Security Statistics and Operating System Conventional Wisdom

kev0153 writes "Microsoft Windows is more secure than you think, and Mac OS X is worse than you ever imagined. That is according to statistics published for the first time this week by Danish security firm Secunia. "Secunia is now displaying security statistics that will open many eyes, and for some it might be very disturbing news," said Secunia chief executive Niels Henrik Rasmussen. "The myth that Mac OS X is secure, for example, has been exposed." "

Comments

Security or obscurity

[Anonymous Coward]

I don't think too many people have said MacOS X is especially secure just that no one cares enough to exploit it.

Widoze is lazy and study is bogus.

[twitter]

If a sysadmin is lazy and security unaware, he will ALWAYS be cracked into and exploited regardless of the OS system used, Windows Linux whatever. At the same time if he is vigulant and security aware he will unlikely to be seriously cracked and his systems will be stable, again regardless of the OS involved.

I'm tired of seeing this argument when the big advantage of Microsoft, and the excuse for M$'s poor security, is supposed to be EASE OF USE. That is the raison d'etre for an OS with a GUI that can't be turned off, right?

A diligent operator would rule out Microsoft for all but legacy applications. Besides security, cost and feature sets rule every deployment from web servers and databases to desktops. If you have not concluded this yet, you have not done your homework. If you don't believe this, ask yourself why so many diligent system administrators at well funded Fortune 100 companies continue to have their servers rooted and other companies do just fine with Apache and others.

This particular study seems to make the critical mistake of comparing an operating system to a software distribution. "Suse" with it's thousands of programs should be compared to ALL M$ and everything you could possibly put on it, not simply the $300 OS itself. How many of those Suse exploits came from running something silly like eterm for logs? There's a huge difference between M$ exploits on services that can't be turned off and an exploit in an optional program for which there are several secure alternatives. That this distinction was not clearly stated throws the article's conclusions into question.