Security Statistics and Operating System Conventional Wisdom

kev0153 writes "Microsoft Windows is more secure than you think, and Mac OS X is worse than you ever imagined. That is according to statistics published for the first time this week by Danish security firm Secunia. "Secunia is now displaying security statistics that will open many eyes, and for some it might be very disturbing news," said Secunia chief executive Niels Henrik Rasmussen. "The myth that Mac OS X is secure, for example, has been exposed." "

Comments

Welcome to Bizzaro World!

[Zorilla]

...where MS wants you to use Firefox and Mac OS X is less secure than Windows!

Re:Welcome to Bizzaro World!

[gnu-generation-one]

"Welcome to Bizzaro World where MS wants you to use Firefox""

Or perhaps, where they want a target for their MSIE developers to aim at?

Security or obscurity

[Anonymous Coward]

I don't think too many people have said MacOS X is especially secure just that no one cares enough to exploit it.

Re:Security or obscurity

[Three Headed Man]

I remember reading about them discovering and patching a "remote root access exploit" at Apple. Reread that phrase in quotes. Remote root access exploit. Nobody really cared. It was because, for the numbers of boxen you could hack and "pwn", the bug wasn't all that useful because it had limited use.

Re:Security or obscurity

[Anonymous Coward]

No, it's because hackers can't afford Macs.

Re:Security or obscurity

[Anonymous Coward]

Script kiddies may not care, but I assue you that there are governments and criminals that do.

Re:Security or obscurity

[Bush Pig]

> ... there are governments and criminals that do.

You write as though there's an important distinction. Surely one is merely a subset of the other, at least in America and Australia.

On a side note...

[Anonymous Coward]

We would all like to thank the millions of dollars Microsoft invested in our research to bring it to the successful conclusion.

It took us a couple of tries to get the results so that they would give us the right answer, but eventually we figured out a way. Microsoft kept funding us all along the way.

Thank you!

Re:On a side note...

[Jacco de Leeuw]

Pecunia (Secunia?) non olet...

Re:Debian. Who cares?

[Anonymous Coward]

You mean Debian GNU/Hurd, the only real Hurd distribution?

And whom funded this 'article'

[nurb432]

If you trace the money, there wont be much suprise in who it leads back too.

Re:And whom funded this 'article'

[Anonymous Coward]

Not to be a grammar Nazi, but it's "who funded this article," not "whom."

Re:And whom funded this 'article'

[Anonymous Coward]

Micorsoft

Re:And whom funded this 'article'

[Anonymous Coward]

Zig Heil, very true.

Re:And whom funded this 'article'

[Anonymous Coward]

The Stonecutters!

Billy Gates and Stevie Jobs are both members they are playing us for saps. Linus couldn't join because they already had one Torvalds...

I will not be silen...[TRANSMISSION ERROR]

Re:And whom funded this 'article'

[Anonymous Coward]

Is a corporation a who or a whom? How many people funded the article, or did a non human piece of paper do it? When in doubt in English, should you default to a singular or plural, a possessive or non possesive? And when you say "not to be a..." then go ahead and "be a" is it one, or the other?

Or can we just agree to stop with the grammar correcting posts on an ad hoc casual forum instead?

I suggest publicly broadcasted trials by ordeal for grammar nazis, to see if they are "correct", as there is no static "thing" known as the English language, it has evolved and will continue to evolve. If there was such a thing as a static English language, it would exist, you could point to it, say "looke, forsoothe and foreswear, and with the King's Blessings, it is in trufe a static thynge" or some such. You cannot point to anything like that, because it does not exist. If you think it exists, you are hallucinating, and/or trolling, and my best guess is it is both those things.

Changes, or dialects, or sub dialects, or sentence structure changes, or introduction of foreign words would never have occurred, but they did, still do, and will continue to do so, which proves there is no such thing as a static English language..

If the intent is clearly understood by the majority of the hearers from the speaker, at any point in time, concurrent with the utterance in question, it is "English", and is also "more correct" in that instance than "non correct". Correctness is merely an indication of whether or not the data gets transferred in a "good enough" fashion for it to be understood by the majority who are receiving it. This was debated years ago when "ebonics" was finally admitted to be just as valid a subset of "english" as a variety of other subsets, because it follows language structure currently in use by the majority of the population that fits inside the demographic from within it is spoken, hence, it is correct. "Brooklynese" is a subset of English, a dialect, which is just as differing as any other subset of english, and as such, is no better nor any worse than Ebonics, nor is it "more correct". It certainly sounds strange and incorrect to non Brooklynese speakers though, same as Ebonics. Tex-Mex or "Spanglish" is another, it contains a lot more Spanish words than other English subsets, yet it is "proper" English within their own demographic, even though the words are quite different in a lot of cases, as are the sentence structures used, such as ending a sentence with a verb.

And so on, many examples may be noted. English as spoken in England proper, as opposed to Scotland, or as opposed to in Missippi, etc. They are all "correct", yet they all have significant and profound differences. "Valley girl" speech is just as correct as a "down east" dialect, within it's demographic.

Now, how does this relate here? Glad you asked! This is a forum on the internationally accessible internet, with a primary demographic of the United States, within are contained many demographics, so in order to proceed, we must by of necessity concentrate on intent, over any particular subsets demographically peculiar dialect, all the way to individual differences in relatively trivial instances of sentence structure, minor word spelling differences, or use of partical nouns or pronouns. If it is close enough, it is correct, and in no need of correction. If it fails to convey the message though, then perhaps in might be noted. In this instance, whether who or whom was used, nothing is changed for any practical consideration.

Or, the grammar nazis seem to be free to offer up their own website where people may go to post random utterances and they can correct each other, to their hearts content. I suggest they do so, and leave slashdot to those who wish to discuss the subject at hand, using all the varieties of English out there, so it is accessible and useable to all, not just a few highly anal-retentive patrons.

Re:And whom funded this 'article'

[maximilln]

Is a corporation a who or a whom? How many people funded the article, or did a non human piece of paper do it? When in doubt in English, should you default to a singular or plural, a possessive or non possesive? And when you say "not to be a..." then go ahead and "be a" is it one, or the other?

Please. It's not that difficult.

"Who" is a subject. "Whom" is an object. A subject performs an action with a verb, an object receives the action of a verb. Prepositions take objects. I may have heard the term "subject of a preposition" but, grammatically, the subject of a preposition is an object.

"To whom am I speaking?"
"With whom do you speak?"
"Jenny and Michael spoke with those who did the crime."
"Who is that man on the bench?"
"Bill and Bob beat whom?"
"Who did Bill and Bob beat?"
"Who would you like to invite to the party which is being held in honor of whom?"

The last one pulls two questions out of one sentence and, while logically muddled, is grammatically correct.

Now, how does this relate here? Glad you asked! This is a forum on the internationally accessible internet

So how does this relate to an international forum? Because anyone with any grasp of any language is familiar with the concepts of subjects and objects around verbs. Honestly though I didn't really start to grasp the concept fully in English until after I had studied a foreign language. With that in mind I would expect that any foreigner who has studied English as a second language should find it very easy to pick out where the proper uses of "who" and "whom" are. It has nothing to do with dialect.

Re:And whom funded this 'article'

[Anonymous Coward]

You just contradicted yourself. In the sentence "Who did Bill and Bob beat?" "who" is the object of the verb "beat" and therefore it should be "whom", if we are using textbook grammar and not common usage. Likewise int he last sentence "who" is the object of the verb "invite".

Re:And whom funded this 'article'

[mrscorpio]

Dear Slashdot Grammar Nazi,

It is commonly accepted now to use "who" in place of "whom". "Whom" is still ok, but "who" is no longer wrong when used in the same way. So unless you're still using "thy" and "thou" in everyday speech, you have no ground on which to bitch :)

Ah, the wonders of a dynamic language!

Re:And whom funded this 'article'

[JuggleGeek]

It has nothing to do with dialect.

Whom cares? Only the grammer nazi's that don't want to think about anything important, and who prefer to bitch and whine because someone used a comma in the wrong spot, or said "Who" when it should have been "Whom".

Were this an english class, it might be important. This isn't, and it's not.

Re:And whom funded this 'article'

[Anonymous Coward]

You can rant all you like about the joys of using who instead of whom. That doesn't change the fact that the great-grandparent used WHOM (not who) wrong. Regardless of the movement of the language, the great-grandparent was WAY WAY incorrect.

Always read before posting!

Re:And whom funded this 'article'

[It'sYerMam]

Incorrect. "Commonly accepted" does not mean "correct."

And "Grammar Nazi" is probably another way of saying "one who is correct" Now, grammar is not that difficult a subject, and while not all of it is necessary it arguably makes for a better/richer language. Things are possible in English; nuances and undertones through mere selection of synonym that can alter a sentence's meaning. Similarly, the particular grammatical "style" that is used can do likewise, so don't let English's colour perish.

Re:And whom funded this 'article'

[maximilln]

It is commonly accepted now to use "who" in place of "whom".

By whom is this atrocity commonly accepted? Who in their right minds could have authorized such a thing? I have a compulsion to severely bludgeon those who committed such a heinous atrocity.

It's actually useful knowing the difference because, initially, I was going to write "...to severely bludgeon whomever I find out committed..." In thinking about the function of "whomever", though, I found that it was really the subject of "committed" and not an object of the prepositional phrase "to...bludgeon", and the "I find out" was grammatically incorrect and extraneous.

Re:And whom funded this 'article'

[maximilln]

"Who" is the subject of the verb "did" and "Who" is the subject of the verb "would".

Re:And whom funded this 'article'

[maximilln]

because someone used a comma in the wrong spot, or said "Who" when it should have been "Whom"

Incidentally because the subject of your compound sentence is the same "someone" across both verbs "used" and "said" there was no need to use a comma. :-P

Re:And whom funded this 'article'

[BorisSkratchunkov]

Matthew Broersma (the author of this article) was probably forced to misspell "Microsoft" for the fear of being sued.

On another note, since when has Windows been an application? I always thought of it more as a hack for DOS to make DOS "prettier" and give it a GUI. I don't think that Mr. Broersma has any clue about what he's talking about. As far as I'm concerned, the "Micorsoft Windows application" is nonexistant.

Re:And whom funded this 'article'

[JuggleGeek]

As I said before - whom cares?

Re:And whom funded this 'article'

[Anonymous Coward]

It should be "Whom did Bill and Bob beat?", assuming both "who" and "whom" are used to gain precision (these days nobody cares because it takes two to tango, and the both of them need to know how). With "who", you end up with an archaic construct, which here would indicate that the inquirer seeks the identity of the beater of Bill and Bob.

Were we to correctly implement the whole extravaganza, which is proper English (sorry yanks, proper ENGLISH) we could all jolly well go hang ourselves, for it is a hodge-podge of overlapping systems of grammar, idioms, beliefs etc. gathered up through the centuries, and in varying states of refinement and decay.

English, with all its fluidity, is about "getting it". If what you are about to say or write feels natural, by all means say or write it. If it doesn't, you are in over your head.

Please note that this post is meant to complement the parent, as well as to ensure the perfection of the correctness in the lesson posted by him. If anyone cares to correct any errors of mine, I would be filled with gratitude.

Re:And whom funded this 'article'

[acramon1]

"Who did Bill and Bob beat?"

"Who" is the subject if Bill and Bob were the losers. ("John did beat Bill and Bob.")

"Who" is the object if Bill and Bob were the winners. ("Bill and Bob did beat John.")

Re:And whom funded this 'article'

[optikSmoke]

an object of the prepositional phrase "to...bludgeon"

I hate to pick nits (or whatever), and normally I wouldn't, but since this thread and your post are about grammar -- you should know that "to severely bludgeon" is not really a prepositional phrase; it is a split infinitive. So, "to bludgeon severely" would be the correct form ("to bludgeon" being the infinitive form of the verb and "severely" being an adverb).

Re:And whom funded this 'article'

[maximilln]

Alright. I'll take one on the chin in my examples but my definitions were correct.

Re:And whom funded this 'article'

[Anonymous Coward]

Commonly accepted does mean correct if there is no objective standard of correctness, which is the case with language. How does following arbitrary rules in contratiction to one's natural accent/dialect make for a richer language? As always, the pedantic ideal is nothing more than bland uniformity: a language which is "correct" but devoid of character, diversity and any interest which does not pertain to the perpetuation of ridiculous and nonsensical shiboleths.

Re:And whom funded this 'article'

[maximilln]

Sweet. Thanks. :)

Re:And whom funded this 'article'

[sp0rk173]

Preach it.

Re:And whom funded this 'article'

[teece]

I am certain there were old codgers (not saying your old) that were bemoaning the loss of inlfectional and declensional endings in Old English towards the end of the first millenium and beggining of the second. English used to inflect almost as much Latin. But the stress on the first syllable caused the inflections, at the end of the word, to be slowly obscured in the position of least stress.

Now, the loss of inflection is very big -- it changes a language form synthetic to analytic, which is quite a leap.

Guess what? English survived just fine. There is not a single living human that will chastise you for failing to properly decline your adjectives.

The fact that you must point out this who/whom distinction shows that the battle has already been lost. In 50-100 years there will be no distinction between them.

That's life. Langauges evolve.

(Mind you, I'm with you in spirit. I try very hard to use the right version of those words. But that is beside the point.)

Re:And whom funded this 'article'

[Anonymous Coward]

Try to aviod the passive voice. That might help.

Re:And whom funded this 'article'

[Noren]

Whom cares? Only the grammer nazi's...

I'm not sure about "whom", but I do know that Bob the Angry Flower dislikes the practice of putting apostrophes in plural nouns for no apparent reason.

Re:And whom funded this 'article'

[ultranova]

And "Grammar Nazi" is probably another way of saying "one who is correct"

No, "Grammar Nazi" refers to individuals who have nothing to add to the conversation, so they pick up completely irrelevant issues (such as the difference between who and whom) to appear smart.

Grammar Nazis are like spam: an annoying waste of bandwith and storage space.

Re:And whom funded this 'article'

[maximilln]

And to think that I wrote my little piece on who/whom just because someone else made a big deal out of excusing using the "dialect" arguement. I only wanted to point out the grammatical background.

I suppose it goes right in with "will you borrow me some money?" and the various which/that conventions (which is only an inanimate object). I still don't hear a significant amount of "Them like to play football" or "Us would like to go hiking" but I do catch myself using "/me wants to go out for a beer" quite often. :)

Re:And whom funded this 'article'

[NSash]

Whom cares?

Was that intentional? Because that was pretty funny.

(No, it doesn't bother me that you still struggle with your native language.)

Re:And whom funded this 'article'

[zaphod_es]

woo whom!!

Re:And whom funded this 'article'

[tunah]

The point is the OP used whom instead of who, which makes him sound like a pretentious idiot.

Re:And whom funded this 'article'

[Bush Pig]

> "Commonly accepted" does not mean "correct."

Correct. After all, it's commonly accepted that the world was created in 4004 BCE ...

Re:And whom funded this 'article'

[Anonymous Coward]

I'm not someone who corrects other people's grammatical missteps and I did not major in English, but when I hear something like "whom cares?" I tend to think less of a person's ability or meticulousness. If people are careless with their language, who's to say they aren't careless with their thinking?

Kudos on the use of the subjunctive though.

Re:And whom funded this 'article'

[JuggleGeek]

Was that intentional?

Yes. So was the comma, and the apostrophe. (See "grammar nazi's".) I thought that would be obvious to grammar geeks. Apparently not.

I don't struggle with my native language. I can communicate just fine, which is the primary point of a language. I can't diagram a sentence, though. I don't know what a past participle is, and I don't really care about whether a word is an adverb or adjective or preposition. I just think it's silly for people to worry about unimportant details instead of what the words *mean*. Ideas are more important than grammar, IMO. In particular, in a forum such as this one, not everyone is a native English speaker, and few people other than grammar geeks take time to edit, spell check, etc. A slashdot post isn't the same as a school essay.

Until LM authentication is gone...

[pegr]

Until LanManager authentication is totally removed (not just turned off) from Windows, Windows will not be secure. There are just too many exploits involving LM authentication to take Windows seriously.

Re:Until LM authentication is gone...

[x0n]

Not sure I understand you. You seem to be implying that when LM auth is disabled (via local/group policy), it is still exploitable? This is news to me.

Please elaborate.

- Oisin

Re:Until LM authentication is gone...

[julesh]

Until telnetd is totally removed (not just turned off) from Linux, Linux will not be secure. There are just too many exploits involving telnet to take Linux seriously.

What's wrong with having insecure features that are disabled by default? Many people operate in secure environments where such features (which they need for interoperability reasons) offer a "good enough" degree of security. There's no point in making these people's life harder.

Re:Until LM authentication is gone...

[Darren Winsper]

Do many distros install telnet by default any more? I don't know the figures, but I'd have thought most would have just moved to ssh by now.

I keep the client around, but haven't had telnetd installed for years.

Re:Until LM authentication is gone...

[Darren Winsper]

I guess if it's still around, there may be some sort of exploit in the rest of the system that will allow you to enable it. I'm not saying there is, but it's possible.

Re:Until LM authentication is gone...

[AliasTheRoot]

There's no telnetd on my machine which is a out of the box install.

Re:Until LM authentication is gone...

[richie2000]

Until telnetd is totally removed (not just turned off) from Linux, Linux will not be secure.

So you're saying Linux is secure? Good. You see, it's been a few years since telnetd was installed in a base Linux install. I'd say that qualifies as "totally removed".

Re:Until LM authentication is gone...

[pegr]

Not sure I understand you. You seem to be implying that when LM auth is disabled (via local/group policy), it is still exploitable? This is news to me.

You can certainly turn it off, but unless you disable storing the LM hash, it's still available for cracking. In the wild, my experience is that LM hashes are available as a general rule (90% of the time or better). My insistance that LM authentication be removed outright is due to the "lazy admin" factor. So yes*, in practice, unless it is removed outright, many times it is still exploitable.

*Definately needs qualifying. Can you turn off LM effectively? (yes) Do admins do it? ('fraid not...)

Re:Until LM authentication is gone...

[gallir]

telnetd is completely removed from Debian GNU/Linux.

BTW, when are they going to remove it from VMS and derivatives?

Re:Until LM authentication is gone...

[lpontiac]

Until telnetd is totally removed (not just turned off) from Linux, Linux will not be secure. There are just too many exploits involving telnet to take Linux seriously.

Bad example. There's a telnet service in Windows too.

Re:Until LM authentication is gone...

[Anonymous Coward]

I didn't think any Linux distribution that is taken seriously still DOES install telnetd by default. SSH has been standard in most Linux distros for at least 4 years, possibly more.

Re:Until LM authentication is gone...

[RickHunter]

And there is no telnetd in Linux. There's one in GNU/Linux, but you can uninstall it trivially.

Re:Until LM authentication is gone...

[x0n]

You wouldn't feel guilty of downright FUD spreading by saying that, no? ;)

Re:Until LM authentication is gone...

[x0n]

Yes, what you say is true, but in order to obtain LM hashes, you must be either a domain admin (for AD retrieval) or a local admin. We can then get into a chicken/egg type debate here, but I'm not trying to accuse you of FUD spreading but it seems your point has migrated from "windows sucks" to "windows admins suck". This may well be empirically true, but hardly the point, no?

- Oisin

- Oisin

Re:Until LM authentication is gone...

[pegr]

Yes, what you say is true, but in order to obtain LM hashes, you must be either a domain admin (for AD retrieval) or a local admin. We can then get into a chicken/egg type debate here, but I'm not trying to accuse you of FUD spreading but it seems your point has migrated from "windows sucks" to "windows admins suck". This may well be empirically true, but hardly the point, no?

I do not take issue with a single word, though the points you take aren't quite the points I intended. To be clear, my point is 1) LM authentication is broken, 2) Windows admins typically don't know LM authentication is broken, and 3) Those Windows admins who know LM authentication is broken are generally not successful in removing it.

So why are we still burdened with it? Because removing it outright would be a PIA for MS and Co. MS would have to distribute updated code for older clients. Many Windows shops would have to update their entire population. I guess MS feels it's too big of a pain for themselves and their customers.

But anyone who runs Windows has to be aware of constant updates and patches. Forcing a change to the client isn't that big of a deal when considering all the updates that come out of Redmond. Still, MS would rather have this glaring security issue remain than inconvenience their customers. Now whose interests do you think the boys in Redmond are protecting? (Hint: Ain't yours (unless your a stockholder...))

Re:Until LM authentication is gone...

[tlhIngan]

Yes, what you say is true, but in order to obtain LM hashes, you must be either a domain admin (for AD retrieval) or a local admin.

Funny. I cracked the administrator password of XP (Pro, on a domain, with encrypted hashes), *without* admin access (that was the reason I cracked it - I needed admin access!).

What I did, was boot Knoppix, and copy over the SYSTEM and SAM registry hives. Most apps will crack with just the SAM hive. However, the SYSTEM hive contains the encryption key to the SAM hive, and a little app known as SAMinside (another l0phtcrack app), *does* understand how to crack this more secure hash.

Heck, there was a way to do it, so you could get the hashes, import them into l0phtcrack and use it to crack.

All it took were a couple of demo/shareware apps (l0phtcrack, SAMinside), and a Knoppix CD (to get at SAM and SYSTEM hives, via NTFS driver). And a 3rd party machine.

And no, none of those apps would work on the machine in question - locked down. I cracked it on my own Win2k machine.

Re:Until LM authentication is gone...

[ultranova]

Until telnetd is totally removed (not just turned off) from Linux, Linux will not be secure. There are just too many exploits involving telnet to take Linux seriously.

Please explain how a non-running telnetd binary, which is just lying in the disk (and not run by inetd or whatever), insecures Linux ?

Re:Until LM authentication is gone...

[Vancorps]

MS already has released new code for older clients. When you switch Windows into native mode you do effectively shut off LanManager.

In the past the hash was still stored, that was because you only disabled the service rather than the component which has a few services associated with it. You can also shut off LM hashing in the local security policy or domain security policy.

As far as updates, I'm not sure of your point, considering the linux platform also has daily updates.

Might also be worth mentioning that 98 and below are no longer supported by MS hense the willingness to cut them out of accessing Windows 2003 boxes which was previously unheard of.

Of course, if they'd have stopped with the whole AD thing and licensed NDS from Novell none of this would be an issue. Even NDS has its issues but they can be dealt with far more easily.

Re:Until LM authentication is gone...

[pegr]

As far as updates, I'm not sure of your point, considering the linux platform also has daily updates.

I think the day is coming whereby LM hashes are no longer supported, period. I just think that day should have been five years ago.

Of course, if they'd have stopped with the whole AD thing and licensed NDS from Novell none of this would be an issue. Even NDS has its issues but they can be dealt with far more easily.

Amen, brother! Unfortunately, they were not interested in doing what was technically superior. They wanted Novell... Dead, that is. Doesn't quite serve the consumer, now, does it...

Re:Until LM authentication is gone...

[Anonymous Coward]

So I guess you suggest we use nis and nfs so that any shitbird can su to root on his local box then su to any user he feels like. Now that's high security baby. You don't even have to do anything undocumented.

Re:Until LM authentication is gone...

[God! Awful 2]

"Until telnetd is totally removed (not just turned off) from Linux, Linux will not be secure."

So you're saying Linux is secure? Good. You see, it's been a few years since telnetd was installed in a base Linux install. I'd say that qualifies as "totally removed".

Setting aside, for the moment, whether the original statement has any merit, I just want to know... how does a poster get modded up to +4 insightful for concluding that if A=>B then B=>A?

-a

Re:Until LM authentication is gone...

[richie2000]

Well, I did claim that B was true. But I agree, I should have gotten a few +1 Informative and a -1 Fucking Obvious instead. ;-)

Re:Until LM authentication is gone...

[ColaMan]

Hmm , I've got a little bootCD put out by someone that does that as well - insert CD, boot a small rescue linux distro, it runs a little program that does ,er, some funky stuff with the hives that clears the admin password (you are also given the option just to change it...never really worked for me), reboot and away you go.

Of course, it's all marked "super-experimental-may-trash-your-system" ... but it's worked for me the half-a-dozen times I've needed it.

Re:Until LM authentication is gone...

[x0n]

Ah come on, don't be silly. Of course physical access supercedes all other points; that's hardly the issue. Perhaps I should have qualified my point better. Additionally, if SYSKEY has been run against the SAM, this makes this kind of attack orders of magnitude more time consuming, but I think this is enabled by default these days (post NT4).

- Oisin

Re:Until LM authentication is gone...

[robertjw]

You see, it's been a few years since telnetd was installed in a base Linux install.

Slackware, as of 9.1, still installed telnetd. It isn't ENABLED by default, but it's there. I wouldn't install a Linux distro that didn't have it.

Re:Until LM authentication is gone...

[Darren Winsper]

Not really, since I'm just hazarding a guess at his reasoning.

Missing Stats?

[BearJ]

Ok, from my read of the article everything is roughly equally insecure, give or take. Question then becomes, how quickly are these problems responded to. Surely Microsoft as the largest company out there would be the quickest right?

right?

Re:Missing Stats?

[stratjakt]

They really do respond quickly, usually the first time I hear of a new exploit is when automatic update prompts me to download and isntall it. Usually a few days before it's posted on Slashdot for the second time.

You can't compare to the OSS project directly. You have to compare to the distro. How long does it take for patched fixed code to be available by an emerge or apt-get? I know the OSS community is pretty good too.

Frankly though, typing emerge -u samba (if say, it was a samba bug) takes about 6 months to complete on some of my less capable machines.

I'm called a troll, and will be modded down again. But the plain truth is there is no perfect OS out there. Windows isn't perfect, linux isn't perfect, BSD isn't perfect, BeOS isn't perfect, OSX isn't perfect, Solaris isn't perfect.. Etc, etc.

I tire of all the idiocy around OS's bandied about on slashdot. For a "news for nerds" site, people here sure don't know what the fuck they're talking about. It blows my mind how little they know about computers or the industry at times.

Oh well.

All modern OS's suck from a security standpoint. Why? Because we've only really GIVEN A FUCK about security for the last half a decade or so. Before that 99% of the worlds PCs were by themselves on a desk, or on some small 10mbit lan with a couple others.

When a virus hit, it'd spread like wildfire across the sneakernet.

Noone worried about remote exploits, because there was no "remote", for the most part. Now, in the age of the internet, it's a big deal. But everyone's still learning. Hell, the internet began with completely insecure protocols (http, ftp, smtp, telnet). Our security was basically mutual trust and good faith.

Anyways, the end.

Re:Missing Stats?

[radicalskeptic]

The stats don't make sense to me. Here's what I see:

Windows XP Professional saw 46 advisories in 2003-2004, with 48% of vulnerabilities allowing remote attacks and 46% enabling system access, Secunia said.

So that would mean, multiplying 46 by 48% would give you the number of remote attacks, and multiplying 46 by 46% would give you the number of attacks enabling system access. So for Windows:

• 22.08 remote attacks.
• 21.16 system access attacks.

Don't ask me why they are not integers. I suppose that some advisorys covered more than one bug?

Now, for OS X:Of the 36 advisories issued in 2003-2004, 61% could be exploited across the internet and 32% enabled attackers to take over the system.

Using the same system as before, I got:

• 21.96 remote attacks.
• 11.52 system access attacks.

So they're saying OS X allows HALF of the number of attacks that can gain access to a system as XP, but their conclusion is that "The myth that Mac OS X is secure, for example, has been exposed"???Hmmm....

Re:Missing Stats?

[Anonymous Coward]

I'm sure that those numbers are rounded, would you rather it read: Windows XP Professional saw 46 advisories in 2003-2004, with ~47.82% of vulnerabilities allowing remote attacks and ~45.65% enabling system access, Secunia said.

Re:Missing Stats?

[Anonymous Coward]

How about 200 days for a critical security issue? Talk about Microsoft Trusted Computing.

And how do you come up with "equally insecure"? How many viruses/worms have you found for Macs? How many pop-up ad programs can you find on Macs? How many expoits requires access to hardware? The percentage of the remote hacks are exagerrated since to be able to take over a system remotely, it needs a local access first. Secunia mentioned articles that pointed to the announcements of Apple fixing a bug and counted them as exploits. Secunia is Microsoft's whore, much like @Stake.

Look at the actual performance: Microsoft patches failed to patch or undid the previous patch. It ships softwares with open ports unnecessarily. It allows automatic executions of apps, etc. I truly perplexed that you can say equally insecure.

Re:Missing Stats?

[Anonymous Coward]

Dude, they probably rounded the percenatge points. They aren't going to say 47.9667%, they're just going to round up and say 48.

Take the blue pill man.

Re:Missing Stats?

[Anonymous Coward]

Probably.

However,
"Of the 36 advisories issued in 2003-2004, 61% could be exploited across the internet and 32% enabled attackers to take over the system."

11 / 36 = ~31%
12 / 36 = ~33%

I think I can find it in my heart to forgive them, though.

Re:Missing Stats?

[goatpunch]

Windows XP Professional saw 46 advisories in 2003-2004, with 48% of vulnerabilities allowing remote attacks and 46% enabling system access, Secunia said.

So that would mean, multiplying 46 by 48% would give you the number of remote attacks, and multiplying 46 by 46% would give you the number of attacks enabling system access. So for Windows:

• 22.08 remote attacks.
• 21.16 system access attacks.

Don't ask me why they are not integers. I suppose that some advisorys covered more than one bug?

They're close to, but not exactly, integers because the percentages have been rounded off- 47.82608695652...% is less useful to the reader than 48%

Re:Missing Stats?

[zhiwenchong]

I think it's just a case of their phrasing being misleading.

I believe they mean that
1) Windows is not as insecure as YOU THINK
2) Mac OS X is not as secure as YOU THINK (they assume Mac OS X users think that the operating system has 0 to few exploits)

They're not really saying that Windows is more secure than Mac OS X. But the way the said it -- well, sure could mislead a lot of people.

Re:Missing Stats?

[Anonymous Coward]

Ok, from my read of the article everything is roughly equally insecure, give or take. Question then becomes, how quickly are these problems responded to. Surely Microsoft as the largest company out there would be the quickest right?

Did you really read the article?

A recent Forrester Research study compared Windows and Linux supplier response times on security flaws and was heavily criticised for its conclusion that Linux suppliers took longer to release patches. Linux suppliers attach more weight to more critical flaws, leaving unimportant bugs for later patching, something the study failed to factor in, according to Linux companies.

Sheesh.

Re:Missing Stats?

[Phragmen-Lindelof]

"Frankly though, typing emerge -u samba (if say, it was a samba bug) takes about 6 months to complete on some of my less capable machines."
I always wondered where those C-64s went.

I am using an old machine (slow COMPAQ iPAQ - paid $60 for it last year) and decided to see how slow is portage. I have not been keeping this machine current so I decided to update portage ("emerge portage"). Let me check ... all done. (Took 1 or 2 minutes; I was not paying attention (different session (?) - F1 vs. F7).) Now let me try "emerge -u world" and see what happens. I do not use samba but, if it will make you happy, I will "emerge samba" after that and see if it takes 6 months. I'll report back on the (approximate) time required.

"They really do respond quickly, usually the first time I hear of a new exploit is when automatic update prompts me to download and isntall it. Usually a few days before it's posted on Slashdot for the second time."
Let me be honest; from your previous posts I think there is a possibility that you are a MS employee trying to make XP look good. I may be completely wrong (or not). Anyway, it is hard to take you seriously. I think we all know about bugs MS was told about and did nothing about for months (or longer). This is not to say that your statement is wrong; if you do not pay attention or MS keeps security hole secret, "... usually the first time I hear of a new exploit is when automatic update prompts me to download and isntall it ..." is probably true. However, this does not mean that the hole had not existed for a long time.

Anyway, I will reply to this note with times for emerge world and emerge samba (unless there is some issue with samba (for which I have no use and will emerge simply as an exercise) I am forgetting) when I have them. Cheers.

Re:Missing Stats?

[richie2000]

Why? Because we've only really GIVEN A FUCK about security for the last half a decade or so. Before that 99% of the worlds PCs were by themselves on a desk, or on some small 10mbit lan with a couple others.

I'm really tired of idiots on Slashdot that have no clue what the fuck they're talking about. Half a decade. Ptoii! I can start by going back 15 years and easily debunk your lies. At that time, most computers in this here world (disclaimer, I have no idea which world you're from - but you should phone home coz' your green-skinned momma is worried about you) were either in universities or corporations. I'm not counting the C= 64s, Atari ][ and Colecovisions here, kay? They have no bearing on the current crop of operating systems. UNIX does. VMS does. Access control and security were big back then - simply because schools with thousands of students had one 64k line to the world (for mail, ftp, gopher, archie and telnet) and diskspace measured in megs so there had to be ways to keep the students from eating it all up. They had to be kept from use the mainframes to play Nethack, to download ASCII pr0n and to chat on IRC instead of studying. Quotas, passwords, password policies, shadowing, encryption - all that jazz. It's not new. It's been around several decades. Half a decade... Maybe Microsoft haven't cared for it more than half a decade, but the world does not revolve around Redmond.

Security is not new. The problem is that Microsoft built DOS for single-user. It had no real security layer and that carried over into Windows 3.11, Windows 95 and all the way into ME. They had to preserve backwards compatibility, see? They had to maintain their monopoly and they could not let little things like end-user security get in the way of that goal.

Meanwhile, all the OSes that came from multi-user roots had a lot of that already built-in. They were network operating systems, built from a network-centric point of view. It wasn't tacked on afterwards like the TCP/IP stack for Windows 3.11. Remember that? It was a separate download.

Half a decade, my ass The Internet has been around and popularized by the WWW much longer than that. I've been building websites since 1995, kiddo. Were you even born back then? I used to log in remotely to SunView terminals and run the WhenHarryMetSally.aiff on my classmates' computers at full volume, that's a remote exploit if ever there was one! The Morris worm. Say no more, Squire!

And what delusional script kidde MS astroturfers modded your crappy rant Insightful, we'll never know. Hell, I was ranting on the 'net in 1990! You'd think the art would have evolved since then...

Re:Missing Stats?

[CdBee]

+5 Insightful just isn't enough for this post.....
We demand Genius Modifier!

Re:Missing Stats?

[LostCluster]

Security is in some ways a binary state. Your OS only needs to have one flaw capable of giving remote root, and you're insecure. The other security flaws are just extras that make it harder to get back to secure when patching things up... so long as there's one way to get total control, you can be 0wned and the rest just doesn't matter at that point.

Re:Missing Stats?

[Anonymous Coward]

I'm called a troll, and will be modded down again. But the plain truth is there is no perfect OS out there. Windows isn't perfect, linux isn't perfect, BSD isn't perfect, BeOS isn't perfect, OSX isn't perfect, Solaris isn't perfect.. Etc, etc.

Except, of course, that Windows is a gaping hole the size of an tractor-trailer truck.

Re:Missing Stats?

[jonastullus]

You can't compare to the OSS project directly. You have to compare to the distro.
Windows isn't perfect, linux isn't perfect, BSD isn't perfect, BeOS isn't perfect, OSX isn't perfect, Solaris isn't perfect.. Etc, etc.

"distributions"/systems like *BSD rely much less on binary distribution (i.e. only the core system is really shipped in binary) whereas most of the programs are installed from source (with pkgsrc/ the ports system) and it is thus very easy to just "update" one program which in turn will fetch the latest version from the DEVELOPER (sic!) and therefore for additional packages the overhead due to the "distribution" is very small!

Re:Missing Stats?

[burnin1965]

And simply reading the article is exactly what this Microsoft shill is expecting everyone to do.

This may be asking alot, but I'd like everyone to dig a little deeper and actual go to the secunia.com website and poke around at the statistics yourself. What you will find is that the guy who wrote this article is either too damned lazy to fully research his topic or he is intentionally using these statistics inaccurately in order to prove a false point.

For those who don't have the time to find out for themselves what the statistics REALLY say, here is what I found:

In the secunia.com statistics for Windows XP there is only a single exploit related to Internet Explorer. That sounds pretty good but its also blatantly false.

In fact, if you dig a little deeper into the statistics on their web site you discover that Internet Explorer 6 from 2003 to 2004 had 40 advisories by itself with 98% allowing remote attack and 31% enabling system access.

secunia.com/product/11/

So taking into account all the IE vulnerabilities instead of grouping them into one advisory we suddenly discover that Microsoft Windows XP Proffessional had 86 advisories from 2003 to 2004 with 71% allowing remote attacks and 38% enabling system access!

Now some will say "not fair" because IE is a seperate application. All I can tell you is that if you actually looked at the statistics you would already know that the OSX and linux statistics include security advisories for ALL applications included in with the OS. So it is only fair to also include ALL Windows applications that come with Windows.

So in conclusion, when I include the vulnerabilities of just one single Windows application the number of exploits in Windows is around double what you have with the likes of OSX or linux. I suspect that including other Windows applications that were excluded from the Windows statistics everyone will begin to understand why Windows is a haven for worms and viruses.

I don't think I will be migrating from my Mac OSX and linux installs any time soon.

burnin

Re:Missing Stats?

[finkployd]

They really do respond quickly, usually the first time I hear of a new exploit is when automatic update prompts me to download and isntall it. Usually a few days before it's posted on Slashdot for the second time.

From your perspective, yes they respond quickly. Join a few security mailing lists and hang out with security people and you will see just how long it takes them to fix exploits that some people (perhaps not you or slashdot) know about. Believe me, the crackers and script kiddies are not relying on slashdot to let them know about 0day exploits.

Finkployd

Re:Missing Stats?

[maximilln]

See... I just mangle entries for security databases and I knew this. Kudos to you for actually taking the time out to prove it for the record.

Re:Missing Stats?

[Anonymous Coward]

The post is neither insightful nor genius. The poster could not even figure out that the author rounded the percentage points. But, this is Slashdot ... bash Microsoft, get a carrot.

Re:Missing Stats?

[sunwukong]

I'd like to add another moderation category: grumpy old man. ;-)

Of course, I'm as guilty too ...

Re:Missing Stats?

[Professor S. Brown]

Theres also stats like how many are exploitable in a default install and how many require services to be enabled. Also, it should be noted that the vast majority of OSX (and probably *nix) 'advisories' counted in the statistics are actually fucking [b]Apple posted security updates[/b]. It would be interesting to see what percentag of the MS advisories are fixed issues.

Re:Missing Stats?

[Rinikusu]

Actually, for millions and millions of people, the C-64's, Amiga's, Atari ST's, MacOS, and Desktop PC's are where people learned the whole "trade" of "computing". A world that did not involve multiple users, security patches, etc. We were online and were wary of virii (from warez, of course), but we weren't worried that someone would come along and, uh, "reverse hack" our machines. You say that UNIX and VMS were what "really counted", I say horse pockey because most users never had access (and still don't). We learned our "admin" skills playing around with C64's. (In other words, we didn't learn ANY admin skills) Lots of bad habits cropped up and for many of us, those "bad habits" are still habits. Add to that that some of your precious "modernity" features, such as multiple users, are absolutely useless for many of us (I could add accounts for my cats, but I seriously doubt they would use them) that many of "you" take to be the holy-grail of a modern OS. Having to log into my own machine is rather stupid, IMO, as my home machine is at home, not at work where it makes more sense. Why are we pushing research/business paradigms into the HOME computing experience? I suppose it's cheaper to develop ONE OS rather than two, but it's still annoying.

Re:Missing Stats?

[fermion]

Beyond the number of security alerts, one has to look at default setup and the time available to apply updates. MS does release patches quikcly, but that has not been a issue for A Long Time.

The traditional default setup of Windows is insecure. The new service pack will make the defualt setup secure, but will make IE and Outlook incompatable with legacy web apps. The decision to make IE insecure was surely a decision to put commercial interest ahead of consumer safety. MS has been forced to change, but it is not clear that consumers will follow. All it will take is a fraction of percent of users disabling the safegaurds to make the whole thing useless.

Also, most patches need to be installed immidiately. This is the biggest problem. MS always complains taht they released the patch a month ago and blame users. However, it is silly to assume that 100% of the users will ever install all patches. The math models tell us this will never be so, and complaining about is just another sign of math illiteracy. The percent that has unpatched machines are deadly.

So we must ask why everyone uses a machine that must be fixed immidiately or cause damage. This is what is called bad engineering. We should not accept such behavior from what should be a mature and commodity product.

Re:Missing Stats?

[argent]

It doesn't really make sense to bother counting system access attacks separately on Windows, because unless you lock the system down to the point where it's basically a kiosk there's no way to prevent the user getting system level access. The only statistic you need to worry about is remote user access, everything else is a given.

For example, if you want to allow the user to release and renew their DHCP lease (which is an essential troubleshooting step for any problems involving IP address problems in a dynamic address environment) you have to give the user the right to load device drivers. Which can be boosted to system level access.

Since access is associated only with the user... there's no setuid mechanism that allows a program to be run by the user but with elevated privileges... any code run by the user has that right, and thus any remote or local exploit really has to be treated as a root exploit.

On any UNIX based system, the same operation can be controlled by the setuid mechanism, which isn't perfect but *does* allow more separation of privilege than exists in Windows. And Mac OS X makes extensive use of it... every time you enter your password to allow access to a system function you're using setuid.

So those stats are really:

XP: 22 remote access attacks, 43 system access attacks.
OSX: 22 remote access attacks, 12 system access attacks.

Also, OS X ships with all remote access turned off by default, including remote file system and shell. You have to explicitly enable it. XP ships open to the world, you have to close it, and there's things you *can't* close without setting up a firewall.

So the statistics look more like this:

XP: 22 remote access attacks, some open by default, all leading to system access.
OSX: 22 remote access attacks, none open by default, no remote system access attacks open by default.

Here's the statistic that I'm concerned about:

There has been one significant browser-based hole on OS X. In the same time there have been multiple exploited holes in IE, including almost the same hole that was found in Safari, and after almost 10 years of similar browser-based holes being found on a regular basis with Microsoft making no attempt whatsoever to fix the underlying design flaw that makes them inevitable.

Hopefully Apple will respond better than Microsoft.

Re:Missing Stats?

[eofpi]

The problem is, that would necessitate and angst-ridden teenager category.

On second thought...that could be quite useful for ignoring.

Re:Missing Stats?

[Zirtix]

... the TCP/IP stack for Windows 3.11. Remember that? It was a separate download

Eh? Am I missing something? TCP/IP for Windows! Download it here! Over TCP! ...

Re:Missing Stats?

[Anonymous Coward]

"and diskspace measured in megs so there had to be ways to keep the students from eating it all up. "

hmmm... except for TOPS-20 where a recursive batch job could
have an output log exceed the quota and take up all remaining
space on the system disks.

Re:Missing Stats?

[Anonymous Coward]

Now some will say "not fair" because IE is a seperate application.

Didn't Microsoft swear under oath that it was not a separate application, but was instead an integral part of the OS?

Re:Missing Stats?

[gnuman99]

The problem problem with the statistics is that they do not deal with "Linux, the kernel", or "Apache, the web server", or ISS or whatever. They just state that there is a percent of all apps on these platforms that is broken. Well, hello???!!

The problem with Windows is that it is impossible to micromanage the OS. Under Linux, you can do that quite easily (I hope most distributions, though I'm a Debian user myself). Frankly, a hole in Postgres or wftpd or telnetd does not affect me, yet it can be part of Secunia statistics. A similar hole in IE can affect a lot more people, even if they use a different browser because IE cannot be removed.

You cannot compare the pure number of holes in Red Hat's distribution and MS core OS. It's like comparing countries to cities! There is a lot more in one than the other.

Re:Missing Stats?

[1010011010]

If you want to allow the user to release and renew their DHCP lease you have to give the user the right to load device drivers.

Whhaaa? That's pretty dumb, if true. Idiotic.

Re:Missing Stats?

[Anonymous Coward]

Since access is associated only with the user... there's no setuid mechanism that allows a program to be run by the user but with elevated privileges... any code run by the user has that right, and thus any remote or local exploit really has to be treated as a root exploit.

You mean kinda like the RunAs service, which you can access by doing shift-rightclick on an executable and picking Run As... ?

Re:Missing Stats?

[HBI]

Frankly though, typing emerge -u samba (if say, it was a samba bug) takes about 6 months to complete on some of my less capable machines.

I recommend distcc for you. It doesn't work real well with Samba, but just about everything else it speeds up compilations to near-"I don't care" ranges by using all your systems to compile stuff. I have 4 systems rigged up with it.

Re:Missing Stats?

[ThousandStars]

I've never even heard of a worm or virus that exploits OS X. That doesn't mean a theoretical attack or security vulnerability; that means an actual break. Care to name one, and provide a link?

At the university I attend, I've never heard of any OS X user with a virus or worm, but only perhaps a quarter of Windows users make the same claim.

Re:Missing Stats?

[ThousandStars]

Although it's somewhat off-topic, I saw that your sig says "helping people with MS lead a better life." I figured the MS meant Microsoft, and I was surprised when I followed the link.

Re:Missing Stats?

[Guitarzan]

You betcha.

Security IS a binary state. This state is false.

Re:Missing Stats?

[jesser]

What was the hole in Safari? Was Mozilla vulnerable to the same hole?

Re:Missing Stats?

[gilroy]

Blockquoth the poster:

Don't ask me why they are not integers. I suppose that some advisorys covered more than one bug?

Or, perhaps, they rounded the percentages before publication.

22/46 = 0.47826 --: 48%

21/46 = 0.456527 --: 46%

Re:Missing Stats?

[sp0rk173]

I don't think he actually uses Gentoo. He might...but I doubt it highly. That being said, I doubt he cares.

Re:Missing Stats?

[argent]

Apple has followed Microsoft into he "merge the desktop and the browser" trap.

This means that protocols and helper apps that the desktop uses are also available to the browser, with various "hardening" done to try and keep you from neing able to (for example) creatse a "sh://rm -rf /" style URL. This is of course daft.

Any application that uses LaunchServices (on Mac OS X) or the HTML control (on Windows) is susceptible. On OSX there is at least some intention that apps should be hardened if they register in LaunchSrevices, but still there's stuff you wantto be able to use from the desktop (like help:) that you would never need to use in a browser.

In any event, it turned out you could use "help:" to trick the help viewer into running a shell command.

Ironically, the same thing ahppened with the CHM hole in Microsoft's help viewer the same month.

Either way, it's a broken design and I hopeApple fixed it faster than Microsoft (ten years, almost, and they're still doing it).

Re:Missing Stats?

[robochan]

I there a mod for +5 pwn3d?

Re:Missing Stats?

[Anonymous Coward]

You can't add the remote access and system exploits for XP and get 43 because some of the exploits counted as both.

Re:Missing Stats?

[SiR_CharLZ]

So many angry people on Slashdot. Is this how everybody talks to other people when they are not in front of a keyboard?

Re:Missing Stats?

[gilroy]

Blockquoth the poster:

usually the first time I hear of a new exploit is when automatic update prompts me to download and isntall it.

Your choice of antecedent and pronoun seems to be "exploit" and "it". Are you saying that Microsoft has decided to skip the middleman and just start sending exploits directely to the end user? Isn't there any market they won't subvert? :)

Re:Missing Stats?

[jesser]

I wouldn't call that a hole in Safari, since it affected Mozilla too (bmo 243699). It was a hole in the OS. Mozilla now disallows links to help: URLs to work around that hole, btw.

Re:Missing Stats?

[Anonymous Coward]

Finally a statistician in the audience :)

Re:Missing Stats?

[zangdesign]

Hell, I was ranting on the 'net in 1990! You'd think the art would have evolved since then...

You left out: get off my lawn, you damn kids!

Re:Missing Stats?

[macdaddy]

From what I've read on almost every critical bug/hole found in Windows in the past is that the entity that found the problem and reported it to Microsoft did so up to a year before the fix was released. I once saw a table on a website of all the known bugs/holes/sploits in either Windows or IE, if they were patched, and when. I forget where I saw that table though. IT showed dozens of critical problems that had yet to be addressed. If anyone happens to remember such a table please add the link to this thread. Just because the first you hear of a problem is when the fix is released doesn't mean that those that mean you (or others) harm hadn't heard about it months prior.

Re:Missing Stats?

[macdaddy]

Computer Weekly computed their stats with the new fangled MSMath v1.0. It has a few bugs that should be fixed by version MSMath v2010.

Re:Missing Stats?

[richie2000]

You left out: get off my lawn, you damn kids!

Oh, yeah, thanks. I guess the Alzheimer's finally getting to me.

Get off my Internet, you damn script kiddies!

;-)

Re:Missing Stats?

[argent]

Fair enough, but I wouldn't call it just a hole in LaunchServices, it's a design flaw: there needs to be a separate set of LaunchServices style bindings for trusted sources (for example, applications using them to launch the help viewer, you might as well trust those apps because they're already executing native code :) ), and for untrusted ones (there's no reason why a web page would even need to call help:).

And some protocols or file types may even benefit from different helper applications depending on the context: structured office documents, for example, might have a 'viewer' application like Word Viewer on Windows.

Re:Missing Stats?

[richie2000]

I figured the MS meant Microsoft, and I was surprised when I followed the link.

Yeah, I figured that since BillG launched that whole Digital Nervous System campaign (stealing an acronym in the process) and MS is a disease afflicting the nervous system...

Well, connecting the dots is left as an exercise for the regular Slashdotter. :-)

Re:Missing Stats?

[jasonbw]

i also found it odd that they counted every iteration of windows (and IE 5, 5,5 and 6) separately, yet theres one single entry for OSX.

Re:Missing Stats?

[Theatetus]

You mean kinda like the RunAs service, which you can access by doing shift-rightclick on an executable and picking Run As... ?

No. For a comparison of the concepts, get to a Linux shell somewhere and compare "man su" to "man 2 setuid" (setuid is a system call, not a program itself).

Windows implements something very much like "su", the "runas" command (on a Windows command prompt, "runas /?" for usage). This runs the requested application as another user. It also requires knowing the other user's password (I seem to recall you need to know the password even for a privilege downgrade, but I could well be wrong about that bit). So, the ability to runas (or su) implies root/Administrator access to the system in question, since you must have that password to do it.

OTOH, POSIX systems also implement setuid, which allows a processes's effective userid and groupid to be changed. A famous example of this is sudo, where root can allow certain programs normally requiring root access to be run by non privileged users. To my knowledge Windows has no such facility: if I want to schedule a task requiring Administrator access, I must save the Administrator password in whatever Windows calls its cron table -- but more to the point, I must know it in the first place. If I can do anything privileged on a Windows machine, I can do everything privileged.

Allowing a true sudo/setuid would be a HUGE step towards securing Windows -- in my opinion it's the biggest step Microsoft should take if they want Windows to be a serious choice for the corporate desktop. I know AD Group Policies allow control almost as fine-grained as setuid and setgid, but this still leaves several problems:

1. Not every Windows install is part of an Active Directory
2. Correct local security configuration should not depend on the network's LDAP service
3. Group Policy is in my experience brittle and prone to difficult-to-trace bugs

Re:Missing Stats?

[richie2000]

We learned our "admin" skills playing around with C64's.

So did I. But I contend that most people can differentiate between what was basically a multifunction games console with a command line and a networked computer (yes, I know that there are network cards for the C=64 now). Especially people responsible for designing and implementing security solutions into operating systems. Please remember that this discussion did not center around end-users, but rather how operating systems are designed - with security in mind or not. I would sincerely hope that no one coding a modern OS kernel has retained those bad habits you speak of. The grumpy old gits (like me) got an education at a university or similar institution of learning where we were exposed to multi-user systems from the onset and the younger ones has grown up with the Internet, learning to ph34r remote exploits.

The ones that grew up with C= 64s, managed to avoid educational facilities, ignored learning from the Internet these last 20 years and still go on to writing operating system code today should thankfully be very, very few.

Why are we pushing research/business paradigms into the HOME computing experience?

Because it is very valuable for my gf to be able to have her own desktop, her own browser bookmarks and her own e-mail login clearly separated from mine. This may come as a shock to many Slashdotters, but most homes do not consist of a male geek in the basement and a set of clueless parents above; but rather a man, woman, 2.4 children and/or a cat/dog/pet halibut named Eric. All of them want their own login.

I suppose it's cheaper to develop ONE OS rather than two, but it's still annoying.

Tell that to Microsoft. They have separated their Windows line ever since Windows 95 and NT 3.5 AS. 98/NT4, ME/2000 Pro, XP Home/Professional and now that First Smoke Reduced Edition. Not to mention the embedded and pocket versions and all the different servers; Advanced Server, Server, DataCenter Edition, Terminal Server Edition, Enterprise Edition Server and Internet Virus Server with Extra Buttfuck Edition... Hell, there are almost more Windows versions than Linux distros, and those a just a few hundred fewer than all the grains of sand in the Sahara desert.

OK, I made up that last server as I went along, but you gotta admit that it can't be very far off. ;-)

Re:Missing Stats?

[richie2000]

Well, let me just hack into SlashCode (lokkie here, CmdrTacos password is 'pencil', same as BillG's), edit a few lines right about here... And there you go. All done.

'course, you still can't mod and post in the same discussion, so you just have to wait before you can use it. But thanks anyway. ;-)

Re:Missing Stats?

[richie2000]

Nah, I'm cool now. But thanks for your concern. :-)

Re:Missing Stats?

[Phragmen-Lindelof]

Still emerging -u world - so far about 4 hours and 20 minutes (approximately). (I told you it was a slow computer and I was REALLY behind in updating this box. I only use it for slashdot (and web surfing) and to ssh into my office computers.)

Re:Missing Stats?

[ultranova]

Having to log into my own machine is rather stupid, IMO, as my home machine is at home, not at work where it makes more sense. Why are we pushing research/business paradigms into the HOME computing experience?

So that when you next download those warez games you can create a new account, log into that account, and install the game there. Any damage from virii/trojans is contained into that account, meaning that your precious p0rn collection is safe.

Also, most homes contain more than one individual. It is handy to be able to keep your p0rn safe from your 5-year-old little sister's/daughter's eyes, so quick to file things away for asking about later from your mother/wife, or fingers, so quick to write "rm -Rf /" as her very first shell command.

Besides, at least Red Hat 9 can be configured to automatically log into the desktop as a certain user (Main Menu -> System Settings -> Login Screen). As Redhat uses GDM as it's login manager, I'd imagine that almost any Linux system can be similarly configured. Don't know about Windows, but I'd imagine something like that would be possible there too.

Re:Missing Stats?

[Anonymous Coward]

The problem is people run their windows systems under the default "Administrator". Would you run as "root" on linux all the time?

There is a way to "setuid" to root on windows... it's called running a user level account, right clicking on what you want to run, and choosing "Run As". If all windows users ran un user level mode, and just used the admin account to install/config/apply updates, Im sure windows would be a lot more secure (in regards to all the worm infested, spyware infested desktop computers out there).

Re:Missing Stats?

[HeadDown]

Since access is associated only with the user... there's no setuid mechanism that allows a program to be run by the user but with elevated privileges... any code run by the user has that right, and thus any remote or local exploit really has to be treated as a root exploit.

That is only partially true. While I personally don't know a way to assign 'proxy roles' to a program, it is easy enough for an out-of-process com component.

Re:Missing Stats?

[ZiggyM]

Clearly you have completely missed that the article is about SECURITY, not about using multiple accounts so that your cats can use your computer.

Its not about having multiple accounts for multiple "phisical" users. Rather, its about assigning different priviledges to those multiple accounts. That way, your account (a 'user') can have the minimal priviledges, and that gives you some safeguard against a program doing things behind your back. After all, Im sure you have not code-reviewed all the software installed on your computer, to make sure they wont erase a system file or worse.
It even protects you againts accidental program errors, the program does not have to be intentionally malicious, just poorly written.

For example, on my OS X box, I get prompted to log in as 'root' or admin whenever a program tries to access something that is not supposed to. At that point I have a choice to allow access by typing the root password, or not.

So multiple users are actually a MUST for a secure OS, even if it is only used by one phisical person.

Besides, its not like you dont ever have friends that want to borrow your computer to check their email. I have a "BrowseOnly" account that only has priviledges to run the browser. Protects my computer, and hides the pr0n too :)

Re:Missing Stats?

[argent]

Sure, you can do the same thing by creating a service that the program talks to that acts as a proxy, but either way involves creating a new component in the system that sits there like a toad on a log waiting for this particular exception to the Microsoft security model... which is based on rights assigned to users and inherited from or passed around by applications.

This is more or less equivalent to creating (in this example) a new right, call it "Manage DHCP bindings", and assigning it to a user.

You say it's "easy enough", but it's clearly not "easy enough" for Microsoft to do this instead of just say "OK, to do this common task you need to have these esoteric rights, so we have to add these rights to 'Power Users'" until Power Users have enough rights they can boost to System.

This is an old problem in NT. It's not inherently unfixable, but it's a lot of unsexy work that doesn't produce good headlines so I don't expect Microsoft to fix it any time soon.

Re:Missing Stats?

[Anonymous Coward]

but rather a man, woman, 2.4 children and/or a cat/dog/pet halibut named Eric

Thanks for renewing my faith in the conspiracy.

Re:Missing Stats?

[uglyduckling]

most homes do not consist of a male geek in the basement and a set of clueless parents above; but rather a man, woman, 2.4 children and/or a cat/dog/pet halibut named Eric. All of them want their own login

You should think yourself lucky - my halibut demands his own machine.

Re:Missing Stats?

[Anonymous Coward]

No, Microsoft takes their time. For example, they took years to adopt the GUI. Those damn slow pokes. Also, they have taken years to make an OS that, in general, didn't COMPLETELY SUCK. Even now, the inconsistencies in Windows XP far outweigh their claims to have created a semblance of a coherent User Interface. But I digress.....

Re:Missing Stats?

[drsmithy]

They had to preserve backwards compatibility, see? They had to maintain their monopoly and they could not let little things like end-user security get in the way of that goal.

I'd be willing to bet you a large sum of money a much larger proportion of the market care about legacy support than they do about security.

It wasn't tacked on afterwards like the TCP/IP stack for Windows 3.11. Remember that? It was a separate download.

Well that's hardly surprising, given that back in 1992 "the Internet" wasn't exactly a regular dinner table discussion topic.

Re:Missing Stats?

[Rinikusu]

Oh, I do the same thing. I have an OS X machine that automagically "logs" me on (only prompts for security updates and what not), which is, for a single user "secure" machine, about as fair and painless as it's going to get in this evil filled world. It also helps that I have a laptop (iBook), and frankly, no one is going to use it but me.

For my desktop, I use WinXP Pro and I've done something similar to you. I created a main account for myself with full admin rights and a secondary account for 'other people' to use. That account has been used exactly zero times in the past year or so.

I certainly don't do any code review, nor do I expect others to do it for me. I'm just saying multiple users is a bit of OVERKILL for most desktops, albeit a necessity for today's networked computing environment.

Re:Missing Stats?

[Anonymous Coward]

This whole thing is bullshit anyway. Most Linux distros include many times the amount of code that Windows XP does.

Consider:

• SuSE is 7 CDs;
• Fedora/Red Hat is 4;
• Windows XP is only 1

Windows had roughly the same number of vulnerabilities as these much larger codebases. Thus, it would have much a higher RATE of vulnerabilities (i.e., per megabyte). I don't have time, but can anyone else

• compare windows and only the corresponding components in a linux distro;
  
  and/or
  
  
• compare a linux distro and all of Microsoft's software.

You should get something very different from what Secunia did.

Re:Missing Stats?

[Gleef]

Arget asserts:
Apple has followed Microsoft into he "merge the desktop and the browser" trap.

I wouldn't exactly say "followed", Mac Finder has been bluring that line since the 80's.

Re:Missing Stats?

[dcam]

Security is in some ways a binary state.

Excuse me?

Your OS only needs to have one flaw capable of giving remote root, and you're insecure. The other security flaws are just extras that make it harder to get back to secure when patching things up... so long as there's one way to get total control, you can be 0wned and the rest just doesn't matter at that point.

You are never totally secure. Never. So by your argument we are always in the off position. On the other hand if you have 9 out of an available 10 patches, if someone tries one of those exploits you are fine.

Repeat after me, the only secure box is one that is turned off, isn't connected to any interfaces, is encased in concrete and buried 6 feet under. And then only maybe.

You aren't secure if you are fully patched. You aren't secure if you are fully patched and have a firewall, but you are more secure.

There are bugs in all software (including ROM). Some can be exploited to provide unauthorised access.

Re:Missing Stats?

[arminw]

The security of a computer is not only dependent on the OS itself, but also to a large extent to the way the user accounts are set up and managed.

Every OSX computer I set up gets at least three accounts -- one the "Master" user with full access, 2)the normal standard user with NO admin privs and 3)a limited (no password) user named "visitor" who is only allowed to use e-mail, the web and text edit.

This in addition to an external firewall/NAT box makes it a quite secure system, certainly much better than any flavor of Windows. Normal users cannot mess with the system deliberately or by downloading malware. At worst, they can trash their own accounts.

All current flavors of Windows are INHERENTLY less secure than *NIX flavored systems, not matter what the statistics may indicate. If MS would like to make their OS as safe as the *NIX based computers are in actual practice, they could do so, but only at the expense of breaking most programs currently in use. The need of the registry in Windows is one source of much insecurity and instability for example.

Re:Missing Stats?

[GSloop]

No, Forrester was wrong. See this post...
http://slashdot.org/comments.pl?sid=11349 3&cid=961 4144

Re:Missing Stats?

[Zareste]

I wonder if you can mark posts +5 Flaimbate

Re:Missing Stats?

[Bob Davis, Retired]

You say that UNIX and VMS were what "really counted", I say horse pockey because most users never had access (and still don't).

Sure! There are these new-fangled 'Free' OSes such as Linux, BSD, and others around now available to anyone with a computer!

I got my first taste of Linux in 1993. It was free then, and it's still free now.

Re:Missing Stats?

[richie2000]

There are many missing mod options. Maybe someone should write a book? "Slashdot: The Missing Mod Options". I'll talk to O'Reilly about that.

Re:Missing Stats?

[argent]

Mac Finder has been bluring that line since the 80's.

That would be impressive indeed, since the browser hasn't been around since the '80s.

Re:Missing Stats?

[npsimons]

they assume Mac OS X users think that the operating system has 0 to few exploits

Sadly, I've found this to be true. Mac users seem to be so blinded by their zealotry and love of all things Apple that they think that Apple can do no wrong (including having security flaws in their software).

Even though I love Linux, I'll admit it's not perfect, and when I see a complaint about open source software, I generally try to find out if it is valid, then see how it might be fixed. At least in the case of open source software I *can* fix it. I don't have that option with Apple.

Re:Missing Stats?

[Genevish]

At least in the case of open source software I *can* fix it. I don't have that option with Apple.

Why can't you fix it?

http://developer.apple.com/darwin/index.html

Re:Missing Stats?

[Phragmen-Lindelof]

Well, I noticed that "emerge -u world" was finished sometime between noon on Thursday and noon on Friday. So, let's say it took 70-80 hours to complete. This computer is a 500 Mh iPAQ with 128M of RAM. Now onto emerging samba.

Re:Missing Stats?

[Phragmen-Lindelof]

Well, "emerge -u samba" took less than two hours. (I was in the shower and do not know exactly when it finished.)

Re:Missing Stats?

[Phragmen-Lindelof]

Just so you know, "emerge -u samba" took less than two hours on an old COMPAC iPAQ 500Mh computer with 128M of RAM. In order to take 6 months, perhaps a C-64 is too fast?

Follow the money.

[user no. 590291]

I wouldn't be the least bit surprised to find that this "Secunia" derives funding from a common source with SCO.

Re:Follow the money.

[fuzzix]

I wouldn't be the least bit surprised to find that this "Secunia" derives funding from a common source with SCO.

Not true. Secunia is its own private concern and judging from correspondence they have with the inquirer I very much doubt they'll be swayed by "contributions" as easily as our R&D friends at Adti.

That said, there are some omissions from the article such as which applications in the Linux distros were vulnerable and how long it took for each vuln to be patched.

Re:Follow the money.

[jejones]

Not true. Secunia is its own private concern and judging from correspondence they have with the inquirer I very much doubt they'll be swayed by "contributions" as easily as our R&D friends at Adti.

Re:Follow the money.

[jejones]

Not true. Secunia is its own private concern and judging from correspondence they have with the inquirer I very much doubt they'll be swayed by "contributions" as easily as our R&D friends at Adti.

Yeah, but... in TFA, it says "[Secunia's] service, easily accessible on its website, allows enterprises to gather exact information on specific products, by collating advisories from a large number of third-party security firms." To use an old phrase, GIGO. MS doesn't have to influence Secunia if it's influenced the third parties, does it?

(Sorry about the gratuitous post; I tried to stop it, but it looks like I didn't manage to.)

Re:Follow the money.

[harlows_monkeys]

Yeah, but... in TFA, it says "[Secunia's] service, easily accessible on its website, allows enterprises to gather exact information on specific products, by collating advisories from a large number of third-party security firms." To use an old phrase, GIGO. MS doesn't have to influence Secunia if it's influenced the third parties, does it?

You can trivially go to Secunia's site and view their lists of advisories, grouped by product or vendor, and easily check for yourself whether their interpretation of the data is reasonable.

no of vulnerablilities vs actual exploits

[martin]

Would be nice to see how many of these *potential* exploits resulted in actual malware/hackers using them.

Just because the potential is there doesn't mean these holes have exploits running in the wild.

It's a risk thing...Windows exploits are *more* likely to be exploited than Solaris ones, but that doesn't mean the Solaris ones won't be exploited (cf a couple of super computer centers getting hacked!)

Before we all jump on the AdTI bandwagon...

[Xshare]

...and everyone says that Microsoft is paying Secunia to do this, etc. (like with AdTI, though AdTI really is getting funding from MSFT, different story), read this: http://www.linuxinsider.com/story/32370.html
It seems that it was Secunia which released lots of IE bugs, and that Microsoft has had scuffles with them before. Unless someone here has evidence that they got funding from MSFT since then, don't say that.

Re:Before we all jump on the AdTI bandwagon...

[Anonymous Coward]

Who invited you to the party?

Re:Before we all jump on the AdTI bandwagon...

[Anonymous Coward]

Everyone has its price. Perhaps MSFT sent some money their way to, um, redirect the emphasis of its research a little. I agree that without evidence, this can't be proven, but it's certainly plausible.

~~~

Re:Before we all jump on the AdTI bandwagon...

[robogun]

Explain then the FUD from these guys, and why they ignore, in terms of everyday use, why only Windows/IE users can get r00ted by simply browsing a website, and OSX users can't. How come when I re-install Win2K SP# it takes 63 security updates over nine reboots before I can even consider plugging in directly to the net.

This article is so beyond common sense and everyday experience, I cannot see how it can possibly hold up to examination.

Re:Before we all jump on the AdTI bandwagon...

[Xshare]

Also, yet another article about Secunia, very interesting: http://www.internetnews.com/dev-news/print.php/217 0381
It seems they have a very "free as in freedom" view on security, etc.
"We believe that security information should be free, so that administrators can patch their systems and software developers can learn from the mistakes made by others. All the security researchers and experts who posts to Full-Disclosure, VulnWatch and Secunia wants their research to be free and available we owe them that much," Kristensen declared.

Re:Before we all jump on the AdTI bandwagon...

[operagost]

I assume '#' = '3'.

The answer is, you should be installing SP4. SP3 came out almost three years ago. Of course there are security updates missing. And there aren't 63 of them. I don't believe there are even 63 updates of any kind after SP3.

Re:Before we all jump on the AdTI bandwagon...

[GlassUser]

That's usually because the user chooses to install software. That software then runs in the security context of the user. Since most windows users are lazy, they have admin rights on all their accounts. The software then "gains root".

It's a combination of laziness and failing to enact a sensible policy.

Re:Before we all jump on the AdTI bandwagon...

[mj01nir]

But isn't it interesting that now when ever anyone appears to support Microsoft, they're automatically suspect of being a MS sock puppet? Years of string-pulling by Bill and Monkeyboy have put wireheads everywhere on alert. Looks like yet another underhanded tactic is backfiring on them.

Re:Before we all jump on the AdTI bandwagon...

[robogun]

Yep it's SP3. I don't feel like buying another copy of 2000. There are 63 by actual count, a couple weeks ago. There have been two new critical updates since then.

What is strange is when doing this, you finally get down to only 2 or 3 left, which must be installed separately, after the reboot, there are five more. Which tells me some critical security updates must receive their own later security updates. For instance, this latest one is only a partial solution by msft's own admission.

This is with Windows Update via IE. Possibly by manually installing the security updates, the actual count will be less.

Re:Before we all jump on the AdTI bandwagon...

[MoonBuggy]

I'd also take exception with the statement that "The myth that Mac OS X is secure, for example, has been exposed.". Reading the article it seems to show that OSX was infact the most secure, even by their criteria. Why does the fact it is apparently more secure than the competition lead them to say it is not secure? (or have I missed something important here?)

Re:Before we all jump on the AdTI bandwagon...

[Anonymous Coward]

OTOH, one of them is qouted as saying

A product is not necessarily more secure because fewer vulnerabilities are discovered," he added.

Re:Before we all jump on the AdTI bandwagon...

[rufo]

While in general, people are lazy and haven't learned to care about security (I don't really blame anyone about this, there's never been a need to before), I think it's mainly because Microsoft gives you root rights by default, whereas Apple does not.

Seriously... I believe I'm using the same account on my Windows XP box that the installer set up for me. I don't think I've ever had a single permissions issue with editing the registry, installing/uninstalling software, etc. Never been asked for my username/password, outside of logging in. On my Mac, on the other hand, any time I do anything remotely related to modifying the system, up pops a dialog asking for my username and password, and informing me what application is requesting this information.

Now, this dialog isn't anywhere near secure - I think it'd be trivial to put together a fake dialog that looks like it's some other application, but uses the information typed in to its own nefarious advantage. But it does give you the idea that Apple seems to be more concerned about security out of the box.

Re:Before we all jump on the AdTI bandwagon...

[Malc]

Huh? Why would you have to buy another copy of Windows 2000? You install Windows from the CD, you install Service Pack 4 (which is one of those free downloads that you're presumably including in the 63) and go from there. I keep an extracted copy of SP4 handy for these occasions.

Re:Before we all jump on the AdTI bandwagon...

[equiraptor]

why only Windows/IE users can get r00ted by simply browsing a website,

An unpatched OS X system can "get r00ted" by simply browsing to a websight. Safari has an extension association that would allow a page to call the command terminal and run any command desired. Oops, you're rooted. It has been patched, but so have most of the bugs viruses use in Windows.

Re:Before we all jump on the AdTI bandwagon...

[the_flatlander]

Ummmm... I hate to break it to you, but LinuxInsider is not what I'd call, ah, an *impartial* source. I think they work for Billy-boy, too. Really, read the [deleted] articles they publish. Did you see how LinuxInsider treated Ken Brown of AdTI? They "broke" the story that Linus "didn't invent Linux." LinuxInsider seems to have pulled that piece of [deleted], but see this one for an example of their "Fair and Balanced(tm)" reporting style.

The Flatlander

Free Advice: Ignore LinuxInsider as a news source.

Re:Before we all jump on the AdTI bandwagon...

[HiThere]

It's a good point, but the article doesn't seem to justify the conclusions.

I have no knowledge of WHERE they are getting their funding. But they don't seem to have any criteria by which someone besides themselves can judge the security of a system. Saying "Mac security is worse than anyone imagined" is nugatory without saying how bad you think someone had imagined it as being...unless you give some other indication of how bad you think it is. Perhaps they did, and I just didn't understand them. I must admit that I didn't bother to read the article very carefully after the first few wild accusations without immediate proof. Instead I skimmed it looking for proof, which I didn't find.

So perhaps they're just trying to drum up business, but they don't appear to be a group that should be trusted. (But *do* be aware that this may just be the marketer or "journalist" who put this article together.)

Re:Before we all jump on the AdTI bandwagon...

[Anonymous Coward]

How come when I re-install Win2K SP# it takes 63 security updates over nine reboots before I can even consider plugging in directly to the net.

Maybe because the OS is over 4 and half years old? Wouldn't you expect something similar if you installed RedHat 5 or 6? Would you rather have NO updates???

Re:Before we all jump on the AdTI bandwagon...

[Twirlip of the Mists]

Safari has an extension association that would allow a page to call the command terminal and run any command desired. Oops, you're rooted.

Sounds wrong to me. I'm not up on all the lingo, but doesn't "rooted" mean "gained superuser access?" It's not possible to gain superuser access on an out-of-the-box Mac using that trick.

(If you're using "rooted" in the obvious sense, as a synonym for "fucked," then just excuse me for over-analyzing your post.)

Re:Before we all jump on the AdTI bandwagon...

[Have Blue]

You can't get r00ted through that, you can only get "usered". Losing your account is by no means a good thing, but owning the entire computer would require a restricted operation, and that unavoidably pops up a dialog box which the user would hopefully be smart enough to cancel.

(Of course, if it turns out in the future that OS X has any privilege elevation bugs, all bets are off.)

Re:Before we all jump on the AdTI bandwagon...

[excessive]

I don't particularly think that its an unfair or unbalanced article. Its just reporting what Kenneth Brown has said. The headline is "Accusatory Stufy" afterall.

I'd reread the last paragraph, which in particular points out that NT owes a lot to VMS and that the AdTI accepts money from Microsoft (As well as anybody else) but won't reveal how much.

Theres nothing in there that says that they're accusing Linus of anything and they do have quotes from people who disagree with it.

Re:Before we all jump on the AdTI bandwagon...

[Anonymous Coward]

Actually, the exploit just allows arbitrary scripts from executing as the current user. Mac OS X doesn't even enable the root user unless you activate it after installation. So the best any bad scripts could do was really mess things up (delete files, maybe get passwords etc.) for the current user. The system itself would be fine and thus it would not be "r00ted." Just a nitpick..

Re:Before we all jump on the AdTI bandwagon...

[equiraptor]

I was quoting his "get r00ted." And, yeah, I basically meant you're screwed.

Re:Before we all jump on the AdTI bandwagon...

[mindstormpt]

Is it?

I've been using Windows XP with Mozilla (now Firefox), behind a router firewall, but no antivirus or firewall software. For a few years now.

Never had any problems (meaning never caught any virus or been exploited). I just visit windowsupdate every month or so, and know where to click. And once in a while virusscan from another box, or from an internet-based scanner.

Is is that bad?

Re:Before we all jump on the AdTI bandwagon...

[diamondsw]

Oops, you're not, because you're still running under whatever privileges Safari is - you did not just get root access, and the user would be warned at any attempt to gain such privileges.

Nevermind that there are innumerable *worms* on Windows that will be attacking your machine from the moment you plug in an ethernet cable, nevermind surfing to some fictional web site. Go ahead, try building a Windows 2000 or XP system while connected to the internet (to download your patches).

Re:Before we all jump on the AdTI bandwagon...

[robogun]

When needing to do a re-install, since you cannot reinstall SP3 once you've upgraded to SP4, you have to do a new install, then get the critical security updates, and then reinstall apps, or buy an SP4 disc so you can install over the upgraded SP3 install.

I'll try your method, but I think Windows Setup reads the disc title, instead of checking to see which files you have around, before kicking you out of Setup for not having SP4.

Re:Before we all jump on the AdTI bandwagon...

[Anonymous Coward]

How come when I re-install Win2K SP# it takes 63 security updates over nine reboots before I can even consider plugging in directly to the net.

Windows 2000 isn't that new, first of all. So don't expect a service pack to bring you all up to date. But if you are using a relatively new version of Automatic Updates for Windows, then you shouldn't have to reboot that many times. Looks like you are using an old utility (or none at all) to update your system manually.

Re:Before we all jump on the AdTI bandwagon...

[MyDixieWrecked]

You're a little off... You don't get "r00ted" from the safari exploit. Worst case scenario is that it erases every file you have access to (ie- your home folder and applications folder), unless you are logged in as root, in which case, you're a dumbass to begin with...

It could also, possibly preset you with a false admin password dialog, and steal your password, but you could also fake one up with a standard browser window.

Anyway, although the exploit is bad, it only allows execution of code with the privs of the current user.

Re:Before we all jump on the AdTI bandwagon...

[equiraptor]

And the current user on nearly ever Mac system I know is a power user. A power user is capable of doing damage to more than just their own account. It's not the equivalent of UID 0, but it can do some pretty nasty stuff.

Re:Before we all jump on the AdTI bandwagon...

[equiraptor]

And nearly everyone I know who runs OS X runs as a privalidged user. It's not the equivalent of UID 0, but it's more than just a normal user. It can do damage to the entire system. This exploit can do major damage to many OS X systems.

Re:Before we all jump on the AdTI bandwagon...

[rekt]

actually, if that same information (username/password) is the only thing required by the system to acquire root-level powers (e.g. you have complete sudo privileges), then any application which harvests your uname/pw could use it to run any sudo'ed application -- including a root shell. This is definitely "r00ted", not just "usered".

My understanding is that this is the way Mac OS X is set up by default for the first account. So thjs kind of harvesting via a trojan is a real concern. The technique has yet to be exploited publicly that i know of. Of course, it's not a "hole in the OS", strictly speaking, but you need to think about it if yer an OS X admin.

Re:Before we all jump on the AdTI bandwagon...

[Anonymous Coward]

Ummmm... actually no.

Your argument assumes that a keylogger can be
installed by a normal user in OS X. This is NOT the case.

Just to clarify - without root already, it is impossible* to "sniff" the su popup box in OS X to gain root.

* (discounting undiscovered exploit)

Re:Before we all jump on the AdTI bandwagon...

[MyDixieWrecked]

I agree. I was trying to keep from downplaying its severity too much.

Losing /Applications, or all the data on your 250GB external Firewire LaCie drive is pretty bad.

Even before the exploit, I always made sure that safari's "open safe files" checkbox was off, not for security reasons, per se, but rather because I frequently download things that I don't want to look at right away, and can sort through my downloads folder easier when I know what I looked at already (ie- it isn't unstuffed).

the biggest problem with computing today is that everyone wants their computer to do so much, yet are unwilling/unable to learn enough to actually do so. When you have a multi-user system and you don't know how to secure it... to KNOW there's a problem is one thing, but to not know is something completely different. Most people think that as long as they don't transfer their personal data over the internet (ordering online, email, etc), that it's safe. It's not; especially if you don't know jack about how to secure your system. Encryption is worthless if you leave it unlocked all the time (like in one of those encrypted database programs...), and leaving an administrator login session active while you're not physically at the computer is like leaving your home's front door wide open.

Re:Before we all jump on the AdTI bandwagon...

[Anonymous Coward]

Whenever I help someone set up a new MacOSX machine, I always tell them to make the initial user "Administrator", short name "admin", and ignore all the attempts to set you up with an e-mail address. Then the first thing you do is create your real user, log in to it, and set up e-mail as you want it. It really isn't that hard to do, and I don't understand why Apple doesn't do that by default.

What's strange is that if you don't do it this way, and later go to create an admin account, it will not let you create a user ID of "admin" (I guess because it also tries to create a group "admin", which fails because admin is already a group). What's even more interesting is that if you create the admin user during setup, it not only allows it but sets primary group to "staff", so it must be special-cased.

Re:Before we all jump on the AdTI bandwagon...

[Malc]

I never do reinstalls and keep the existing system. Too much of the registry and other things gets blown away. Then again, I've found Win2K not requiring 6 monthly reinstalls like NT4 did (the first install I ever had lasted 3 years until I trashed the start of its partition with grub and dd from Linux). The only time I reinstall without blowing everything away is if I need to recover data, and then I do the install in to a different directory... although that still blows away \Program Files\Common Files. I had a problem doing this under NT4 once and it trashed the newer version of IE. I've never tried it again since under NT4, or Win2K or WinXP or Win 2003 Server.

Re:Before we all jump on the AdTI bandwagon...

[Torne]

You can make your own Windows CD that will install SP4; just take a copy of SP4, and any CD (SP3/2/1, gold, doesn't matter) and slipstream it. http://old.bink.nu/bootcd/ has instructions on how to do this while preserving the bootability of your CD. This can be done with 2000, XP or 2K3 and works with any service pack.

Mac OSX and Linux - face the facts

[Anonymous Coward]

The Mac and Linux communities need to accept the fact that Windows, however much you might HATE Microsoft, is more secure.

How many independent reports have we seen that come to the same conclusion? 10? 20? The head in the sand approach won't work. The "Microsoft Shill" theory doesn't hold water.

No, it is time for the Linux community to address these issues and bring Linux back up to the level of Windows.

And by the way, I'm a cybersecurity consultant, so I know what I'm talking about.

Re:Mac OSX and Linux - face the facts

[mangu]

How many independent reports have we seen that come to the same conclusion?

I once read that Hitler ordered a report made, signed by a hundred scientists, proving that Einstein was wrong. When they asked Einstein about it, he answered "if I was wrong, one scientist alone would be able to prove it".

Re:Mac OSX and Linux - face the facts

[skroz]

"Cybersecurity consultant" huh? The only people I know of that use that title are PHBs looking for catchphrases on resumes, jackasses with A+ certifications that read a book on security once, my boss, and Kevin Mitnick. And I wouldn't let ANY of those people anywhere near a secure system unless they were menacing me with some kind of weapon that I was sure would actually work.

Cyber is an idiot prefix/word for soundbites, the fear mongers at DHS, and William Gibson

Re:Mac OSX and Linux - face the facts

[Anonymous Coward]

And by the way, I'm a cybersecurity consultant, so I know what I'm talking about.

Rule Number One: Never trust anyone with "cyber" in their job title.

Re:Mac OSX and Linux - face the facts

[Anonymous Coward]

Wow, must be something in the air. The moderators actually got the humor of this post and didn't mark it a troll. How often does that happen on /.?

Re:Mac OSX and Linux - face the facts

[julesh]

Cyber is an idiot prefix/word for soundbites, the fear mongers at DHS, and William Gibson

Amen. Now, please tell CERT to stop using it in their advisories. It makes them sound incompetent.

It also doesn't mean what they think it means:

Cybernetics

n. The theoretical study of communication and control processes in biological, mechanical, and electronic systems, especially the comparison of these processes in biological and artificial systems.

[From Greek kubernts, governor, from kubernn, to govern.]

(Source: dictionary.com)

Re:Mac OSX and Linux - face the facts

[HiThere]

I thought it was from the Greek word for steersman on a ship?

Govern would carry approximately the same meaning, but I seem to remember that it was choosen because the original device was about steering artillary shells to their target.

Re:Mac OSX and Linux - face the facts

[jonathanduty]

No, it is time for the Linux community to address these issues and bring Linux back up to the level of Windows. .... .... And by the way, I'm a cybersecurity consultant, so I know what I'm talking about.

I find that usually when people talk like this, they usually have not taken the time to actually learn how a Unix/Linux type system works. They just decide that since it doesn't have pretty gui's and may be a little more complicated and their employer isn't willing to send them to some expensive training, they it must be less secure.

I just got done working in a shop that has both Windows servers (with a full staff of MS certified admins) and linux/unix servers. I can't tell you how many times the windows boxes went down, got viruses, or for some reason or another gave us headaches... however, the Linux boxes just seem to keep humming along, never putting up a fuss. I like actual proof rather than the phrase, "I know what I'm talking about"...

Yes, a unix box can be setup to be less secure... but if you have taken the time to undestand the different parts of unix... then you are educated enough to understand "gee, maybe I shouldn't open up clear-text ftp or telnet over the internet.. someone maybe snifing my passwords, or maybe I shouldn't run this daemon as root."

Expensive software doesn't make systems secure... admins/developers who are willing to learn and make the extra effort does.

Re:Mac OSX and Linux - face the facts

[Anonymous Coward]

So are suggesting we follow the MS example and close the source to Linux (unless you're an active developer) so that only a small fraction of these bugs will ever show up in public advisories?

The closed source appproach is the only way to truly have your head in the sand.

Re:Mac OSX and Linux - face the facts

[Anonymous Coward]

The report doesn't show that Windows is more secure. It just shows that Macs aren't as secure as they are made out to be.

Re:Mac OSX and Linux - face the facts

[Anonymous Coward]

Nope, one wouldn't necessarily be able to do that, but if s/he did it, it would have been enough. The point is, once a theory is proven wrong once, there's no need to do it 99 times more.

Re:Mac OSX and Linux - face the facts

[multiplexo]

And by the way, I'm a cybersecurity consultant, so I know what I'm talking about.

Could we get some corollary to Godwin's law on /., we could call it Multiplexo's law but that's kind of egotistical of me. The law would be that as a thread on /. continues the probability of someone claiming great knowledge of the topic, without providing any proof of such knowledge and while posting as Anonymous Coward will approach unity.

Re:Mac OSX and Linux - face the facts

[ScottGant]

Wrong about what?

General Theory or Special Theory?

If Hitler wanted to prove he was wrong, then why were the Germans trying hard to make an atomic bomb? Did they have some other theory or means to try this other than E=MC^2? I'm not a physics person at all, but it seems to me that the science is all related.

Where did you hear this? Or is this another one of those stories like: "Einstein was a savant and he couldn't tie his own shoes" you hear so much about?

Just wondering.

Re:Mac OSX and Linux - face the facts

[Karellen !-P]

Which means that they day MS gets their sh1t together is the day you start looking for a new career.

Re:Mac OSX and Linux - face the facts

[BorisSkratchunkov]

I simply HATE (nice going with the caps there, eh?) to tell you, but all operating systems are relatively equal when it comes to security. All operating systems conform to industrial standards, and therefore have a common compatibility. Hence, a virus could easily be ported to all platforms with relative ease, and since all platforms have the same basic structure ( having a binary folder, system folder, and an admin) it would relatively easy for a hacker to take the foundation of any operating system and devastate it. This is all thanks to international standards organizations such as ISO, ANSI, and the fact that every modern operating system is somehow based upon *nix (usually through BSD code).

Oh, and by the way, I couldn't care less about your profession. You could be George W. Bush for all I care, and I still wouldn't trust that you "know what" your "talking about". Just because you happen to think that you are correct because you have a job in the field of internet security is wrong. Many others with the same exact job and the same exact field could disagree with your opinion, and you're doing yourself no service by making yourself look like a petty, ignorant ass in front of millions of people. Your opinion is not a fact, and you have no way to back it up; if you desire anyone's respect, show why you believe what you believe, and keep us informed with your views in a knowledgeable way.

P.S. I must say that I use Linux, Mac OS, Mac OS X, and Windows all on a regular basis and that I do not HATE Microsoft (or Micorsoft, as the author of the article that this post originated from would say). In fact, I do not HATE anything, really, I just DETEST some aspects of the world. For example, I DETEST the way that M$ refuses to let any other company compete with its software monopoly (and don't you argue that it isn't a monopoly, because 90% of the consumer market is indeed very overwhelming). Additionally, I DETEST the way that you think that you know everything about internet security just because you chanced upon landing yourself a job in the field of "Cybersecurity Consultation". Anyone in this day in age can get a job in a computer-related field with ease, and it is no big achievement that you managed to hobble into a random personal computing firm, considering the fact that thousands of other people have been able to duplicate this feat.

With that, adieu, and may good fortune and blessings fall upon your head. Of course, this falling is pretty much guaranteed, considering that your ego has probably made your head swell to the size of a watermelon.

Re:Mac OSX and Linux - face the facts

[slagish666]

And by the way, I'm a cybersecurity consultant, so I know what I'm talking about.

Lemme ask a question:

Was this post modded Funny because he said Windows was more secure than Linux, or because he called himself a "cybersecurity consultant," in other words an Internet 'Barney'?

Re:Mac OSX and Linux - face the facts

[gilroy]

Blockquoth the poster:

Hence, a virus could easily be ported to all platforms with relative ease, and since all platforms have the same basic structure ( having a binary folder, system folder, and an admin) it would relatively easy for a hacker to take the foundation of any operating system and devastate it.

Yes. Also, since computers are made of elements commonly occurring on Earth and you are made of elements commonly occurring, it would be relatively easy for a hacker to make the virus affect you! *cue ominous music*

OK, I'm being flippant. But I don't see where the idea that modern OSs share things like the idea of a filesystem renders them easily cross-vulnerable. Although, I suppose, it would offer some justification for that lame virus ending of Independence Day...

Re:Mac OSX and Linux - face the facts

[BorisSkratchunkov]

Yes. Also, since computers are made of elements commonly occurring on Earth and you are made of elements commonly occurring, it would be relatively easy for a hacker to make the virus affect you!

Why not? When ISO and ANSI set standards for biotechnology and cybernetic implants, what is there to stop hackers from killing off entire populations that use goods and services base upon such standards. I can just imagine it now...... Win32.MyKnee.Patella@mm....... OUCH! I think I may already be infected!

Re:Mac OSX and Linux - face the facts

[steve_bryan]

Einstein was designated as wrong by Hitler because he was Jewish and had chosen while quite young to leave Germany (remember he was an employee in the Swiss patent office when his first three famous papers in 1905). Hitler (and others like Philipp Lenard) had a thesis about Jewish science versus Aryan science. It is rather nauseating to read this stuff but it is a part of history. Ironically, if Hitler and his policies had not driven out so many of the best Jewish physicists it seems entirely possible that Germany rather than the US would have had a successful atomic bomb project. Of course, then Hitler would not have been the "Hitler" we recall from history.

Re:Mac OSX and Linux - face the facts

[mosb1000]

That's hardly a reasonable conclusion to reach. There were hardly any Jewish scientists on the Manhattan Project at all. Einstein himself only wrote a statement emphasizing the importance of the project so that it could get funding, none of his theories had any part in it. Einstein developed theories about relativity and quantum mechanics, not nuclear fission. The main reason that Germany never developed the bomb was that Heisenberg himself kept insisting to Hitler that the project was non viable. He actually arranged a meeting with an American scientist during which he showed the scientist a diagram of an atomic bomb in an effort to show that Germany would not develop one. In fact, the german "Bomb" project was actually called the commission on uranium, since their purpose was so ambiguous at the time.

It is likely that the reason Germany never developed the bomb was because Heisenberg thought the bomb was so horrible it should never be built. It's too bad American scientists didn't think the same way, or we might not suffer from the anti-nuclear sentiment which prevents us from using nuclear power today.

Re:Mac OSX and Linux - face the facts

[steve_bryan]

If you don't make the restriction to former German citizens who were Jewish, but leave it as you appear to as "any Jewish scientists on the Manhattan Project at all" I can think of two immediately: Robert Oppenheimer who was the scientist in charge and Richard Feynman who was young but already one of the brightest stars. I think I recall that it was Feynman's work on the implosion technique that was crucial. I just verified that Leo Szilard was a Jewish German physicist who was forced out of Germany in 1933 when Adolf Hitler passed the first anti-Jewish law that stripped "non-Aryan" scientists of their post. Together with Enrico Fermi he achieved the first controlled chain reaction at the University of Chicago.

Hans Bethe had a Jewish mother (she became a Lutheran but I don't know if this would have done any "good" for Hans). Among the eminent scientists forced to flee from Gottingen were Max Born, James Franck, Eugene Wigner, Leo Szilard, Edward Teller, and John von Neumann. I'm not sure how many of them were Jewish but you can't dismiss scientists of this caliber and expect good results.

I think there is reasonable speculation that Heisengerg thought the prospect of an atomic bomb was too horrible because that was what many American scientists thought. Perhaps most notably Oppenheimer who was later treated very poorly as a result of his position and the increasing tension due to the rise of the Soviet Union. Given the military realities of post WWII Europe I think that the case could be made that without the volatile presence of nulear weapons there seems little chance that Soviet military ambitions could have been contained in Europe. Perhaps this doesn't disturb you so much but I don't think there was anything guaranteed about the eventual crumbling of Soviet power.

An interesting story about David Hilbert from {http://www.childrenofthemanhattanproject.org}:

About a year after the great purge of Gottingen he [Hilbert] was seated at a banquet in the place of honor next to Hitler's new Minister of Education, Rust. Rust was unwary enough to ask: "Is it really true, Professor, that your institute suffered so much from the departure of the Jews and their friends?" Hilbert snapped back, as coolly as ever: "Suffered? No, it didn't suffer, Herr Minister. It just doesn't exist any more!"

Re:Mac OSX and Linux - face the facts

[Asprin]

"Cybersecurity consultant" huh? The only people I know of that use that title are PHBs looking for catchphrases on resumes, jackasses with A+ certifications that read a book on security once, my boss, and Kevin Mitnick.

Yeah, just like "rock solid".

How respectable are these guys?

[CaptainPinko]

Does anyone know of this company? Are they another AdTI? Any known connections to SCO or Microsoft? Is it tinfoil hat time or is it time to reconsider our prejuidices about stability and security?

Re:How respectable are these guys?

[maximilln]

Secunia, IMHO, is a respectable security source.

I admonish the following:

Security databases are largely fed with information from people working on open source code. It is much easier to find a logic fault in source code than to notice a bug and reverse engineer its origin in proprietary code. When I mangle entries for security databases the majority are for open source code. By and large the security databases are weighted in such a fashion that makes open source code look less secure.

When I last looked at my Windows Update history on my machine at work, there were no fewer than 10 security patches and, going to the MS website, each one patched several security holes in this/that/the other. None of these will ever be documented in databases like Secunia because MS doesn't release the technical information. Secunia only lists the exploits which users in the field have found and submitted.

So relax, people. The article may be inflammatory and perhaps the head of Secunia should be shoulder-checked for 3 hours straight on the soccer field, but the Linux OS is still outperforming the competition.

Re:How respectable are these guys?

[sr180]

So relax, people. The article may be inflammatory and perhaps the head of Secunia should be shoulder-checked for 3 hours straight on the soccer field,

Thats a bit harsh, making him play 3 hours of soccer?

Re:Debian. Who cares?

[RAMMS EIN]

Actually, I think the next stable release won't be that long now. And Hurd is definitely not going to be ready for all platforms Debian supports by that time.

Hmmm...

[morgdx]

• Lies
• Damn lies
• ....
• Profit!

The leadline makes it sound like XP is more secure than OS X, and then you read down to find its more like that OS X isn't much more secure than XP.

Now if the comparison included the length of time that exploits were left unpatched we would get an entirely different picture...

Re:Hmmm...

[jdb8167]

The length of time from discovery to the release of the patch is not the only important statistic, it is also important to study the percentage of the patches successfully deployed.

Apple has Software Update on by default and set to check weekly. The vast majority of OS X users update within a week of a patch being deployed. This is NOT the case on any version of Windows. Apple has a reputation of successful patches that, in general, don't screw up your system. Microsoft is far less successful in that department.

There is also more to security than how many reports of security holes are submitted. I won't claim Secunia have any agenda other than self aggrandizement but these "statistics" really don't show the security of any OS. It compares the number of security bugs found in each system. That is clearly not the same thing as measuring the actual security of an OS.

Secunia reports statistics but haven't studied the information, not even superficially. The statistics don't take into account how many of the remote exploits have the ports turned on or off by default in the OS. This is far more important than the bug count. If 30 exploits are from ftp and no one ever turns ftp on, then those 30 exploits are far less interesting than a single exploit that works through port 80 from a web browser without user interaction. There can be no comparison between those in terms of severity but Secunia doesn't even superficially try to rank the seriousness of the security problems.

All in all, Secunia's information isn't very useful for anyone really trying to understand the security differences between different OS platforms.

Finally, I can find nothing resembling a study of OS security on Secunia's website. All I can find are statistics without any information on how they categorized them in the Critical to Not rankings. I don't really see anything that is a study, just a statistical report with dubious information about exploit rankings.

MOD GRANDPARENT POST FLAMEBAIT

[Anonymous Coward]

It had to be said

Re:MOD GRANDPARENT POST FLAMEBAIT

[Anonymous Coward]

Wouldn't the grandparent to your post be the article itself since you are the child of the fr0st pist?

Re:MOD GRANDPARENT POST FLAMEBAIT

[Anonymous Coward]

that's the point. the article is flamebait. that's what the grandparent to you said.

Re:MOD GRANDPARENT POST FLAMEBAIT

[Anonymous Coward]

Just checking...

FUD?

[Anonymous Coward]

Each product is broken down into pie charts demonstrating how many, what type and how significant security holes have been in each.

FINALLY, someone who knows about pie charts, its so clear now, absolutlely no fud can be present in pie charts..

Lets be positive. I'm trying to rtfa but I keep having to do my 'chants' to get over the fud-ish language.

Maybe there's something in this,.. when I find some actually 'stuff' I'll get back to you.

Re:FUD?

[Anonymous Coward]

Reminds me of a good quote from Mike Gordon of Phish: "It is kind of silly when they're making pie graphs about set list openers. But then, I always liked a good graph."

Re:FUD?

[Anonymous Coward]

I've read the article and I still don't understand why someone would think, "The Micorsoft Windows application is more secure than you think".

Its a blank statement and says nothing.

I believe the Micorsoft Windows Application is secure, since it doesn't exist. Its the Microsoft Windows (tm) OS I'm worried about.

The Microsoft Windows .... what?

[julesh]

The article opened with the words "The Microsoft Windows application".

I'm not sure I want to read any further.

Re:The Microsoft Windows .... what?

[julesh]

The company in question have an "advisory" on the front page of their site ... that a web site that uses frames might be able to display content from another site inside it.

I think we all knew that one.

Re:The Microsoft Windows .... what?

[Knuckles]

You are giving them too much credit: it opens with the words The Micorsoft Windows application. Inspires confidence, doesn't it?

Re:The Microsoft Windows .... what?

[Anonymous Coward]

Dude, I think they're just poking fun at MS calling this bloatware an operating system, when it is laden with so much cruft that has nothing to do with it being an OS.

Windows really is an application with an operating system burried somewhere deep inside.

Re:The Microsoft Windows .... what?

[mrnobo1024]

Windows doesn't have any more "cruft" than the average Linux distribution. Would you rather have just a kernel, a shell, and coreutils; or would you want a system where things can be done out of the box without the hassle of installing it all?

Micorsoft?

[philkar77]

from the article: "The Micorsoft Windows application is more secure than you think..."

A statistic is like a whore...

[rainer_d]

...everybody can fuck around with her, while paying.

Re: A statistic is like a whore...

[Black Parrot]

97.2% of all whores are made up?

Gah!

[CaptainAlbert]

Didn't see the actual report, but I hope it's better than this incredibly inaccurate article!

> The Micorsoft

erm, Microsoft?

> Windows application

Which one? Oh, you mean the Microsoft Windows "Operating System".

> is more secure than you think,

What do I think? Go on, what? Tell me!

> and Mac OS X is worse than you ever imagined

So what exactly did I imagine, dear writer?

Amateurs. :)

Re:Gah!

[Artifakt]

Any article needs to be targeted at a particular audience. In fact, it's a sign of incompetent writing if a crical reader can't figure out what audience would find the article relevant.
Even if I hadn't RTFA'ed, from the parts you quote alone, I would gather that the target audience is intended to exclude people who don't yet really have an opinion on MS Windows security one way or the other. It also is designed to exclude people who still think Microsoft is largely secure and those who already think OS X has significant vulnerabilities. It still leaves a fairly broad range, i.e. people who think both OS's are about the same, AND people who think OS X is better but not by a huge amount. It also still includes people who think any significant PART of OS X's better security history comes from being a lower profile target. Does such a target audience exist?
I try to avoid the tendency to define my audience by telling the reader what he thinks myself, but then my editor says I end up naturally longwinded as a result. Even for professional writers, it's very hard to avoid both mistakes at once. If you try recasting the sentence to define an audience without resorting to this method, you might see how long and compounded the sentence gets trying to avoid it. If you can avoid writing like you're patronizing your readers, keep it tight, short and focused, and do both consistently over the course of a career, you need to be the one writing the articles.

Patches do not equal problems.

[djh101010]

Looking at my email inbox, I see a ton of junk generated by the Windows virus/worm of the week. Looking at my firewall logs, I see very little probing for any of the Unix exploits.

When the difference in use of exploits is an order of magnitude or two higher for the 'doze stuff, it's hard to see how a mere "count of vulerabilities fixed" means much at all. The basic design differences between unix and 'doze are profound, which is why the 'doze exploits do so well.

Re:Patches do not equal problems.

[eddy]

I finally added:

SetEnvIfNoCase Request_Method "SEARCH" nolog
CustomLog /var/log/apache/access.log combined env=!nolog

To my Apache configuration. Some Microsoft(R) Windows(TM) worm was filling my logs with megabytes/day! Made lessing the log virtually worthless.

The "default.ida"-stuff isn't so large, so I'm keeping that logged, just for the fun of it.

Re:Patches do not equal problems.

[imnoteddy]

Looking at my email inbox, I see a ton of junk generated by the Windows virus/worm of the week.

Yeah, I cleaned out my junk mail folder about two and a half hours ago and thought I'd take a look. Of the 42 messages OS X Mail correctly identified as junk 35 were from Windows viruses with attachments with extensions like .exe, .bat, and .pif.

I cranked my firewall up to shut off everything, partly because it was silly to look at logs that showed probes for IIS exploits every couple of minutes.

I guess you can make the statistics lead to any conclusion you want, but it'll be a hard sell to convince me that *BSD/OS X/Linux are less secure than Windows.

Re:Patches do not equal problems.

[djh101010]

SetEnvIfNoCase Request_Method "SEARCH" nolog

Problem with that, is that you also won't be able to run stats on your site with Analog or another tool, if you want to see which search engines folks are using to get to it. For almost everyone that doesn't matter, but sometimes it'd be nice to be able to show that like for a marketing site, or whatever. I just do a quick grep -v of a few strings before running through analog, so I can still get the search engine info (how folks found the site) without all of the M$ worm/virus stuff.

Re:Patches do not equal problems.

[eddy]

You mean hits from search engines show up as SEARCH requests? I seriously doubt that, but if they did, just refine the Env to use Request_URI and the appropriate regexp pattern for the worm in question.

Re:Patches do not equal problems.

[Anonymous Coward]

Have you ever thought the amount of email viruses may be due to that FACT that the overwhelming majority of internet users use a Windows based system? Its all relative.

Article is an irrelevance

[eamacnaghten]

The article is an irrelevance and does not deal with the real issues of security.

If a sysadmin is lazy and security unaware, he will ALWAYS be cracked into and exploited regardless of the OS system used, Windows Linux whatever. At the same time if he is vigulant and security aware he will unlikely to be seriously cracked and his systems will be stable, again regardless of the OS involved.

What I have found is that managing Linux properly is a lot easier and cheaper than managing the Windows OS's properly due to the better OS design in philosophy and security, and attitude of the OS maintainers.

THAT to me is what is relevant.

Re:Article is an irrelevance

[AliasTheRoot]

What the heck are you doing posting?!? Unplug your computer from the network and pur concrete into the case now!

Don't dismiss this

[ObsessiveMathsFreak]

The facts are hard to look at, yet we all know that Linux, despite opinions to the contrary, has suffered from system holes. And to be quite frank, the fact that Mac OSX is leaking like a swiss cheeze should not come as a surprise to anyone.

Linux is fallaible, but at least with open source we can find bugs and get rid of them quick, without waiting for patches. Windows is not as bad as OS X in this regard either.
I find the statement Linux suppliers took longer to release patches. Is that true? I know security consious admins will patch themselves but is it true that vendors will igorne minoe bugs?

Perhaps this is what the MS reps meant when they said Linux was becoming morew like windows.

Re:Don't dismiss this

[Accipiter]

Leaking like swiss cheese?

Did you perhaps mean to say "leaking like a sieve" or "full of holes like swiss cheese?"

Re:Don't dismiss this

[NarrMaster]

Full of holes like a sieve. Hmmm, maybe I should make like a tree and go.

Re:Don't dismiss this

[System.out.println()]

I think there is a huge flaw with Secunia's study in that they only considered PATCHES. In other words (if my understanding of this is correct) if Apple had patches only the least serious vulnerabilities, they would have been considered the most secure.

Patches do not equal holes. Patches are PATCHES.

Re: Don't dismiss this

[Black Parrot]

> Leaking like swiss cheese? Did you perhaps mean to say "leaking like a sieve" or "full of holes like swiss cheese?"

You've obviously never been in a boat made of swiss cheese.

Again Windows only vs. RedHat/SuSE plus apps?

[Knuckles]

I can't see it metnioned in the article, and neither can I find the relevant stuff at secunia.com, but this is the first question I want to answered before I spend another 10 seconds on this: do the numbers actually compare Windows with RedHat/SuSE stripped down to what a plain Windows install does, or do they yet again include all the security advisories for the 3.000 (or whatever) packages included with the distros?

Re:Again Windows only vs. RedHat/SuSE plus apps?

[julesh]

Tell me, what do you think?

Even if it was a stripped down build, how would you, for example, determine which of the several FTP servers that ship with (eg) SuSE is the one to substitute for the IIS FTP server? Which browser do you substitute for IE? Which chat program for MSN messenger? Which web server? Which e-mail server? These are all important questions that are quite hard to answer.

OK, it might be a little simpler with OSX, I've never installed it myself so don't know how many packages come with it, and what kind of variety there is.

Re:Again Windows only vs. RedHat/SuSE plus apps?

[schotty]

Plus with the OSS world, you have people ACTIVELY trying to find problems just so they can be plugged up. Almost every issue with Linux and *BSD is resolved in a VERY short period of time. How long is the average Microsoft lag between find and repair? Much longer than Red Hat, SuSE, FreeBSD, OpenBSD, etc.

And yes, parent post : That is a great point -- if Windows XP Home doesnt include DNS, Web, Email, and DHCP servers -- why test it on Red Hat?

Re:Again Windows only vs. RedHat/SuSE plus apps?

[Knuckles]

I think nothing, because I have no data, so what's the point.
Regarding your question: I would count the exploit for each of those per app class, and weight them with their respective percentage of users -- if I have too much time on my hands. Otherwise, i'd just take the most often used app.
But whatever I do, if I wanted to be taken seriously I would disclose my method.

Re:Again Windows only vs. RedHat/SuSE plus apps?

[robin_j]

I can't see it metnioned in the article, and neither can I find the relevant stuff at secunia.com, but this is the first question I want to answered before I spend another 10 seconds on this: do the numbers actually compare Windows with RedHat/SuSE stripped down to what a plain Windows install does, or do they yet again include all the security advisories for the 3.000 (or whatever) packages included with the distros?

The list of advisories for RedHat AS 3 is listed at the bottom and currently it contains 51 advisories and what they were issued for. I copied the list and sorted them so here you can see a list of exactly what they included:
CVS
ethereal
FreeRADIUS
gaim
glibc
gnupg
httpd
iproute
ipsec-tools
kdelibs
kdepim
kernel
krb5
lftp
LHA
libpng
libxml2
mod_python
mod_ssl
mozilla
Mutt
NetPBM
net-snmp
nfs-utils
OpenOffice
OpenSSL
PWLib
Quagga
rsync
slocate
squid
squirrelmail
sysstat
tcpdump
utempter
XFree86

As you can see a lots of these are what might be called non-OS components. I've had a quick look at XP Home and it doesn't even seem to include issues with IE which according to MS is an integral part of the OS unlike Linux and Mozilla, yet they happily bundled them together.

Strange that..........

Re:Again Windows only vs. RedHat/SuSE plus apps?

[Knuckles]

Wow, thank you. After reading your post I tried to find the info again ("at the bottom"), but I seem to be too stupid.
However, I think I have seen enough from your list. CVS (yeah, my mum runs that), ethereal, gnupg, httpd (what's that? apache, boa, ....?), OpenOffice ....

Re:Again Windows only vs. RedHat/SuSE plus apps?

[julesh]

If I wanted to be taken seriously I would disclose my method.

Exactly my point: they haven't answered the questions of which applications were included; they haven't disclosed a method (and the statistics that are described as 'easily accessible on their web page' in the article seem to be buried so deeply that I can't find them), so the chances are the method they used is one that wouldn't be taken seriously if it were known.

Re:Again Windows only vs. RedHat/SuSE plus apps?

[HanVerspiltTijd]

I did some digging and found the following for Os X, Win Xp Pro and Red Hat WS3. On a side note: all the stats metioned in the article are based on the number of advisories, not the number of vulnerabilities.

2004 - 9 Secunia Security Advisories
- Mac OS X Multiple Unspecified Vulnerabilities
- Mac OS X Volume URI Handler Registration Code Execution Vulnerability
- Mac OS X URI Handler Arbitrary Code Execution
- Mac OS X Security Update Fixes Multiple Vulnerabilities
- Mac OS X Security Update Fixes Multiple Vulnerabilities
- Apple Filing Protocol Insecure Implementation
- Mac OS X Security Update Fixes Multiple Vulnerabilities
- Mac OS X Security Update Fixes Multiple Vulnerabilities
- Mac OS X Local Denial of Service Vulnerability

2004 - 11 Secunia Security Advisories
- Microsoft DirectPlay Packet Validation Denial of Service Vulnerability
- Microsoft Windows "desktop.ini" Arbitrary File Execution Vulnerability
- Microsoft Windows Help and Support Center URL Validation Vulnerability
- Windows Explorer / Internet Explorer Long Share Name Buffer Overflow
- Microsoft Windows 14 Vulnerabilities
- Microsoft Jet Database Engine Buffer Overflow Vulnerability
- Microsoft Windows RPC/DCOM Multiple Vulnerabilities
- Microsoft Windows Enhanced/Windows Metafile Handling Vulnerability
- Microsoft Windows ASN.1 Library Integer Overflow Vulnerabilities
- Windows XP Malicious Folder Automatic Code Execution Vulnerability
- Microsoft Data Access Components Broadcast Reply Buffer Overflow

2004 - 43 Secunia Security Advisories
- Red Hat update for kernel
- Red Hat update for kernel
- Red Hat update for libpng
- Red Hat update for squirrelmail
- Red Hat update for krb5
- Red Hat update for ethereal
- Red Hat update for CVS
- Red Hat update for squid
- Red Hat update for tcpdump
- Red Hat update for LHA
- Red Hat update for utempter
- Red Hat update for rsync
- Red Hat update for libpng
- Red Hat update for cvs
- Red Hat update for kdelibs
- Red Hat update for kernel
- Red Hat update for ipsec-tools
- Red Hat update for kernel
- Red Hat update for OpenOffice
- Red Hat update for CVS
- Red Hat update for ethereal
- Red Hat update for mozilla
- Red Hat update for mod_ssl
- Red Hat update for OpenSSL
- Red Hat update for sysstat
- Red Hat update for nfs-utils
- Red Hat update for libxml2
- Red Hat update for mod_python
- Red Hat update for kernel
- Red Hat update for PWLib
- Red Hat update for XFree86
- Red Hat update for Mutt
- Red Hat update for NetPBM
- Red Hat update for slocate
- Red Hat update for gaim
- Red Hat update for ethereal
- Red Hat update for kernel
- Red Hat update for net-snmp
- Red Hat update for kdepim
- Red Hat update for tcpdump
- Red Hat update for cvs
- Red Hat update for httpd
- Red Hat update for kernel

Re:Again Windows only vs. RedHat/SuSE plus apps?

[robin_j]

To find the list of advisories:

1. In the top right choose "Listed by Product".
2. Choose your product.
3. Page down to the end of the document and you'll see the list.

Re:Again Windows only vs. RedHat/SuSE plus apps?

[Knuckles]

Thanks a lot

what does it prove?

[Anonymous Coward]

Mac OS X does not stand out as particularly more secure than the competition, according to Secunia.

The proportion of critical bugs was also comparable with other software - 33% of the OS X vulnerabilities were "highly" or "extremely" critical by Secunia's reckoning, compared with 30% for XP Professional and 27% for SLES 8 and just 12% for Advanced Server 3. OS X had the highest proportion of "extremely critical" bugs at 19%.

Oh, okay, well, by MY reckoning, none of the OS X vulnerabilities were "highly" or "extremely" critical, therefore by MY reckoning, OS X is the most secure of them all!

These studies analyze the statistics of the security advisories and attempt to draw conclusions. I don't see the value of it.

Here's what I do: I just *assume* that all operating systems and software is insecure (unless djb wrote it, heh). After all, I'm constantly updating FreeBSD, Gentoo, and Windows, all the time, anyway.

Since it only takes ONE show-stopper bug to let in an attacker, it really doesn't matter to me how *many* bugs each OS has.

In my experience, the easiest OS to upgrade is OS X. However I don't manage any production OS X servers, just my own computers, so take that with a grain of salt.

Next easiest is Gentoo. You can upgrade just the components you need, BUT it's a little hard to separate the security fixes from the non-security fixes (they are working on that though).

Next is FreeBSD. Like Gentoo, it's hard to pick out just the security updates, but they are working on that too. Rebuilding the base OS is time-consuming and risky, so FreeBSD gets a mark for that.

Next is Windows. Too GUI-oriented, and service packs are too complex and cause breakage.

However we do manage to keep all machines up to date and implement layered security (firewall, network IDS, host IDS [tripwire], remote syslog, log monitoring.......)

Re:what does it prove?

[IamTheRealMike]

Oh, okay, well, by MY reckoning, none of the OS X vulnerabilities were "highly" or "extremely" critical, therefore by MY reckoning, OS X is the most secure of them all!

How can you not find arbitrary remote code execution from a web browser highly critical? It meant that if a bad guy hacked a website popular with Mac users, they could take control of many machines potentially without their users noticing - just like the problems Windows has.

The solution is clear ...

[operagost]

Use VMS!

Bought and Paid for By Microsoft

[Master Bait]

...most likely. Though I'm not going to bother investigating ties between M$ and Secunia.

In the real world, Windows machiness are real sinkholes for real exploits, while Mac and Linux machines aren't.

Re:Bought and Paid for By Microsoft

[ifwm]

Well, others have posted links that seem to refute your speculation. Why don't you just look at the statistics and read them for what they are.

Re:Bought and Paid for By Microsoft

[Master Bait]

Why don't you just look at the statistics and read them for what they are.

Statistics?

"There is terror in numbers," writes Darrell Huff in How to Lie with Statistics. And nowhere does this terror translate to blind acceptance of authority more than in the slippery world of averages, correlations, graphs, and trends. Huff sought to break through "the daze that follows the collision of statistics with the human mind" with this slim volume, first published in 1954. The book remains relevant as a wake-up call for people unaccustomed to examining the endless flow of numbers pouring from Wall Street, Madison Avenue, and everywhere else someone has an axe to grind, a point to prove, or a product to sell. "The secret language of statistics, so appealing in a fact-minded culture, is employed to sensationalize, inflate, confuse, and oversimplify," warns Huff.

There is a wide gulf between potential exploits and actual exploits. The fundamental yet simple flaw in the Windows/DOS operating system is that any file is executable based in the name (such as .exe or .com). This is not the case for either Mac OSX or UNIX-based operating systems.

Re:Bought and Paid for By Microsoft

[ifwm]

Congratulations, you avoided my question and continued to display your paranoia. I said READ THEm FOR WHAT THEY ARE, not believe them blindly. God what is wrong with some people.

Straight from the horse's mouth

[paranode]

These are the statistics that really matter:

Secunia Virus Statistics

Of course you'll notice the common Win32. in front of all of them.

Re:Straight from the horse's mouth

[JohnFromCanada]

"These are the statistics that really matter:
Secunia Virus Statistics"

Uh, no there not. Viruses in many cases stem from exploits in the underlying operating system. If there are exploits in the OS and it is worthwhile virus writers will start programming/scripting viruses for Mac. The fact that they continue to hold such a low market share makes it really unnecessary for a virus writer to target them, when they can infect 100000 times the amount of machines on a Windows OS. Exploits can lead to viruses and are easily just as problematic as without the exploit there would be no virus. Furthermore, Apple has been incredibly slow at releasing updates and fixes in the past. Unlike what all the Apple marketers want you to believe their OS is easily vulnerable just like all others. MS may be the worst but that is yet to be proven as they hold such a dominant position in the market that there is virtually no effort to produce viruses for the other platforms. Security takes effort and knowledge no matter what platform you are on.

Re:Straight from the horse's mouth

[Anonymous Coward]

"These are the statistics that really matter: Secunia Virus Statistics"
Where do you think that viruses come from? They are created from exploits. So saying that the virus statistics are the only ones that matter is completely wrong as without the exploits there would be no viruses. Furthermore not every security problem is a virus many could be hackers using exploits to gain access to unauthorized systems. I have no idea who modded you informative as you obviously don't know much about computer security.

Re:Straight from the horse's mouth

[Anonymous Coward]

From the link:

e.g. 1% means that in 10.000 virus scans, 1.000 of these scans resulted in found infections

Are you sure we should be listening to these "analysts" !?

Re:Straight from the horse's mouth

[Alexis de Torquemada]

Too bad that the Phatbot author did bother to write a Linux "interface" (allowing the worm to cross-infect different OSes), targeting an sshd vulnerability. Still, it had close to zero relevance (never heard of an infected Linux machine), probably because

a) Most Linux boxes were already patched.
b) Others don't even run sshd (e.g. Gentoo and Linspire in the default install)
c) The Linux installations were too inhomogenous causing "compatibility problems".

Re:Straight from the horse's mouth

[Anonymous Coward]

I wouldn't count a programme as a virus that - as an administrator /or equiv you have to manually execute. This is just lame - who can think of 1000s of variations of a .bat file which when run removes certain common files - are these all viruses?

I really don't see the difference between these 'viruses' and an email telling you to format your hard drive and to win $1000 and a lifetime of free pr0n.

Re:Straight from the horse's mouth

[valmont]

All this rambling about OS X's lack of security is moot. Here is the only factor that matters:

A DEFAULT INSTALLATION OF THE CONSUMER-LEVEL VERSION OF MAC OS X (that ships with every mac) HAS ABSOLUTELY ZERO, ZILCH, NADA, NOTHING, NOT ONE NETWORK SERVICE ENABLED BY DEFAULT.

There's no way you can remotely own a default installation of Mac OS X.

Take a deep breath and re-run that sentence to yourself in your head.

Plug a default installation of XP (that ships with every PC) on any open network, you're owned within seconds. It's that simple.

Statistics are pointless when not scoped around what they really mean and their impact. So here's me doing everyone's job:

As a consumer-level operating system, Mac OS X, since day 1, and up until today, has always been, and remains FAR MORE SECURE than windows. Because the consumer-level version of Mac OS X, also known as "Mac OS X Client" does not unnecessarily enable by default any services, because the vast majority of users don't need'em, and the few who do can turn them on easily. Windows could have done that at least since 2001 and heydays of CodeRed and Nimda, yet never bothered to take this very very VERY simple measure. This is your first basic most simple, strongest line of security: if you don't need it, don't even turn it on. Be humble about the software you run, and understand that in may in fact be vulnerable, at the very least, to buffer overflows. APPLE HAS GROKKED THAT FROM DAY ONE, MICROSOFT NEVER DID, though i'm hoping SP2 will turn all that useless crap off. Saying that Apple has been lagging in releasing security updates is simply untrue. They've addressed all real ones very fast.

Now, as a server-level operating system, as far as security goes, it's all in the hands of a systems administrator. All services that run natively to the operating system are, in theory, at the very least, vulnerable to buffer overflows. And this goes regardless of which operating system you use. But frankly, if I was to admin a server, I'd still go with OS X, because I'd know that pretty-much all network services it runs come from the open-source community, if Apple is too slow to release a patch, I'll have known way ahead of time by keeping on-top of advisories and reading workarounds and solutions from the open-source community. If I'm running windoz 2003, I'm at the mercy of microsoft.

Re:Straight from the horse's mouth

[Anonymous Coward]

"I'd still go with OS X, because I'd know that pretty-much all network services it runs come from the open-source community"
Use Linux if you love the open source community; support them instead of such a proprietor company such as Apple.

Junk Science

[Hatta]

The statistics, based on a database of security advisories for more than 3,500 products during 2003 and 2004

The proportion of critical bugs was also comparable with other software - 33% of the OS X vulnerabilities were "highly" or "extremely" critical by Secunia's reckoning, compared with 30% for XP Professional and 27% for SLES 8 and just 12% for Advanced Server 3. OS X had the highest proportion of "extremely critical" bugs at 19%.

This research tells you nothing about how secure an OS is. The number of security advisories has a lot to do with how diligent the OS manufacturer is in informing the public about security problems. For all we know Apple could just be a lot better about airing its dirty laundry than microsoft. I would assume that due to the open source model, the statistcs on SUSE were fairly accurate.

Re:Junk Science

[stratjakt]

Spin it however you want, you're just as wrong as anyone in MSFT's marketting dept.

There is no secure OS. The word "security" wasn't even brought up with regards to OS design until 5-10 years ago. Not until we hooked all the computers together on the internet was a "remote exploit" a worry. The focus was on ease of use, and making the computer do useful things.

Now, cryptology is a booming field, people are looking hard into replacing old insecure protocols. FTP and telnet were "good enough" for a long, long time.

The message here is "all you fanboys shut the hell up, none of you know what you're talking about. All OS's suck from a security viewpoint."

The biggest security hole on any machine is the person administrating it. No OS is immune to a moron.

Re:Junk Science

[Anonymous Coward]

What about the biggest security hole is the number of services run by default on a machine?

Stop blaming the user for using an OS the way is was shipped...

Re:Junk Science

[Hatta]

Spin it however you want, you're just as wrong as anyone in MSFT's marketting dept.

Not spinning it. Just saying that there's no data here. My statement "For all we know Apple could just be a lot better about airing its dirty laundry than microsoft." was merely to demonstrate how these results could be used to prove anything, and therefore have no value.

The biggest security hole on any machine is the person administrating it. No OS is immune to a moron.

I agree completely.

Re:Junk Science

[mindstormpt]

For all we know Apple could just be a lot better about airing its dirty laundry than microsoft.

Microsoft doesn't need to publish advisories, there are a few hundred teams around the world working on finding and publishing windows exploits.

Re:Junk Science

[Anonymous Coward]

"The word "security" wasn't even brought up with regards to OS design until 5-10 years ago" ...

You must be kidding. I did a graduate course in OS security in 1988, where we had access to the Unix system source code. Security was very important then, and thats 15 years ago. And even in 1988 we were networked with machines all over the world.

Moroever the source code we looked at was much older (I think it was the source to the first version of Unix written in C). And in it they were concerned about security. They had to be since Unix was designed as a multi-user operating system.

Get a clue!

Re:Junk Science

[Karhgath]

The paragraph you quoted is bullshit. I know they use numbers later on, but they want to lie/argue with stats on this one, which is irrevelent.

Take for example 33% of OSX vuln. are high or extreme vs 30% for XP... If OSX has only 3 vulnerabilities and 1 of them is high/extreme, then it makes 33%! XP could have 100 exploits and 30 of them high/extreme for a lower 30%. The stats here are meaningless. 33% of what?

Re:Junk Science

[John Starks]

Yeah! OS X is teh rox0r!!!!1111

The stats are only meaningless if you did not read the article. In the previous paragraph, they note that there are considering the 36 security advisories from 2003 and 2004. Perhaps you'll try reading the article next time instead of running your mouth.

Counting advisories is skewed

[upsidedown_duck]

One problem with counting only advisories is simply that there are different levels of transparency to users and developers among Windows XP, Linux, Solaris, and Mac OS X. One thing the study doesn't mention (which is unknowable, so they conveniently brush it off as unimportant) is how many covered-up or known-only-by-crackers vulnerabilities exist in each platform.

Also, why didn't the study mention OpenBSD? What about default configurations? Where the documented vulnerabilities always relevant or were they very obscure (e.g., service X used by three people in Greenland)?

I think this article smells biased.

Re:Counting advisories is skewed

[HanVerspiltTijd]

Especially since all 43 advisories for Red Hat WS3 in 2004 refer to updates, whereas 9 out of 11 advisories for Xp Pro refer to vulnarabilities. The other two are for buffer overflows.

Re:Counting advisories is skewed

[burnin1965]

Agreed, and your point can be proven even with the secunia statistics. They show XP with only one advisory for Internet Exploerer and yet Internet Explorer by itself had about 40 exploits by itself during the same period of time this MS shill is reporting on.

secunia.com/product/11

burnin

They neglect to mention..

[EMR]

That OS X doesn't have any network service running when first installed!!.. Nothing, nada, zilch, zippo.. In order to get exploited you need to have something running that accepts connections.. The default install of the Mac OS X doesn't have a thing. Where as Windows has way too much enabled and exposed.. Most linux systems now days, while they may have some things running, most are only listenting to the internal host (not accessible outside the computer) and they default enable the firewall.

Re:They neglect to mention..

[Anonymous Coward]

Wasn't there a gaping security hole in DHCP on OS X? Something about it allowing the DHCP server to make configuration changes...

Re:They neglect to mention..

[.pentai.]

DHCP servers ALL make configuration changes...that's the idea - they offer configuration details.

And to deal with it you had to have a dhcp server on my local network, and have removed my dhcp server, to affect me. Let's face it if you have physical access, you've already won

Also, it wouldn't be hard to put a DHCP server on a windows network pointing to a custom DNS server that redirects all web traffic to sites having exploits

Re:They neglect to mention..

[mindstormpt]

Also, it wouldn't be hard to put a DHCP server on a windows network pointing to a custom DNS server that redirects all web traffic to sites having exploits

But not on a linux network, of course.

Re:They neglect to mention..

[John Starks]

Uh huh. I have to accept connections to be exploited? Then explain why I have to patch IE all the time. Or why I had to patch libpng a while ago. Or why it's possible to run arbitrary code on unpatched Mac OS X via Safari (so I hear).

A buffer overflow in software can result in a compromised system whether the software accepts connections or makes them. And given that Windows XP SP2 will have the firewall enabled by default, I suspect we'll see a trend toward security holes in those programs that MAKE connections.

Re:They neglect to mention..

[Anonymous Coward]

The parent's point wasn't that exploits don't exist unless network services are active, but that Secunia is counting as "critical" exploits which the vast majority of Mac OS X and Linux systems won't be susceptible to. If the user doesn't specifically turn on the exploitable service, it's not running.

To simplify: Windows ships with the kitchen sink running an exposed to the world, Mac OS X ships with nothing running, most Linux distros ship with some services running, most of which aren't listening to external traffic. But Secunia is counting issues for Linux and Mac OS X at the same level as an out-of-the-box-explotable issue for Windows.

Yeah, there are other attack vectors. But those doesn't negate the fact Secunia appears to be intentionally skewing statistics through a sin of omission.

Re:They neglect to mention..

[Anonymous Coward]

I don't know about that, man. I plugged my PB into my network cable and I was surfing the net once I clicked the Safari icon. If you mean there are no servers running, then yes, that's true. But if you plug a cable into your jack you've got a connection. That's what makes it so "It Just Works(TM)"; that it configures things for you without asking.

Re:They neglect to mention..

[Anonymous Coward]

That's not exactly true. There are several services running that are listening to the outside world; true, none of them are TCP, and simply turning on the firewall will shield even those.

The services running are (all are UDP): syslog: syslog (514); configd: bootpc (68); mDNSResponder: mdns (5353); cupsd: ipp (631). Turning on "Set time automatically" also turns on ntpd: ntp (123). configd is also listening for all ICMPv6 packets, apparently (*:*).

I'm actually not sure if cupsd is running before you configure any printers, but I definitely have printer sharing off and it's still listening.

Re:They neglect to mention..

[SilentChris]

"That OS X doesn't have any network service running when first installed!!"

Uh, if that were the case, you won't be able to access networks without configuration. Considering the default behavior of OS X is to have all ethernet cards set by DHCP (like most OSes) that argument goes out the window.

I think what you meant to say was "easily exploitable ports". That I could kind of agree with.

Re:They neglect to mention..

[EMR]

DHCP doesn't listen though.. it's an outgoing request. does a broadcast request for a response.. As I can firewall off all incoming requests and still retrieve an IP via DHCP.

Yes some stupid cable modem internet companies send dhcp acks back over the wire to test if a system is live, but they are not required to have DHCP operate.

And actually, you have to enable the network card before the network even works. ( at least I did when i last installed OS X.. )

Somebody explain to me...

[RAMMS EIN]

Somebody explain to me how this article supports the claims that have been based on it.

``Windows XP Professional saw 46 advisories in 2003-2004, with 48% of vulnerabilities allowing remote attacks and 46% enabling system access, Secunia said.

<snip>

SuSE Linux Enterprise Server (SLES) 8 had 48 advisories in the same period, with 58% of the holes exploitable remotely and 37% enabling system access.

<snip>

Mac OS X does not stand out as particularly more secure than the competition, according to Secunia.

Of the 36 advisories issued in 2003-2004, 61% could be exploited across the internet and 32% enabled attackers to take over the system.''

So, Windows XP and SLES had about the same number of vulnerabilities, but SLES manages to keep them out of the vital parts better. Mac OS X has had significantly (about 30%) fewer vulnerabilities, with the percentage of vulnerabilities leading to system level access on par with SLES.

What this says to me is that _if_ the detection ratio for all systems is the same (which I don't believe, but without this assumption, you can't say anything), WinXP is the worst, and OS X the most secure. This is exactly opposite to what is claimed.

Re:Somebody explain to me...

[Glowing Fish]

The article didn't seem to say that Windows was more secure, just "more secure than you think", while OS X is "much worse than you imagine". So, depending on who "you" is, this could indeed be true.

Yeah, it is dumb.

Re:Somebody explain to me...

[C10H14N2]

That, and they also don't correlate the likelihood of the exploit to be running on any machine. The vast majority of the Windows advisories I've seen coming through CERT are for services that are on by default or outright integral to the OS. With Linux that isn't so. For instance, the only exploits my linux machines are vulnerable to are those related to SSH, so if it isn't knocking on port 22, it's not getting in. Okay, one machine also is vulnerable to attack on 25 and 110. That puts me at risk about every 18 months as opposed to every ten days. The primary point is that even if my most vulnerable Linux machine was compromised, it would most likely be contained and not spread to the rest of my network. Not so on a default Windows network.

The only way I trust my Windows machines to be even relatively safe from outside attack is if they are on the opposite side of a Linux machine and even then only because I'm using non-MS-Standard Apps (OpenOffice, Mozilla, GAIM etc.). That's not a very likely configuration, though, and it is that likelihood that this article needs to address. That choice is based on a very simple analysis. I rarely if ever see an exploit on my Linux services (running or not). I get a DELUGE of attacks on my Windows services. I need little more information than that to determine that my Windows machines should be as far from my network perimeter as possible and that they should be as isolated as possible.

Doesn't change the facts...

[nattt]

Statistics don't change the facts that after running Mac OS X since it's inception, I've not had one OS X virus, or any of these exploits used against my machines. And the stats don't take into account not just how quickly a patch is released, but how quickly the users of that OS patch it.

Re:Doesn't change the facts...

[Izeickl]

Doesnt change the fact that i have never had a virus or exploit against me on any windows machine Ive had for the past 9 years either. I think this study points out that just because you run OS X your not immune and just because you run windows you attract virus and exploits like a plague rat. The user/admin can be the biggest deciding factor whether or not a virus or exploit affects you.

Re:Doesn't change the facts...

[nattt]

Yes! Education is more important than overall "security". Do you patch on time (still running windows 98??)? Do you have your system configured badly? Do you know not to open attachments that could contain a virus?

Perhaps people who use a computer on a network need to pass an exam first, just like we make sure people who drive on our roads know about road safety??

Re:Doesn't change the facts...

[mqx]

"Statistics don't change the facts that ..."

This is because the article fails to distinguish the difference between the number of bugs and the impact of those bugs.

The number seems (avoiding the arguments raised by other posters) actually relatively constant across all OSs.

The impact though, is significantly worse: because Windows bugs are actively exploited through Virus/Worms/etc and then have wide spread impact because of the sheer market size of the Windows, and the nature of the use of Windows.

To do a fair comparison of "impact analysis", you need to both look at the raw data (presented here), but then assess it in terms of number of expoits of those bugs, and then total overall impact. I think it will be clear that having done this, Windows will stick out by a mile.

However, the data does illustrate that the other OSs are not _intrinsically_ more secure than Windows, it's just that they don't receive as much attention. This means that if virus/worm writers focused on these other OSs or hackers actually targetted penetration of them, then the results would be no different that the problems seen with Windows today.

From another perspective, if you were thinking that your organisation may be the _active target_ of hackers, then choosing other OSs over Windows may not actually make much difference to your threat risk - you're just as vulnerable. However, if you're not the type of organisation that may be an _active target_, -- e.g. you're just a boring car rental paper-pushing company with Linux desktops -- then you'd actually be better off with the other OSs because of the far higher impact of bugs seen with Windows.

Re:Doesn't change the facts...

[SilentChris]

"Statistics don't change the facts that after running Mac OS X since it's inception, I've not had one OS X virus, or any of these exploits used against my machines."

Means nothing. I could create an OS that runs on only one machine, stick it on the Internet, and call it ChrisX. Chances are it would never be broken into. Why? There are millions of other machines out on the net with easily identifiable OSes and vulnerabilities. Bigger attack range.

If Apple ever manages to increase market share, then we'll see how long the "no virus" argument holds. Until that happens, security on OS X has partly to do with the fact that so few run it.

Windows is for everyone

[Doc Ruby]

Microsoft products are researched more because of their wide use, while open-source products are easier to analyse because researchers have general access to the source code, Kristensen said.

"A product is not necessarily more secure because fewer vulnerabilities are discovered," he added.


In other news, ebola is much more lethal than cancer. And the Commodore VIC-20 OS is much less secure than Windows.

Black and White

[INeededALogin]

as a Mac OSX user I have to defend my lil OS that could.

This poll does not take into affect the time to resolution, effect of exploit, and how hard it was to actually perform the exploit. Honestly, all software has bugs, all software has exploits it is the result of those exploits that I am more concerned with. Quite often Apple finds and fixes exploits before their are programs in the wild to exploit them. The same goes for Open-Source software which I am sure that some of the OSX advisories were a result of given Apples embrace of OSS.

Ask an Apple user how many Viruses, pop-ups, and unexplained daemons they have had on their system. The number will almost always be 0.

Re:Black and White

[diamondsw]

Almost always?

Potential study problem

[Synn]

The study compares security alerts between OSes, but one problem with that is that at least under Linux vendors not only release alerts for the core OS, but for applications as well.

If The Gimp has a security issue a Linux vendor will issue an alert for it.

If Photoshop has a security issue, MS won't inform you.

Also most alerts I see for Linux are pro-active, someone finding a bug that may be exploitable. Most alerts I see for MS are reactive, pluging a hole that has been exploited. That's the primary difference between open and closed source software. Not the number of bugs found, but when they're found and how fast they get fixed.

Re:Potential study problem

[Bozdune]

If The Gimp has a security issue a Linux vendor will issue an alert for it.
If Photoshop has a security issue, MS won't inform you.

This is exactly the point. All such comparisons are apples to oranges, and are fundamentally meaningless.

Re:Potential study problem

[KrispyKringle]

Right, the other issue that is apparently not taken into consideration for ranking the severity of a bug is the install base/vulnerable base. In other words, if there's a bug in sshd on OSX, and most OSX desktops have sshd turned off by default, it's not a severe risk, even if the bug itself allows remote code execution as root. In comparison, the same bug on Linux is far more severe, since most Linux boxes, even desktops, run sshd.

Secunia appears not to have taken this into account when ranking bugs by severity, though we can't be sure from the report. What's critical, though, are holes not just in the default install, but in the common configuration. If sshd is vulnerable on OSX, and OSX doesn't run sshd often, yes, OSX is still vulnerable. It's not more secure than Linux, which may suffer the exact same vulnerability in the exact same sshd, but on the other hand, it's still less likely to be exploited.

Or maybe they did mention this and I missed it?

lies, damned lies and statistics

[carndearg]

I think this research misses the point. They deal with the number of security advisories, not with how quickly or effectively (or even if) the holes were fixed.

I would be far more interested to hear, on the MacOs example for instance, how Apple responded to its security holes and how that compared to those of Microsoft or the Linux community.

How is 36 48 ?

[Butterwaffle Biff]

I glanced through the article and they seem to say that MacOS X had 36 vulnerabilities while XP had 48 over the same period. They then claim that this is not significantly less. Even if you discard all but the "serious" of the vulnerabilities (of which they claim MacOS X had more, but I disagree, not having seen any exploits for them) the two come out even at best. Why, then, are they so happy about XP?

Its not the system, its the admin

[nurb432]

90% of security is the administrator. So it really doesnt matter how secure the 'system' is as a good admin can make most anything secure.

That said, most 'windows admins' are home users ( by percentage ) that have NO clue what they are doing...

Home *nix admins tend to have more clue..

Re:Its not the system, its the admin

[stratjakt]

I'd say most Mac owners know nothing whatsoever about computers, and bought a Mac based on it's reputation for being easy to use and that it "just works".

Home *nix admins, btw, think they know everything. Most are complete morons if you peek under the veil - hell, just read slashdot objectively and tell me what you think the IQ of the average gentoo (debian, whatever) zealot is.

Mirror

[Shachaf]

The website was pretty slow, so here's a mirror:

Mirror.

Just counting

[miraclemax]

They're just counting bug fixes. And counting how many are labeled critical. Well, that still doesn't factor in, at all, how easy it is to exploit. Fact is, if you try to run a system level program on Mac OSX, it STILL will ask for admin password. So a program can't be run on your machine in kernel space without your knowledge. Windows seems to have been made for just this purpose. This study is laughable. It's just a count the bug fixes garbage. Linux has more fixes and updates because open source is more honest. How often have we heard of M$ waiting six months to release fixes that they knew about? How many holes are there that the public doesn't know about?

Re: Just counting

[Black Parrot]

> They're just counting bug fixes.

Whereas it's the ones that aren't fixed that bite you in the ass.

Still not accurate

[signe]

Once again, we have someone comparing Windows with RedHat, while not taking into account that RedHat is comprised of many many additional applications that don't have equivalents in the Windows install. Not to mention many server applications (Apache, bind, sendmail, rsync, etc.) that enable the remote access that many of the security vulnerabilities use. I would wager that OS X is in a similar situation (when compared with Windows).

Let's have one of these companies do a real test. Where they take a Windows install, and then a RedHat (or SuSE) install crafted to match it as closely as possible. No servers, Mozilla installed on the Linux system. Just the basics. Then count the vulnerabilities. It will tell a much different story.

-Todd

Re:Still not accurate

[stratjakt]

What does it matter? The fact is, there is no OS out there that's immune from attack. The end. No need for hurt feelings or zealotry.

They ALL suck. The end.

Re:Still not accurate

[callipygian-showsyst]

I run all of these:

Apache, bind, sendmail, rsync

On my Windows XP box! It's easy to do! There are cygwin installers for all of them. So there are equivalents in the "Windows Install" if you just visit cygwin.org

Most of the GNU stuff will also compile "Native" on Win32

Re:Still not accurate

[smash]

Perhaps Redhat, and the other linux distros need to take a leaf out of FreeBSD's (and, i am guessing, open and net, as well) book, and ship their distros in 2 parts.

CD1 - core system. Kernel, command line tools, perhaps X11 with a *MINIMAL* install of KDE/GNOME.

CD2, CD3, etc - apps. Don't call these "Redhat Linux". Call them "Redhat Applications".

Then we'll get a little better representation as to which OS is more secure.

smash.

The most important question for me

[Zork the Almighty]

How many vulnerabilities result in unauthorized access ?

WinXP 21
Suse 18
OS X 12

Correlation vs Mechanism

[laudney]

In research, it's vital to differentiate between correlation and mechanism. Stating that Linux and Mac OS/X are less secure than Windows based on kindergarten-level integer comparison is correlation: i.e. following/duplicating superficial attributes of known objects in hope of getting the same results in other objects. This is almost always baseless and useless. It's more important to undertand the underlying hidden reasons, or mechanisms: Windows security problems stem from awful designs in OS, such as integration of all sorts of applications into kernel space for speed acceleration. Whilst Linux and Mac OS/X security problems are mostly from mis-configurations.

Re:Correlation vs Mechanism

[martin]

or buffer overflows just like everything else :-)

Re:Correlation vs Mechanism

[HiThere]

Which is why C and C++ (to a slightly lesser extent) are terrible languages to implement a system in. (Slightly better than assembler.)

N.B.: There are (and to a greater extent were) reasons why they are good choices...but the way they handle arrays and pointers is an atrocity...and it frequently finds a place to happen.

Re:Correlation vs Mechanism

[Gyorg_Lavode]

I agree that they are probably being fair with their assessments. I agree though that the signifigant information would be how many exploits are purely theoretical and how many exploited.

I would like to know how the fact that the source is available for linux and signifigant portions of OSX affects the bug comparison. I think a lot of open source bugs are discovered in source while windows ones are discovered in practice. I would think this emplies that the windows source has signifigantly more bugs and we just can't find them since we don't have source access.

Also, the comparison of time to fix the bugs of the levels evaluated.

That said, I wouldn't discount the legitimacy of their findings.

Re:Correlation vs Mechanism

[martin]

And you'd suggest what? Java....ADA??

I find most programming languages have difficiencies. You need the power (ie low level stuff) of C to accomplish alot, but it should be hidden in proper functions/procedures that are well checked in order to handle the low level array stuff.

We've written a whole slew of C++ classes to handle all this abstraction for our stuff at work (www.solid-state-logic.com - shameless plug:-) so we are 'less likely' to run into this issue.

Re:Correlation vs Mechanism

[HiThere]

Ada wouldn't be a bad choice. Java (as a compiled language) wouldn't be a bad choice. Eiffel might be a good choice. D might be a good choice (that's Digital Mars D, not any of the others, which I don't know).

And, yes, C has reasons why it was a good choice. The principle one being that lots of people already know it. And one can make arguments in favor of Modula II. (I don't know about Oberon or Modula3.)

But array overflows and the handling of pointers in C/C++ are a continual source of problems.

(Now if you want, I could make arguments against any of the languages mentioned. It's true that nothing is perfect. But array overflows and wild pointers are a particular hazard in C/C++, and I don't really feel that it's appropriate that a system implementation language have that feature. Being small (C, not C++) is a poor argument. It was better, when chips couldn't handle decent compilers, but that's not true any more. If you're developing for a small system, or an embedded system, you're likely doing cross-compilation anyway.

Re:Correlation vs Mechanism

[martin]

This article entitled My programming language made me do it kinda says it all really..

Security reporting worse than you ever imagined

[Frater 219]

The reported study discusses the number and claimed severity of official security advisories for different systems. The factitious claims being made do not address the following problems:

Different suppliers report vulnerabilities differently. Consider every "cumulative update" you've seen, and every "multiple vulnerabilities in $product" advisory from CERT. A supplier which is more honest and meticulous about vulnerability reporting may have more advisories but better security -- while one which batches up several bugs in a single advisory will underreport.

A system which includes more software may have more advisories, even though most advisories do not affect most computers running that system. In Windows, a database server is a separate product whose advisories would not be counted against "Windows". Many Linux systems include at least two database servers, but they are not turned on by default. If a hole in MS SQL doesn't count against Windows, should one in mySQL count against Red Hat?

Unpatched vulnerabilities may go for months without the release of an official advisory. For instance, a number of holes in Internet Explorer have been known and discussed within the security community well in advance of any official advisory from Microsoft.

Systems which have better default system-wide security settings (e.g. packet filtering, services turned off by default) may have all kinds of "vulnerabilities" that can't actually be exploited. For instance, Mac OS X includes OpenSSH, but it's turned off until the user asks for it. A hole in OpenSSH cannot be exploited on a default-install Mac system.

Leaving it up to the supplier to decide if something is a "vulnerability" or a "feature" leads to underreporting. Take CD autorun, for instance, which allows the installation of spyware when a (mostly-)audio CD is inserted into a Windows PC. A security-conscious user regards this as a vulnerability, but the supplier regards it as a beneficial feature.

Some of the most common attacks -- such as viruses -- rely on social engineering, and on "features" that are not classed as "vulnerabilities". However, these attacks are also more prominent on some systems than on others. Any comparative assessment of security which discounts the most common attacks blinds itself to a wide segment of the security landscape.

Re:Security reporting worse than you ever imagined

[alex_tibbles]

"If a hole in MS SQL doesn't count against Windows, should one in mySQL count against Red Hat?"
In fact, since mySQL is a supported product on Windows, why not count all mySQL vulns on Windows too?

Seeing is believing....

[Anonymous Coward]

Windows XP Professional and Windows XP Home Edition are listed separately. Windows XP Professional has 66 advisories total and 45 in the last year. Windows XP Home Edition has 58 total and 43 in the last year. For all versions of Mac OS X there are 36 total and 33 in the last year.

Windows XP Professional
http://secunia.com/product/22/

Windows XP Home Edition
http://secunia.com/product/16/

Mac OS X
http://secunia.com/product/96/

forget about who's funding it...

[peteforsyth]

...this article reads like it was written by a PR person for Secunia. It's basically an advertisement for their service, with a bit of sensational news about OS X and Windows as the hook.

Looks to me like a case of a swiftly approaching deadline and a lazy editor at Computer Weekly. They just took a PR puff piece for Secunia, chewed it up, changed around a couple sentences, and spat it back out.

Re:forget about who's funding it...

[Colourspace]

Yeah weve seen this in the hardware industry too recently with articles being based on popularity contests rather than cold hard facts.

These guys can't count.

[minator]

This came up on OSNews a while back.

They count security patches from MS as 1 when they were actually patching 14 vulnerabilities.
They also didn't include the vulnerabilities in IE - which alone had nearly as many as OS X.

Their conclusion would be very different if they actually knew how to count.

It is nothing more than FUD dressed up as research.

PLEASE RESPOND

[Anonymous Coward]

Please post your comments about this article to columns@computerweekly.com

In contrast...

[mratitude]

I don't know that it matters the purpose for rating security problems nor is the emphasis on head-to-head number of events matter a great deal either. For instance, I didn't note in the article a comparison of how quickly firms or organizations responded with security fixes or notices of the security problem. We all know that the Linux community would lead any such comparison.

It is interesting to note though that an OS or apps "perceived" security relies heavily on the community using it. That Windows is insecure is well known mostly because a lot of people take much delight in exploiting the flaws (and no doubt, there are a lot of flaws). However, with the flaws in *nix flavor OS, they're there but they are fixed quicker and there aren't a lot of people taking great delight in exploiting the flaws. The perception derives from this nuance.

On the issue of "who does or doesn't" get exploited - I installed RedHat 6.1 and before I could get the system updated and general security in place, someone had gained root access and left a funky UID behind as a "nya-nya". It had been connected to broadband for only 30 minutes. I installed RH 7 and there wasn't a repeat of the incident (although the attempts were numerous - once an exploitable IP gets found, it makes the rounds among certain folk).

Patching, patching, patching!

[JamesR2]

Does this not really all boil down to sheer effort of continuous patching? Seems that all OS's and major applications have patch lists these days. Sure, the MS haters are actively exploiting the MS stuff, so the risk is higher. But if I had a Linux box, would I rest, not patch, because of this? I think not. Not to mention SSH, Apache, etc. I fear the junk that has no patches ... like printers and stuff that have web servers in them. Nice place for a Trojan to hide.

Re:Patching, patching, patching!

[excessive]

Generally most of the older printers shouldn't be too bad 'cos a lot of them can't run code thats that complicated.

Then again, I suppose there was a fractal generating postscript file that I saw a while back that recursed forever...

Anyone find it strange?

[midifarm]

...that in their super critical statistical analysis that he never actually gave a number of OS X incidents, just some vague percentages? No real specifics at all. I mean sure if OS X had 10 security holes and 6 were critical that you be 60%, whereas if XP had 100 holes with only 37 of those as critical it'd only be 37%. By that logic XP would be rock solid secure! This just seems like Apple bashing, and had they mentioned what percentage of the OS X holes were in common open source programs that may have been across the board amongst Linux/Unix systems? At least I can gather that if there's a hole in Windows that M$ is to blame for the bad code, not a class project from MIT!

Peace

Re:Anyone find it strange?

[waveclaw]

At least I can gather that if there's a hole in Windows that M$ is to blame for the bad code, not a class project from MIT!


C:\Windows\Desktop>strings.exe "c:\windows\system32\ftp.exe"
@(#) Copyright (c) 1983 The Regents of the University of California.
All rights reserved.

Of course there wouldn't be any MIT class project code. It's (the Window$ TCP/IP stack and tools) mostly Berkely class project code (i.e. BSD.)

Strange bedfellows indeed.

As Linus Torvalds will assure you, open source without good attribution tracking can be. . . interesting. . . come Intellectual Property and shift-the-blame/pass-the-buck time.

Re:Anyone find it strange?

[SilentChris]

"This just seems like Apple bashing"

"M$"

Wow, way to be unbiased. Try leaving the $ out. People will listen to the argument more.

Effective security

[iamdrscience]

Of course, like all statistics though, these numbers only show part of the story. There are more holes (and more serious holes) in OSX, but does that really affect your systems security (i.e. the chances of your system being compromised)? There are less people (effectively zero) people who are writing worms for Mac OS, so you've got a very small chance of that happening and there are far less people who are experienced at targeted compromises of OSX systems (and most of those few are white hats) so again your chances of your system getting compromised are probably lower than a Windows user.

I'm not trying to minimize this though, this is something that I hope will be taken very seriously by Apple and is a real eye-opener for myself.

Re:How is 36 48 ?

[stratjakt]

They aren't "happy about XP". I didnt read this as an "XP is awesome! buy it!" piece at all. I read it as a "wake up you zealots, you could be every bit as vulnerable as anyone else" piece.

A false sense of security is not your friend. Especially if it's only based on fanaticism and not any sort of facts.

Most secure OS: MacOS 9!

[YouHaveSnail]

Friends, it's clear from Secunia's own data that we should all switch back to MacOS 9, since Secunia knows of only one security issue for that OS.

Friends, you just can't argue with pie charts.

Re:Most secure OS: MacOS 9!

[toddestan]

Yeah, but how many security issues do they list for MS-DOS?

Re:Most secure OS: MacOS 9!

[mac os ken]

...or Contiki? Hmmm?

Re:Most secure OS: MacOS 9!

[Anonymous Coward]

Apple = Gay.

Homo.

This is the "we're-not-zealots" FUD troll

[JeffTL]

Secunia is simply saying this to "show" that they are not "anti-Windows zealots." I haven't heard much about OS X servers being cracked, and the only viruses created for OS X have been non-replicating proofs of concept. Moreover, no OS X program can screw up your system unless YOU GIVE IT YOUR ADMIN PASSWORD-- and hopefully you have your personal data backed up anyhow, as hardware failure hits when you least expect it.

Even on an administrator account, you can't screw up the operating system without a chance to bail out at a password prompt. Try that on Windows.

Re:This is the "we're-not-zealots" FUD troll

[Glowing Fish]

I am sure there are some ways that a virus could hurt the system without admin password. Even with just permission to a home directory, it could write and delete a file over and over again, until the disk caught on fire and your computer exploded and your house crumbled to dust.

Lies, Damn Lies, and Statistics

[jmccullough]

Browsing through Secunia's Site doesn't reveal too much regarding the report mentioned in the article. The links to the vendor's security pages do show that Apple, Suse, and others list vulnerabilities and security issues for products not developed by the particular company. Apple lists Apache, OpenSSH, rsync, and others. Since most Linux and BSD operating systems report security vulnerabilities in third party applications. Thus listing Suse and Redhat as having 48 and 50 vulnerabilities respectively 57 of them are probably the same vulnerabilities.

In my experience Microsoft only lists security vulnerabilities for their own products. With the methods used in these statistics vulnerabilities and the open source community are probably overcounted many many times over.

Secunia is probably just trying to get attention.

Re:Lies, Damn Lies, and Statistics

[gbjbaanb]

The number of exploits doesn't really matter either though - just 1 is enough to ruin your weekend. and it's a lot more likely to hit if you think that there aren't any exploits that could hit you.

Re:Lies, Damn Lies, and Statistics

[jaseuk]

erm, if there are more exploits thats more weekends!

Re:Lies, Damn Lies, and Statistics

[gbjbaanb]

now I know you're trying to justify not visiting relatives, but blaming Microsoft just isn't going to help!

Re: I'm a cybersecurity consultant, so I know what

[demigod]

I'm a cybersecurity consultant, so I know what I'm talking about.

I don't think using the term "cybersecurity" helped you case, but then again people telling you they know what thier talking about because of "X" is ususally a good sign they don't.

Though I think we both could agree that no general purpose desktop operating system available today has adequate security.

The summary is missleading

[SnprBoB86]

People are reading the summary and then this article and saying "bias! bias! bais!".

Re-read it carefully!

The summary is making it out to say that the article is suggesting windows is the most secure OS (or at least more secure than OSX). Clearly, the article is simply saying that all the OSes are equally insecure. The summary was written by a true slashdot/linux--fan in a way (intentionally or not) that influenced the opinions I see in these comments.

Re:The summary is missleading

[maximilln]

Clearly, the article is simply saying that all the OSes are equally insecure.

But the article doesn't mention that Secunia is stocked primarily with vuln information which comes from the open source sector. Vuln information from the proprietary sector is reliant on the proprietary company releasing all of the properly arranged information to make a proper entry in Secunia's database. In the OSS community, every single vuln in every single patch which you got from Windowsupdate would receive a separate entry. It doesn't because MS doesn't collaborate to create these entries. By default the Secunia database is light on actual vulns for MS-Windows. Primarily the vulnerabilities in Secunia's database which are relevent to Windows will focus on third-party software manufacturers.

Flamebait article?

[0rbit4l]

"Mac OS X does not stand out as particularly more secure than the competition, according to Secunia."

So, the article says that OS X had 36 advisories last year, compared to 46 for Windows XP Professional. But somehow, the article opens with:

"The Micorsoft Windows application is more secure than you think, and Mac OS X is worse than you ever imagined."

I don't see how, given that XP had more exploits than OS X, XP is "more secure than I think". Admittedly, OS X has had more security advisories than normal this year, but they've fixed them in short order. It seems to me that this article is taking a relatively small sample size (2003-2004) and suggesting that the problems during that sample (which were still significantly fewer than XP) are indicative of some long-term problem that we should "beware" of. This is bunk. It's easy to lie with statistics - suggesting that XP is magically "more secure" by counting advisories (which doesn't even support that claim!) is bogus because it doesn't take into consideration the length of time between the exploit being revealed and the patch becoming available nor the exposure to in-the-wild exploits. For instance, how many MS exploits are only fixed after lengthy exposure to real-world exploits (many of which you can probably find on my dad's computer?) Now, how often does the same thing happen on OS X (I can't think of this ever happening, but I won't say "never"). Furthermore, while my anecdotal experiences at a major university may be just that (anecdotal), the constant problems with zombie machines and exploited holes used for adware/malware strongly disputes their claim that XP is "more secure than I ever imagined" - likewise, the rather large Mac contingent at the university has no such problems. Give me a call when panicky mac users start bitching about adware on their computers. Until then, I think it's safe to file this article with all the other "Apple is dying" troll articles that we've seen since the early 1980s.

It's not just Funny

[RAMMS EIN]

You are modded funny, but you might be right.

Many vulnerabilities have been discovered in Linux over the last twelve months. Most of these were in do_mremap. If vulnerabilities can continue to exist in one function, even after it has been supposedly looked at by many, and fixed several times, how much faith can you have that the rest of the kernel is any good? And this is even though Linus rejects patches that aren't elegant enough, so the kernel can be expected to be one of the less crappy parts of the system. I don't want to count how many vulnerabilities exist in commonly used userland software...

Turning the camera to Microsoft now, how many exploitable vulnerabilities have been discovered in their kernel in the last 12 months? Most of the exploits I have heard about exploit vulnerabilities in userland, and do things that do not require superuser privileges - sending email, network access over TCP/IP, etc. This would work just as well under any *NIX system that had vulnerable applications.

I don't have any numbers, but I am afraid that Windows may not be as insecure as is commonly thought.

Re:It's not just Funny

[maximilln]

how many exploitable vulnerabilities have been discovered in their kernel in the last 12 months?

No one needs to exploit the Windows kernel because, typically, the user running the application has sufficient priveleges to accomplish the goal of the attacker. In that sense the Windows kernel just lets them right on in.

This would work just as well under any *NIX system that had vulnerable applications

I don't allow non-root users to execute sendmail. They can't modify my firewall rules or change network settings. Normal users can't add routes or change gateways. Normal users cannot see system configuration files or add network shares with executable code which can modify system data. These are all things that the Linux system has which Windows doesn't.

And I'm going to remind you what my earlier post said: Secunia and other security databases are stocked primarily with vulns from the open source community because Microsoft does not give Secunia the technical details behind every MS security patch. Check your installed update history on any Win2k/ME machine. There should be, by no, no fewer than ten "security patches". Each one of those patches fixes three to five vulns each. Yet not a single one of those security patches is listed in Secunia's database because MS isn't kind enough to provide the world with the details.

Re:It's not just Funny

[broter]

• Turning the camera to Microsoft now, how many exploitable vulnerabilities have been discovered in their kernel in the last 12 months?

How many people have been looking in Microsoft's kernels in the last 12 months?

Re:It's not just Funny

[blugu64]

No kernel expert here, but could that be because of the Micro versus monolitic aspect of the kernels?

(I'm under the understanding that NT is a micokernel, and I know linux is a monolitic)

Re:It's not just Funny

[stormcoder]

I'm thinking this guy and the "author" of the parent are the same person. Post AC and then with an account, post a supporting argument. Cute. Now if there were some way to make money at it... Hmmm.

Re:It's not just Funny

[Knuckles]

NT was planned as being a microkernel, but isn't.

Re:It's not just Funny

[blugu64]

cool, thanks for the info

Links to Some Graphs and Statistics

[APDent]

From the products page of the Secunia web-site:

• Apple Macintosh OS X
• Linux Kernel 2.4.x
• Linux Kernel 2.6.x
• Microsoft Windows 2000 Professional
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• OpenBSD 3.x
• RedHat Linux 9
• Sun Solaris 9

More importantly, how they address those issues

[cloudness is x]

Stats means nothing if the operating system maker makes it difficult to patch some holes (how are normal persons supposed to know if they have Outlook Express 6.0 or 6.0 SP1 ), takes his time to address known vulnerabilities, and makes it impossible for pirated copies to update their version of the OS.

And it's sickening to hear that the only reason Windows is so much vulnerable is his popularity. It is not. Sloppy programmation and bad choices of default options definitively have their share.

Are you kidding

[jonathanduty]

I'm really having trouble believing this.... Mac OS is really FreeBSD (Darwin) and if you are not logged in as root.... how unsecure can it be? Sure I may be able to hack into your user space (not saying I can, but someone may be able to), but I still can't modify things that are owned by root. Am I wrong?

Same Story, Different Source

[johnhennessy]

This has been duly covered and thrown out as complete rubbish before.

But this made me think - The numbers they give for Redhat and Suse are quite high. Thinking back over the last few months I don't think I needed to patch my server that number of times at all.

I think people need to distinguish between exploitable flaws and flaws that could be used in "theory".

Another point - flaws that are reported to Redhat aren't always installed on every server. A flaw could be reported in Apache, but that is not to say that everyone with Redhat Enterpise is running Apache.

Plan and simple: these type of statistics should always come with the caveat: your mileage may vary !!

Re:Missing Stats? ???

[HiThere]

All modern OS's suck from a security standpoint. Why? Because we've only really GIVEN A FUCK about security for the last half a decade or so. Before that 99% of the worlds PCs were by

I don't know just where you were living, but Unix and Linux grew up on networked systems where multiple college students shared the same machines (well, Linux less than Unix here) because they were too expensive. Actually, Linux is almost an accidental beneficiary here. Linux used Unix as a role-model, and Unix grew up being attacked by hackers who wanted to play Space-Invaders or Cave or Hunt the Wumpus when their school accounts wouldn't cover it. And by Phd candidates trying for a few more runs on their thesis project. It's true these weren't *remote* exploits. They were local ones...where the attacker didn't have priviledged access. But that's the basis of all security. Once you do that, all you have to do is make remote connections a special case of local access.

'Security by obscurity' is the real myth!

[Anonymous Coward]

I can't believe they are comparing OSS advisories with MS advisories and attempting conclusions based on the metrics.

More OSS bugs get discovered AND FIXED because the code is an open book.

Do they really think a patched OS is less secure than an unpatched OS?

A high advisory count for OSS means the code is being scrutinized. This is a Good Thing.

Or would you rather see advisories based on bugs found by people with enough time on their hands to disassemble Microsoft code and pore over that stuff? This is far more of a breeding ground for klller net worms. Though the metrics may be lower, i takess far takes longer for bugs to be discovered by the wrong people this way, and the results are far more devastating.

Also, how many MS users actually read advisories and patch their machines? The so-called "study" is fundamentally flawed in multiple ways.

The article does nothing more than prop up the myth of software security by obscurity.

Actually...

[Draconix]

The funny thing about Mac OS X and Linux... a great deal of the people who write the viruses and hack into Windows machines are (shock) Mac OS X and Linux users. I'd not so much call it 'security through obscurity' as 'honor among crackers'. ;)

Re:Actually...

[Anonymous Coward]

And you know this for a fact because...?

Let toss Internet Explorer in there...

[Anonymous Coward]

everyone's favorite browser with 38 advisories last year and according to Microsoft it's part of the Operating System. Internet Explorer alone has more vulnerabilities than all versions of Mac OS X. Additionally, just for icing on the cake IE has a wonderfully high 97% of the holes exploitable remotely.

http://secunia.com/product/11/

counting anti virus updates as vulnerabilities ?

[Anonymous Coward]

Someone should ask why anti virus updates aren't counted as system vulnerabilities...

Lies! Lies! Lies!

[fname]

I'll quote from the only true site for Mac news, As the Apple Turns:

Notice also that Secunia yaps on about how, for Mac OS X, "of the 36 advisories issued in 2003-2004, 61 percent could be exploited across the Internet and 32 percent enabled attackers to take over the system"-- but never mentions how many could be exploited across the Internet to enable attackers to take over the system. Personally, we aren't much concerned about exploits that require local access to a Mac, because if anyone's climbing in through a window downstairs, we've got more important things to worry about than whether or not he can mess with our Finder preferences. We picked one of those advisories at random, noted that it's tagged with an impact of "System access" and a location of "From remote," and then scoped out the description of the flaws to find that the only ones listed that appear to allow "escalation of privileges" can only be exploited by "malicious, local users." So as long as we keep the doors locked at night and don't tick off our housemates to the point of digital vandalism, we're apparently all right.

Please read the entire article, as it thoroughly points out the many flaws to this study, and points to other articles where Secunia makes other ridiculous OS X security claims. Oh yeah, and the site is damn funny too.

Re:Lies! Lies! Lies!

[Golthur]

Not to defend the so-called "accuracy" of this report, but keep in mind that a vulnerability that allows remote (but unprivileged) access, and one that allows local privilege escalation can combine to create full-scale remote rooting - so it's not just limited to someone "climbing in through a window downstairs".

Re:Lies! Lies! Lies!

[quantaman]

I strongly believe that both Mac and Linux systems are far more secure by a variety of metrics but the writers of that quote have no idea what they are talking about. Local access doesn't just mean someone walking up to your computer and fiddling around, indeed if you log out or lock the desktop when you leave the computer you should be safe from local exploits. Local exploits are someone having access to a local account. It doesn't matter it ther're sitting looking at the computer or logged in from Mars (well they might time out in that case) getting their access through a remote exploit, if they have access to a local account a local exploit which allows "escalation of privileges" can give them root. Remote access exploit + Local privilage escalation exploit = Remote privilage escalation explot

Re:Lies! Lies! Lies!

[Anonymous Coward]

sigh. the perils of quoting a satirical website are revealed.

Here are the numbers.

[JPriest]

XP Professional: 46 advisories in 2003-2004
48% remote attack
46% granting system access

SuSE Linux Enterprise Server (SLES) 8 had 48 advisories in the same period,
58% remote attack
37% granting system access

Red Hat's Advanced Server 3 had 50 advisories in the same period - despite the fact that counting only began in November of last year.
66% remote attack
25% granting system access

Mac OS X 36 advisories
61% remote attackers
32% granting system access

Re:Here are the numbers.

[phillymacmike]

Time to slashdot my favorite soap opera. This article, a week old already, is a hatchet job.

See Lies, Damned Lies, and Statistics

The conclusion:(quote)

Faithful viewer jfletch pointed out another Techworld article from almost two months ago that also quoted Secunia and claimed that Mac OS X's security problem at the time "makes Microsoft's current Sasser problems look no more than a nasty nip." (Of course, two months later Sasser still turns up in articles on Google News posted just hours ago, but who's counting?) Now, far be it from us to claim that there's some sort of Techworld-Secunia conspiracy intended to undermine Apple's attempt to gain an entry into the enterprise market, because we would never-- oh, who are we kidding? There's some sort of Techworld-Secunia conspiracy intended to undermine Apple's attempt to gain an entry into the enterprise market. We've been jawing about this incessantly for about four days straight, now, so determining motive is left as an exercise for the viewer. Follow the money!

Re:Here are the numbers.

[golgotha007]

i've always been under the impression that most of the linux based distribution security advisories aren't exploitable remotely, unless you already have a user account on the system.

can someone please enlighten me as to what exact services in linux have been exploitable in the last few years? i mean, a completely anonymous attacker gaining root access to a machine over a network?

these 'statistics' apparently show some 20 holes in linux that are remotely exploitable by anonymous attackers. i call shenanigans.

Re:Here are the numbers.

[Anonymous Coward]

Yes. There was a exploit last year. Ironically a samba exploit. you gain root access in a matter of minutes.

Re:Here are the numbers.

[th4tGuy()]

Thank you for posting the numbers - I was just about to. I read this headline and then read the article expecting to see Microsofts numbers fairly low and OS X's numbers much higher. Then reality hit me :) Although I am surprised by the Linux distro's numbers.

The comment: Microsoft Windows is more secure than you think, and Mac OS X is worse than you ever imagined.
Doesn't that seem a bit dramatic. Yes OS X had a higher % of remote attacks than all but Red hat, but it also had the fewest advisories. Isn't that a bit like saying mad cow disease kills 100% of its victims in the US when only 1 person has been infected? (Okay - my numbers aren't right and it's an extreme example - but you get my point). The fact of the numbers are that bottom line: XP had the most advisories which granted system access. Sure its number of advisories are lower overall - but nearly half of those are granting system access.

Definitely an agenda to this research.

Re:Here are the numbers.

[Anonymous Coward]

XP Professional: 46 advisories in 2003-2004
22 Remote Attacks
21 Granting System Access

SuSE Linux Enterprise Server (SLES) 8 had 48 advisories in the same period,
28 Remote Attacks (127% of xp)
18 Granting System Access (86% of xp)

Red Hat's Advanced Server 3 had 50 advisories in the same period - despite the fact that counting only began in November of last year.
33 Remote Attacks (150% of xp)
12.5* granting system access (60% of xp)

Mac OS X 36 advisories
22 Remote Attacks (100% of xp)
12 granting system access (57% of xp)

*this makes no sense it should be 13 (26%)or 12 (24%) I wonder if computer weekly was the culprit

Re:Here are the numbers.

[jrexilius]

To make these stats relevant you also need to add:
1) percent activated by default
2) percent that could not be be deactivated or removed,
3) percent that related to core services that are commonly used (HTTP,SMTP,FTP,DNS, i.e. that would likely not be blocked by standard default firewall rules)
4) difficulty of exploit (can it really be scripted for the kiddies?).

Those numbers by themselves are more misleading than meaningless.

As another poster commented it would also be good to define what an OS is, MS binds IE and MediaPlayer to its OS but WordPad and Solitaire can be considered non-OS apps that happen to ship with it. For linux and MacOSX?

Re:Here are the numbers.

[mcsuper5]

XP Professional: 46 advisories in 2003-2004
48% remote attack (22.08)
46% granting system access (21.16)

SuSE Linux Enterprise Server (SLES) 8 had 48 advisories in the same period,
58% remote attack (27.84)
37% granting system access (17.76)

Red Hat's Advanced Server 3 had 50 advisories in the same period - despite the fact that counting only began in November of last year.
If counting began in November it's not the same period.
66% remote attack (33)
25% granting system access (12.5)

Mac OS X 36 advisories
61% remote attackers (21.96)
32% granting system access (11.52)

I actually read the article, and they pretty much tell you they're comparing apples to oranges. I noticed the numbers looked really close for remote exploits for XP and OS X, so I did the math.

I didn't bother to look up any of the exploits found, but the numbers still look best for OS X to me. Since it wasn't a fair comparison the numbers don't mean anything anyway.

Re:Here are the numbers.

[golgotha007]

but samba isn't a service turned on by default in most (if not all) distros. samba should never be exposed to the internet anyway.

Interesting wording

[digitalgimpus]

The proportion of critical bugs was also comparable with other software - 33% of the OS X vulnerabilities were "highly" or "extremely" critical by Secunia's reckoning, compared with 30% for XP Professional and 27% for SLES 8 and just 12% for Advanced Server 3. OS X had the highest proportion of "extremely critical" bugs at 19%.

Emphasis mine.

Were not talking solid numbers, but numbers made by personal opinion. What is 'critical'?

MS can butter up the numbers so none of their holes are 'critical' if they so desire. So can anyone else.

better OS design philosophy security, and attitude

[Anonymous Coward]

"better OS design in philosophy and security, and attitude"

Bwahaha! You make it sound like everyone at Microsoft is chained to their desks and everyone working on the Linux distros is taking happy pills and working in pink rooms with butterflies and lambs painted on the walls.

Speak for yourself!

[callipygian-showsyst]

OS-X is just as secure as *I* imagined!

Seriously, having programmed on both OS-X and Win XP extensively, the two operating systems are more alike than they are different. There's no fundamental difference in their architecture that would make one more secure over the other.

Epilogue

[dh003i]

But if you want to have as much security by default as is possible, there's always OpenBSD.

Re:Epilogue

[bfg9000]

Mod INSIGHTFUL, not FUNNY. There's nothing funny about choosing OpenBSD for security; it's the BEST solution by far, and it's sheer arrogance to think that the other OSes mentioned here are anywhere close to a properly configured OpenBSD box. I still use (and love) Linux and MacOS X for what they excel at; but if I was building an Internet Banking site, I'd choose OpenBSD without blinking.

Security is what they DO; it's the reason they exist. If security is your Number One focus, choosing anything else is just wrong.

Re:Epilogue

[bfg9000]

Re:Epilogue (Score:3, Funny)
by bfg9000 (726447) on 15:35 Monday 05 July 2004 (#9615181)

LOL! Shoulda seen it coming...

Can't draw conclusions from this

[MobyDisk]

Firstly, this article is a summary of some other set of statistics. These summaries are usually horrible since the writers really don't understand statistics. Things never add up to 100%, and one quote often refers to a slightly different way of calculating things than another.

I don't know tons about security, so I read this with an open mind. But I KNOW some things are wrong:

A recent Forrester Research study compared Windows and Linux supplier response times on security flaws and was heavily criticised for its conclusion that Linux suppliers took longer to release patches.

I haven't read Forrester's research, so I would like to see it. (anybody know a link?) OSS is definitely faster at releasing patches. We see that time and time again. Perhaps they were comparing how long it took for the vendors like Red Hat to ship product updates for Apache, or put them on their web sites? But if I installed Apache, I don't look to Suse or Red Hat or Mandrake for my updates, I look to apt-get or apache.org. Of course, MS claims that all exploits come from MS patches anyway. (Which is proven not to be true on a weekly basis).

Lastly, the article rebuff's itself in the final quote:

A product is not necessarily more secure because fewer vulnerabilities are discovered," he added.

Even though that is the basis for the article's comparisons. lol!

I wonder who's really behind this.

[Pizentios]

I wonder...Could it be another case like we've see in the past where a "think tank" gets funding to do research and the later everyone finds out that the company/companies that funded the study are the one that the data showed to be better that all the rest. I wonder where secunia gets there funding for this new study. I tryed looking around on their webpage, but i didn't find the info i was looking for anywhere.

all those servers...

[SocietyoftheFist]

How many web and mail servers are running Linux? Software is written by humans and human aren't perfect so yada yada yada... It's no suprise that Linux would have as many bugs as any other piece of software. It would appear though that those that choose to run Linux keep their servers patched and turn off unnecssary services more often than those that choose Windows. The majority of web servers use Apache. The majority of those Apache servers are Linux boxes yet we don't see the issues with Apache that we see with IIS.

Troll

[Anonymous Coward]

Telnetd is removed from all modern Linux distribution default installs. Also, telnet doesn't have much exploits as such, it's just that it is not encrypted.

The US Army does.

[rufo]

Or did, at any rate. For a number of years the US Army used Mac OS 9 and Webstar to host www.army.mil. Looking at Netcraft now, they've moved to OS X but are still using Webstar, which has a much lower rate of vulnerabilities then Apache.

Welcome To Slashdot

[DecadeSol]

...where Pro-Microsoft comments are modded as trolls, we worship a penguin named Tux, and Bill Gates is hung if effigy every night!

Simple Math proves them wrong.

[Luckboy]

According to the article, Mac OS X had the highest percentage of extremely critical vulnerabilities. Of course it also had LESS overall patches. They're obviously rounding numbers a lot, too, as I doubt any OS Developer will be releasing fractions of critical vulnerabilities. Apparently, if we want to run the system with the least critical holes, we should all be running Red Hat Linux Advanced Server.

All stats pulled from the article.For the highly and extremely critical vulnerabilities and their respective OS:

Windows XP: 46 advisories x 30% critical = 13.8

Mac OS X: 36 advisories x 33% critical = 11.88

SuSE: 48 advisories x 27% critical = 12.96

Red Hat: 60 advisories x 12% critical = 7.2

Solaris 9: 60 advisories x 20% critical = 12

As far as the less than "highly" critical holes in the OSes, so what? Those are just minor bug fixes. I appreciate companies like Secunia finding them, but when the majority have to be exploited on the full moon of a month not ending in "R" while waving a dead chicken and rubbing a balloon on your head and typing your root password with your left foot, I'm not so concerned. I won't even mention what *I* actually use. The whole article is pointless.

Zombies

[Jazzy1]

How many Mac zombies are there sending out millions of spam messages?

Macworld dismisses Secunia as purveyor of FUD

[eltoyoboyo]

This May 2004 Macworld editorial talks about "Henny Penny" attitudes. [I guess they meant "Chicken Little" as in "The sky is falling".] Macworld writers have been dismissing Secunia for months as a FUD source for security issues with Linux and MAC OS.

What a terrible article

[pavera]

This article is complete bunk. For example, There are 2 security errata on RHN right now for the kernel, both of which either require local access or a very poorly configured server to exploit, but this company probably counts both of them as critical although of the hundreds of servers I manage only 1 is vulnerable to either of these (I only have one machine with local users on it, and I'm not running the kernel NFS server anywhere).

Further, it states that RHEL 3 has had 50 vulnerabilities since last Nov... well, I'm quite sure that they are counting bugs in all of the software included with the distro. Most of my servers are just running a barebones amount of services, any one advisory might hit on 2 or 3 of my 500+ servers (unless its something like openssl/ssh..) But anyway, on the few windows servers I manage (about 10) every vuln hits on all ten of them every time. It is much more difficult to patch those 10 systems than the 500+ redhat boxes (log in to RHN select the errata, click apply, wait a few hours done). With the 10 windows machines, walk into the data center, walk to the windows rack, pop open the kvm, log in to 1 server, go to windowsupdate, start the download, log into the next, start download * 10, then reboot all 10 servers use my downtime for the next 2 years... and ok 2 hours later, during which time I had to actually be monitoring all of the boxes and couldn't do anything else, I've patched the latest IE hole....

Out-of-the-box security is important too

[mrmacman_g4mac.com]

One other point of note is how secure an operating system is _out_of_the_box_. For example, when I get a brand new Mac OS X machine, plug it into the net, and turn it on, it has 0 probability of getting rooted, because no services are running. This is true of a completely unpatched OS. On the other hand, if I install a brand new Windows box and connect it to the internet, it will usually be rooted within a day, because it starts 6-7 services automatically, ones that may have serious security holes or other problems. A Linux box is not particularly better than Windows in that respect, although the services generally have fewer holes, because it has a bunch of stuff in /etc/inetd.conf and several RPC services running.

Where's the study?

[gvc]

I went to Secunia's site and saw no reference to the study, even for a price.

I am very suspicious of outfits who describe their results with hyperbole like "dispels the myth" but fail to make their research report available for scrutiny.

It sounds like this study uses "retrospective" methodology, which is OK, but one must be very careful to assess the meaning and transferrability of such results. In general, retrospectives don't yield blockbuster evidence that "dispels myths."

Here, in contrast is proposed hypothesis for a forward-looking study: I predict that a larger fraction of Windows machines will be compromised in the next 12 months than machines running non-windows operating systems. That is, the probability that a given Windows machine will be the victim of a successful attack is higher than the corresponding probability for a non-windows machine.

Same old FUD.

[jschottm]

You can make statistics to prove just about anything you want. What makes the data useful is good analysis, which this article does not have.

The OS X/Linux vulnerabilities include many, many third party applications that they bundle. The Windows list almost exclusively covers Windows the operating system and IIS. If you really want to do a comparison, load up Windows with two or three office software suites, Visual Studio, Safe Source (the way that the Cisco hackers got in), etc., etc., and then compare vulnerabilities.

Further, the study doesn't correlate remote and system access attacks. The MS RPC vulnerability and the two Linux Kernel escalation of privilege vulnerabilities both gave system access. But one was sitting wide open for random attacker, and two took getting into the system in the first place. A very big difference.

Also, many Linux distributions and OS X ship with a minimum of services turned on, so they are inherently much safer out of the box. Most of
the vulnerabilities for *nix/OS X were server related, which desktop users wouldn't have on or installed. Most of the Windows ones were things that you'll find on almost all installations.

If you want, we can do a show of hands of how many Windows systems have been compromised vs. how many Macs. Even adjusted for the Windows/Mac ratio, I'm pretty sure that OS X will come up as safer.

With OS X and most modern Linux systems, you _have_ to work to create security problems. Whereas each new Windows installation I do requires a series of patching via CD or memory key before I can put it online to download the rest of the updates...

Unobfuscated numbers

[Jeremy Erwin]

Halfway down the article, the reporter starts comparing percentages, as if that's supposed to be of any use.

Suppose, some company designed an operating system with one exploit. Suppose that this single exploit was determined to be "critical". Sucunia would have us believe that this means that due to incompetence, this OS tops the chart with a 100% "critical" rating, even though the aggregate number of bugs is less than 2% of it's competitors, and the aggregate number of critical bugs, less than 9 %.

OS........ Total Remote System Critical
Windows XP 46 22.08 21.16 13.8
MacOSX.... 36 21.96 11.52 11.88
RH........ 50 33.00 12.5 6.000
SUSE...... 48 27.84 17.76 12.96

Windows has 21 System exploits, MacOSX has 12. The OSs seem to have about the same vulnerability to "Remote" exploits, assuming, of course, that each release starts out with a clean slate, and that say, WindowsXP is invulnerable to a Windows NT exploit...

The truth is simply this...

[Anonymous Coward]

I work as an IT security analyst for a certain large R&D firm, and I can tell you with utter confidence that Windows is far less secure, not only because so many things are tied into the kernel, but becuase the admins that run Windows tend to know less about the inner working of their OS.
After 6 years years of being an IT geek, I've seen Solaris boxes get owned, as well as Windows boxes.
There is some truth to making an OS secure out of the box. The admins who then proceed to deploy the boxes MUSt turn on required services, not the other way around. We are living on an increasingly more dangerous Internet. OpenBSD, while utterly lacking in out-of-the-box ease of use, is the single most network ready OS out there for *nix if you require security. Linux has the Bastille project, secure distros, and the ability to view the code if I'm unsure.
Windows, Mac OS X, and most others are INSECURE out of the box. Being in a LAN beyond a firewall is also not a sure thing. Firewalls have rules that allow certain ports opened. What happens if next week there is a devastating exploit for SSH and that is an allowed port?
It boils down to what Bruce Scheier of Counterpane says: "Security is a process, not a product."
If one can deploy an OS that is "safe" like OpenBSD on a LAN, then so much the better. I'm hoping that all OS developers start to release products that are locked down by default. NOt only is this safer, but the admins who work the boxes tend to learn more about the security process. They tend to think.. "hmmm, should I run telnetd or not? Do I really need it?"
Security is a process, not a product.

Actual Installed Software

[chill]

The better comparison would be which vulnerabilities affected the average install of Windows & Linux, as opposed to the entire package list supplied.

A quick glance at RHN shows me 17 patches for my registered system. These are dated from 11-15-2002. If you look at just the patches that affect the server system I deployed in February, that narrows it down to 4.

One only applies if using the kernel nfs server. I don't. 3

Two others are local exploits -- and I am the only one with a shell account on my servers. Still, if someone could exploit Apache or my PHP scripts, it is *POSSIBLE* to maybe exploit these.

In all fairness, one of my systems was the victim of a DoS due to the recent OpenSSL vuln.

* * *

And, in the other corner, Windows XP -- the last Windows system I installed for someone.

They live out in the country and had a dial-up account. And the system was infected and 0wn3d before I could download the Windows Update updates -- from a fresh install.

I had to go home, download all the updates to a CD and bring it back. Also all the AV updates. And ZoneAlarm, and a dozen other packages to make the system useful and secure.

I know I compared a server system to a desktop. However, my desktop hasn't had a virus, worm or trojan in almost 10 years on my various Linux desktops. That wasn't a fiar comparison.

-Charles

3 easy steps to profit!

[BufferArea]

1. Find security bugs in operating systems 2. ??? ->write analysis comparity security among them 3. Profit! -> Take funding from Microsoft showing how Windows is more secure!

A ripped text from the wonderful "appleturns"

[Biotech9]

Unrepentant Mac Apologism time! It seems that there are some "statistics" flying around that can be interpreted to mean that Mac OS X is, practically speaking, no more secure than Windows, and we certainly can't let that sort of stuff go unchecked, now, can we? Whether it's true or not, we mean. So we feel it's our sworn duty to cast all sorts of aspersions on the reliability of said stats and on the character and competence of those who compiled them. Of course, you'll have to keep in mind that absolutely nothing we say on the subject carries any weight whatsoever, since, far from being experts on computer security, our real expertise is in the field of making vegetables out of Play-Doh. (Corn on the cob is our specialty. We can get it all bumpy and everything.) However, while we're not security experts, we've seen one on TV; surely that counts for something.

Anyway, it's like this: faithful viewer C. J. Corbett tipped us off to a Techworld article last week with the ominous title of "Mac OS X security myth exposed" which leads off with this oh-so-fair-and-balanced sentence: "Windows is more secure than you think, and Mac OS X is worse than you ever imagined." See, security firm Secunia claims to have compiled some honest-to-goodness statistics proving once and for all that choosing Mac OS X over Windows is your surest path to having some scary 'net dude invade your system, swipe your financial data, and start leering at digital photos of your family members in an... unsavory manner.

How is this possible? Well, numbers don't lie, and while Windows XP Professional clocked "46 advisories in 2003-2004, with 48 percent of vulnerabilities allowing remote attacks and 46 percent enabling system access," Mac OS X racked up 36 such advisories, with 61 percent remotely exploitable and 32 percent allowing the takeover of the system. See? Worse than you ever imagined. It's like a wedge of Swiss cheese with a shotgun blast through the middle or something. Meanwhile, Windows users will no doubt be thrilled to hear that their virus-ridden, spyware-loaded, worm-propagating systems are more secure than they think. Good for them.

There are just a few problems with this argument, however. The first is the claim that Mac OS X isn't much better than Windows XP Professional because it had 36 security advisories compared to Windows's 46. Maybe we're fresh off the turnip truck or something, but 22% fewer advisories sounds quite a bit better to us. Also, if you actually look at the data to which Techworld refers, it's not 36 advisories for Mac OS X at all; it's 33. (Apparently Techworld decided to go back to 2002 to fetch its reported number.) Granted, the Windows number is also 45 instead of 46-- yeesh, Techworld; fact-check much?-- but even so, now we're talking about nearly 27% fewer security advisories for Mac OS X than for Windows XP Professional.

Now take a look at the advisories themselves, and notice how no fewer than eleven of those 33 advisories (that's a third, for the mathematically inept) are titled "Mac OS X Security Update Fixes Multiple Vulnerabilities" or something similar. Yes, in its advisory count, Secunia is including those advisories it generated just to report that Apple had fixed something. Does anyone else find it a little odd that Secunia penalizes Apple for fixing problems, including ones that were fixed so quickly that Secunia had never found out about them in the first place? (While they may describe a flaw and immediately note the presence of a patch, none of the Windows advisories appears to exist simply to announce that Redmond had fixed a bunch of holes.)

Notice also that Secunia yaps on about how, for Mac OS X, "of the 36 advisories issued in 2003-2004, 61 percent could be exploited across the Internet and 32 percent enabled attackers to take over the system"-- but never mentions how many could be exploited across the Internet to enable attackers to take over the system. Personally, we aren't much concerned about exploits that require local access to a Mac, because if any

Anything about FreeBSD, NetBSD or OpenBSD?

[Anonymous Coward]

Anything about FreeBSD, NetBSD or OpenBSD?

Re:Anything about FreeBSD, NetBSD or OpenBSD?

[Anonymous Coward]

No, because *BSD is dead.

That depends upon how you count it.

[khasim]

In the Forrester report referenced in that article, they only STARTED counting from the time Microsoft PUBLICLY admitted to a problem.

Which, in many cases, was when Microsoft had a patch ready.

But www.eeye.com had reported security holes to Microsoft for MONTHS before a patch was made available.

In other words, if Microsoft NEVER admitted PUBLICLY to a security hole, that security hole would NEVER be counted in the Forrester report.

http://www.eeye.com/html/research/upcoming/index .h tml

For the current listing.

With Open Source software, the vulnerability is usually discussed on the mailing list.

So, if a hole is discovered in Linux, and discussed on the mailing list and a patch is released 48 hours later.....

And then Red Hat releases a .rpm 24 hours later...

Forrester would count that as a 3 day delay.

You take the medium threat from www.eeye.com that is 49 days overdue (actually informed 109 days ago) and Microsoft releases a patch the same day Microsoft admits to the hole....

Forrester would count that a 1 day or less delay.

Bad reporting

[Erik Greenwald]

I find this article difficult to take seriously given the second word in the abstract, 'Microsoft', is misspelled on the ComputerWeekly site. I'd hope any professional author writing a professional article would at LEAST grind it through spell checking software before publishing, particularly for a piece intended for management types instead of tech weenies. WTF is 'micorsoft'?

Secondly, it's not the bugs that are known and reported that concern me, it's those undiscovered and/or kept hidden. The reporter sensationalizes that fact even with quotes from Secunia's CTO saying bugcount is more or less irrelevant..

-Erik

To use an analogy...

[3seas]

... consider your brain on the internet...

How many can get faulty information into it without your knowledge?

Now, consider your computer on the internet....

How many can get faulty information onto it without your knowledge?

Now there are two ways to solve the problem, one of which works with absolute certainty.

*) Do not connect to the internet.

or

Become aware of all communications from the internet and your computer.

This second solution direction may require reducing such communications to human understandable parts....

but if that happened then the wool would be lifted from the eyes of the end users as to what they really can do....

Lies, Damn Lies, and Statistics

[cryptochrome]

This article is complete garbage. Comparing proportions means nothing - particularly since they always add up to 100%! What matters is the actual number of exploits, and how likely they are to occur. The parent is absolutely right.

-1, Troll!

[Slashamatic]

Telnet has been a depreciated protocol for donkeys years now. Most Linux distros I know will not enable it (hey, the daemon isn't even installed, so I call it more than turned off as you call it) unless you really want it and indeed sshd is the preferred option.

Re:-1, Troll!

[Anonymous Coward]

Telnet has been a depreciated protocol

Assets depreciate (lose value).

Protocols are deprecated (disapproved).

Re:-1, Troll!

[darkjedi521]

The distro I'm running doesn't even install the client out of the box. PITA when you are trying to talk directly to an SMTP or HTTP server to troubleshoot.

Like with like

[alex_tibbles]

MS Windows does come with a lot of software (server editions come with IIS etc.), but Redhat comes with more (5 mail servers, 4 RDBMSs ...). XP Pro is not a server OS. Redhat ES is. We should be comparing Windows Server 2003, with a comparable groups of server packages (including Exchange etc.).

I don't think so.

[khasim]

Why not just stick with numbers for the entire statement?

Rewritten: "Windows XP Professional saw 46 advisories in 2003-2004, with 22 vulnerabilities allowing remote attacks and 21 enabling system access, Secunia said."

An even better way: "Windows XP Professional saw 46 advisories in 2003-2004, with 15 vulnerabilities allowing remote attacks and 14 enabling system access and 7 enabling system access via a remote attack, Secunia said."

(I just took 7 from each to make it clearer.)

I don't trust percentages given without support.

I honestly don't care...

[Anonymous Coward]

Look! I spend hours each week cleaning adware/spyware/viruses off of my client's Windows machines. This is in spite of the fact that I have gotten throught to most of them and they have the protection that Windows requires (firewall, AV software, updated machines).

I have helped setup a few (very few - 3 so far) Linux boxes for clients that were fed up with the situation. I never hear from them unless it is a "I can't get my (pick one) scanner, printer, camera, [something]" working on Linux." Don't get me wrong, I get plenty of that from Windows clients, too. But I would much rather work on those problems than cleaning yet another spyware/adware/trojan infested machine!

I am not a slouch at this (take that however you want, I manage to stay pretty clean on my network at home), but I have myself been infested with that particularly nasty bugger, CoolWWSearch, a couple of times. Both stemmed from a switch to IE 6.0 that was forced on me by my DSL provider. The second time, I had IE 6.0 buttoned down as tight as it can be! I have since switched DSL providers and dropped back to IE 5.0. No problems!

Now I have to have some Windows machines at home: my clients depend on it, my regular job depends on it and my son wants to run those nifty on-line games. So I don't have a choice. But I find myself increasingly using non-Microsoft products to keep Windows from being compromised!

My firewall runs Linux (IPCop). Stripped down to its essentials, the firewall has only required 9 updates in a year of service. I use Mozilla to browse the Web and manage e-mail. I haven't used it long enough to venture a guess about updates but CoolWWSearch ain't been back! I never did use Outlook so I haven't suffered from any of the myriad of Outlook exploits! The list grows as I do more for my clients; do you really think I am going to recommend IIS or SQLServer with their security histories?

So these stats don't mean anything to me. I don't care whether or not other products are inherently more secure or it is just the fact that Windows is more popular. The fact is that connecting to the Internet, as it exists today, with Windows is like playing Russian roulette with 5 bullets (assuming a 6-shot revolver)!

This is an absurd way to calculate OS security

[rjbrown99]

Just looking at the number of critical issues for an operating system is absurd. What about default configuration? OS X by default does not listen on any network ports. Scan a Windows XP system and you'll see MANY ports, including 137, 138, 139, and 445 - the NetBIOS services that are typically exploited by attackers. With those services you can launch remote password guessing and other attacks against the base system.

On anoter note, how about we tally the number of viruses and trojans for the different operating systems? This is one of the most important security problems facing businesses today. Gee, I think we'll see a MUCH different ratio for OS X vs. Windows XP.

I can't stand it when a security company comes up with skewed statistics in an effort to get press and web hits. The comparison of only the number and type of vendor bulletins is not an effective measurement of OS security.

Interesting time to publish the report

[Brett Johnson]

Interesting time to publish this - right between last week's IIS/IE multiple exploits and this week's Evaman Worm outbreak.

Now that CERT and the Dept. of Homeland Security both recommend consumers abandon Intenet Explorer, can we get them to recommend dropping Outlook Express?

Drivel ... OS X is still safest.

[bonaldi]

Can we please differentiate between a vulnerability and an exploit? Mac OS X has no exploits (aside from proof-of-concepts). It has had vulnerabilites, including some serious ones, but *not one* has turned into an exploit.

That makes how many have been reported compared to Windows utterly irrelevant.

And all that talk about "but windows has more users so it gets viruses written" is horseshit too. Why do people write viruses, for notoriety, right? Well remember the noise that surrounded the discovery of a simple vulnerability in Mac OS X? Can you image the fame that would surround the writer of the first OS X virus? It would be *huge*.

Finally, even if that supposition were true, wouldn't it still be better to be on OS X? There's no way it'll ever get to 98% marketshare, so it'll always be safer by that logic.

Let's translate those statistics to medicine

[borjam]

I wondet what would be the Secunia diagnosis in this case:

Patient A's clinical history:

Headache
Influenza
A small scar in his hace
A broken arm

Patient B:

Stomach cancer

Which of the two patients is in a worse state? According to Secunia, patient A would be really bad, he has three lines in his medical record!!!!

Amazing, indeed

LM Hash Info

[EventHorizon]

FYI thebroken has some basic TechTV-style coverage of LM hashes:

http://www.thebroken.org/

including the regkey that disable thems.

For all the haters: Seems like this situation is akin to the MD5-vs-DES crypt(3) dialog Debian gives you upon install--except that shadow doesn't also store the weaker DES hash when you select MD5.

For those of you still on a Microsoft platform: I've heard that L0phtcrack works wonders reversing an LM hash on modern hardware. Godspeed with your WinXP password recovery.

Re:LM Hash Info

[Anonymous Coward]

The broken is an interesting show however the tips you get from them are often very old and outdated and extremely ineffective. Episode one and two consist of virtually no information that is useful and episode three is probably useful for people that have no clue where to begin with computer security. Most of the information in all the episodes has been widely available for a long period of time for anyone that looks. I showed the videos to most of my co-workers who are also Computer Programmers and most of them related the show to a perfect show for script kiddies as it mainly points to scripts and programs that have been made by others to perform your so called hacking/cracking.

Re:LM Hash Info

[pegr]

For those of you still on a Microsoft platform: I've heard that L0phtcrack works wonders reversing an LM hash on modern hardware.

I've used LC and you're right, it works pretty well. It's also ungodly expensive and the serial number is tied to your hardware, so using it on another machine requires tech support "blessing". LC5 is licensed in truly bizarre ways, and did I mention that it's ungodly expensive?

For the same or better brute forcing speed, lower cost, no hassles moving to another machine, and generally a more polite program, try SamInside Best $40 LM hash cracker around.

Now for a "free" instant password cracker, use Rainbow Tables, a db of password/hashes that does all the brute forcing up front. For details, check out my journal. I'm soliciting participants to help generate the 128GB of data needed. Other than the pain of generating and storing all that data, it's free and extremely fast.

Re:LM Hash Info

[Anonymous Coward]

For all the haters

I love seeing this word. It reminds me why I *never* listen to USians and their shallow childish opinions. It seems to be a fashionable word, these days, to describe anyone you don't like or disagree with.

What's the matter... have you been watching The O'Reilly Factor a lot recently and it's left you unable to converse on an adult (non-USian) level?

Re:LM Hash Info

[Anonymous Coward]

"FYI thebroken has some basic TechTV-style coverage of LM hashes:"

The last broken tip was to download L0phtCrack. Almost all the tips are merely pointers to external programs that are widely known and freely available. Furthermore, none of the hosts on the broken create any of the programs and they simply regurgitate widely available information.

There tips are similar to the following :
Broken : Need to crack a password
Viewer is thinking : Ok
Broken : Download this to do it for you.

They give no insight or explanation of the fundamental reasons how it works or why it works I don't see this creating nothing but more script kiddies.

Re:LM Hash Info

[Anonymous Coward]

Yep, us USians are all the same. We all watch Bill O'Reilly and make cracks about France and use terms we learn on MTV and Jerry Springer.

Get a fucking life.

Re:LM Hash Info

[EventHorizon]

"Hater" is just expedient, colloquial slang.

Exactly like with your "USian", which is shorter than "Resident of The United States of America".

We're both using verbal compression, so now kindly uriniate aft.

Re:LM Hash Info

[cbreaker]

L0phtcrack is also very easy to get from Usenet, and you can crack it and run it on any machine you want.

Although not really good for the IT professional doing a security audit, it is good for some joe shmoe on your network that wants to cause trouble.

Re:LM Hash Info

[Anonymous Coward]

True enough: Calling you a "pathetic USian cock-monkey" is verbal compression for "I find your tedious opinions to be almost completely without merit, and lacking even the basic understanding of the issues. In addition, your casual use of a term made popular by right-wing demogogues in an attempt to bring political discussion down to the level of playground slagging match, is typical of the immaturity shown by most residents of North America. Thank you for attention, you may now go back to consuming and regurgitating crude propaganda and thinly disguised newspeak."

Re:LM Hash Info

[jtev]

Um, the term hater started in black popular culture. The US is a melting pot of ideas and English, especialy American English is a melting pot of linguistic content. It is said that other languages borrow words, while English hunts languages down in dark alleys, beats the crap out of them, and riffles through their pockets for loose grammar.

Now that you know the origin of this word you are free to continue disliking it, however please, at least be accurate in your diatribes. Thank you for your time.

Re:LM Hash Info

[Anonymous Coward]

You do understand the words "made popular", do you? "Hater" most certainly did not start in black popular culture, it is a word with a very long history -- I suggest looking it up before you mouth off again. It's recently come into more popular use through: 1. Right-wing mouthpieces 2. Black culture. A rather odd pairing at the best of times.

Now I doubt that EventHorizon is a black gangsta, so he's simply parroting what amounts to newspeak. As for American English "especially American English is a melting pot for linguistic content" -- Britain is surrounded by a huge number of different languages and has subsumed enormous numbers of words from them. Quite why you think America is "special" in that regard is a bit of a mystery. If anything, America is rather isolated and parochial when it comes to languages.

And whatever the origin of the term, it is (as I said originally) a moronic and lazy way to dismiss those who disagree with you, which has recently come into mainstream (ab)use by those who want to reduce discussion to crude propagandising.

Re:LM Hash Info

[jtev]

Britain isn't "surrounded" by other cultures, it has them to the south, and to the east. British English was formed by repeated invations of the british isles. American English has been influenced by repeated waves of immigrants. While it's somewhat isolated, it has had a rather high level of immigration, which does create a lot of cultural influx. Also, the way I read the post was he was refering to those who hate windows, not those who thing his arguments are stupid. My main bitch was that you were using the wrong source to bitch about. I'll admit it, I am a shameless troll on not so rare occations.

Re:LM Hash Info

[Anonymous Coward]

Britain isn't "surrounded" by other cultures,

Yes, yes it is. It isn't surrounded by land masses... but it is surrounded by cultures. Have a think about the difference.

British English was formed by repeated invations of the british isles

Among other things. How is this relevant?

American English has been influenced by repeated waves of immigrants.

As has British English... the British Empire dragged in influences and language from every corner of the world.

My main bitch was that you were using the wrong source to bitch about.

But you see... I wasn't using the wrong source...

yeah right ok

[l3v1]

Windows XP Professional saw 46 advisories in 2003-2004

Right. 46. In 2003-2004. 46. If this was 42, I would've swallowed it with a sad grin. 46. Jeez, people, counting shouldn't be so hard :P

Anyway, I'm sick and tired of these kinds of "opinions" and "reviews" :thumbsdown: People who "know" try to persuade and convince dumb lames who "think they know". And they get loads of cash for it.

They know they lie. We know they lie. Those who don't, will find out eventually. I'm waiting for that day :P

Re:yeah right ok

[maximilln]

They know they lie. We know they lie. Those who don't, will find out eventually. I'm waiting for that day :P

As long as the liars continue to profit we'll never see it.

X is remotely exploitable

[cryptoluddite]

I haven't seen it mentioned yet but it should be pointed out that virtually everything in Unix or Mac OS X "could be exploited across the internet". A temporary file bug in gzip could be exploited across the internet. A bug in automake could be exploited across the internet.

How many of these "over the network" holes can be done by somebody without an account? If the number of those in both OS X and Linux combined, covering the range of software that comes with Windows, is more than two or three then that would be a newsworth story. What this story is really saying is that even though you can't do squat remotely in Windows there's still a huge number of remote exploits.

But isn't that contradictory?

[khasim]

Somehow, the rest of your post does not support, and seems to contradict, your initial statement.

A "respectable security source" that knowingly mis-counts vulnerabilities and then publishes an inflammatory "report" based upon such?

That sounds like the opposite of "respectable" to me.

Re:But isn't that contradictory?

[maximilln]

The author of the article is

Matthew Broersma writes for Techworld.com

Which did not stop him from doing a cursory gloss-over of pie-chart statistics on Secunia's website.

I mangle entries for these security databases. Without Secunia's database and information my efforts would be significantly hindered.

Now this quote:

"Secunia is now displaying security statistics that will open many eyes, and for some it might be very disturbing news," said Secunia chief executive Niels Henrik Rasmussen. "The myth that Mac OS X is secure, for example, has been exposed."

shows us that Mr. Rasmussen should be shoulder checked, repeatedly, for three hours on the soccer field.

Proof that the results are BS

[schmiddy]

I was looking at Secunia's Virus Info Page .. right under the graph it says "Based on Information delivered by BullGuard".

That set off a few bells... Know what BullGuard is? It's spyware that happens to come bundled with Kazaa. Amusingly, you can see BullGuard on Kazaa's *cough* No Spyware Policy Page, where they try to pretend that their bundled software isn't spyware.

Mainly true, but...

[ricky-road-flats]

The default install of Windows Server 2003 is much, *much* better in this respect - not even file sharing is enabled until you explicitly enable it, and the IE is tied down tight as well.

If this is an indication of where they're going with XP SP2 and onwards, things are going to seriously improve. We're actually considering rolling out Windows Server 2003 Web Edition on laptops - from a security point of view it's well worth the extra 50 UKP it costs, and the hardware compatibility is excellent to...

# Advisories != # Vulnerabilities != Security Risk

[Trevin]

There are two major things wrong with this article, which have been touched on by other posters. One is that the number of vulnerabilities is different than the number of advisories, because advisories can cover multiple vulnerabilities.

The second is that (as other posters have covered) Linux distributors post advisories and bug fixes for all software bundled with their distribution, not just the kernel and core libraries. Looking at the list of MS Windows XP advisories, all I see are the core components, with the glaring omission of Internet Explorer (which these days is in fact a core component of the operating system).

Perhaps....

[Anonymous Coward]

Perhaps MS have "funded" this research because everyone is buying X serves, like me. To be frank I couldn't give a toss what a possible MS funded company says, they would already be way to tainted for my tastes.

Viruses on my 6 OS X systems: NIL, ZERO, NADA, 0

Viruses on my 3 xp machines, to many to mention, that is why they have remained switched off for the last 4 months.

Fuck off secunia, fuck off MS.

Re:Perhaps....

[Anonymous Coward]

Viruses on my Windows 2003 box: 0
Viruses on my Win98 setup before that: 3-4 in 7 years. My fault for not scanning before running foreign apps.

Don't blame the OS for your own incompetence.

The Real Measure

[eggnet]

How many of OSX's exploits were still exploitable when behind a firewall?

The problem with Windows is exploits in IE and Outlook/Outlook Express.

Not potential, it is a study problem

[burnin1965]

In the XP stats they show one advisory for IE. But looking at the exploits statistics on the same website you find that the one Microsoft application by itself has about as many exploits as other competing operating systems and all their applications combined:

secunia.com/product/11/

Sorry Windows lovers, its time to face the facts, your OS of choice and associated applications are a haven for worms and viruses not because there are so many of you, its because the software is crap.

burnin

Re:And whom funded this 'article' - a good page

[Anonymous Coward]

Here's a pretty decent explanation:

WHO/WHOM

This study is bogus

[cowbutt]

a) it doesn't take account of the window of vulnerability between discovery (or, at the very least, public disclosure) and a working patch being made available. This study does. Google finds more details for those that want 'em.

b) All Linux distros ship far more software than Microsoft does with Windows, and rarely will all of it be installed and running on a given system. If a vulnerable package isn't installed on a given system, then that system isn't vulnerable. To compare like with like, you'd need to take Windows' stats and add them to IIS, Exchange, Mozilla, Office/OpenOffice.org, Cygwin/SFU, SQL server, a bunch of free and shareware IRC clients and so on.

If folks are going to play these silly pissing contests, then the only fair way to do it is to take account of the period of vulnerability and base comparisons on "role profiles" (e.g. PHP web server, anti-spam MTA, static web server, graphical desktop).

--

A turd is a turd

[burnin1965]

There is truth in your statement, however, it does not change the fact that Windows and its associated applications have a significantly larger number of flaws when compared to the competition.

If you look at the secunia statistics for IE you find that by itself it has nearly as many exploits as competing operating systems and all their associated applications combined.

secunia.com/product/11/

burnin

Re:A turd is a turd

[Anonymous Coward]

Windows and its associated applications also have a significantly larger number of users as well, so whats your point?

Re:A turd is a turd

[burnin1965]

I'm sure I'm wasting my time responding to an AC post, but here goes.

My point is that Windows and its associated applications, such as Internet Explorer, are turds.

I agree that system administration plays an important role in securing any system, however, that does not change the fact that Microsoft software is delivered to the administrator with vastly more flaws than comparable software from the competition. And while a good sys admin can secure their Microsoft install base it is going to be a hell of a lot more work than it would have been with competing software. There is also a higher probability they might miss something because there are so damned many holes to plug.

So what is your point? Are you trying to say that there is some type of relationship between the number of users and the exploitability of some software application or OS?

I hope not because that's a lame arguement, but just in case I'd like to make a proposal. There is no way to prove a theory like that either way unless we get a comparable install of open source software so we can get a good measure of which has better security. So lets start with current high level recommendations of everyone switching to a Mozilla based browser and dumping Internet Explorer. If we get enough people to switch then perhaps we can get some good data from which to assess that arguement. Until then its a bogus arguement that can't be proven either way.

burnin

Methodology is flawed...

[rdean400]

as with other flawed "surveys," this one doesn't seem to account for features that are disabled by default, or that can't be exploited if the vunerable package isn't installed.

The solution

[anynameleft]

I know what you need to do when you want a file server, use File Exchange! Sure, it is exploitable (can be crashed, vulnerable to DoS, possibly allows access to every file on the server to anybody) but heck, I haven't had the time to issue advisories yet! And if I had, the leaks are years old already! And if they hadn't, it would be only three advisories!

And sure it runs on Windows, but what OS has been "proven" to be the safest by Secunia :-P

Crap.

[Anonymous Coward]

Gha, seems that didn't do it (did catch me telnetting in doing a "SEARCH /"-request though). Okay, trying:

SetEnvIf Request_URI "^SEARCH.*" nolog
SetEnvIf Request_URI ".*(\\x90)+.*" nolog

If this doesn't work I'm going to get angry, and you wouldn't like me when I'm angry.

Rainbow Tables + EFS?

[EventHorizon]

Cool. Will this full rainbow table allow for simpler decryption of Windows encrypted files?

Based on my limited Windows knowledge I believe it will: The NTLM hash is not one-to-one. However the rainbow table can (in theory) provide multiple NTLM keys, one of which is probably the original user password that will ALSO re-hash for EFS.

Seems like your LM RT is an EFS accelerant. Comments?

Re:Rainbow Tables + EFS?

[pegr]

Cool. Will this full rainbow table allow for simpler decryption of Windows encrypted files?

Based on my limited Windows knowledge I believe it will: The NTLM hash is not one-to-one. However the rainbow table can (in theory) provide multiple NTLM keys, one of which is probably the original user password that will ALSO re-hash for EFS.

Seems like your LM RT is an EFS accelerant. Comments?

Wow, I hadn't really considered it. I'll have to research it. If it's so, well, I'm pretty much floored by that one...

Ok all you technicality asshats

[paranode]

The point is that PRACTICALLY, Microsoft is the most insecure operating system because you cannot hook a default install up to the internet without getting 20 worms by the time you patch it up.

In THEORY, you are correct that it is all about exploits and there are possibly exploitable holes just as much in Linux or Mac. Difference? In the real world, they are exploited much less on the latter two. Also, critical issues are fixed MUCH faster in the latter two leading to a less vulnerable system.

MOREOVER, these assclowns count a vulnerability in every piece of free software as a Linux vulnerability and only count core vulnerabilities in Microsoft. Similarly for Mac probably. So yes, exploits are what matters, but in the REAL WORLD there are more exploits for Windows and more boxes constantly being exploited, so your point is moot.

Re:Ok all you technicality asshats

[Anonymous Coward]

In THEORY, you are correct that it is all about exploits and there are possibly exploitable holes just as much in Linux or Mac. Difference? In the real world, they are exploited much less on the latter two. Also, critical issues are fixed MUCH faster in the latter two leading to a less vulnerable system.

In thre real world they're used much less than Windows.

MOREOVER, these assclowns count a vulnerability in every piece of free software as a Linux vulnerability and only count core vulnerabilities in Microsoft.

I always found this hypocritical of Linux advocates. When it comes to vulnerabilities Linux advocates hate it when "...in every piece of free software as a Linux vulnerability..." but when it comes to useability Linux advocates champion every piece of free software as Linux.

Which is it guys? Is Linux just the kernel? Or is it an entire distribution? Once you decide please be consistent when you discuss vulnerabilities and useability.

Re:Ok all you technicality asshats

[Anonymous Coward]

"In the real world, they are exploited much less on the latter two."

In the real world you would also realize that if everyone started using Mac, as you seem to preach, and it has lots of exploits that viruses would soon ensue as it would make it worth it for coders to target Macs. Security through obscurity is not a good tactic, even for someone lacking any knowledge of the subject such as yourself should be aware of that.

"Also, critical issues are fixed MUCH faster in the latter two leading to a less vulnerable system."

Wrong, where are you getting your information from. Let me guess Apple.com. Apple is by far the slowest in patching vulnerabilities there are still plenty of Mac OS X exploits that are in the wild and highly known (including those known by Apple) and Apple has not even addressed them yet. Apple is known by most to be incredibly slow at fixes for the Operating System. Before you call people asshats you may want to learn something about computer security as the parent poster is correct and you are a clueless troll.

Re:Ok all you technicality asshats

[NemosomeN]

It depends. "Linux" (As a word) is so grossly overused, it's just a buzzword for whatever a writer wants it to mean. I've seen "Critical Updates" for things like games allowing remote execution of code (Can't remember when it was, or what it was. Don't think it was long ago, but I laughed hard). I say count MS core bugs, and count "Linux" bugs inherent to the kernel and things such as Apache, etc. that are going to likely be running in a server environment. Also, don't test for things such as Apache with EVERYTHING installed. (Or whatever, but security analyses are mostly done for servers. Remember the #1 rule: Fuck the user).

Re:Ok all you technicality asshats

[Anonymous Coward]

It depends. "Linux" (As a word) is so grossly overused, it's just a buzzword for whatever a writer wants it to mean.

That's true. That's why I'm asking for a consistent use from the Linux community. As you've noted they change the definition of Linux based on what their needs.

Also, don't test for things such as Apache with EVERYTHING installed

As long as you're willing to make the test situations equal I have no problem with this.

Re:Ok all you technicality asshats

[NemosomeN]

Interestingly enough, with my example the equivelant test would be Apache on Windows as well. IIS just isn't as widespread, as much as I'd love to include it with Windows. And, although the Linux community does it as well, it's mostly journalists who get it wrong. It is, I admit, very hard to get it right without confusing your readers. Mostly people have only seen the word "Kernel" in white text with a blue background.

Re:Ok all you technicality asshats

[Zareste]

Painfully true. Did anyone read the article by chance? There were lots of bad percentages, according to what Secunia says. Plenty of vulnerabilities, according to what Secunia says. And all sorts of flaws, accor-- you know. Anything specific? Nope. Why isn't anybody stepping forward to point out OS X's many vulnerabilities? The same reason nobody steps forward to point out how the sun revolves around Earth.

The article and claims wherein are humorous and all; maybe a little fun to read, but I'd say it lacks a punchline. And if per chance they're trying to boost the sales of Windows or other systems, they could try harder than this. If all you have to go on is how many potential vulnerabilities a system could possibly have if maybe more people went after it, then I should quit typing because you're computer's about to crash anyway.

Counting advisories as measure of security

[gmuslera]

• if a vendor mostly don't worry about security, will be few advisories, so it will be more secure?
• if a vendor bundles only the OS, and the competence the OS and a bunch of other programs, the security advisories of the other programs makes the os insecure?
• if a feature is "broken by design" so no fixes will be available for it, while in other OS is fixable and releases an advisory with the fix, will make the later less secure?
• if a vendor's security advisories are each one a pack of fixes, and another vendor send a one for each problem fixed, that makes the 1st one more secure?
• if a vendor fixes a reported severe problem half a year later, and the other in the next few days, how that is showed in that statistics?
• if a vendor ships an insecure by default product, that need mostly an expert to make it safe, and another a secure by default, who is the safest?
• if a vendor releases a product where is very hard to be finished the installation and finished the application of patches without getting a worm/virus/etc, and the other can be installed safely and without problems connected to internet, what is the safest?

Too many question, but just one answer: that study stinks

Did Ken Brown help out?

[StLawrence]

Secunia asserts that all the advisories are available on their site.
Perhaps it would be interesting for someone to check their
analysis using their own data.

They claim that, for Mac OS X, "Of the 36 advisories issued in
2003-2004, 61% could be exploited across the internet and 32%
enabled attackers to take over the system." But it is interesting
that they don't reveal the intersection of these two numbers: in
other words, what percentage enabled attackers to take over the
system across the internet.

They also don't talk about actual exploitation of vulnerabilities
that occurred, such as in billions of dollars for Windows exploits
vs. dollars for Mac exploits.

This smells like more Microsoft-funded FUD...

It stands to reason

[Orion Blastar]

that if Apple is not keeping up with the BSD Unix development, that the BSD exploits that need to be patched, may not be patched quick enough in OSX.

Apple did the same thing with MKLinux, the development of MKLinux fell behind that of other Linux systems, and Apple was slow to patch the security holes found in Linux.

Don't worry...

[ScottGant]

This is mainly the area of English majors who wish to justify their degrees while out looking for teaching positions. Ignoring them is usually the best thing to do.

Re:Don't worry...

[Rotworm]

I doubt it. I have an english degree and I don't care. They're just being anal, most teachers don't care all that much. If they were writing a paper for publication teachers would be nazi-esque, if they're commenting on a thread colloquiallisms are fine.

There is no such thing...

[JessLeah]

There is no such thing as "the Linux OS". There are only "Linux distributions" (or "GNU/Linux distributions" if you please) containing "Linux" (which is just a kernel) and a bunch of pieces of code that are not Linux, but individual pieces like a compiler (GCC), an editor (nano, EMACS, vim), a libc (glibc), a graphical environment (X.org)......

I am sick of hearing about "Linux OS". There is no such god-damned thing. It's like calling DOS systems (DR-DOS, MS-DOS, PC-DOS, FreeDOS, etc.) the "io.sys/msdos.sys OS".

Re:There is no such thing...

[maximilln]

Okay. Just for you I'll call it the SOTPGWAFWTCOTGLK OS. Set Of Tools, Predominantly GNU, Which All Function With The Cooperation Of The GNU/Linux Kernel.

The market share argument ...

[zonix]

The fact that they continue to hold such a low market share makes it really unnecessary for a virus writer to target them, when they can infect 100000 times the amount of machines on a Windows OS.

There's the market share argument again!

Look, I won't bore you with the usual Apache has over 2/3 of the web server market share and all that. No, luckily (in this case?!), we can now highlight Mozilla as a product which still has a low market share in the browser market - as we all know - you see, recently we've seen malware target this particular browser, trying to trick users to installing a malicious extension via XPI.

Mind you, this is not a bug being exploited, but the usual "let's hope the gullible user clicks the 'OK'-button" type of trick. It will not install without user intervention!

Anyway, the bottom-line is that the market share argument is getting old, IMHO. But more importantly, this problem has been handled excellently by the Mozilla developer and user communinity. Blocking of onload-activated XPI installations has been implemented promtly as well as an extension website whitelist (though this one is not activated by default as of yet).

z

Re:The market share argument ...

[JTMON]

"Look, I won't bore you with the usual Apache has over 2/3 of the web server market share and all that. No, luckily (in this case?!), we can now highlight Mozilla as a product which still has a low market share in the browser market - as we all know - you see, recently we've seen malware target this particular browser, trying to trick users to installing a malicious extension via XPI [mozillazine.org]."

good don't...you'll just sound like an asshole comparing a web server to an entire OS...I wonder which piece of software will have more issues...maybe the one with shitloads more code?!! Dumbass

Re:The market share argument ...

[Anonymous Coward]

"There's the market share argument again!"

The market share argument may be getting old however it is an excellent point as it is completely true that Windows is targeted almost 100% of the time as it has such a huge dominance. We're not talking 60/40 or something similar to Apache/IIS, we are talking huge dominance like Windows 90%/Others 10%.

"Look, I won't bore you with the usual Apache has over 2/3 of the web server market share and all that."

No one made a statement about Apache, Apache is a great product that has been tested on an extremely wide user base. The user base of Apache is many times larger than that of Apple furthermore the development process and the companies are so different that they can't truly be compared. However I will say that Apache has proven itself many times over by being installed and used so heavily. Linux proves by the same means and by allowing coders to go through code and try and find exploits. Mac has only proved security through obscurity, they are often slow on patches and they are aware that holes exist and yet do not focus on them.

"we can now highlight Mozilla as a product which"

Congratulations, Mozilla has picked up significant grounds in the browser market and we are now starting to see exploits for it. Will they be as bad as MS exploits, probably not as Active X is not involved, however we know that once it became more well known that exploits started to appear and people started to target it.

"But more importantly, this problem has been handled excellently by the Mozilla developer and user community. Blocking of onload-activated XPI installations has been implemented promtly as well as an extension website whitelist (though this one is not activated by default as of yet)."

How is this even relevant to any of the posts above? The line from the parent post you site doesn't include anything about Mozilla or any other type of web browser, nor does include anything about Apache although you ranted about earlier. We are talking about the OS not the web browser or any other application.

Re:The market share argument ...

[Anonymous Coward]

Are you honestly comparing a web server to an operating system? You must be completely clueless.

Re:The market share argument ...

[zonix]

good don't...you'll just sound like an asshole comparing a web server to an entire OS...I wonder which piece of software will have more issues...maybe the one with shitloads more code?!! Dumbass

Why, thank you! With respects to market share in this context, I would expect you to compare Apache to Microsoft's IIS, of course. I'm unfamiliar with the actual source code line count for these, but they largely perform the same function.

z

Re:The market share argument ...

[JTMON]

thats great but you and I both know you were taking the old market share argument which mainly applies to OSs, especially when the topic of discussion here in this story is OSs, and trying to apply it to apache..using an OS to webserver OS comparison...nice try at saving yourself though

Re:The market share argument ...

[zonix]

How is this even relevant to any of the posts above? The line from the parent post you site doesn't include anything about Mozilla or any other type of web browser, nor does include anything about Apache although you ranted about earlier. We are talking about the OS not the web browser or any other application.

I'm sorry, I may have drifted there. :-)

In light of a low market share product being targeted by malware, my intention was to illustrate the fact, that the Mozilla community responded promptly to the abuse. This has to do with how security issues are handled between vendors, however, this is not essential to my argument about market share, as you rightly point out.

Anyway, the original poster was speaking about market share, which has often been referred to in general terms - I was trying, though perhaps too implicitly, to put it into context here to show, browser-to-browser, that the market share argument doesn't much apply anymore.

As for Apache, please read my reply to the other non-AC who was kind enough reply to my comment.

z

Re:The market share argument ...

[zonix]

No, not intentionally - see my other replies! And thank you, BTW.

z

Re:The market share argument ...

[Anonymous Coward]

Look, I won't bore you with the usual Apache has over 2/3 of the web server market share and all that.

Which version of Apache has 2/3 of the web server market?

Micorsoft

[HFShadow]

Anyone know where I can find a copy of this "Micorsoft Windows"?

No stores near me seem to have it.

Re:Micorsoft

[macraig]

Heh... yeah, I seem to be only the second person to notice that misspelling in the intro paragraph of the article (and in bold, no less).

Good writing and proofreading help is *so* hard to find these days, ain't it?

I wonder how XP Home would have done...

[Beardo the Bearded]

I wonder how XP Home would have fared in this little contest. That's the real bad one. Of course, they might not have had the computing resources to find a number that high. Remember - there are three kinds of lies. Lies, damn lies, and statistics.

I think their point is that it's not the operating system that mucks things up, it's the proliferation of the OS that makes it more effective to make things muck up. If you can write an exploit for OSX vs XP Home and have it take the same amount of time to write, you're better off with the XP Home exploit because you get more compromised machines with the same work.

Your OS is not secure. There are exploits. Don't be smug, or some writer that's got a lot of time and motivation will wipe that grin right off your face.

It really did work that way

[Saucepan]

Yes, you needed to somehow get hold of a TCP stack before you could download with TCP. But there were other ways of downloading before TCP, you know. You could dial into a BBS with a terminal program and use zmodem, for example (and in fact zmodem was and still is a much better protocol for bulk downloads over a modem than TCP).

But usually you'd get a TCP stack on the floppy your ISP gave you when you signed up. Like many small ISPs we used to distribute an install floppy containing the shareware version of Trumpet Winsock, which included a PPP dialer. When MS finally came out with a free install kit for making floppies for Windows 3.1 that included IE, the Windows TCP stack, and a nice dialer it was like a godsend (even though we viscerally hated what MS was trying to do with IE).

Widoze is lazy and study is bogus.

[twitter]

If a sysadmin is lazy and security unaware, he will ALWAYS be cracked into and exploited regardless of the OS system used, Windows Linux whatever. At the same time if he is vigulant and security aware he will unlikely to be seriously cracked and his systems will be stable, again regardless of the OS involved.

I'm tired of seeing this argument when the big advantage of Microsoft, and the excuse for M$'s poor security, is supposed to be EASE OF USE. That is the raison d'etre for an OS with a GUI that can't be turned off, right?

A diligent operator would rule out Microsoft for all but legacy applications. Besides security, cost and feature sets rule every deployment from web servers and databases to desktops. If you have not concluded this yet, you have not done your homework. If you don't believe this, ask yourself why so many diligent system administrators at well funded Fortune 100 companies continue to have their servers rooted and other companies do just fine with Apache and others.

This particular study seems to make the critical mistake of comparing an operating system to a software distribution. "Suse" with it's thousands of programs should be compared to ALL M$ and everything you could possibly put on it, not simply the $300 OS itself. How many of those Suse exploits came from running something silly like eterm for logs? There's a huge difference between M$ exploits on services that can't be turned off and an exploit in an optional program for which there are several secure alternatives. That this distinction was not clearly stated throws the article's conclusions into question.

Re:Widoze is lazy and study is bogus.

[Anonymous Coward]

Moderators: Please note that "twitter" is a known fanatical sycophant whose obnoxious offtopic rants are legend here on Slashdot. It doesn't matter what the topic is, he'll find a way to scrape in some pointless Microsoft bashing. While nobody expects us to love Microsoft in any way, his particularly tepid style of calling anyone he replies to "troll" or "liar" or "fanboy" because he happens to disagree with whatever they're saying is well documented and should not be rewarded. If anything, twitter is the type of person that should not be part of the open source/free software community. He is an anathema to all that is good about free software.

I'm posting this so that you (the moderator) have some context to consider twitter and not mod him up whenever he posts his filler preformatted rants about installing Knoppix or Mepis or whatever that unfortunately get him karma every single time and allow him to continue posting his trademark toxic crap (read on) day in and day out. You may consider this a troll - I consider it community service. And I ain't kidding.

If you're a /. subscriber, I invite you to look through some of his posting history. I guarantee that you'll be hard pressed to find someone that is more "out there" than twitter. You'll also probably notice he's got quite an AC following. Don't just read his posts, make sure you go through the replies.

To get an idea of what I'm talking about, check this post out. This is an article about email disclaimers. The parent of the post is complaining about the ads in the linked page and so on, and twitter actually goes off on a rant to blame it on Microsoft and recommend Lynx, because "is teh free".

Here's another. In this post twitter not only calls the OP a troll but attempts to "tell it like it is" while making some vague argument about "GNU". Yes, if you're confused, you're not alone. The reply (modded +4) proceeds to simply destroy his bogus argument. You will notice he did not reply. This is what some people call "drive-by advocacy". A sort of I'll just leave you with my thoughts here and move on to the next flamebait kind of deal. In fact, he almost never replies because he knows that his fanatical arguments simply do not hold up to any sort of discussion. It's not that he's chosen the wrong cause - he's just going at it in a completely wrong way.

Here's that drive-by advocacy and FUD in motion: twitter goes on about some topic and then drops the usual "oh and M$ is teh evil" because "WMP phones home" or some such. Called on his FUD, he then claims that WMP stores every song and movie you've ever played in a file, somewhere. Pressed further, he just sort of slithers out of sight, his FUD-spreading complete. This is not about some Microsoft technology that nobody likes anyway; it's about lying for the sake of lying. Way too many of his posts are exactly like this one.

More? Just read though this post and the subsequent replies. I guess this stands on its own. Or these two. Or this one. Or this one.

Still not convinced? This is what twitter considers "humour" while going about his daily "M$" routine.

M

Re:Widoze is lazy and study is bogus.

[Anonymous Coward]

This particular study seems to make the critical mistake of comparing an operating system to a software distribution. "Suse" with it's thousands of programs should be compared to ALL M$ and everything you could possibly put on it, not simply the $300 OS itself.

Isn't it amazing that people like you can claim Windows should not be compared to Linux because Linux "is just the kernel" when it suits you (usually when someone finds a hole in something other than the kernel) and in other cases, when it suits you, you claim that "Linux" is a distribution and should be compared to Windows because its 30,000 useless games and redundant text editors make them "so much better than teh Windoze".

It kills me. It just does. It's so funny.

Re:Widoze is lazy and study is bogus.

[Anonymous Coward]

Jesus christ you extremist fuck, you can't even spell "Windoze" any more. How hilarious is that.

Telnet? You're missing the point

[minion]

Until telnetd is totally removed (not just turned off) from Linux, Linux will not be secure. There are just too many exploits involving telnet to take Linux seriously.

Bad example. There's a telnet service in Windows too.

When was the last time telnet was exploitable? telnet is sniffable. Big deal, so is imap, pop3, smtp, http, you name it. Sniffing should not count against an OS - its a problem with the protocol, which is inherint to all internet based OSes. Heck, lets just say anything that uses TCP/IP is too insecure for internet access.

Here's an example:

RHSA-2004:174-09
Fix: utempter local exploit.

Ok. A local exploit. Granted, an exploit, but still, its a local exploit. This is what these so called "secuity" groups need to realize - webservers on the DMZ typically don't have local access for joebob to login to. Typically, they have ports 80,443, and maybe 22 open. So now, all of those 60+ exploits attributed to Red Hat become 0 (thats Zero, with a 0). True, Red Hat had more published advisories than Windows did in the same time period, but Windows didn't ship with nearly the amount of software Red Hat did, and no "sysadmin" is going to put a box on the DMZ, running every service on the box, with no firewall. It just doesn't happen.

So all of these so called security groups can shove it, because thats not real world security. Why don't they do a study on how many linux/unix sys admins patch their boxes diligently vs how many windows admins bothered to patch their boxes with patches available months before code red and other internet problems plagued the internet?

PS: On Windows, it'd be port 3389 (remote desktop), not port 22... And BOTH services (ssh and rdp) have had remote exploits available, so you can't retort with the "ssh is insecure" BS.

Re:Telnet? You're missing the point

[0racle]

...no "sysadmin" is going to put a box on the DMZ, running every service on the box, with no firewall...

I think you'll find it happens more often then you think. Administrating a *nix box doesn't make you a better admin any more then being a Windows admin means you know nothing. Unix has already had its trial by fire, the Internet worm knocked out something like 2/3's of what the internet was at the time. As bad as SQL Slammer, blaster and the like were, they haven't come close to what that one was able to do, their a nuisance not a plague.

I wish they hadn't taken it down, but the Honeyd project took a 'poll' of spam, and found something like 40% of what was hitting the honeypot was from Linux hosts. Security is in the configuration, and the configuration is done by the admin. There are good windows admins and bad ones, there are good *nix admins and there are ones that don't know their ass from their elbows.

Re:Telnet? You're missing the point

[Anonymous Coward]

no "sysadmin" is going to put a box on the DMZ, running every service on the box, with no firewall. It just doesn't happen.

What do you mean? I have my system set up in that exact way. If you don't believe me, you can check it out at my IP: 86.7.53.09

-Jenny

j/k :)

Re:Telnet? You're missing the point

[Anonymous Coward]

When was the last time telnet was exploitable? telnet is sniffable.

This is exactly why having a running telnet daemon would be a security problem. Someone could sniff a log in and then all those local exploits would become remote exploits. And as you point out, it doesn't matter what OS it's running on.

The point is that turning off telnet is sufficient to close that particular security hole. (and in this case, just not using it would be enough) You don't have to completely uninstall it.

Big deal, so is imap, pop3, smtp, http, you name it.

Those don't typically result in local access under normal operation. telnet does.

Why don't they do a study on how many linux/unix sys admins patch their boxes diligently vs how many windows admins bothered to patch their boxes with patches available months before code red and other internet problems plagued the internet?

Indeed. But let's not assume what the results would be until the study's been done.

Re:Telnet? You're missing the point

[God! Awful 2]

When was the last time telnet was exploitable?

Well... have you seen the source code to telnetd from a few years ago? (before they patched the exploits) Some versions of telnet contain a parameter called NET_SLACK (which I seem to remember was set to ~4kb). And what, pray tell, does this parameter do?

Well, it appears that at some point someone noticed that heavy traffic could cause the send buffer to overflow, causing telnetd to crash. And thus the buffer size was increased by NET_SLACK bytes so that if the buffer overflowed, it wouldn't do any harm. (Of course, this doesn't prevent someone from *deliberately* overflowing the buffer by more than NET_SLACK.)

-a

Re:Telnet? You're missing the point

[Master of Transhuman]

40% of spam is coming from Linux?

Oh, really?

The OTHER stat I'VE heard is that 60-80% of spam comes via compromised home machines.

Are you saying 40% of the home market is running Linux?

I didn't think so.

That's a crap statistic and your conclusion is nonsense.

Re:Telnet? You're missing the point

[MasterShake]

Until telnetd is totally removed (not just turned off) from Linux, Linux will not be secure. There are just too many exploits involving telnet to take Linux seriously.

Bad example. There's a telnet service in Windows too.

When was the last time telnet was exploitable? telnet is sniffable. Big deal, so is imap, pop3, smtp, http, you name it. Sniffing should not count against an OS - its a problem with the protocol, which is inherint to all internet based OSes. Heck, lets just say anything that uses TCP/IP is too insecure for internet access.


w00t ssh and ssl are too insecure for the internet because they use TCP/IP as the transport layer! Shame on OpenSSL Org for using TCP/IP when they obviously should have used DecNet or AppleTalk. SHAME!

Re:Telnet? You're missing the point

[Just Some Guy]

telnet is sniffable. Big deal, so is imap, pop3, smtp, http, you name it.

Which is why I use IMAPS, POP3S, SMTP w/ TLS, and HTTPS when connecting to my home network from remote locations. If you don't want people to sniff your information, then it's naive and ignorant to use any unencrypted protocol. It's not 1998, people - most server apps give you the option to use SSL or TLS if you tell them to.

Re:Telnet? You're missing the point

[0racle]

I'm so sorry to see you can't read, I said 40% of what was hitting the honeypot came from Linux hosts.

Would you care to point out where you got your bullshit stats of 60-80% of spam coming from home users, by which I assume you mean Windows PC's. Well an article here says only a third is estimated to come from home PC's. Now I'm not mathematician but it seems to me that about 33% is significantly less then 60-80%. Now I don't ever expect to see an objective discussion about Linux here, but between Linux and Windows, which one installs a MTA that is very nicely relaying everything it receives? Heres a hint, you have to add it to IIS after the system is up and running. 2/3's of spam is coming from mail servers that are open, as in the admin didn't configure it correctly, and most of the mail on the internet is relayed by *nix machines. Once again, simply being a *nix admin does not mean you know anything.

Re:Telnet? You're missing the point

[Master of Transhuman]

There have been articles recently citing the 60-80% figure. You can Google as well as I - do it. Some of these articles may even have been on /. Here's one I found on Google in ten seconds.

I'm not arguing FOR the stats, I'm arguing against the notion that you tried to present that 40% of spam is coming from Linux hosts.

That's fucking nonsense, as Linux has barely 3% of the desktop/home market. How the hell does 40% of spam come from Linux in that situation? You said that 40% of spam hitting the honeypot came from Linux hosts. Your implication was 40% of ALL spam comes from Linux hosts.

Now you're claiming it's all from UNIX mail relays. Well, it might be, I wouldn't know. But if any significant percentage - whether it's thirty or sixty - is coming from zombie home PCs, then how is it that the rest is coming from UNIX servers when UNIX and Linux combined have only around fifty percent of the server market?

Or are you saying Windows has no market presence in email transmission - and that it's all UNIX? I didn't think so.

I don't expect an objective discussion about Linux from Windows trolls, either.

Where's the beef?

[AnotherBlackHat]

When it comes to security, what I want to know, from most important to least is;

How many remote exploits allow privileged access?
How many remote exploits allow non-privileged access?
How many exploits allow privilege escalation?

I'm interested in the other stuff, but a DoS attack, or cross server scripting bug isn't on the same scale.

Neither the article, nor the Secunia web site seems to help answer those three questions for any OS.

-- not a .sig

ARGH!

[mattyrobinson69]

in slackware's install process (and im sure many other linux disto's) it asks you which services to start from /etc/rc.d/*

if you dont tick any of those boxes, there aren't any servers running - no remote exploits. on the other hand, Windows XPsp1 makes it very difficult to turn off the right services, some of which cannot be disabled, and the firewall is off by default (meaning rpc [msblaster] is open for the world to see by default). i know rpc has been fixed, its just an example.

My theory....

[ShadowRage]

I dont think they're so much funded by SCO or M$ as the "researcher" is just a dumbass, and grabbed some figures and sloppily put them together, saw he had an interesting attention grabbing story and published it, regardless of being carefully looked at, not to mention he stretched some facts like it takes days to patch linux or any of the free unixes, which is prolly the longest delay for any opensource based patch. Also, he failed to mention how long it took M$ to update patches. I have a feeling this reearcher played with unix, got lost and stuck to good 'ol windows. and is a Microsoft apologist as well.

Linux virus list - Theoretical vs. Practical

[mrjb]

A google for "linux virus list" does actually turn up with something. The first site returns as many as 35 results (in TOTAL) in a search for linux viruses (of which some are not technically viruses but exploits). Compare that with a list of new windows viruses and exploits for just the last year. Giving some credit to arguments such as 'Windows is more popular so it will be attacked more', it's been a long time since I had to deal with any virus/security issues of my own. Definitely neglectable compared to the number of AGV/adaware/firefox/thunderbird/zonealarm installs that I've been doing for Windows.

My favorite quote of course is "A product is not necessarily more secure because fewer vulnerabilities are discovered". This may be true, but given the statistics (35 viruses vs. 50000), and daily reality, I know which system I feel more comfortable with. I don't see daily reality shifting to the other side of the scale anywhere in the near future.

Re:Missing Stats? ???

[Anonymous Coward]

1) Exploiting unix trust relationships gave a lot of people shells on machine they do not have passwords for. Think NFS, and the 'r' services.

2) There were a lot of remote security holes found in unix. Think about bind, telnetd, shd, finger, sendmail,wu_ftpd or even pine.

3) Sniffing passwords was easier back then before switches and encryped login services (ie: ssh) were wide spread, so getting local access on most networks was not very difficult once you had a foothold on one.

4) It wasn't until the dot com boom when every new security company and hacker looking to get a real job and source code became more common that a lot of security holes were found and patched. Just look at red hat 6.0.

What about the BSD'd, Debian...

[essreenim]

Question then becomes, how quickly are these problems responded to
I think a more appropriate question is:
If everything is equally secure/insecure, then why pay for something that is no more secure than something you can get for free???????
Also, Im surprised and disappointed they neglected to include/mention other servers like OpenBSD, NetBSD, Gentoo, Debian, Mandrake... Its not right. Market share means nothing. They should have everything in there : (

Secunia and Linux

[Colol]

I've seen numerous posts regarding the inaccuracies in Secunia's reporting of Mac OS X and Linux in this report. There's one big point, though, I haven't seen anyone bring up.

Secunia is comparing Linux servers -- SuSE Linux Enterprise Server and Red Hat Advanced Server -- to a desktop Windows (XP Pro) and an uncertain Mac OS X (are they counting OS X Server vulnerabilities? It's a mystery!).

Well, no shit you're going to get bigger Linux (and potentially OS X) numbers that way! They're comparing a desktop operating system that ships with minimal (but still too many) services enabled to a Linux distribution made up of dozens of running services and a million optional parts which may or may not be installed on any system.

Other posters can banter all they like about how Secunia isn't taking money from Microsoft, but more than a cursory glance reveals it isn't exactly a level playing field regardless of who's funding them. (Yeah, yeah, I know, it's Slashdot ;)

Re:Missing Stats? ???

[essreenim]

the attacker didn't have priviledged access. But that's the basis of all security. Once you do that, all you have to do is make remote connections a special case of local access. Come on, I would pick a FreeBSD/Linux based OS every time on principle alone but we live in a completely different world now. Just look at WiFI hacks. Its not as simple as you say,
but you are right. The way permissions is handled by Linux/Unix based O.S.' was a tried and thrusted addition to the development of security on those O.S.'

Interesting results...

[octogen]

Look at these:

IBM z/OS V1.x
one vulnerabilty (in Sendmail, which was ported to z/OS)
By the way, most (if not all) parts of z/OS were written in PL/1.

IBM OS/400 - V4.x, V5.x
zero vulnerabilities
(Note, that OS/400's kernel ("SLIC"), written in C++, is absolutely closed code (afaik you can't even access its machine code on the iSeries 400's DASD), so nobody outside IBM knows, what kind of bugs might be in that kernel; anyway, because of its single-level storage architecture, this system has hardware pointer-in-memory protection, which, as a side-effect, prevents many of the most dangerous kinds of exploits, for example overwriting of return-addresses, overwriting of function pointers and such; so it's impossible to "smash the stack" on this machine)


Conclusion:
===========

To err is human; as long as people use Assembler, C or similar programming languages, they will probably cause buffer overflows and similar bugs; for this reason, we should take advantage of more intelligent hardware architecture, including features like tagged pointers and special CPU instructions for modifying addresses (so you still can change a function pointer, but only if you use the correct instruction; overwriting it using instructions for copying data areas (MOV on intel) would cause the pointer protection hardware to invalidate the pointer). Better hardware is a good foundation for better software. "Protected mode" (memory protection, preemptive multitasking, ...) brought us stable operating systems; some new hardware could get us stable and secure operating systems. By secure I DON'T mean hardware-addons like TCPA. TCPA is inadequate for a free-programmable computer architecture.

Use a suitable programming language to implement applications; you don't need to mess around with direct memory access, pointers and such, if you're programming software for accounting or a spread sheet application. Many commercial applications for z/OS and OS/400 are written in COBOL, PL/1, etc. rather than in C, and they do not seem to have nearly as many critical bugs as most C programs; OpenVMS people will tell you the same story, I don't know what programming language they used to write most of their applications, but I know it wasn't C.
If you can't get an open source Ada, Cobol, PL/1,... compiler, at least use C++ (use std::string).
Don't forget Java; java programs might not be as fast as compiled code, but especially non-GUI applications are still pretty fast, and Java is a well-designed language.

Unfortunately, there are no results for trusted operating systems such as Trusted Solaris; it would be interesting, whether the same bugs that are critical on standard operating systems could cause system access or any similarly critical escalation of privileges on trusted operating systems (my guess is, commonly not; these systems have extremely strong security implemented in kernel code). By the way, Solaris 10 will include many key security features that were only available in Trusted Solaris before (including privilege sets and compartment-like process separation).

Book hint: "The Inside Story of the IBM iSeries" by Frank Soltis, the system architect of the iSeries 400 (aka AS/400) and OS/400; especially interesting because of the fact, that this system's design is very different from common hard- and software architecture;

I'm safe.

[Gordon Bennett]

See, I said that not upgrading my Apple Lisa would pay off in the end.

thank you

[dh003i]

I agree (I should, I'm the parent-poster). Though I don't use OpenBSD, doubt I'll ever use it for my desktop (I use Debian/Gentoo), if you have something where security is vitally important, OS' other than OpenBSD just don't hack it.

BwuahahahaHAHAHA!

[Qbertino]

HAHAHAHAHAHAHAHA!
BWUAAAAHAHAHAHAHAHAHAHAHAHAHAHA !
*GASP!*
*wipes tears from eyes* ...UAHAHAHAHA! (etc.)

I'll buy into the Linux isn't the heaven of security thing and also that we'll have some stuff heading our way once Unix desktops (Mac OS X and Linux) are mainstream and that there'll be some stuff to get sorted out. One being the ridance of the allmighty root.
But good heavens, what a load of bullcrap this article is.
Give me a break. Windows XP is evidently the most insecure OS on the Inet ever! You can probably even root the damn thing through it's media player using a pipe organ emulating modem tones. Every Idiot on this entire planet can write a Outlook-compatible VBScript twoliner that formats your HD, blows your UPC, floods the Net with "Bigger Dick NOW!" E-Mails and Sasser rippoffs and shuts down the power grid on your entire block.

And now these silly f*ckers through about with statistics listing the amount of security warnings and using them to rate the secureness of an OS? Give me a f*ckin' break, man. These people probably just got some Mickeysoft gold partner contract shoved up their behind and now wanna play nice with the dark side.

What a truckload of nonsense. I can't believe this makes it onto a IT webzine nowadays.

Errrm... Make that 'throw'. Thank you.

[Qbertino]

see Subject.

Re:Missing Stats? ???

[Anonymous Coward]

But these are still isolated systems where people are handed accounts. The history of Internet security on Unix still sucks. This is evident in IPv4 and SMTP, where trust is simply assumed, or sendmail where debugging features, with root-level access, are built into the product itself.

It is a very different world we have today. You don't have a dumb terminal hanging off of a miniframe, or an individual PC hopelessly disconnected, and all of the current OSes aren't built for this. All they can do is adapt.

Vulnerabilities vs Advisories

[AYeomans]

Note very carefully, they count advisories only once, even though they may include multiple vulnerabilities.

The Windows XP Pro list includes:

• Microsoft Windows 14 Vulnerabilities
• Microsoft Windows RPC/DCOM Multiple Vulnerabilities
• Microsoft Windows ASN.1 Library Integer Overflow Vulnerabilities
• Microsoft Windows RPCSS Service DCOM Interface Vulnerabilities

contain 14 + 4 + 2 + 3 = 23 vulnerabilities but Secunia only count 4 advisories. So the count is now 65 acknowledged vulnerabilities for XP Pro. Not including those silently fixed, nor the 38 vulnerabilities in Internet Explorer 6 alone.

Actually, Secunia tend to publish alerts based the vendor bulletins. There are better sources for collated vulnerability information, such as Sintelli (free) or TruSecure (fee) which have far higher totals.

Re:Vulnerabilities vs Advisories

[DMUTPeregrine]

Also, a lot of the RH or OSX vulns are through extra programs bundled with the distro.

my money is on this:

[CAIMLAS]

$10 says that when they considered MacOS X and Linux distributions they included bug and security releases for all the packages that are available for the distribution, not just for the core OS/core set of functionality.

I'm fairly certain that there've not been 30+ kernel exploits in a year for Linux, ever.

Windows XP offers a significantly small subset of what a Linux distro offers. What's combined in Linux all depends on what the task of the server is.

Something is rotten in the state of.....

[Anonymous Coward]

MARCELLUS: "These numbers are wrong. Something is rotten in the state of Denmark."

GATUS: "Quick now, release the article."

MARCELLUS: "Yes my Lord. As you wish."

GATUS: "We've proven Windows is secure! Now let's feast."

Hmmm... Let's Follow The Trail Of Money

[tilleyrw]

1. Comparative studies exist.
2. Comparative studies need funding.
3. Was this study funded, however indirectly through international shills, by Microsoft?

Q.E.D. The whole study was a pretense to read about Microsoft, helping them advertise.

Technicality

[tilleyrw]

Remember, it ain't a vulnerability if we don't tell anyone about it...

Meanwhile, Sc71pt k1ddi3z run wild on your OS.

Non-braindead analysis

[Anonymous Coward]

What complete crap. Let's look at their statistics without being completely brain dead.

To get the reported "36 advisories" for Mac OS X, they have to count 2002, 2003, and 2004. See for yourself: . Yet to get the reported "46 advisories" for Windows XP Professional, they have to count only 2003 and 2004. They left out an entire year. Count Windows over the same years as they're counting Mac OS X, and Windows XP Professional has 61 advisories.

They lump together all versions of Mac OS X, including Server. For example, the sendmail bug only affects 10.2.x and 10.1.x, not 10.3.x, which does not ship with sendmail. And the Apache 2 bug only affects Mac OS X Server. Yet they only consider one version of Windows, Windows XP Professional. It would take too long to figure out all the bugs they left out on Windows, but one category is easy: Microsoft IIS, their equivalent to Apache (which they considered on the Mac), has ten advisories listed over 2002-2003-2004. So that brings the total to 71.

They throw in Quicktime bugs for the Mac, but leave out Windows Media Player on Windows. That's 2 more for Windows, bringing its total up to 73.

And it gets a lot worse. They happily throw in the Safari bugs into the Mac OS X list, but they only throw in one IE bug into the Windows list. Go to the IE 6 page and see for yourself. There's 54 bugs listed on their Internet Explorer 6 page for 2002-2003-2004; their web browser alone is more vulnerable than all of Mac OS X put together. That brings the Windows total up to 127, more than three and a half times the Mac OS X.

If they scrutinized Windows the same way they did the Mac, it wouldn't look so "surprising" at all. It would just confirm what we've all known: the Mac isn't perfect, but it's a heck of a lot better than Windows.

dork.

[Anonymous Coward]

hate PPronunciation Key(ht)
v. hated, hating, hates
v. tr.
To feel hostility or animosity toward.

To detest.


To feel dislike or distaste for: hates washing dishes.

Re:dork.

[BorisSkratchunkov]

Unfortunately, only a true dork would look up something so obscure and mundane in a dictionary. Besides at least I'm not an "Anonymous Coward" who enjoys posting hit-and-run insults that offer no validity. Your post has also received a score of "0" as you can see, Monsieur Dork.

P.S. We wouldn't be reading /. now if we all didn't have just a bit of "dork" in us all, now would we?

Arbitrary USER code execution isn't a ROOT exploit

[caveat]

The Safari browser hole didn't allow superuser code to be run, only the particular users code - *any time* setuid is used on OS X, it will pop up a password dialog, and if you're dumb enough to not Cancel an unprovoked password demand, you deserve to be r00ted.

Contrast this with the Windows (and Linspire...) model, where Joe User is already root, and the ability to run arbitrary user code becomes a lot more of a problem. OS X isn't "perfectly secure", nothing short of a totally unplugged bx is, but it is a hell of a lot MORE secure than Windows.

Openbsd

[Anonymous Coward]

The article goes for OpenBSD in a way too. It is a really unsecure system by design and the project team's policies make it even worse.

They outright LIE to maintain their "clean status" and are technically years behind the rest.

Interesting Statistics Analysis...

[Insolence2003]

I find it interesting that they creatively left out the count of actual security holes found on Windows XP and only reported the percentage. I'm betting that the amount of critical flaws in Windows XP is actually a lot higher (in count, not percentage) to any of the other operating systems compared.

Did anyone else notice this creative trick to NOT display the statistics for Windows XP?

I dunno about you guys... but to me, it isn't the "percentage" of bugs that allow system comprimise, but how many, period. =P I love it how people can bend statistics to make their favorite (or their sponsor) company look better.

Anyone know the missing statistic from the article?

They're using Oakland School Administration math.

[Ungrounded Lightning]

From Secunia Virus Statistics web page:

Indicates the percentage of scans that resulted in a found infection (e.g. 1% means that in 10.000 virus scans, 1.000 of these scans resulted in found infections).

They did this twice, too. So does 1% equal one percent of machines infected, or ten percent?

(I refer to this as "Oakland School Administration math" because a high administrator of the Oakland California schools, while testifying before the state legislature, cited the percentages of black teachers in Oakland schools vs. black people in the US population, with the percentage far lower for the teachers. But in the same testimony she gave the actual numbers of black teachers and total teachers, and in fact the percentage of black teachers in their schools was far HIGHER than blacks in the general population. She'd blown the percentage computation. Doubly funny, since she was testifying about how the new teacher certification tests were unfair because they required far too much arithmetic.)

Wrong!

[csoto]

The Safar bug you're referring to could have (before it was patched a few weeks ago) allowed someone to 1) run arbitrary code 2) as the user who is running Safari, 3) using whatever available binaries are on the system. This is a FAR CRY from "r00ting," which would require superuser prviledge elevation.

Same old stuff

[gwoodrow]

I work on Mac OS X Panther, Windows XP, and Fedora Core 2. For me, I personally haven't had hacking or virus troubles on any of those systems. Indeed, Windows XP has had other problems of its own, but security has never been an issue for me.

Why? Same old thing - be vigilant about patching your system and do virus scans regularly. Apply at least basic firewalls. Turn off window pane viewing and complex html in external mail programs. Don't download attachments unless you're sure of what they are.

In reality, security of your system comes down to whether or not you're a dumbass. I know that there are extreme cases where someone is made to suffer even if they did all they possibly could, but for the home user those seem few and far between.

I do wish that my systems came with better security from the outset, but that doesn't mean I wouldn't remain vigilant. People with home or car alarms still don't leave their doors unlocked, neither should we neglect the personal responsibility of our computers.

There's a lot of religious fervor about which system is better whenever there's an article like this. People who bicker about it on slashdot don't really make much sense to me because any person that's reading slashdot in the first place is probably smart enough to actually keep their system - whatever OS it may be - up to snuff. Generally speaking, the statistics in the article probably don't apply to "us" as much - they apply to the technologically limited.

I think it would actually be kind of scary to see stats on slashdot users' computers!

Secunia

[XO]

Every article I've ever read from Secunia is vastly overexaggerated utter rubbish.

Please stop using them as a source, for real news.

Thank you!

Re:Arbitrary USER code execution isn't a ROOT expl

[IamTheRealMike]

You don't need root to do the things most malware/trojan programs do. This is doubly the case for non-secured windowing systems like Quartz.

This is Bullsht

[Anonymous Coward]

This is crap. The article is crap, these researchers are crap. MacOS X is baddass.
Fuck off you PC weenies.

Yep and the default Linux firewall blocks it dead

[Anonymous Coward]

sshd http ftp smb all don't normally work unless you let them to. So defence is better.

The simple fact is that Microsoft OS protection system is 5 years out of date. And Linux desktop interface is 5 years out of date. Basicly one worked on defence one worked on pretty now both are doing catchup. The question is what one gets there first.

Of course I tell people to shutdown any service they have no use for(deamon ...)This even applys to the task bar beside the clock in windows.

Basicly people are given a computer and given no protection information note we don't leave houses without door locks any more but we level computer with out them.(linux has one well built door lock built in the firewall windows is only getting started on its.)

LMTO (since I moved from W32!)

[Anonymous Coward]

Top 10 Viruses/Worms last 24 hours: Score 10/10 x 2 for W32 platform.

Approximate (sic) viruses on my 3 Macs over the past 18 months: ZERO.

No. of EMail viruses received: 811. No. of Exploits: Nil (all for W32).

OS/X works in theory but will it work in practice.

GjB@irl

Re:Missing Stats? ???

[HiThere]

While you have many valid points, still, security was built in from the very beginning. And many of the holes were patched while the cost of doing so was only a campus machine needing a reboot (well, not *quite* that simple, but close)!

OTOH, you could point to spam as an example of one place where the patching didn't get applied in time, so now it will be a HUGE job to fix things. And the fix will need to be right the first time.

Grammar Nazis

[Brettt_Maverick]

It strikes me as odd that there would be people on slashdot who are NOT grammar nazis! Nobody should be more aware of the value of proper syntax and structure, and of the errors that can occur when nonstandard syntax and structure aren used. I mean, come on! We all know better than to reference a variable (especially a pointer) without initializing it, yet people think nothing of starting a conversation with, "He just said it was broken!" without first specifying who 'he' or 'it' are.

Any language, natural or otherwise, is a code, in which meaning is derived from words (spelled properly) arranged meaningfully with other words and punctuation. Unless both sender and receiver decode the message using the same rules and syntax, information will be garbled, if not dangerously corrupted. If the rest of the world thinks '"' means "inch", and Spinal Tap think '"' mean "foot", well...

We all know this. We're all grammar nazis. The ones that aren't write bad code, bad specs, bad documentation, bad support e-mails, bad comments, and bad posts to slashdot.

That said, as an olive branch to those who argue otherwise, I will not bother proofreading this post.

poor security practice

[auzy]

I've seen this article, and its completely wrong... The reason is that they are basing the results on all the linux programs, which means that they are using security advisaries for programs even like X-chat and such, advisaries which MS will never release, so the valnerablilities exist, but are hidden.

Its also been long known that IE and OE, and the entire internal infrastructure of Windows is insecure, while linux can be set up without those problems (I personally would never set up a public remote shell using windows).

It also doesn't take into account a lot of things such as propolice, or other systems that are commonly enabled on linux distributions today.

Dont give this article any credit.. Because I bet that if we compared the internal list from Microsoft of known security flaws, with all the internal lists of linux, then there will be a clear winner security wise.

The only people who use public exploits to highlight the security of the operating systems, are either done by highly incompetant security "experts", or by people trying to bend the results like what MS tried to do previously by comparing an ancient copy of redhat to windows 2003.

Exactly

[Pan T. Hose]

They really do respond quickly, usually the first time I hear of a new exploit is when automatic update prompts me to download and isntall it. Usually a few days before it's posted on Slashdot for the second time.

This is exactly my experience. I usually get said automatic updates by email from my friends.

don't do things backwards

[Anonymous Coward]

The point is that PRACTICALLY, Microsoft is the most insecure operating system because you cannot hook a default install up to the internet without getting 20 worms by the time you patch it up

Thats because you do things ASS backwards.
First you patch it up, then you connect it to the internet.

amazing

[Anonymous Coward]

I think you missed it. Try again.

What happens in the *real* world?

[innate]

I'm sorry, I hate to be a Mac zealot, but...

A friend buys a Windows PC. Eventually I will almost certainly have to repair their system after they load a trojan, get a virus, or spyware. If they call me about their computer it's something messy, like a driver that doesn't work or a corrupt registry.

A friend buys a Mac. I never have to repair their computer. If they call me it's for advice on Word or Photoshop features. They never, ever call me regarding viruses/trojans or spyware. I never need to repair their system.

I know this is anecdotal, but it happens time and time again. Ask anyone who supports both Macs and PCs and they'll tell you.

So from my point-of-view, it doesn't matter whether the Mac is theoretically insecure. In my real-world experience I would much rather have my friends and family using Macs -- and that's just because of security, not to mention the other advantages of OS X.

Re:Missing Stats? ???

[SilentChris]

"I don't know just where you were living, but Unix and Linux grew up on networked systems where multiple college students shared the same machines (well, Linux less than Unix here) because they were too expensive."

And I don't know just where you were living, but the first timeshare systems had passwords with no other security, and all users basically had access to all files. Read "Hackers". The primary goal was to share information -- security takes that away.

And the grandparent poster was right. We've only "given a fuck" since now home computers are being targetted, en masse. It used to be corporate servers, then corporate workstations. Virus/worm writers are deliberately trying to take over home machines, and that's where the real danger comes out.