Slashdot Mirror
Linux Distributions Respond to Forrester
dave writes "GNU/Linux vendors Debian, Mandrake, Red Hat, and SUSE have joined together to give a common statement about the Forrester report entitled "Is Linux more Secure than Windows?". Despite the report's claim to incorporate a qualitative assessment of vendor reactions to serious vulnerabilities, it treats all vulnerabilities are equal, regardless of their risk to users. As a result, the conclusions drawn by Forrester have extremely limited real-world value for customers assessing the practical issue of how quickly serious vulnerabilities get fixed."
WTF? Why does anyone buy shit from these people.
The executive management of the agency that I work for pays Meta $500/hr to evaluate project plans... they always rubber stamp whatever answer the execs want.
I'm sorry, but I simply can't believe that a research company, a company DEVOTED TO RESEARCH, would come out with biased opinions influenced by money.
And who paid for the Forrestor study?? Not Red Hat they haven't got the cash. Probably another Microsoft funded event.
The most dramatic thing from my point of view is that SuSe, Red Hat, Mandrake and community based Debian all got together to formulate a common reply. This is the BEST news we could ever hope for - a common on unified front - no forking when it comes to security.
do we listen?
(site loads slowly. here we go in case of /.'ing)
GNU/Linux vendors Debian, Mandrake, Red Hat, and SUSE have joined together to give a common statement about the Forrester report entitled "Is Linux more Secure than Windows?". Despite the report's claim to incorporate a qualitative assessment of vendor reactions to serious vulnerabilities, it treats all vulnerabilities are equal, regardless of their risk to users. As a result, the conclusions drawn by Forrester have extremely limited real-world value for customers assessing the practical issue of how quickly serious vulnerabilities get fixed.
The security response teams of GNU/Linux distributors Debian, Mandrakesoft, Red Hat and SUSE have assisted Forrester in gathering and correcting data about vulnerabilities in their products. The gathered data was used at Forrester for a report that became titled "Is Linux more secure than Windows?". While the Linux vulnerability data that is the basis for the report is considered to be sufficiently accurate and useful, Debian, Mandrakesoft, Red Hat and SUSE, from now on referred to as "We", are concerned about the correctness of the conclusions made in the report.
We believe that it is in the interest of our usership and the OpenSource community to respond to the Forrester report in the form of a common statement:
We were approached by Forrester in February 2004 to help them refine their raw data. Forrester collected data about the vulnerabilities that affected Linux during a one year period and looked at how many days it took us to provide fixes to our users. Significant efforts have been put in not only making sure that the underlying dataset for the Linux vulnerabilities was correct, but also to articulate the special technical and organisational care taken in the response processes in the professional Open Source security field. This expertise is greatly appreciated by our usership since it adds a high value to our products, but we see that most of this value has been ignored in the methods used for the analysis of the vulnerability data, leading to erroneous conclusions.
Our Security Response Teams and security specialized organisations of respectable reputation (such as the CERT/DHS, BSI, NIST, NISCC) exchange information about vulnerabilities and cooperate on the measures and procedures to react to them. Each vulnerability gets individually investigated and evaluated; the severity of the vulnerability is then determined by each of the individual teams based on the risk and impact as well as other, mostly technical, properties of the weakness and the software affected. This severity is then used to determine the priority at which a fix for a vulnerability is being worked on weighed against other vulnerabilities in our current queue. Our users will know that for critical flaws we can respond within hours. This prioritisation means that lower severity issues will often be delayed to let the more important issues get resolved first.
Even though the Forrester report claims so, it does not make that distinction when it measures the time elapsed between the public knowledge of a security flaw and the availiability of a vendor's fix. For each vendor the report gives just a simple average, the "All/Distribution days of risk", which gives an inconclusive picture of the reality that users experience. The average erroneously treats all vulnerabilities as equal, regardless of the risk. Not all vulnerabilities have an equal impact on all users. An attempt has been made to allocate a severity to vulnerabilities using data from a third party, however the classification of "high-severity" vulnerabilities is not sufficient: The mere announcement of a vulnerability by a particular security organisation does not necessarily make the vulnerability severe - similarly, the ability to exploit a weakness over the network (remote) is often irrelevant to the vulnerability's severity.
We believe the report does not treat the open source vendors and single closed source vendor in th
Then, there is the relevence of bugs. SE-Linux makes many otherwise serious glitches a mere nuicense. As do other modules in the LSM.
There is no chroot() in Windows, to the best of my knowledge. This also changes the severity of a bug from catastrophic to irritant, in Unix.
Finally, Nessus and SAINT are more often used to scan Unix boxes than Windows ones.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Any box in the wrong hands can become unbelievably secure, regardless of the OS.
What would be a very interesting read would be to have sys admins lock down the box (perhaps those do consulting for corporations) and then test how well they're set up.
Granted, it's up to the admin at that point so have many admins on different boxes.
"Microsoft Corp., however, fixes security problems the quickest"
how can they claim that since Micro$oft receives bug reports that are not publicly announced???
It is easy to announce the bug along with the patch after having it hidden for 6 months...
No one buys reports from these companies to actually learn anything. The primary purpose these companies serve is to give companies objective sounding quotes to pepper their marketing material with and to convince risk averse managers that they are safely following the largest herd.
-_-
Have you ever considered that all of the media that you read and watch is biased? And actually if you'd read the article, you'll notice that what they say is perfectly reasonable. Basically, the forrester report was much to narrow focused to have a fair assessment of the data. The simplicity of the initial report is actually laughable. MS fixing 100% of its bugs? Now, remember that Microsoft's code is *not* open source, so they can wait until some poor sap gets bit a bug before they fix it. The initial report by forrester was faulty and relied upon obscurity and simplicity to blatantly shift the report in Microsoft's favor. And before anyone says that forresster is a research company and as such is unbiased, I recommend that you look to SCO for an example of MS's cleverness.
But when you "unbiased, fair reporting, with due impartiality to both sides of an argument", why does Slashdot immediately spring to mind?!
I'm amazing. You aren't. SUCK IT
Probably another Microsoft funded event.
you would be correct
From the article:
"In 2003, Microsoft Corporation commissioned Forrester Research, Inc., to conduct a study to measure the potential market of people in the United States who are most likely to benefit from the use of accessible technology for computers."
[Update: Apr 6 at 7:58pm CDT... Martin Schulze from the Debian team added some more information.] Javier Fernandez-Sanguino Pena composed a survey in 2001[*] and discovered that it has taken the Debian security team an average of 35 days to fix vulnerbilities posted to the Bugtraq list. However, over 50% of the vulnerabilities where fixed in a 10-days time frame, and over 15% of them where fixed the same day the advisory was released! For this analysis, all vulnerabilities were treated the same, though. He has rerun the survey based on vulnerabilities discovered between June 1st 2002 and May 31st 2003 and found out that the median value of delays between the disclosure and releasing an advisory including a correction was 10 days (average is 13.5 days). Again, for this analysis advisories were not classified with different priorities.
Microsoft finds their flaws in a number of ways, businesses that report them, and white hat hackers they do this for a living.
But to answer your question a little better. If you look back at the flaws in IE, consumers, not businesses, were the ones that got attacked before the patches were out. Again, because it was a person, it is hard to track down the exact problem that occured to them. IE has the flaws that were exploited before the patches came out. Phishing scams from the address bar.
-- johntracy.com, because everybody else is wrong.
Hey why aint gentoo on the list? I guess they're still compiling their response ,p
(PS I love gentoo, so don't go flaming me!)
[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.
This is Slashdot. If the news wasn't a little slanted I wouldn't read it.
Besides. It's the community take on events that I'm interested in. I can check out the wire services if I just want the news.
Ummm.... So you're saying that Linux is less secure because more valuable data is stored on Linux than on Windows?
If anything, I'd say that validates Linux's usefullness.
Now I only wish someone could tell me what this has to do with the number of bugs...
I think that the point that he was trying to make is that Microsoft *has* given Forrester money for a report in the recent past.
From tests conducted at an observatory overlooking the skies of Los Angeles, researchers have concluded from the gathered data that the sky is indeed red.
Buried in all the hoopla, they never tell you that all the smoggy red photos were taken at around the time sunsets happen.
Statistics and numbers in general can be thrown any which way to serve the purpose of the writer. It's an unfortunate side-effect of being biased by nature. Even if someone were to WANT to be impartial, they'll often offer a slant merely by presenting data a certain way.
It's difficult to find people to trust when money is on the line somewhere. With Microsoft's track record and its acknowledged need for "Trustworthy Computing" (a marketing term), it's difficult to take their word. Unfortunately, with that money, they have enough marketing power to buy research, and flood biz execs with enough propaganda...and when they constantly hear that kind of information from what they'd consider mainstream sources, they start to believe it as fact.
Now that's dangerous.
"Hey Microsoft, you guys have funded studies for us before. I know Linux is being a problem for you and we just so happen to be doing a study to see which OS is better, yours or theirs. Would you be interested in funding us once more? -nudge nudge, wink wink-"
Like most linux geeks, I too believe that linux is much more secure than windows, but when asked why, I can only give some rant about how the open source methodology is superior and promotes faster response times to vulnerabilities. Either that, or I point to all the recent windows virus outbreaks.
But if linux were on every desktop, I'll bet you'd be getting a few emails every day with attachments like "your_paper.sh" that most of us would trivially delete, but many would stupidly run (and these are the same users who would login as root to check their email).
It wouldn't be fair to use instances like this (albeit they're not common yet) to show that linux is more vulnerable than windows.
Therefore, I believe that by quantifying the vulnerabilities and response time, Forrester is on the right track, they just need to take into consideration this response, and find a better method of quantifying the data.
Sure. So is the Fedora project (though you could call them "RedHat", and not be too far off).
I rely on then for providing me a rock-stable, thoroughly tested distribution and any security upates to that distribution.
I, in turn, (since I'm not a really good coder) spread the good word that these people know what they're doing. If I find a bug or security vulnerability, I report it to them ASAP. I also test out thier new stuff, and report bugs and such for them, and suggest ways that thye might improve thier products.
They give me something, I pay them in the currency they want. They are indeed a vendor.
Soko
"Depression is merely anger without enthusiasm." - Anonymous
Depends if you can pay an "IT reasearch firm" to put their name on your marketing material or not.
BTW, here's the report....if you have 900 USD to get it:
The Forrester Report
The idea is that these vulnerbilities don't have equal impact at all. Lets examine some of the unix security vulns i've seen in the last few months.
3 or 4 games, unsafe handling of common scoreboard files producing exploits.
WHAT THE HELL? That's Unix security for you... even GAMES that have vulns get attention. Windows only gets remotely exploitable vuln attention.
Consider how many windows programs use shared registry keys, consider how many read/write to common temp folders, or common locations on disk. Have any of the probably hundreds of overflows involved in reading a temp file from C:\Winnt\Temp been taken into consideration with WIndows? Heck no, nobody even cares. Windows too many remote vulns to even pay attention to stuff like that.
Consider gzip's unsafe handling of temporary files. I wonder how many Winzip/Windows Compressed Folders have? NOBODY HAS EVEN LOOKED.
Well, of course the news here is slanted. Otherwise they'd have to call it "Pipedot."
How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?
I remember reading a report from one of these big research firms (I think) in 1997. It was a report first published in 1994. It talked about how Apple would own the desktop (90% probablility), NeXT would be a power player (90% probability), and how GuptaSoft would drive most IT application (90% probability).
Funny, the report was ALL about WRONG. Nothing was close to reality. How did they get it SO WRONG?
In another situation, I was directed by Management to ask one of these big research firms about embedded database products. At the time they didn't have any expertise in that area. However, they found a kid internal to the company that was willing to learn so they could write a report. It seemed silly and convoluted. Here's a guy without the necessary understanding or expertise, and in a few weeks he's going to learn and gather enough information to write a report? A Report that other people will use to make decisions? Crazy!
In the end, I concluded that these reports are useless "on the ground". They're only useful for those who wish to pretend that they've done adequate research.
So my short answer is: These research firms exist to just cover butts and promote positions. Any IT management personnel that subscribe to their services should be FIRED. It's negligent to cite their reports; it's negligent to use them as a resource. If you need expertise, hire a consultant with REAL expertise, not a generic and biased report. If you want a biased report, the sales guys will come to you for free.
I'm staying with Linux and my money goes with Linux. After two years of running Linux I've not been hacked once, I've not gotten ONE SINGLE VIRUS, I've not had to look at one single pop-up add that I didn't want to look at, I've not had to look at one single BSOD, I've not had to reboot one single time unless I chose to.
I don't have to spend all my time in a panic worried about patches and viruses and other such nonsense. Neither do my friends and family, I converted them to Linux too. Now I don't have to worry about them either.
What does Windows offer me that I can't do with Linux? Nothing. Why should I use Windows which is constant trouble and extremely high maintenence and is a constant cash drain, versus the ONE TIME PURCHASE (if I choose to purchase v. free download) of a Linux distro, in my case Suse, that is mine, with no strings attached and will cost me no further money, ever?
Once I own the $89 Suse distro I never have to spend another penny on it or any other software, ever. It works. It's secure. Anyone that says it isn't is a stupid SOB or a liar or both.
These reports are so dumb. In high school, I remember learning that averages don't give a good representation, because extremes will skew the numbers. The median is a better representation. Funny how some people don't seem to remember that. By Forrester's methods of research, they could come to the conslusion that the average american has one testicle (statisticly true btw).
You are right in your suspicions that these sort of "studies" are commissioned by Microsoft as part of their marketing strategy (just part of the business--Oracle, Sun, IBM etc parade studies flatter their products as well after all). However, I don't dwell at all on these sorts of studies and I certainly wouldn't give them any meaningful weight when making a decision on deploying Linux (or not).
Even given the positive spin towards Microsoft, however, Forrester's comments on the study are a barely lukewarm endorsement of Microsoft, and don't seem to be too critical of Linux. Check out some of the comments by Forrester analyst Laura Koetzle:
Surprisingly, Microsoft did the best job at patching vulnerabilities fast, even though it ranked at the top with the largest percentage of its security holes rated as high
So they DID acknowledge that Microsoft's platform had the most HIGH RISK vulnerabilities, althought this fact is glossed over in the article. Koetzle also acknowledges that the study did NOT look at how WELL the patches addressed the problem (MS often needs to issue more than one patch to get it right, and sometimes they fix one bug and introduce another).
"The fact that the Linux distributors fixed such a high percentage of their vulnerabilities is a remarkable achievement," she said. "Even Debian, in last place, was pretty darn thorough."
Sure doesn't sound like something you'd expect an MS-paid cheerleader to day about the competition...
This is very much a case of your mileage may vary
Translation: even if patches are made fast they can still leak...
The bottom line? Any of these platforms can be operated securely
Quite the ringing endorsement for MS ain't it? Nice to see their people so solidly back their studies...
One thing that I don't see mentioned is that as the gnu/linux base grows larger, so do the proportion of competent developers who can spot and fix code security problems before they go mainstream. With MS, the number of people looking to spot code security problems reamins constant no matter how big the user base.
Although I've herd MS say that the reason Linux hasn't had as many big security problems is because they aren't used as much, I think the truth will turn out to be just the opposite. Not to mention that a hacker who finds a security flaw in Linux is more tempted to get fame by reporting it, and that fame becomes more prestigious as Linus grows, but a hacker who finds a security flaw in windows will be more tempted to gain fame by exploiting it.
Rob Enderle, formerly of Forrester writes:
While I agree with your fanboy critique your criticism that any attempt to denounce a study in favor of Microsoft is always a knee jerk reaction simply isn't relevant in this particular instance.
I don't know if you took the time to read the response from the Linux vendors to the Forrestor report but it is clear that if Forrestor conducted the analysis as described that they made a HUGE statistical error. The question naturally must be asked "how could a supposedly well funded source miss such an obvious gaff?" It takes time and money to do research, surely Forrestor has one above average statistician on staff.
To have performed such a study and in the end wasted their money would seem incredulous. This is akin to being asked to write a word processor and coming up with a spreadsheet program. A natural supposition than is to question the motives of the researchers, however this could easily be a case of "never put down to malice what can easily be attributed to incompetence."
Sure information wants to be free, but how much are you willing to pay for the packaging?
Much of my daily spam now comes from compromised Windows boxes being run as spam zombies.
My personal data was stolen from a company I trusted because their server was running IIS and it was infected with Slammer.
I suffer because of Windows insecurity almost constantly, yet no operating system *except* Windows has ever caused me any such grief. Clearly the Forrester "data" is FUD. Plain and simple.
>> My ultraviolent Linux switch video.