the economy, and makes life exceedingly difficult, not to mention that it affects freedoms that we are used to. We hear this kind of talk in the media all the time. It's a fine line - too little security, disaster happens - too much, life gets difficult and the economy suffers.
So the fact that it takes a certain amount of time to respond to security problems is indicative of the superior nature of Linux. Even though some analyst may say that this is technically not as secure as something else, with Linux you can let things slide a little more because that's just the kind of OS it is. The distros are "on top" of it, because still, nothing bad really happens. That's the test - what bad happens. If nothing bad happens, it doesn't matter how you look at it, because the bottom line - your data is safe.
Furthermore, if need be, you can "crank up" the security level in Linux. Way up. National security level. Hardened. Trusted. It's just unnecessary, and makes it harder to use for non-critical situations.
So look at the bottom line, and look at the ability to crank up the security level. Windows has very little ability to crank up any security level, it needs hardware to do that. Linux can crank up the security without needing specialized hardware.
Linux is superior, and the fact that it is "less secure than Windows", yet nothing bad happens, just goes to prove how technically superior it really is. These analysts have just shown how superior Linux really is.
These reports are so dumb. In high school, I remember learning that averages don't give a good representation, because extremes will skew the numbers. The median is a better representation. Funny how some people don't seem to remember that. By Forrester's methods of research, they could come to the conslusion that the average american has one testicle (statisticly true btw).
You are right in your suspicions that these sort of "studies" are commissioned by Microsoft as part of their marketing strategy (just part of the business--Oracle, Sun, IBM etc parade studies flatter their products as well after all). However, I don't dwell at all on these sorts of studies and I certainly wouldn't give them any meaningful weight when making a decision on deploying Linux (or not).
Even given the positive spin towards Microsoft, however, Forrester's comments on the study are a barely lukewarm endorsement of Microsoft, and don't seem to be too critical of Linux. Check out some of the comments by Forrester analyst Laura Koetzle:
Surprisingly, Microsoft did the best job at patching vulnerabilities fast, even though it ranked at the top with the largest percentage of its security holes rated as high
So they DID acknowledge that Microsoft's platform had the most HIGH RISK vulnerabilities, althought this fact is glossed over in the article. Koetzle also acknowledges that the study did NOT look at how WELL the patches addressed the problem (MS often needs to issue more than one patch to get it right, and sometimes they fix one bug and introduce another).
"The fact that the Linux distributors fixed such a high percentage of their vulnerabilities is a remarkable achievement," she said. "Even Debian, in last place, was pretty darn thorough."
Sure doesn't sound like something you'd expect an MS-paid cheerleader to day about the competition...
This is very much a case of your mileage may vary
Translation: even if patches are made fast they can still leak...
The bottom line? Any of these platforms can be operated securely
Quite the ringing endorsement for MS ain't it? Nice to see their people so solidly back their studies...
One thing that I don't see mentioned is that as the gnu/linux base grows larger, so do the proportion of competent developers who can spot and fix code security problems before they go mainstream. With MS, the number of people looking to spot code security problems reamins constant no matter how big the user base.
Although I've herd MS say that the reason Linux hasn't had as many big security problems is because they aren't used as much, I think the truth will turn out to be just the opposite. Not to mention that a hacker who finds a security flaw in Linux is more tempted to get fame by reporting it, and that fame becomes more prestigious as Linus grows, but a hacker who finds a security flaw in windows will be more tempted to gain fame by exploiting it.
"You know, ever since I upgraded to Windows XP I haven't had a single Blue Screen of Death."
"Does it randomly reboot?"
"Sometimes."
"You have automatic reboot on. It's like a Blue Screen of Death, but without the pretty colors."
The ______ Agenda
Yes, that would be the point he's trying to make.
The point he is proving is this:
Any slashdot story concerning Microsoft is so biased as to be useless. It's a circle-jerk for fanatics bordering on the religious, a bout of self-affirmation for a group slightly more fanatical than Mac owners. A report against Microsoft is published? Praise it to the heavens! A report in favor of Microsoft is published? Doubt the data, impugn the source and repeat the mantra "M$ is bad, mmkay?".
Posted as an AC so the cocksucking slashbot moderators who have failed to read and understand (or independently realize) this don't gratuitously destroy my karma.
- Muttley
Run, Forrester, run!
Red Hat, for one, has internal bugs that aren't viewable to the general public - often including the person that reported the bug in the first place.
How many viruses run under Windows? Answer: How many are in the wild?
How many viruses run under Linux? Answer: Zero
This isn't to say that there are no Linux viruses. Oh hells bells there probably are many (in a lab some place) and one released.
BUT with a quick bug fix the Linux virus went away. Bye bye. It is fairly likely the lab viruses make use of one time defects that have long ago been fixed.
It is reasonably easy to update open source software. So if the latest libary has problems with your favoret apps you download the updates of the apps as well.
With Windows those same updates cost money. Fixing a hole in Windows security may cost you quite a bit in rebuying the applications you rely on.
There is also a pure addatude problem.
In Linux each person takes his share of responsability for being hacked.
The programmers appologise and release a bug fix ASAP.
The destros who didn't catch the bug and released the defective code release the bug fix with applogys.
The admin who get hacked are redfaced for not catching the bug and appologise.
The users smash head into wall for not armoring against attack. Not making back ups. Not taking nominal precautions.
Microsoft:
Most of the antimicrosoft slams Linux and Mac zellots repeate often come from Windows users who blame everyone but themselfs.
Windows admin have a pack of excuses so thick it makes you sick.
Application develupers "Well it happends you gotta expect it. Not our problem. Should have protected yourself.
For $5,000 we'll audit your systems so this won't happen again"
And Microsoft pays for reports on how OTHER operating systems are just as bad (or worse) instead of preventing the mistakes.
In short:
Linux: My fault sorry I'll fix it. Won't happen again (at every level)
Microsoft: Not my fault. Your fault. You fix it. I can't be held responsable for YOUR stupidity. (at every level)
This isn't even an open vs closed issue however maybe the open and closed source communitys do inspire thies addatudes.
This dates back to the original GNU and Microsoft addatudes way back in the 1980s.
GNU: Everyone is responsable.
Microsoft: Your so stupid it's all your fault.
If I hear again how smart Microsofts programming team is again I'll throw up.
That is the single most arrogent peace of bull I've heard.
If Microsofts programmers are so smart then I'm Enstine. Microsofts coders make the kind of mistakes every day "I" knew to avoid when I writing my own "Hello world" on a Commodore Vic 20 in 1979.
I don't actually exist.
Yes. Exactly. Let's worry about the basics first.
Is your camera plugged in?
Sort of like the one that I seen yesterday that says that linux cannot scale as good as unix. Nevermind it currently holds the TPC-C record. As for security does Windows have the flexibility to run port knocking? Can I modify all of the port settings for all of the services in Windows?
One of the biggest strenghts in linux is it's flexibility. Windoze lacks the flexibility required to create a diverse environment.
I hereby declare that Windows security is not as good as Linux.
Got Code?
Yeah! Its So Obvious Linux Is More Secure Than Windows!
Just Don't Store Your Important Source Code On It.... :))))))))))))
the forrester guys obviously arent familiar with the open source process. sure, patches aren't "released" for longer, but:
a) any admin can opt to install an early (sometimes buggy itself, sometimes not) version of the patch before their "vendor"(red hat, mandrake, etc) officially ok it.
b) the source code is right there, staring at the admin, just a cd away. If the bug is that mission-critical the admin needs to get off his lazy ass and hack together a patch until a better one is released, and possibly even get on whatever mailing list in involved and throw his source at it (if his contract allows). You never know, it might surry the official patch up quite a bit. Under the Windows model, this is all but impossible.
c) Microsoft patches are a joke. They usually fix the intended problem by the second, sometimes third try. However, there are long complained about IE and Outlook vulnerabilities that have leaped the gap of major version changes! You know, the version changes that cost companies TENS OF THOUSANDS OF DOLLARS.
my $0.02
Oh, and a d!
d) What home user really uses Microsoft update? Not very many, because it's a pain is the ass. Fedora's model of a simple "yum update" is blissful. I would guess the RH's enterprise offerings are even better. When was the last time an update to your linux system (save a kernel update) required a reboot? never, or close to it. This happens routinely in Windows Update. Once more, WINDOWS UPDATE IS A PAIN IN THE ASS TO USE. As a result, many many machines are not patched, not after it is released, not a month later - NEVER.
the end
for real this time.
I should know, I just did a bunch of research on the web for my boss to write a whitepaper about the proformace of a scientific application on various highend servers. We have no evidence, just what others posted on the web.
I assume all whitepapers are done this way.
Posting AC to keep my job.
While you sound like the commendable type who's willing to spend the money to support further development, for the sake of accuracy I feel compelled to mention that you don't have to spend the initial penny on SuSE professional, you can install it over FTP from any of several servers. 129.79.5.130 is pretty fast :-)
but this isn't MS commisioned. The group Koetzle works in meets and plans research topics by what they think will be the biggest things on IT directors minds. FORR used to pride themselves on not doing commisioned research (this may have changed in the last couple of years, but AFAIK it hasn't). If anything the biggest flaw is in the research. For the most part it's 50 companies that they can get on the phone. Some of the analysts have never worked in the fields they cover, they just learn by reading about it and talking w/vendors. One might write about the future shakeout of programming languages, but never even compiled "hello world". The product suffers w/out the experience and underlying knowledge of the topic.
Dude, lay off the troll juice a little. I have used Windows XP and I have to say that plucking out my eyeballs with a shopvack would be less painfull than that candy coated shitfest. I used to think that KDE was to damned cartooney, but then I saw OS X and XP and I decided that EVERYONE is going cartooney, then RHS betrayed me with that abomination that is Blue Curve. STRAIGHT LINES people, I want STRAIGHT LINES, and not disgusitng bubble gum colors, make things look like something that a profetional would use, not a crappy candy coated bloatfest. Anyway I guess I'm done ranting. For now anyway.
That which is done from love exists beyond good and evil
We got rid of all of our windows boxes so I guess it would be easy to claim it is safer because it no longer exists.
Got Code?
This is just one of the great things about Linux (or any open source project):
...as Linux is releasing the seventeenth update since the article....
Say an article about security is published in a magazine. The article takes a really good critical look at Linux vs. Windows and genuinely points out a few areas of improvement. Well, that just prompts the open source community to rev up their engines and (should they agree with the evaluation) they'll just go out and fix it! In fact, there's a pretty good chance that the fix is available in a development version in time to send a letter to the editor for the next month's issue.
Now compare that to Windows. Microsoft would spend two, maybe three times that long debating with the media about whether or not it's a problem or a 'feature', and then whether or not it will be fixed immediately or we have to wait until 2031 for Looooooonghorn to be released. Then they'll just sit on it for a while to see if people really care about it being fixed, and how much. They might also, at this point, have their lawyers spend three weeks writing the licensing agreement for the patch, should it be created. Then they put the whole thing on hold and wait until somebody exploits the problem. Then, only if everything else has gone completely in their favor and the problem has been exploited and the existance of the problem has reached at least two major media outlets, they might work on a patch and distribute it....
Then Microsoft will brag about how quickly they've updated their software in response to the problem...
Punctanym: alternate spelling of words using punctuation or numerals in place of some or all of its letters; see 'leet'
Windows XP still has the option to use the classic skin. If all you want is straight lines, XP has that covered. You know you want to come back to the greatest OS ever invented!
The article underlines the differences in urgencies and speed of responses :
:
They focus mainly on critical update, and sometime delay less critical (first fix the bug in SSL, then fix the bug that happen if some uses GAIM to log into some alternate non-standart [not owned by Yahoo] Yahoo server), therefor explaining why unbalanced average seems bad.
But I think they missed the second important thing
You shouldn't compare the amount of patcheds between a full distro, and a Windows systeme.
To be fair, you should compare the distro, with whole Microsoft patches for Windows+IIS+ASP+Office+VisualStudio+etc...
or compare patches to Linux Kernel+a few core librairies and applicaction to Windows.
And I don't think that way Linux distro will seem that much patchy, compared to Windows.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
"Debian, Mandrake, Red Hat, and SUSE" And when they combine their powers into one, they become... VOLTRON!
Rob Enderle, formerly of Forrester writes:
As a result, the conclusions drawn by Forrester have extremely limited real-world value for customers
Thats probably why they went from having all but two floors of the building they were in in Cambridge to only two floors and part of a third.
Forester was intsremental in trying to stop the martian. In fact, he brought one of their 'eye pieces' in for study. In the end, it was are basteria that did them in though.
Dr. Forester also has a plane.
The Kruger Dunning explains most post on
I didn't read the report, as I am sure most of you haven't, simply because it is $899 to tell me something that I already know otherwise.
..
.. so even if that was exploited, a cleanup on a *nix machine would be significantly faster than perhaps a Windows box that does not chroot its respective DNS service.
Anyways, my question is about the severity of the vulnerabilities. When you get right down to it, Microsoft generally only offers one web server, one mail server, one database server, etc..etc..etc.. A standard distribution OTOH includes a huge array of software. For example, I can choose sendmail, postfix, qmail, exim and others for my mail server; apache, aolserver, boa, dhttpd, zope, etc for my web server; php, ruby, python, perl, cgi, etc for my scripting needs; mysql, postgresql, berkley db, firebird, etc for a database; gnome, kde, xfce, etc for a window manager
you get the point.
In addition to the multitude of different configurations that I could have for a particular system, I can also, if desired, cut out everything that is not essential to maintain as barebones of a system as possible (heck this even includes lots of kernel modules/features).. I can run everything through a localized firewall, block ports, limit IP ranges for various services, chroot/jail certain services, etc..etc..etc..
So I guess my question is:
1. Does this report simply gather up all published security issues and compare? Or do they look at "best practices" on both platforms and only compare packages that, for example, would be installed on a web server, mail server, database server, standard desktop, etc?
2. What is the true damage that could be done by successfully exploiting these issues? Ie, I'm sure most BIND installations are in a chroot/jail
Sure, raw data might indicate that a Red Hat distro has the same number of exploits as a Windows system, but I am much more interested in the applicability of those exploits to my systems and ultimately the increased chance of exploit.
You're right, I do want to go back to the greatest OS ever invented, but fortunatly I'm about to go home, so my GNU/Linux box is only about half an hour away.
That which is done from love exists beyond good and evil
why are we arguing about what kind of oranges we like? i mean linux, windows, and os x are different types of oranges (cli + gui = os) this is boring already. lettuce have salad and eat a new computer interface:
SmellOS
i wrote it yesterday and got it to run on a 286 tandy and an old gameboy i had laying around i just hooked them up to different essential oils now my inbox smells like spruce (get it PINE!)
The IT research firm I work for has been contracted by Microsoft to study the Linux vs Windows value to corporations just recently (last week).
Microsoft, for the first time, paid in full advance even before a full proposal could be drafted, or even basic details.
They initially wanted a TCO study, and our CEO told them to NOT DO THAT, he is very honest, and knew beforehand Windows would lose. On the other hand, ew do not know what will happen.
The reality is that under some very common scenarios, at least where I live, Linux expertise is regarded as expensive, and that some Microsoft apps allow companies to get work done quicker.
If you where to look at the Linux trend of adoption, growing support, etc., regarded retraining costs as an investment into future savings, noted that Microsoft is free to change it's pricing policy anytime, and they can force you to demand more than you want in the future, and that after 3 years you own nothing at all (license obsolete, or app obsolete), then you'll see Linux wining by large.
But guess what, Research firms, even unbiased ones, tend to choose scenarios that are real world, but benefit their customers more.
If IT adopters where the ones financing these research studies, then the story would be different. But guess what? They dont pay much, and if they do, then Microsoft and the likes can double the bet to get what they want or, as someone else put it, they'd pay you $400 so that you'll "agree" with whatever their CIO believes is true. The same happens with newspapers, what you read is 90% dicatated by the ads they can sell in that "section". Thats why you always see some Cars suplement, because people like it, but MORE importantly, because they can sell expensive adds.
If you want unbiased researchers, find a way to fund that does not involved their reveneus depending on an interested party.
unfinished: (adj.)
Okay, true. There are some Windows lockdown tools. Some are even pretty good. Of course, there are also things like that nasty "shatter" attack... You know, the badly designed bit of protocol that makes windows (the objects) vulnerable if they have an edit control, are on the desktop, and have admin privs.
... unless it were set Free (libre), perhaps...
Now, of course, you may say that good coding practices (and how I wish that we all used good practices!) dictate not to have a vulnerable window with an edit control to be vulnerable to that.
I've heard it compared to a SUID root program with an overflow. My question is: How do you audit your system for crap like that? Mind you, finding ALL SUID root executables is a single command on *nix.
This is just a small example of how *nix is more secureable than windows.
Another would be this: we all know about format string bugs. Nasty chars can be injected and will cause overflow problems in anything that uses them improperly. In *nix, a few appropriate greps will allow me to find (and fix!) ever single such bug in Linux (SFAIK, there aren't any, but the point here is that I can *check*). How many are in Windows? How do you know? I don't relish the thought of reverse engineering Windows to check, moreover the EULA says that I cannot (whether or not this EULA is actually enforceable, I leave to others to debate).
Suppose another such category of exploits is discovered; what can you do? I can grep, you cannot. And think before you speak--even a code monkey can grep for things like format strings & bug someone else to fix it.
Linux is secureable, Windows cannot be
As for who is the most secure, that's OpenBSD, hands down. Theo may not be the most likeable person ever, but he keeps OpenBSD secure. I half-wish he'd audit Linux, but I'm sure he'd probably just drive the core developers nuts...
... underwriters laboratories or like consumer reports magazine? Are there any other remotely credible industry neutral testers or analysts out there?
Is that the basic Linux system architecture is more secure.
Once viruses and such have been downloaded by a stupid user, Windows makes it easy to run them; the default account is effectively root. On Linux, or any kind of Unix, the damage a virus can do is largely confined to the user's home directory. To do system-wide damage, a program would have to be run as root; if you login as root to read your email, you deserve to get screwed.
Even that assumes that the user actually runs the virus. A non-technical person doesn't know how to use chmod and set execute permissions. In Linux, there is no .exe.
I don't think there's even a chroot() in Windows. I could be wrong; my knowledge of the Windows API is pretty bad. But assuming I'm right, that makes it much more likely that malware and corrupted services can get access to the whole filesystem tree.
In short, Windows is "surface-heavy." Once you get past that nice, user-friendly GUI, there's not much worth looking at.
Some day the Linux losers will wake up and realize how patetique this again and again "report bought by Microsoft" sounds to others.
Fucking beautiful. Absolutely beautiful.
While I agree with your fanboy critique your criticism that any attempt to denounce a study in favor of Microsoft is always a knee jerk reaction simply isn't relevant in this particular instance.
I don't know if you took the time to read the response from the Linux vendors to the Forrestor report but it is clear that if Forrestor conducted the analysis as described that they made a HUGE statistical error. The question naturally must be asked "how could a supposedly well funded source miss such an obvious gaff?" It takes time and money to do research, surely Forrestor has one above average statistician on staff.
To have performed such a study and in the end wasted their money would seem incredulous. This is akin to being asked to write a word processor and coming up with a spreadsheet program. A natural supposition than is to question the motives of the researchers, however this could easily be a case of "never put down to malice what can easily be attributed to incompetence."
Sure information wants to be free, but how much are you willing to pay for the packaging?
The spamdaemon sets up a remote backdoor, starts harvesting mail addresses in ~/Mail, and does all the usual stuff Windows worms do.
With SELinux, this might become a lot more difficult though. e.g. it could prevent you from running programs that haven't been installed using signed packages.
make things look like something that a profetional would use
Like a web browser with a spell checker perhaps?
"The bottom line? Any of these platforms can be operated securely," said Koetzle. (Koetzle is the leader of the Forrester Team).
Now have a look at yesterdays Slashdot Virus article.
The site where: "I'm right, as long as you ignore the things that prove me wrong", became a valid method of debate.
A slight bug in locally installed setuid program usually gives access to that acount. A slight bug in remotely callable program usually creates a remote exploit with enough determination or at least a nice, satisfying denial of service. For example, if your server logs long audit messages for each failed login, I can just keep calling until your machine runs out of disk space.
Therefore, I think it's justified to count all security bugs of measurable consequence and not try to assign an exact priority. What makes sense is setting up stripped-down Linux servers that only run the top-tested software. If you run a web server with perl, python, tk and shell scripts as apache modules, you might well have more bugs than the fully patches IIS with no extra stuff installed. On the other hand, if you stick to tomcat and well-written J2EE apps that always use prepared statements for user's input and set up a firewall to reject all incoming traffic except ports 22, 80 and 443, you probably have more worries about physical access and kidnapping than remote exploits.
So one of the points we make in the joint statement is that the Forrester report treats all vulnerabilities as equal. After all the time and effort we all put into the raw data set, seeing it boiled down to a simple mean average is disappointing.
Anyone who follows the security advisories for any Linux distribution knows that the critical fixes are fixed first and fixed quickly. Let's take the Microsoft definition of a "critical vulnerability" for example. Then for Red Hat Enterprise Linux in the 21 months from release to March 2004 there were 13 CVE named issues that matched the definition. 77% of those were fixed within a day of them being public. The mean was 1.1 days.
Even if we take into account attacks Microsoft would not class as critcial; things like privilege escalation, remote DoS, information leaks, etc. then we get to 47 CVE named issues where 57% were fixed within a day of them being public. The mean was 7 days.
You'll see the same effect for all the Linux distributors mentioned in the report. However not even all "critical" vulnerabilities have the same risk to all users - you might not be using fetchmail, or your box might not have an SSL-enabled webserver. So really, to get an accurate assesment of "days of risk", you need to look at which of the vulnerabilities affected you, which posed the most risk to your organisation, then see how quickly your vendor fixed them.
-- Mark
-- Mark Cox, http://www.awe.com/mark/
Much of my daily spam now comes from compromised Windows boxes being run as spam zombies.
My personal data was stolen from a company I trusted because their server was running IIS and it was infected with Slammer.
I suffer because of Windows insecurity almost constantly, yet no operating system *except* Windows has ever caused me any such grief. Clearly the Forrester "data" is FUD. Plain and simple.
>> My ultraviolent Linux switch video.
You can have one of the two, but not both.
Back before I became a law-abiding citizen, my experience was that the more fine grained the privilege system is, the easier it is to crack. The key is that you get first some small, insignificant privileges, and then use these to gain some slightly larger privileges, and so on. On Unix systems, the key to breakin tended to be sgid, nor suid.
If administrators and users are both compentent and careful, breaking in is hard. But it is easier to be incompetent for a complex system, and it is more common to be lazy if less apparently is at stake. "Ok, if someone work around this, they will get access to the shared printer. Not worth worrying about".
I wouldn't really want Debian to join forces with the larger software houses. Debian is truly free, and I love that it stays that way. Furthermore I like the Debian way of doing things, while I recent the Redhat way - that's why I use Debian, and wouldn't want a merge to change this.
------- I fumbled my registration and I now must suffer
mod parent up, not flamebait at all
TIAEAE!
What is this test based on? On all vulnerabilities of packages that these distributions maintain against the Windows operating system? How do they go about evaluating which software should be part of this? How about Desktop vs. Server use? Man, everyone runs such a wide range of different application sets! Maybe a good comparison would be to have Linux system with: - Kernel - Most common GNU software - Apache - PHP - KDE or GNOME - Mozilla - OpenOffice.org Against all Microsoft security bulletins, their severity. But then there must also be estimated the percentages of uses like howmany Windows users have IIS enabled and howmany Linux users use OpenOffice on howmany machines they have. Also, not unimportant; howmany time did the bug trackers gave vendors to create the patch? For example the do_brk exploit for Linux was private for some time before it leaked so it was impossible for vendors to make the patch before the news was public knowledge. There's just toomuch to think about to come to an accurate conclusion.. even impossible, cause how do you track the use of certain software in the Open source community, and ofcourse the Windows user base. Never believe such reports..
Linux supporters should be ashamed at this response letter. It makes points about how the study misinterpreted the data, but offers no alternative analysis or conclusions. It's basically saying "they're wrong because the didn't do X" without showing how the results differ if you do X. Go ahead and tell someone they are wrong, but please show it. They haven't shown the methodology to be wrong until they show that changing it produces different results. I expect the results to change, but I don't know by how much without data - perhaps they're raving about nothing.
Damn straight I will. Why? Because one group
represents the best interests of a bunch of fat
asses who got rich off the rest of us, and the
other not only represents the best interests of
my community, it IS COMPOSED OF MY COMMUNITY.
Just because they are part of your community, doesn't necessarily mean they have your best interest in mind. Most of them (with the exception of Debian) are still a company trying to sell a product. I'm not saying they don't have our interests in mind, I'm just saying your logic is flawed.
The biggest problem with "reports" like these is that Microsoft has huge pockets that often help to "fund" them. Fortunately the linux organizations aren't that unethical. (or at least they haven't done anything to date that we know about)
The biggest problem is "activists" like you who ruin it for the rest of the linux advocates. Or you could just be a troll and I just wasted my time.
Yeah, that'd be cool, to bad I was using IE from work to make that post.
That which is done from love exists beyond good and evil
That's because doing wrong gets you fired and there are LOTS out-of-work IT guys waiting for that job, no matter the pay.
Does anyone remember when Ken Olsen called Unix snake oil? About 6 months later that Ken Olsen was history and 10 years later so was DEC.
Just cause Forrester says something doesn't make it so.
Surprisingly, Microsoft did the best job at patching vulnerabilities fast, even though it ranked at the top with the largest percentage of its security holes rated as high
So they DID acknowledge that Microsoft's platform had the most HIGH RISK vulnerabilities, althought this fact is glossed over in the article. Koetzle also acknowledges that the study did NOT look at how WELL the patches addressed the problem (MS often needs to issue more than one patch to get it right, and sometimes they fix one bug and introduce another).
Also - note that MS frequently doesn't announce a vulnerability as soon as they find out about it. They might sit on it for a few weeks and then release the patch at the same time. Hardly an accurate assessment of how fast they fix vulnerabilities. I'm not sure what methodology was used, but they should only measure response times to vulnerabilities that are published publicly at the same time that the vendor finds out about it. I'm not convinved they'd fare better than linux in this case...