Slashdot Mirror
MS Security Chief Says Windows is Safer Than Linux
Kip Winger writes "Mike Nash, Microsoft's Chief Security Executive, has made claims that Windows is more secure than Linux. In a recent online chat, he staunchly defended Microsoft's record on security, basing part of his argument on how Windows Server 2003's 15 patches in the past year are far less than what RedHat or SuSE have had to endure." He also mentioned the recent purchase of Sybari and their Antivirus product.
the patched that they should have done?
...they do protest too much.
Did he inhale?
Microsoft is basing that claim by number of patch distributions, not by size for severity, cute. So, just because they (usually) wait up to a month to release a patch, somehow they are better FUD never had so much meaning. I'd be outraged, but words like this are so expected.
The force that blew the Big Bang continues to accelerate.
Right and I have a lovely bridge you can buy...
Our lives begin to end the day we become silent about things that matter. - Martin Luther King, Jr.
Or is M$ really flooding the media with a lot of their fantasies? also, they are not very funny any more...
Pumbaa! I don't wonder; I know.
when the machine is turned off.
Do you *really* think he could one day admit the oposite ? :)
* when put behind a baffling series of hardware and software firewalls destroying all connectivity with said Windows machine. In addition, a 500 ib gorilla must be guarding the keyboard.
If anyone from Microsoft said anything to indicate that their software is in any way inferior to other software, it would hurt their marketing.
Knowing this, their only option is to claim that they have the best software.
He should have refrained making that statement this week. Wasn't it only Tuesday that MS had another bunch of its endless patches?
If you can just manage to say something that gets picked up by major news organizations, then it might make it come true.
Or at the very least, you might at least fool some people enough to continue to give you money.
I'm a big tall mofo.
My linux computer is so over run with spyware and viruses that it is completely unusable and it is firewalled.
I connect my fresh installed XP system directly to the internet and I can go months before I get any malicous programs on my computer.
hmm, or do I have that backwards?
Paying taxes to buy civilization is like paying a hooker to buy love.
... I need to approve the new MS patches on the SUS server.
We see these posts trumpeted by entities like Slashdot. It it warrented? Does Redmond have any credibility on things like this left? Should we be paying any more attention to this sort of behavior than to just consider what MS is doing? :\ I'm more interested in the well thought out comments all-y'all have.
Sam
FUD on the horizont, sirre ;-)
- if you compare RedHat/SuSE then you have to compare it to Windows Server + complete BackOffice + complete Visual Studio + complete MS Office and you still are not close enough...
- I'd be interested in average time to fix critical bugs...
- also number of known un-fixed cricital bugs will be interesting (incl. IE on Windows)
I think we need a new section for these stories. I propose we call it 'Flamebait'.
UNIX/Linux Consulting
"Mike Nash, Microsoft's Chief Security Executive"
What does everyone think he's supposed to say? Windows security is inferior to linux? He'd lose his job.
My sig of choice is Marlboro
There is only one god!
:awe:
:shock:
"Year-to-date for 2005, Microsoft has fixed 15 vulnerabilities affecting Windows Server 2003. In the same time period, for just this year, Red Hat Enterprise Linux 3 users have had to patch 34 vulnerabilities and SuSE Enterprise Linux 9 users have had to patch over 78 vulnerabilities."
This actually brings up an interesting point. Does Windows have less bugs (I know, I know) than these Linux distros? Or are Red Hat and Novell more proactive to fix the bugs they do have? Unfortunately, my guess is most PHBs would think the former.
It's "no one," not "noone." Who the hell is noone anyway?
Sounds more like someone was baiting him in the chat log.
... I've never beat my wife.
Q: When did you stop beating your wife?
A: Well, I
Q: We know you are lying. Liar.
A: I can only defend my record as far as I have one. I am not a wife beater.
Q: Liar liar pants on fire!
Why do these people even come to these online chats?
Try and prove it!
I dare ya.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
...when the world stopped laughing, it was revealed this person might have some sort of conflict of interest, being that he works for MS and all....
Microsoft's top security honcho insisted Thursday that Microsoft "is making progress on security using any reasonable metric."
What is a 'resonable metric'? Is that one that only provides the results that one wishes to see or is that a metric provided by a reputable security organization that is known for being extremely truthful and accurate in its results?
If you ignore the other uses of a tool, does that make the tool less useful, or you less useful?
Too bad we can't mod the story as a troll....
How many fixes in wondows were for vulnerabilities that allowed the machine to be remotely owned, vs how many for Suse or RH? How many for local vulnerabilities?
The cesspool just got a check and balance.
Windows 2003 Currently, 5 out of 44 Secunia advisories, is marked as "Unpatched" in the Secunia database. Red Hat rrently, 0 out of 133 Secunia advisories, is marked as "Unpatched" in the Secunia database. I think I would rather take a system that is all patched then one that is Unpatchable.
... patches to Exchange, IIS, MS-SQL, Office and the rest of their bug ridden software.
Earlier this week, they released a slew of patches... 6 or 7 of them that affected XP SP2 and were rated critical. Perhaps they feel inadequate in comparision to Red Hat, et al and have some catching up to do?
--
iBill not paying it's custumers. This guy says for almost 4 months since ww.com has been paid.
Yeah, Whatever. Next.
In the land of the blind, the one-eyed man is king.
Linux might have more security holes within the release times but I feel the Linux patches are more proactive than reactive.
When Microsoft releases a patch it's usually because thousands of users have already been complaining about something and they have to address it in a reactive mode. In Linux, someone makes a discovery of a security flaw, contact's the vendor, and it's usually patched within a couple of days. Note that within that discovery, everyone is still happy as a clam because there haven't been 50,000 trojan's trying to exploit it.
If I were in that position, I'd probably say the same thing too... he's just trying to keep his job (despite the fact that he's not very good at what he does).
Oh my gut hurts from laughing too much! I guess MS forgot to mention that it's main security feature supporting that claim - is a dead NIC.
he maybe forgot that both distributions he mention comes with tons of software that windows does not, so comparison is at least stupid...
It went something like this:
;-)
"Round 1. FIGHT!"
If there's only 15 for 2003, then why does that secunia link list 44?
Notably, the RedHat and Suse links list a higher number of vulnerabilities, but also state that there are ZERO unpatched security holes.
Surprisingly, the Windows 2003 product still has unpatched holes.
Problem: MS's products are insecure.
Solution: Have your Security Chief claim that your products are more secure than the competition.
If you had super powers, would you use them for good, or for awesome?
This is nothing but Flamebait. (move it along, nothing to see here)
Then maybe it's safe.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
SO much safer that their one line of defense on spyware has already been voided.
t id=201&tid=172&tid=218
See http://it.slashdot.org/it/05/02/10/2325205.shtml?
Perhaps less time making bullshit PR about how awesome their OS is, and more time in developement making it better.
Just an idea maybe.
(This is not a rant, merely a description of what happened to me receintly:)
1. reboot computer - It'd hung running something the rhymes with Titborrent.
2. Login prompt -log in
3. Get a start button, click on it to start a browser
3a. lose focus as MS is saying AVG isn't turned on. (It's not?)
4. Hit start again to get a browser
4a. Lose focus again as AVG says it's not working.
5. Press start to start a browser.
5a. Lose focus as the UPS monitoring tool adversises that it's HERE! PRESENT! ACCOUNTED FOR!
6. Press Start to get a browser.
6a. Lose focus AGAIN as MS spyware gives me a status update.
7. go over to the iBook, it doesn't Constantly Interrupt Your Train of Thought At Every Opportunity!
"Draco dormiens nunquam titillandus."
I would say that to.
Even going by the numbers... without making claims of severity of each security hole, most distros include a full featured desktop with MANY applications. I dont believe win2k3 does, or any windows for that matter.
unless they want to start counting word pad as an office program etc.
Granted win2k3 is a server environmnet so less stuff is there,but how useful is xp to begin with? very useless.
I've seen patches coming through for RHEL which are for things like "If you use movemail in xemacs, a malformed message might cause a malicious user to execute commands as the xemacs user"... contrast that oh-so-likely scenario with the type of RPC remote user executing code which runs with administrative priveleges, and the numbers really mean very little.
500GB of disk, 5TB of transfer, $5.95/mo
...time to put on your asbestos suits! time for the wars to begin... is linux more secure intrinsically? or because its user base is more knowledgable technology wise? for the record i use xp without a problem, my coworker on the other hand is always having problems. i think the biggest problem is the user, not the softare.
always mosh clockwise
In other news: North Korea announced it will cooperate with US and destroy its nuclear warheads as well as open access to inspectors from the West.
Ford Security Chief Says Ford Safer Than Lexus. Film at 11.
Seriously, do we have to post here every single lie said by Micro$oft? If so, then could we at least have an option to moderate such articles as -1, Troll?
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
every few months, or some times as frequently as monthly, windows releases some sort of major security hole patch.
about every year or so, perhaps more often than that but not nearly as much as windows, *nix, in some form, releases a security fix. most of these deal with a real issue like ssh. Contrary to some overlooked flaw in a 'NEW - MORE MS SPAM' Media Player or some frequently used mail program.
Doesnt there seem to be something fundamentally fuzzy and improbable about comparing 15 patches to what "Red Hat and SuSe has had to endure"?
Isn't that like, a friend and I comparing our cars, and me braging that I only changed my oil once in the lifetime of the car, while he has changed it every 3 months, therefore I must have a better engine?
Just because Microsoft has dished out fewer patches doesnt mean it is more secure...infact, the knee jerk reaction is that they are probably just missing something(s) really big...
People are funny.
Microsoft is a corporation. It needs a base of support to exist. Pausing in its creation of "new and improved!" products to backtrack and actually fix anything is not additive to the bottom line (profit).
Therefore, MS will never fix anything. They will merely use PR to promote their products. If falsehoods are created and spread, they will focus on the person who created that lie, not the legal individual Microsoft. (Corps. are equivalent to living people in most states but that's a rant for another time.)
Q.E.D., nothing to see here. Move along.
This post encoded with ROT26. If you can read it, you've violated the DMCA. Handcuffs please, sergeant.
Apple, for example, comes out with security fixes virtually every month, and many times they fix multiple security problems. So the sheer number of patches matter very little. If we're judging security strictly on the number of patches, then Microsoft should come out with one patch each year that addresses every issue that is known, this way they've "only" needed to release one security patch for the year. The more security patches released, the better I feel about my OS of choice. It means they're keeping up with all known vulnerabilities. If I were Microsoft, given all the bad press about their poor security record these days, I wouldn't be bragging about releasing only 15 patches, IMO
"Even with the relatively large number of bulletins we released this week, we compare favorably," he said. "Year-to-date for 2005, Microsoft has fixed 15 vulnerabilities affecting Windows Server 2003. In the same time period, for just this year, Red Hat Enterprise Linux 3 users have had to patch 34 vulnerabilities and SuSE Enterprise Linux 9 users have had to patch over 78 vulnerabilities." He's taken this as a sign that Windows is more secure. I don't see that it does.. because really he is saying that MS doesn't fix as many vulnerabilities that do exist. I say, Red Hat and SuSE are on top of bugfixes for 2005, and MS is way behind.
perl -e "eval pack(q{H*},join q{},qw{70 72696e74207061636b28717b482a7d2c717b343 637323635363534323533343430617d293b})"
No, just kidding. What a moroon.
This is why the internet is ran by *Nix.
Can you imagine the internet being ran by Windows?! lmao.
How is this news? It would only be news if Mike would say the opposite, why is it news when a company says its products are the best? I see dozens of commercials everyday which do exactly the same but probably are based on the same marketing farts.
Repeat after me: We are all individuals
Or didn't M$ consider that 11% of those bugs have remained unpatched versus the 0% for RH and Suse?
Damn those inquiring minds
2. Distribute 12 patches over a year
3. Claim superiority by only having 12 patches in a year
4. Profit
Cool, for once, didn't even need a ??? for item 3 - that's why MS is doing so well :-)
How is this news? *All* companies put out the message that their product is best, there's really nothing special about it.
I mod down anyone who says "I will be modded down for this", regardless of the rest of their comment
They say this like every other day now. Not a big suprise.
Freedom would be not to choose between black and white but to abjure such prescribed choices. -Theodor Adorno
Given the right methodology and assumptions, one can prove almost anything. Sigh...
which patches fixed remote exploits and which patches fixed local exploits. I find Windows has a lot more holes that can be exploited remotely were Linux requires local access. In either case would the Security Chief of a company come out and say another product is superior to their own?
I say we just grow up, be adults and die.
Microsoft says they're safer than linux This email says that these pills will make my johnson grow to twice it's size. This TV commercial says that this product will make my hair grow back. This car dealer says I can buy a brand new car for less than I'm paying a month now. People say a lot of things. That doesn't make them true. That makes them salesmen. (salespersons?)
Evil Walrus >83=
Comment removed based on user account deletion
Second, comparing Internet Explorer (IE) and Firefox indicates that Windows is likely more bug ridden than major open-source software like Linux. I have used both IE and Firefox. From my experience of visiting thousands of pornographic sites laden with naked women beckoning you to "enter" their site (and other things), I can definitely say that IE is chock full of security problems. After 1 week of pornographic surfing with IE, my entire system (browser and OS) becomes infected with malware -- to the point that I must reload Windows. I have yet to experience the same problem with Firefox.
The only thing that I hate about Firefox is that it is very slow, probably due to the fact that my computer system has limited DRAM and that Firefox must swap to disk more often than IE. Such is the price that I must pay to enjoy porn.
So if their software is so secure, why do they have to recommend antivirus software to stop their systems from being infected?
It's the strategy called the Big Lie. If you say something often enough and with enough conviction, and can get enough of your flunkies to repeat it, then most people will begin to act as if it were true, and some will actually believe it.
Unfortunately, it works very well.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
....that the iPod is better than anything from Creative or Rio.
Just think...If MS were to not release *any* security patches at all, they could use that figure as absolute proof that Windows is more secure than anything else out there!
I'll turn into a supernova and burn up everything. Well I'll turn into a black little hole and you'll turn into string.
...let the facts speak for themselves, and keep running a virus free, spyware free, adware free system.
Visit http://ringbreak.dnd.utwente.nl/~mrjb/growingbettersoftware to download your free copy of the book
i mean : when you are designing your spyware/virus program, you try to get them installed on as much computers possible. Now, what OS should i write em for? ...
Ergo, if there should be a competor to windows that is equally in user size, only then should you be able to make a decent comparison on what is the safest OS currentely available.
ps : Sorry for the akward spelling/grammar, i'm in a hurry!
"Year-to-date for 2005, Microsoft has fixed 15 vulnerabilities affecting Windows Server 2003. In the same time period, for just this year, Red Hat Enterprise Linux 3 users have had to patch 34 vulnerabilities and SuSE Enterprise Linux 9 users have had to patch over 78 vulnerabilities."
just because MS has only released 15 patches doesnt mean they only had 15 vulnerabilities to patch.
i cant see how Mike Nash can put that forth as a useful comparison, unless of course hes trying to say MS devs are lazy when it comes to bug fixing.
I cannot seem to find a good list of the vulerabilites found in SuSe Enterprise Linux 9, which he is comparing to Win2003. I wonder how many vulerabilites are in non-core applications, which would make comparing Windows 2003, the OS, with SuSE EL 9.0 a little unbalanced. Does anyone have a link to the SEL 9.0 vuln list so that we can compare for ourselves?
OpenBSD has experienced "Only one remote hole in the default install, in more than 8 years!"
http://openbsd.org/
Move along people. Nothing to see here.
A Linux distribution contains hundreds to thousands of programs.
A Windows distribution contains a handful of programs.
A house divided against itself cannot stand.
Hopefully the Linux community can move forward with SELinux, or some other system that has mandatory access controls. Once that is properly in place Linux will have a significant tangible security advantage over Windows.
Yes Fedora currently has SELinux in the default install. Unfortunately they have had to use a fairly permissive policy because too many applications and libraries don't properly respect the sort of security bounds that ought to be in place. Right now SELinux on Fedora is like user account permissions on Windows. While it is technically there, the majority of applications simply aren't written with it in mind (eg. all those Windows apps that need to run as Administrator), so in practice it doesn't do much.
SELinux is done though, and Fedora has integrated it in nicely (including into the rpm system). What is needed now is for all those open source developers out there to realise that there is a new level of security, other than just filem permissions, that they need to consider and respect. If they can just restrict where they write files to, and what files they want to access to the minimum required that would be great. If they can compartmentalize operations so that each can run as a seperate process with least privilege all the better. This is work that needs to be done though.
Once such things are seriously in place all this harping by Microsoft about "Windows being more secure" will be so obviously the hot air that it is that we won't even have to worry about it anymore.
Jedidiah.
Craft Beer Programming T-shirts
This is one of the problems with "Linux", people compare Windows, the OS, to Linux, the kernel. I bet most of the patches from Red Hat were non-kernel related patches. However this is the beast that will have to be dealt with soon, because as soon as a company like Red Hat or Suse or who ever has a bad patch year it is going to bring down the whole Linux community, economically. It's just like Martha Stewart and how her company went in the tank because her name was attached to it. The name Linux is tied to closely to the OS's, that is my point.
Nash also said that the number of patches shouldn't be the only criteria users apply to tell if Microsoft's doing its job.
/
How about:
(# installations w/ active malware, spyware, trojans or viruses)
(# installations)
This seems a much fairer criteria with respect to the notion of being "more secure." And one, IMHO, I imagine isn't very favorable to MS.
Ok, so they are more secure because they have less patches? So now all MS has to do to be "secure" is not release patches for vulnerabilities, as is obviously their strategy, as the secunia links state that there are 0 unpatched vulns in redhat and suse, yet there are 4 unpatched vulns in Server 2k3... out of 44 errate, 4 unpatched.
And granted 15 in 2k5 is less than 30 or whatever redhat had, but those 30 include patches for web browsers, office suites, database software, programming languages, web servers, all sorts of software. Obviously this has been said before, so I'll probably get modded redundant, but comparing windows to linux wrt patches is like comparing a 50cc motorbike to a v8 super-charged sports car. Is the motorbike easier to fix? yes. Does that mean it's "better" no. and once you get all the cludges and hacks onto that 50cc motorbike to make it go half the speed of the car, you've got so much complexity, it will never run reliably... and that is windows.
All that shows is Microsoft rolls tons of updates into one patch, where as the Linux community is bound to patch as needed. When you roll the updates together, of course you will have less patches. I would rather more patches and know that security holes are patched as they are found.
Comment removed based on user account deletion
How many of MS' patches for flaws include remote exploits?
Frequently, as I follow Linux-Kernel mailing list and others, I see that many of the patches for flaws are for crazy exploits that are merely theoretical.
MS is usually trying to paper over that big whole in their brick wall.
Meaning, of course, that trying to compare just a plain count of "patches" doesn't mean squat!
Iran's security chief says Iran is safer than Iraq.
The 95% of those out there that are 'unenlightened' when it comes to computers and technology probably wouldn't even question M$'s claims. "Oh, Microsoft say they've issued less patches for Windows than others did for Linux and thus Windows is safer. I'm glad to have someone trustworthy to tell me these things!". (-_-)
/.ers.
Because M$ is more reputatable than Red Hat or Novell, the general public will much more likely consider their claims to be true. Oh well. At least it makes for a good laugh for us
Hero of Allacrost, a FOSS RPG for *NIX/*BSD/OS X/Win
This is an argument that can largely be debated on a variety of levels. Honestly? Linux and ultimately unix of any flavor has just as many vulnerabilities as Windows does. Difference -- typically most of those vulnerabilities are patched and assessed before they take affect.
Just do a search for Sendmail Vulnerabilities on google.
Result =
Results 1 - 10 of about 143,000 for Sendmail Vulnerabilities. (0.39 seconds).
for Microsoft
Result =
Results 1 - 10 of about 364,000 for Microsoft Exchange Vulnerabilities. (0.18 seconds).
You can have this discussion for days on end, and really, what the *nix community has up on the M$ community is knowledge and ability. No, there arent any viruses that are successfully written for *nix. Spyware isnt even remotely a concept to a linux user. And most vulnerabilities get patched as quickly as they are given POC. Does this mean that linux users patch any more or less than Windows users, no. But we do it more effeciently and with greater success.
Stability wise , come on. Ive got a redhat 7.3 box that baring powerfailures hasnt been rebooted in over a year. Its a good box, it would probably take an Arkady Rossovich low yeild nuke on its head and still live, and I dont know of any windows box thats able to admit that.
"God of Rock, thank you for this chance to kick ass. "
Lets see - at the current moment there are how many patches for Windows XP floating around out there. Meanwhile - the MacOS is based on a Unix kernel and does just fine. This is precisely why I'm moving away from the Microsoft camp.
"If you can just manage to say something that gets picked up by major news organizations, then it might make it come true.
Or at the very least, you might at least fool some people enough to continue to give you money."
Correct. It's called PR, and it works. Microsoft does it all the time, spewing out completely false or misleading statements knowing those will get the headlines. Corrections get buried on page 17.
The Bush administration has carried this out to a fine art. They make a grandiose announcement they know is completely false at the time ("the cost of the Medicare drug program will be X billion.") knowing that by the time the real number gets out it will get buried in the news. They even use fear to get what they want ("Social Security is broken.") as does Microsoft ("Linux is not as safe.")
Read the EFF's Fair Use FAQ
There were sonmething like 8 or 10 this week. Every "Patch Tuesday" there is at least one IIRC.
.. They need some kind of full comparison, such as Win2k/Office/Websphere,etc against a comprable linux system.
And of course Win2k3 has fewer, they include the total sum of all apps in RH,etc when they do those totals. Win2k3 comes with what?
If the original development path of NT, with a new object-oriented shell and API that would have come out somewhere around the time of NT4 or Windows 2000, had been followed... he might have a point.
But by merging the Windows 95 shell and the execrable HTML control and its associated APIs, Microsoft doomed any chance of Windows ever having a secure code base. Unless they back out or radically redesign the shell and security model they will never be able to honestly claim that Windows is more secure than (or even as secure as) any other protected-mode operating system.
staunchly defended Microsoft's record on security, basing part of his argument on how Windows Server 2003's 15 patches in the past year are far less than what RedHat or SuSE have had to endure."
No....mike....you're not helping your case.....people are upset with your company because they don't give out patches for the numerous bugs and security holes your software has....stop while you're slightly ahead mike......MIIIIIIKE!!!!!!!
"No one is more miserable than the person who wills everything and can do nothing." -Emperor Claudius 10 BC - AD 54
Like Army Intelligence
So Long and Thanks for all the Fish.
It's unbelievable that big MS managers still are tempted to tell such things, haven't they still learned that bashing does not work? And that less than one week after MS sent out one of its biggest bunch of critical security patches of the last year...
http://home.btconnect.com/chrisandcarolyn/ubuntu-h oary/virtual-warty.png Ubuntu-warty for Windows.
Torrents here http://home.btconnect.com/chrisandcarolyn/torrents /
Enjoy
This is news?
M$ does this sort of thing on a daily bases. There probley have been over 100 different articles on slashdot saying basically the same thing.
At this point who cares what M$ thinks. Give it a rest already.
Here's another example of making stats say what you want.
Sure, WINDOWS only had 15 patches in the last year however. IE6 had how many (at least anotehr 18-24), Remote desktop connection on 2k3 Server had 2 security fixes, IIS had about 6 patches....
Need I continue?
Fact is, yes, Windows had 12 updates in a year, but it's components had many more.
And also looking at the time from exploit discovery to fix, not lookin good for them there either.
DarkMantle I been bored, so I started a blog.
If secunia lists 44 and a microsucks vp lists 15 as the number of vunerabilities, how is it that big execs are getting away with such blatant lies, and how does one go about to hold such accountable. Why is it that other than slashdot, everything you read today needs to be taken with a sack full of salt. (okay so I lied about slashdot)
In other news, Iraq had WMD's and Saddam and Osama played golf every weekend. In addition, Social Security will self-destruct this weekend in a massive explosion and kill the baby Jesus.
So long as installers run without requiring passwords, and I have to give my daughter administrator privileges to run Disney games, Windows is in for a lot of hurt in the security domain because there's really no way to control what users, and by proxy the programs they run, muck with.
I mean, it's so bad right now that whole markets spawned to supply band-aids for the lack of basic protections (anti-virus, anti-spyware), and to rebuild broken systems as quickly as possible (ghost). That's pathetic, particularly since Microsoft had the ability to do a much better job of securing their systems since the release of Windows NT in 1993, and it's been mainstream since XP. It's not that they couldn't do it, it's that they didn't.
jim frost
jimf@frostbytes.com
Perfect, let's start rating the security of our products by how many patches have been written and applied. What does this kind of numbers game encourage?
(1) Don't write a patch, since that admits failure or insecure products.
or
(2) Wait a long time before writing and committing a patch, so you can do it as "one big patch" (otherwise known as, haha, a Service Pack!).
Thanks Microsoft! Just your STATEMENTS make systems less secure (nevermind your engineering).
It's not fair to consider this a black mark on Microsoft's anti-spyware app. It's not an expliot with their anti-spyware, just another trojan that happens to target it.
If anything it's a good thing for their app because it shows spyware authors are pissed.
Maybe(probably) trogans are easier to fall for on windows, but that's a separate issue/discussion.
Pope recommends Catholicism
The lecturer was, apparently, talking about the problems in writing mission-critical embedded devices, and at one point he asks his audience: "You all write embedded systems software. Tell me honestly; if your company wrote the software for a 747, how many of you would actually feel comfortable on board one?"
One hand goes up.
"You, sir! You're so confident in your software you'd trust your life to it?"
"Hell, no," comes the reply. "But any plane running my team's software would never crash, because it'd never get off the ground..."
I am confident in the level of safety given by running Windows on a mission-critical device.
Linux Distributions incorporate many packages and utilities, Windows is only an operating system, with a minimal amount of anything included with it. And seriously doubt our mircrosoftie included any patches for WMP, and MSIE, which come with the OS, but are riddled with holes
Patent: from Latin patere, to be open
If Windows needs fewer patches, why don't they offer disclosure of known but unpatched bugs? We've seen several stories of MS not fixing poor implementations after researches have disclosed. What other bugs does MS not find a sufficient business reason to fix?
If they really had a case, I'd at least expect to hear more numbers in their favor. We patch X% of bugs in Y days. Fewer than Z% of our bugs are reopened. The number of bugs that could allow for Administrator/root access in the default install was N.
Any company who uses private issue tracking will always have an easier time criticizing those who use public issue tracking than vice versa.
Korea has nuclear weapons. Iraq is WMD free. Fire is hot.
Details at your non-shock news source....
Why do we act surprised when MS claims their stuff is better than Linux based stuff?
Did you expect them to say, "Crap, you got us. Our stuff is, in fact, less secure than the competition... You win we lose. Good game"?
scott king
"Year-to-date for 2005, Microsoft has fixed 15 vulnerabilities affecting Windows Server 2003. In the same time period, for just this year, Red Hat Enterprise Linux 3 users have had to patch 34 vulnerabilities and SuSE Enterprise Linux 9 users have had to patch over 78 vulnerabilities."
:-)
Inorder for this to be received as a good thing for MS, you have to assume that there are a smaller number of vulnerabilities in Windows.
- Kevin
The less confident you are, the more serious you have to act.
no text
Pope says Jesus is better than Mohammed!
My other sig is extremely clever...
... since I grew up in the sixties, I can tell these guys are filling the medicine cabinet with acid. ...far out, man.
dot-sig.
...and untold thousands of spywares and other malwares directly targeting Windows, compared to Linux's seven viruses (lumping viruses trojans and worms under the generic term of "viruses")
Honestly what do we expect Microsoft to say ?
What company has anyone ever known who has said that they acknowledge their comeptition is better in the key areas they are competing on.
Provided -
1) It works - meaning it doesn't stop booting with that goddamnawful STOP: c000021a {Fatal System Error } message which I swear got just now for no apparent reason.
2) You put it behind atleast 3 overlapping firewalls
3) You do not browse any site with Internet Exploder - just love the blue icon sitting on the desktop - if you trouble it by clicking - it will trouble you.
4) Add remaining clauses from M$ EULA
Now M$ marketing machinery will argue that whatever you say it is in fact secure - if it works it is secure, if it doesn't, well you know - it is even more secure.
.. but I'm just shocked! Next thing we'll hear Linus say good things about Linux, or god forbid RMS say good things about GNU! This is not the world I was brought up in, this is just not.. right..
as long as you have three spyware and a couple of adware packages and a virus scanner, then windows is almost safe.
-- I am. Therefore, I think!
Does Mike Nash remind anyone else of the former Iraqi Information Minister Muhammed Saeed al-Sahaf? He knows how to put a positive spin on any and all news regarding MicroSoft.
More patches can actually be BETTER, because it means that problems are being found AND FIXED. Now, if there are more issues to begin with, then it's not better, but I'd say a stock linux box on the net without patches will run a lot longer than a stock windows box in the same situation.
7 November 2006: The day Americans realized corruption and incompetence weren't addressing 11 September 2001
Last time they were preaching a view that was so far out of touch Bill Gates turned on a dime and went from claiming the internet was only for geeks, pornographers and terrorists - to announcing they were going to rewrite everything they had to take over the internet. They almost succeeded.
This time, I think they are cornered, and even more out of touch with reality!
Mean Time Between Failure - that's the real difference.
Bavarian Purity Law of Rice Krispie Squares: Rice Krispies, Marshmallows, Butter, Vanilla.
1) The dam that gets constantly maintained is obviously the most leak prone.
2) The dam that is only repaired when a major leak occurs is clearly a superior implement of water retention.
Everyone thank Microsoft for pointing out an obvious mistake in our logic! THANK YOU MICROSOFT!!!
*sigh*
I'm too lazy to enter a sig. Hey wait a second! You tricked me!
I hear the president of Coca-Cola has also issued a press release declaring Coke to be more delicious than Pepsi.
Also, what's with Microsoft buying an antivirus product? Haven't they already had one since DOS 6.0, or was MSAV.EXE merely licensed temporarily from another company?
If by Windows 2003 containing 500% more unpatched vulnerabilities (5) than Redhat (0) or Suse (0) you mean secure, then yes, Windows 2003 is more secure.
But mind you, you aren't really defining secure that way, you're defining un-secure.
But I suppose in Microsoft's bizarro-universe, where left is right and up is down there is no contradiction.
I don't know the meaning of the word 'don't' - J
Red Hat AS 3
Windows 2003 Standard
66% of the Redhat vunerabilities are Remote compared to 59% for Windows 2003.
Now lets compare standard services on servers. like web servers.
IIS 6.0
Apache 2.0.x
IIS has only 3 known exploits compared to 26 exploits that apache has.
Have you ever been to a turkish prison?
Is it just me or was the story about 10 stories down about how spyware can disable Microsoft's Antispyware and take your cc #s, passwords, etc. I have been using a copy of linux on one of my exposed servers for several years without patching and without any significant security configuration at boot and it runs like a dream! [Although I like my OpenBSD machines better :-D]
http://www.brentcastle.com
...Kim Jong Il says that North Korea is more democratic than the United States.
(Seriously, did anyone here expect someone in this guy's position to say anything different?)
Fear: When you see B8 00 4C CD 21 and know what it means
By analogy then, a patient who has had 5 quadruple by-pass operations and 4 stints is much healthier than one who has had a couple of stints?
I don't know what's more scary: 1) Microsoft's continuing cavalier "if we cannot fix Window security adequately (shown by the volume of patches) we'll just mount a huge propaganda campaign to herald its safety instead" or 2) the fact that the Chief of Microsoft Security has such poor logic skills.
ignore the reality staring us in the face.
-- Tigger warning: This post may contain tiggers! --
I run a Debian system and haven't had to make too many patches. The ones I've made tended to be around things that aren't really core OS stuff, like patching my media player or some other random additional package that I've added. Granted, MS makes a media player, but do these counts include only the actual OS, or everything? I'm just wondering if Linux gets bashed because the non-core packages are included in the patch count, while MS gets to update mainly core stuff and comes out looking better. Thoughts?
picpix image polls. create - share - vote. fun!
Have you ever seen this report
I look at my windows update...
SIX Security updates for windows + 1 for messanger and 1 for IE (Which I don't use anyway HA!). And that's just since the last time I rebooted.
Red Hat currently, 0 out of 133 Secunia advisories
Based on flaws in 64 different packages out of a total of 477 packages.
Lets compare that against the Windows Server 2003 Enterprise edition. All of these defects are against the core Windows operating system. You have to go to the other Microsoft products to find out the numbers for those.
Lets pick another Microsoft release - say Microsoft Windows 2000 Advanced Server. Oh dear - currently, 16 out of 79 Secunia advisories are marked as "Unpatched" in the Secunia database.
Or say Microsoft Office XP. Currently, 2 out of 14 Secunia advisories are marked as "Unpatched" in the Secunia database.
Another - lets try Microsoft Internet Explorer 6 - surely there must be a fully patched MS product out there! Currently, 18 out of 77 Secunia advisories are marked as "Unpatched" in the Secunia database.
Pick something enterprise critical - say SQL Server 2000. Currently, 1 out of 10 Secunia advisories is marked as "Unpatched" in the Secunia database.
Doesn't really look good.
Cheers,
Toby Haynes
Anything I post is strictly my own thoughts and doesn't necessarily have anything to do with the opinions of IBM.
I suppose a computer with Windows installed really is safer if you:
- cover it with aluminum foil (shiny side out--just in case)
- dip it in liquid latex (to keep the MS spores from getting out)
- add a 1-inch think lead jacket
- seal it in a re-inforced concrete sarcophagus
- drop in the Marianas Trench
- and don't forget to remove the network card first!!
(You can't be too careful!)
This should keep you virus, spyware, and cracker free. Mostly.I might know what I'm talkin' about, but then again, this is Slashdot...
Hilarious. I love that MS thinks that "Our product is more stable because we've fixed less bugs than our competitors" is a valid argument. Perhaps their next tactic will be to impress us with the fact that those 15 patches were hundreds of mbs, cumulatively.
There was a information guy from the Iraque defence, claming that all american forces was outnumbered while bombs fell in the background...
CEO of Nabisco says that Oeros are awesome!
"Of course, we didn't evaluate them with the network cables plugged in. We didn't want the Internet to skew our results. There's some dangerous shit out there."
I guess this thread is about a comparison of Linux vs. Windows security which, of course, is obvious. But what I think isn't being noticed is that the Windows security situation is in a crisis. Now, I know, it's easy to laugh at Windows and say well, sure, Micrsoft was stupid enough to implement stuff like the COM 'Browser Helper Objects,' the unprotected scripting engines, the IE Active-X controls, etc. and so, 'of course', the Windows security sucks. But consider that a major portion of the world uses Windows now for email, the internet, and document exchange and these people are hurting. Yes, the big enterprises have double redundant hardware and software firewalls, virus scanning, spyware extraction, and large staffs of experts to roam around and put out the fires. But the little users don't have any of that stuff and they are finding it increasingly difficult just to keep Windows going day-to-day. Basically, there seems to be a worldwide cyber war going on in which the holes in Windows are being cracked so wide and so frequently that the anti-virus/spyware/trojan software cannot keep up and users are left with systems that barely function, even when they run the latest anti-virus software with the latest downloaded updates. The purveyors of viruses, spyware, trojans, and spam are winning here and there are bad consequences for all of us, even if we don't use Windows. If you are able to help, consider donating a little of your time to helping a neighbor, small business, school, or church with their Windows problems. Maybe you can even help them migrate their system off of Windows. They are probably going to be interested.
Once upon a time Detroit didn't put any new safety features into it's cars because it would imply that their cars were unsafe or that the competion was safer. As a result metal "face breaking" dashboards, "scalping" metal glove compartment doors, and "chest puncturing" steering wheels killed and maimed thousands before Ralph Nader wrote "Unsafe at Any Speed!" and forced Detroit to admit they had a problem and take action to fix it.
Detroit tried to dismiss Ralph Nader as a fear monger, liar, etc.
So how much longer before a major IT crisis cripples a Fortune 500 company and puts thousands out of work. Remember that the Enron/Worldcom fiasco pretty much put Anderson out of business.
Flacks and partisans' opinions are worthless. The only metrics that matter are security audits and compiance to legislative standards like Sarbanes-Oxley.
When MS's 'Man-Ho de Jure' can point to specific audited results that back up his claim then I'll believe him. Until then he's just another pretty boy on the garbage strewn beach of security.
Safer? Pfft very unlikely when you look at the sheer number of patches for all versions of Windows and their various software like Internet Explorer, Office Suit, IIS, Outlook, you name it.
Internet explorer especially for being so damn un-secure that spyware authors just love to infect via Internet Explorer if a person doesn't know what he or she is doing (namely most AOL users).
You must master your joystick like a fisherman masters bait! - Gimpy
Shocking!
Linux vendors include a whole load of `crap' in a distro. Very few of those vulnerabilities have anything to do with the core system, whereas almost all of Microsoft's do.
Comment removed based on user account deletion
Let's not forget how many of those Linux security patches needed a reboot. Although, to be fair Windows only needs a reboot when a patch makes significant changes to the system... or should I say, Internet Explorer.
He is using another security model. At least if you can call it that. They realize security through obscurity. GNU realizes security through openness. The availability of the source code allows people to look for vulnerabilities, which will in the long term result in a better product. The flipside is that there are more security fixes. If you hide your source code, less security holes will be revealed, hence less fixes are required. But anyway... I guess every sane thinking person realized this already... ;)
Personally I feel more comfortable with the free/open source approach. Much more people identifying and fixing security issues, and security issues are immediately out in the public, which is pretty much a better incentive of actually solving the problem.
It doesn't matter how many are fixed, it is the number of unfixed that are important. I'd be happier with 45 out of 50 fixed than 15 out of 600.
to replace XP with SUSE Pro 9.2 on a computer that a couple used to do work at home. They needed to get work done and with the bugs, viruses, adware, popups, etc., they were getting overwhelmed just trying to keep their XP 'clean'.
Last night all those troubles went away.
Running with Linux for over 20 years!
I just thought their music blew. Turns out Kip went to work for microsoft!
At Information Week, their poll shows that 84% of their voters are of the same opinion: Mike Nash is full of crap.
See what I've been reading.
Using that logic, Microsoft outlook is far more secure than Novell Evolution because patches are coming out all the time for Outlook.
What really matters in the end is:
1) The seriousness of exploits
2) The quantity of exploits
3) The imposition placed on IT people in applying patches to fix exploits
If you release a lot of patches but they are readily applied without causing downtime, etc, then that's not a big problem. If a few exploits are found but the exploits are huge gaping holes, that's bad for everybody. This is another one of those cases of trying to measure a qualitative problem using quantitative means. It means nothing but it looks good in a press release.
Is it truly more secure than Linux? The real measure is hacks per capita. How many boxes are out there, and how many are getting exploited?
Frankly, I think Linux is more secure for one simple reason: I can more readily control what's running. Linux is much easier to trim down to a minimal system, shutting down services, and making it very difficult for an exploit to do anything if it can even get on there. If I have a box that's a Linux webserver, I can trim it down to Apache and SSH, and that's it. If I just watch for exploits of those two things and the kernel itself, I'm golden. With Windows, I have these service packs and updates that change mysterious things without my knowledge. I'm at much greater risk of unexpected consequences of a security fix.
This sig has been temporarily disconnected or is no longer in service
In terms of market share of Apache vs IIS, the problem here is that your success rate of infecting a machine is generally going to be higher with IIS because of the discussion we've had in other threads... IIS is most likely going to be run with Administrator privileges on that machine. Apache, at least on Unix/Linux systems, runs as its own user/group, so it never has root privileges on the machine.
OCO is Loco
Comment removed based on user account deletion
...for stories that are likely to make someone spit a mouthful of coffee on their monitor, keyboard, plush Tux, etc.
Discussions about "my OS is more secure then yours" are completly pointless if both OSs have buffer overflows every few days and remote root exploids every few weeks or month in either the kernel or an important and widespread application. Neither OS is secure and requires regular patching, if you don't then its just a matter of weeks before your computer gets some new owners.
The only thing that might be worth to discuss is maybe which OS is easier to patch, but I don't see any clear winner there either, while some Linuxs have apt-get, in practice one often ends up compiling software oneself, so byebye apt-get and hello manually reading bugtrack. Windows has its update service too, but that basically fails for the same reason, since a bunch of software isn't tracked by it.
Talking about patch frequency, well, OSS might be a little bit faster here sometimes and a bit slower at other times, but so far for each worms that widespread used a leak for which a patch was already available weeks or month ago, so patch frequency doesn't seem to matter that much.
And when talking about targetted attacks neither OS seems to be much good either, a whole bunch of popular Linux (Debian, Savannah, Gentoo-mirror, lots of PHPBB sites, etc.) and Windows server got cracked in the past.
So well, wake me up when there is an OS out there that really is secure and doesn't instantly give root to everyone just because a programmer made a tiny mistake. grsecurity at default on all distros, every app written in Java and running on a VM or whatever might be something worth to reconsider the question which OS is more secure, but for now both are insecure if you like it or not. After all there is a reason why truely sensitive data isn't connected to the internet at all most of the time.
MS went to a 'patch once a month' methodology.
The Kruger Dunning explains most post on
ethics? credibility? I think you geeks are just making up your own words, (when you are not trying to recycle these obsolete ones). If you are going to use these strange and arcane bits of vocabulary, you really should explain what they mean. ;)
There is not nearly enough love in the world, but there is far too much trust.
I started to chuckle when I read the headline, then I realised that I had a difficulty figuring out why I was laughing. Is it the fact that somebody who's professionally into computers states this or the fact that a MS guy saying this is considered news?
Even the mere fact that they keep repeating it is hilarious in itself and has it's own twist of humor. *grin*
This actually shows that MS Windows is worse off than I thought.
We suffer more in our imagination than in reality. - Seneca
Well, he would, wouldn't he?
Get your teeth into a small slice: the cake of liberty
But then, I think the Bears are a better football team then the Patriots, the Cubs have a good chance of going all the way this year, and since Brad Pitt left her, I have a shot at Jennifer Aniston.
Mike Nash and Condoleeza Rice?
Using a google search to support your arguments? are you kidding?
Alls this proves is there are more sights with those words in them. Nothing else.
what does exchange and send mail have to do with linux and Windows? Nothing.
look at the opporating systems. Since MS as declared the IE is a core part of the OS, then you need to count those for windows as well.
Look at the exploits, how many of each cn be done remotly? If you need to be sitting at the computer to exploit the bug, then it is not very sever.
what do you do with your OS? I've seen windows boxes with over a year of uptime.
The Kruger Dunning explains most post on
Looks like our good buddy Comical Ali has found a new job. I, for one, am happy for him.
I vaguely recall another PR battle that was waged much the same way... "We have destroyed 2 tanks, fighter planes, 2 helicopters and their shovels - We have driven them back." - Iraqi Information Minister
Every year, Microsoft has made this claim (read more at Techworld). Usually after a major Windows security issue, or a big PR campaign about security.
This year's one is not as good as last year's classic, Days of Risk.
How completely shocking that Microsoft's Security Chief would publicly declare that his company makes a more secure product that its competitors!
The U.S. Constitution needs to be ammended with a "separation of business and state" clause.
Were these '15 patches' to the core OS of Windows, or with applications?
I can count on one hand how many *core* issues with both Linux and FBSD have appeared in the last year.
Need to compare the same sorts of numbers to be accurate. But then again, facts always hurt PR jobs..
---- Booth was a patriot ----
Yes Windows is much safer than Linux when shutdown
Blog from where blogging counts
Okay I'd like to play devils advocate today (I don't really want to have my a%% torched, but I expect it). Everytime the security issue is brought up the number of patches is brought in as an argument (I agree this is ridiculous for a number of reasons already pointed out, basically I don't think the number of patches has anything to do with how secure a system is). But the real FUD line which keeps bring brought up is, if 50% of the computers on the internet were Linux, would linux users have the same problems as Windows users. If linux was targeted more often would linux users have the same problem.
I have some concerns that Firefox is going to be used as the test for this argument. Currently the argument is that Firefox is a more secure browser. The counter argument is that currently the reason it is a more secure browser is nobody targets it. My big concern being that once Firefox is targeted it starts displaying a lot of problems. From then on the argument would be, see as long as nobody uses Open Source they are secure. But once they gain in popularity and become targets they fail.
So can someone point me to the simple golden bullet argument that says Linux is and will continue to be more secure than Windows?
Hey.... when was this guy hired my Microsoft?
Humor aside, counting patches is about as good of a way to determine security as counting car crashes to determine what is the safest car.
People who think they know everything really piss off those of us that actually do.
Since MiroSoft is planning on incorporating this new-fangled AV (anti virus) engine into their operating system it appears that they are not planning on securing their interfaces and API's so much as running constant scans of what is being fed to the system. This sounds like more process overhead, something which already makes Windows servers top-heavy ==> more streamlined OS's will continue to have the advantage of being able to do more on the same hardware.
Go MircoSoft! Yeah, keep running in that direction... *whispers* Ok guys, lets ditch'm!
Religion is poison to rationality, and we lose sight of that at our own peril. -- Lurker2288
Known Facts:
Bill Gates has security.
The founders of that third party closed source solution are secure.
Even the head of security is secure.
I believe that the rest of us fear the night.
Hopefully all this FUD from MicroSoft will spur FOSS developers into adopting more security measures.
May the Maths Be with you!
I know Microsoft is expert at talking their competitors (and good ideas) into a premature death but I find it difficult to believe these kind of statements are going to convince anyone living in the real world. My Boss' home pc has been hacked, our work machine's have been hacked, my daughter's window box had a trojan, every window user I know (and there's a ton of them) is badgering me to help them clean the adware off of their system. All that time my linux box is as stable and happy as a 14th century tahitian prince and my two apple loving friends just sit behind their fancy sceens and grin.
Microsoft just can't talk that away.
Windows is as secure as you make it. Same with Linux.
The big difference between the two is that most of the exploits available for windows requires uneducated users to have some type of interaction to infect their system or to have an exploit run.
For example, I do not believe it's the fault of Microsoft if an end user installs spyware when the visit a website. Or an even better example is how an end user will install an application like kazaa on their system, even knowing that it has spyware installed.
Windows 2003 is very secure, and I believe that comparing XP home edition to Linux is very unfair simply because the majority of people who would be running home edition will have no idea how to protect them selves online. A better comparison would be Linux to 2003.
What are the biggest insecurities that people complain about with windows?
Spyware, which in most cases is installed by an end user full well knowing what they are doing, or being tricked, virus's installed via Email (mostly related to end users (latest version of outlook has a lot of default features turned on to remove the use of images to track users (spam) and to not allow attachments)).
And IE exploits run from non trusted sites, again the end user going to sites that they should not be going to if they do not trust them (I think we all know which types of sites run a lot of these types of exploits).
Yes windows is not secure, in the same sense that Linux is not secure, OSX is not secure etc. It's the people who use the OS that make the big difference.
p.s. Yes I know full well about the various worms and exploits like the messaging service and RPC, which had nothing to do with end user interaction, these were big fuckup's on Microsoft side, but with a updated/ patched system Microsoft has been able to make a stable, POPULAR, and secure enough OS that is capable of being user friendly but powerful when needed.
TruePunk | Games
He, he, he...
I am Mr Big and I sold him the crack he smoked (for way over market rate too)
That would be like Apple saying they're better than everyone else because the iPod has had less patches than any other OS.
Why does this guy even get press time?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
... it was revealed that Aronld Schwarzeneger is a woman and Afghanistan is the leading world economy.
Micrsoft's formula for press releases lately seems to:
1. Take a flaw in a M$ product
2. Compare with Linux/OSS
3. Assert the opposite of what you find
4. Profit
And in other news, it's been discovered that motorbikes are safer than cars because they have fewer wheels.
The world's burning. Moped Jesus spotted on I50. Details at 11.
I had done a quick analysis of this issue back in Janurary (My Blog) and you can get some very interesting stats over there (thanks Secunia!).
One of the FUD items here is that Microsoft buries numerous patches with *multiple* vulnerabilites. While this is true some times with Linux, often times this is not the case.
Secunia lists 38 issues in Windows 2003 server with 11% of them unpached. I wonder what he would have said if the reporter had been able to give him those stats.
Secunia also has this to say about Linux, it's 99% to 100% patched. Windows on average has about 13% unpached.
This FUD is documented as being outrageous if you just know where to look.
Thanks!
How many bugs are fixed by a typical Windows security patch? On the W2K machines where I work, the Software Update thing will quite often show up with 5-7 patches, all of which contain something like the following description:
There could be dozens of bugs fixed in one of those patches. Or there could be just one--you have no way of knowing. I don't even know which files were changed.
Whereas, at least the Red Hat errata I've dealt with, Red Hat lists the all the bugs resolved in a single update (relative the the prior update for that package).
So counting patches is just useless, for many reasons. You need to count the number of open exploits--and how can you count the unknown ones?
He, he, he....
Yes I am Mr. Big and yes he was smoking crack at the time. I know 'cause I sold it him (at way above market rates too)
BeOS and OS/2 were found to have the highest security of any operating system as no patches have been released in years.
"forget our track record, forget what we said before, and ignore everything happening on our desktop systems; our server r0x0rs!"
apparently you are ignoring everything happening on the desktop systems. If you haven't noticed, Windows XP SP2 is rather good. I just got in an argument with someone yesterday about this: when it comes to software development, you can't dwell in the past for TOO long..any software developer will tell you that a project is a continuous work in progress. There is a constant tug-of-war between meeting the deadlines and addressing the implementation of new features.
At it's time, Windows 95 was decent..a big change from what the public had seen before. Windows 98 was a big improvement over that. Windows 2000 was an even bigger improvement. Windows XP was even bigger than that. In retrospect, however, they are all looked back in with disdain. Why is this? Because Microsoft was trying to build an OS that was easy to use and maintain - something that only Mac has been able to do with OSX. Unfortunately, the human factor got in the way and started ruining the day for everyone in the form of virii, spyware, etc.
Since the commercial explosion of the internet (1998-2000) Microsoft recognized that there was a need for a change and they gradually started moving in that direction. It's a work in progress..you live and you learn..that's life. So don't judge them too harshly..they are starting to get the picture. If Microsoft was still hiding behind a product like Windows 98 and calling it safe, stable, and secure, then I could see where one might have some distrust.
Anyhow, bring on the "he's a microsoft fan-bois" comments..
Those who can, do. Those who can't, go into business for themselves.
This reminds me of the days when Novell NetWare has C2 Redbook certification. Microsoft came out with the same claim, that Windows NT 4.0 was C2 Redbook certified as well, except in the fine print it said "provided it was not connected to a network"! That was like buying a boat that was capsize-proof provided you didn't put it in the water. Of course the whole claim was a "me too" campaign to confuse and fool people, and it worked.
But people are no longer fooled by what the folks at Redmond say. Even my mom knows Windows is horribly broken, and she knows nothing of computers. The fact that such statements are being made are not just funny, they appear downright desperate.
Ruby on Rails Screencast
nothing more to say
Grundgesetz * 23. Mai 1949 - 30. November 2007 - http://www.vorratsdatenspeicherung.de/
I'm so tired of this argument "Our software is more secure than their software". It's ridiculous. What they're really saying is "Our programmers and development processes are better than your programmers and processes." These security debates, whitepapers, and arguments are always subjective, never solve anything, and only prove that someone has time to waste.
Any given OS, in the hands of an expert, is just as stable or secure as the next. There's just no way to effectively prove otherwise. The test domain to definitively prove which OS is truly the most secure is incredibly huge. As long as human beings code it, it's insecure. There is no version of Unix or Linux that has a higher Evaluation Assurance Level than Windows 2000. That doesn't necessarily mean that any novice could actually secure it either.
Reality is that Windows has a huge number of desktop installations and it's used by a large number of people that can't even open up Notepad or a command prompt if you asked them to. Those same people couldn't even install Linux so it's not reasonable to even suggest. So, how are they supposed to have any idea about security? Most of them can barely get online. It's no fluke that AOL and Windows are as popular as they are - they're easy to use and they have a small learning curve.
Furthermore, Linux and Windows are so different that's almost ridiculous to even compare them. They solve different problems, they both have their strengths and weaknesses, and other than the fact that they're both operating systems they don't have much else in common. In many ways comparing those two systems is like comparing an F-16 to a Leer jet - they both fly; they both have wings; they both have cockpits, throttles, and tails; they're both airplanes but they don't look the same; they don't have the same internal components; they aren't operated the same; and they aren't made for the same purpose.
Security arguments are out of style. It's safe to say that no major software maker is intentionally designing insecure software. Move on. Innovate. Come up with something original.
If you do what you always did, you get what you always got.
Further in the news:
In the bold move of enhancing users experience and
security MS announces that from now on MS will not realeas any security patches. In this way Windows
will become the most secure OS ever.
Hmmm, lets see...
WINDOWS XP PRO
Secunia advisories rated Highly critical
Currently, 21 out of 87 Secunia advisories, is marked as "Unpatched" in the Secunia database.
RH LINUX
0 Secunia advisories
Currently, 0 out of 133 Secunia advisories
So, is Windows more secure than Linux?
The answer is right in front of you...
What kills me is, with Linux, you can have a patch in days, with Windows, you get your patch in weeks, or months...
--E--
"We have zero escapes!"
Table-ized A.I.
Why is it that everybody is so pessimistic about that?
Everytime Microsoft badmouths Linux, more PHBs realize that this Linux-thing can't be so bad when it's such a huge threat to Windows.
...an article posted on Slashdot allowing an opportunity to bash Microsoft. We really don't hear enough MS bashing on /.
yawn
Nothing to see here.
(+5 Funny)
"Mike Nash, Microsoft's Chief Security Executive" aka "Mike Nash, MCSE". 'nuff said.
ok so his comments might be taken with a grain of salt. but, it does give me an idea that may have implications for Linux/ other OSs.
Windows is currently getting attacked more because it is more popular. There are many people searching for ways to get at it. As they are successful, Windows (eventually) patches the problem and (theoretically) learns a little bit more about security.
Linux et al is not facing the same level of attack and therefore is not getting the same "education" about security. Granted, people are reviewing the code, but not as many as are attacking Windows and not, I would bet, with the same motivation as the Windows miscreants.
What happens when/if Linux gains the same popularity and suddenly is found to be suffering from the same set of problems that Windows worked through years before? Perhaps, at that point, Windows might be considered more battle-hardened and thereby more "secure"
fdc
Synergies are basically awesome, and they're even better when you leverage them. -PA
I don't care if a system has 10 patches a year or 10,000 patches a year. I need a way to distribute those patches easily.
Redhat has an OK system, but Microsoft has a nice tool (software update services) that allows me to download the patches in one place and push them out to all the machines on my network. This will only get better when MS releases the next update to this tool (windows update services).
I haven't seen a similar thing from any of the linux vendors.
Sure, there are tons of third party products to add this feature to Linux, but that's a pain - and it's another product to buy. Each distribution needs to find a way to centrally automate patch management and installation. This should be part of ANY linux distribution by default.
-ted
What did you expect? Microsofts security chief to say that linux is more secure?
If your doing web browsing on your server then you sould expect nothing but bad things to happen.
That is so screwed up, I can hardly understand it. Are you REALLY so conditioned to security holes that this is an expected outcome?
All that is necessary for the triumph of good is that evil men do nothing.
One (me).
And at least two others that I know in meatspace...
--MarkusQ
1. That every time anyone says anything about one OS being more secure than another, especially Windows vs. Linux, Slashdot thinks this is front-page news.
2. That every time such a story MAKES the front page, thousands of people post comments.
3. That many of those those comments obviously took more than five minutes to write.
Who the christ cares what so and so says about the security of one OS over another? Particularly when the two are Windows and Linux, and particularly when the party making the statement is completely biased! This isn't news for nerds! This isn't "what IT is!" This is stupid FUD that no one should care about!
Of course, my statement isn't any more original than the ones the original post is referring to. Isn't irony fun?
-- Have you ever noticed that at trade shows, Microsoft is always the company that is handing out stress balls?
... can any MS product be connected to a dsl connection - without any third party firewall, anti-spyware, or antivirus ? this is the important question.
What network services are turned on in the default install?
This guy is a troll! A very good one, perhaps, but nonetheless a troll.
Hmm..
When counting vulnerabilities and patches for its software, the OS and the Apps are counted separately.
When in front of a federal judge, some of the Apps and the OS are counted as being together.
Hmm..
Maybe if they patch more often, I wouldnt have to run the virus checker that much often! Amazing how they are trying to get credit for slacking off!
The wording is true, Windows 2003 does have fewer security bugs than a linux distro like redhat or suse. But you never got an education if you think you can compare the two. Apparently MS's own security chief is one who didn't get educated, evidenced by the fact that he cannot count, his own site reveals the lie:
c urrent. aspx
There are 35 security advisories on their site for the last year in 2003 server gold.
http://www.microsoft.com/technet/security/
What about the count of bugs fixed in all the other microsoft products that install on Win2003? And all the other products in existence that other companies provide for 2003 server with Windows 2003 certification. And add in those that are undisclosed, or found internally by Microsoft. You would have to include those in a windows vs. linux "distro" comparison.
Then we get the truth, and find that popular linux distro's have fewer security bugs, and they didn't have to send out a dummy to lie to us in the press.
"No one fucks with de Nash!"
For the homor impaired, check here.
*Condense fact from the vapor of nuance*
We can choose which of the "bundled" apps to install.
Windows users can't without jumping through MAJOR hoops. (Microsoft claims it is not possible at all, but software like Win98Lite showed people otherwise).
Windows - We cannot install Windows without installing IE.
RedHat, Gentoo, whatever - Lynx, Galeon, Firefox, Mozilla - What browser do you want to use today? Or maybe you don't want any at all! You can make that choice.
retrorocket.o not found, launch anyway?
Many here have happily pointed out the 'apples/oranges' comparison between a large Linux distro and Windows. The differing nature of most of the holes - largely theoretical local exploits vs largely gaping remote holes - has also been pointed out.
... but providing it in a computer readable, standardized form wouldn't hurt when compiling statistics, and might reduce the use of "blah patches".
One thing that nobody seems to realize is that the fact that Windows is small and that other functionality is in separate products may, from a security point of view, be a good thing. It certainly makes it easier to keep track of what you're using (though it'd be nice if the "other products" would integrate with the OS's security update mechanism - grr).
In a large outfit, I could see real advantages to having a cut-down desktop-only build of a distro for exactly this reason.
Similarly, a server distro where the "tasks" were packaged separately might be useful. This server "isn't a database server" so you don't have to worry about the DB related stuff, etc.
Taking a Debian-like install-less-by-default idea is probably also wise.
That said, half the security advisories I get from Debian are for tiny utilities I've never even heard of, and for games. Usually they're local exploits for things like race conditions and temporary file issues. Yes, they should be patched. Yes, they probably merit a security notice. No, they're not the same as (another) remote root hole in sendmail.
Perhaps distributors could start making it easier to evaluate security issues by sorting them based on whether the package is installed by default or not, whether it's widely used or not and whether the exploit is remote or local. It wouldn't hurt to clearly show whether the hole may lead to a root compromise, normal user account compromise, data leak, etc. This information is usually all there already
I'm using Slackware here and guess when I ever needed to patch my system
Come on, what the hell else is the guy going to say?
He WORKS for microsoft, he's going to defend the company (and its products) that puts food on his table.
Didn't RTFA.
This guy is showing just how stupid or ignorant he is. He failed to point out the most important fact of the entire study --he's counting only OS updates for Windows yet couting everythig patched for Linux. I can remember one or two security updates to the linux kernel last year. I say compare apples to apples next time or don't bother talking.
My lame blog.
In short, if I used Microsoft Windows without protecting it with a whole a bunch of 3rd party products and lots of diligence, it would be a steaming spyware infested heap at this moment. Which is clearly what a great number of machines are.
Even protecting yourself is not perfect. First it costs money - maybe as much as the OS itself to protect it properly. And having to run all that software impacts machine performance. I would not be surprised if the anti-virus scanner alone eats up 5-15% of file performance all by itself.
Anyone who claims Windows is safer than *any* other operating system clearly isn't living in the real world.
Why are they touting their purchase of Sybari? Linux has no need for a virusscan program and that is one of the biggest reasons it has better security.
That's what I think of when I hear Micros~1 say, "but we've only patched 15 vulnerabilities!"
...just my 2 gil.
Microsoft Windows Server 2003 Edition
Currently, 5 out of 44 Secunia advisories, is marked as "Unpatched" in the Secunia database.
Apple Macintosh OS X
Currently, 3 out of 45 Secunia advisories, is marked as "Unpatched" in the Secunia database.
Red Hat Enterprise Linux ES 3
Currently, 0 out of 133 Secunia advisories, is marked as "Unpatched" in the Secunia database.
SUSE Linux Enterprise Server 9
Currently, 0 out of 21 Secunia advisories, is marked as "Unpatched" in the Secunia database.
This is almost too funny. Yeah, he's probably right, but talk about focusing on the wrong thing! When will Microsoft learn. It's the number of open exploits that matter for fucks sake. And no, the common "but Windows is so much more used so people don't report as much problems on Linux" defense apparently just malfunctioned as well. Sure, I use Windows XP at home, dual booted with Mepis Linux, but that's because I don't use it as a server and don't require the same kind of security.
Beware: In C++, your friends can see your privates!
I'd like to see any one of you losers break IIS6 in a hosting environment and PROVE IT WAS YOU. Then tell my its not secure.
Usually the make install of a new kernel reruns LILO anyway. I use LILO on some servers and GRUB on others.
/etc/rc.d/ or using chkconfig.
Usually a bigger issue is that you installed some critical service but forgot to enable it either by dropping symlinks into
When one of my servers needs any new services installed or kernels patched, I actually schedule reboot testing. In fact essentially all of my reboots are due to this testing. It does cut into uptime but it means that when I need it, it will be up.
LedgerSMB: Open source Accounting/ERP
If you know what is running in your corporate infrastructure and you are able to quantify this with tools to make you life easier, you will be fine. If you let your users go out and do whatever they want on the web, (free ipod, download music) then it's your own fault. There are so many layers to the network and so many ways to update and prevent 90% of spyware, anti-virus and exploits from happening it's sickening to just hear people just bitch about the state of things instead of taking that time and using it to make thier current systems better secure, virus resistant, etc. Why is this so hard? If you are a network admin and you are intimate with your network like you should be, then all the discussion about patch management is moot because it's just another tool to help you do your job. If you whine about the tools out there, instead of using the best stuff you can get your hands on, then you'll lose. Take what you have and use it. I'm not really sure what the "most secure" OS that's out there is, but I do know, faced with my currect infrastructure, that I know what's going on within my network, and have put the neccessary tools in place to make sure that my patching is done, my AV is up to date, and have reports of suspicious activities. Now that I automated most of this for free.... I can spend my time on other problems that haven't been solved yet. What frustrates me is that just because windows isn't 100% secure, people complain, instead of using their knowledge and skills to make it better with what's available now.
JP
This could just be rhetoric to boost Bill Gates' upcoming speech at the RSA Conference next week... called "Security: Raising the Bar".
Honestly, I almost spat my coffee out when I read it.
*yawn*
MS says MS is safer than Linux? I never would have guessed that in a million years...
See screenshot: here
HTH.
The following sentence is true. The preceding sentence was false.
It only helps open source and alternative platforms (like Macs). MS can spout on all day long about how secure their products are, meanwhile the average user who is stuck using their products is having an entirely different experience. Sooner or later, people will begin to ask, isn't there a better way?
There is this classic confusion about classifying bugs. There is a fundamental difference between "linux" patches, as they call them, and kernel patches. The linux core has a relatively low number of security flaws. Even when they do, the severity of the patch is far lower since most bugs won't give you root level access. Unlike the windows bugs that typically will give you root/administrator rights. The distrobutions may have a lot more bugs, but they also include thousands of open source applications.
If you want to compare bug numbers, it's only realistic when you count the number of bugs in the kernel compared to the windows base OS.
WURD!!
For without Microsoft we would have been ignorant of how bad it could be. Think about it. If Microsoft security weren't as easily exploited as it is, developers would never have started thinking about security in the way that they now do. The internet was naive. EMAIL and TCP/IP weren't designed to be secure or trace-able because no one considered the possibility that someone would want to harm others. Because Microsoft was the first to get big, they became the first target for the nasties. And because they were the first to get whacked, the security of Linux, OSX, and other opperating systems are being greatly improved before it becomes an issue for them. It could be argued that linux, OSX or FreeBSD would never have as many security issues as Windows did in the beginning, and that may be true, but Java, for example, is a universal application and I'm certain it is more secure now because of Microsoft's example of what not to do with system security. I honestly believe that Microsoft's growing pains have greatly benefitted us all and thank god they have the deep pockets to pay for it. So here's to Microsoft! Salute! Raydude
But one could also look at the trend lines. That will allow to estimate what percentage of vulnerabilities have been fixed for each platform. Then one could compare those two numbers. That will somewhat reduce the effect of not comparing like with like, although you could get an artifact due to Microsoft bundling increasing numbers of patches in order to meet a patch release schedule (I don't know what their policy on bundling is)
Squirrel!
Which is important because, as everyone knows, security is a product. And now Microsoft offers more security than other vendors.
(Now excuse me while I go and gouge out my eyes after having read this article.)
CUR ALLOC 20195.....5804M
My point being was that if your servers are so accessible where people are browsing the net. Or that you are using your servers for your own personal activities then you deserve what happens to you.
Or more to the point, WTF are you doing browsing websites on your server(s) anyways. This is the same as saying that your server is exploitable to an outlook exploit because your check your mail on your server.
Now if your talking about home servers, or non "mission critical" servers, then who cares, I'm talking about servers in a work/business environment.
From my experience from anyone who takes their jobs seriously, they would never use their servers to browse random websites, in fact they log onto their severs as little as possible. But then again they also don't use their servers to play games, check email, etc.
TruePunk | Games
Dude, where have you been since this occurred?
It wasn't THAT long ago, so I won't really hold it against you.
What we should care about, is Microsoft communication department. Anybody that has computer skills and knowledge knows that Microsoft is technically *out*... but not the average joe. So the only ways Microsoft has left in order to be not too much ridiculous, are dishonnest communication, demagogy and legal attacks. Microsoft is improving because it's using/copying open source technologies. For instance download the Microsoft Platform SDK of februrary 2003, and in the objbase.h header you will find some perl code! This kind of declaration is an insult to intelligence.
Windows + Lusers = Garbage
Linux + Lusers = Garbage
Windows is MORE DIFFICULT for any user to patch because it isn't as secure or well-built out of the box, but an idiot with a Linux distro can still create a mess.
"(Atomic) bombs are nothing. Give an ape enough uranium and you will get a bomb." -- unknown from Los Alamos
Satan has announced that Hell is really much nicer than Heaven.
Windows is definitely more secure. I patch whenever necessary and have never had a problem! I love Microso
This week's set of Windows patches requires the machine to reboot. I'm about to give a presentation, so I click on the 'Reboot Later' button. Ten minutes into the presentation, the full-screen presentation reverts to window-sized, and the 'You need to reboot' message pops up again.
Yes, you can drag the window off to the left or right of the screen so that it doesn't annoy, but how many users know to do that? Clicking 'Later' makes the box go away for a while (or click 'Now' and lose what you were doing, oops). There is no preference to make the delay longer, or not pop up at all.
The issues addressed in the parent are easily solved. The 'Reboot Now' message is not. I'll reboot when I'm good and ready, and not a moment before, so stop bothering me!
HP's CIO declared that HP's product were better than IBM's.... What do you really expect the Chief Security Exec to say... another well picked story by the ./ group.
...one of our old friends?
Pre-emptive mod: -1 Redundant (no i didnt bother reading any previous posts)
Sad, very sad. The number of patches is not a measure of security, the actual exploits over a given time is. These guys are seriously deluded.
This entry would be better placed here.
DeMaurier declares smoking is not hazardous to your health.
McDonalds says their food is not bad for you, will not cause obesity.
Other completely-biased research shows that corporation that funded their research is indeed a good company.
You get the idea...
I don't like to get political, but this reminds me so much of the Bush administration. Its not the politics of the Bush administration that bothers me (I don't like their politics, but I can disagree with people without thinking they are corrupt), its the fact that they can have repeated failures, and still with a straight face claim that they have a success. How big does the debt have to get, and how many people in Iraq have to die, before Bush & Co. admit that perhaps they made some mistakes?
Same thing with Microsoft. If they can say with a straight face that Windows is more secure than Linux, how big of a disaster has to happen before they realize the real situation?
Hopefully I didn't put any [] around my words.
IANAL, IAAFMSE (I am a former Microsoft Employee), etc... Microsoft has been shown in court (in the EU at least, iirc) to bundle software with their system in order to damage competitors, especially those which threaten their monopoly or in areas where they want to extend their monopoly. For example, Internet Explorer to kill Netscape, Media Player to kill Real. If they can control these core areas, then people will be locked into their system.
This was NOT the case with the Windows Firewall (which is poorly designed anyway and will never be a real firewall product-- even though it is stateful, ipchains was far superior to it). But many of us questioned it simply because of Microsoft's anticompetitive track record.
Now, compare that to the pro-competitive nature of Linux app bundling.... With Fedora, I can install KDE, GNOME, and/or KDE if I want. Which browser do I want today? Do I want any? Which email program do I want today? Should I use elvis, vim, or emacs? This bundled software encourages competition between the external communities and drives all the distros forward.
I don't have a complaint with bundling as such. What I and many others complain about is how Microsoft tries to lock users into their system. Such a lock-in does not exist in the Linux world among distros composed entirely of Free Software.
LedgerSMB: Open source Accounting/ERP
What else would the MS Security Chief say?
If he said that Linux is more secure than Windows, that would be news!
Of course he will say that Microsoft's OS's are more secure. He works for the company and is in charge of that part of it. He would be crazy to say otherwise. On a personal note, none of the OS's are airtight with security. If you can make it, you can break it.
oh, browsing on a mission critical microsoft server in an enterprise environment...
/everything/ is in fact running on the server (web browsing, mail clients, office suite, etc) -- not on the workstation...
hmmm.. well, what if youre running microsofts terminal server (i think thats what its called), or citrix, where
to me, it sounds like youd be absolutely stuffed in this situation -- but then maybe i am missing something here....
thanks!
(apologies for lack of single quotes and question marks, this damn pc has a spanish keyboard mapping with a uk keyboard)
SCO has fixed 0 vulnerabilities in the last year
Microsoft has fixed 15.
SCO is flawless...
Windows XP is four years old.
Real programmers can write assembly code in any language. -- Larry Wall
MS is making progress on security using any reasonable metric, so if you don't think Windows is secure then you're being unreasonable.
When I was a kid, we only had one Darth.
My question is how do they get away with this? Isn't this considered false advertisement in a sense? And how does the Linux community react to this FUD (I have seen some reaction from Novel but nothing to the extent of M$)?
Let's see, to keep my Windows system safe I have to install:
1. Anti-virus software.
2. Anti-spyware software.
3. An 'alternative' web-browser.
4. An 'alternative' e-mail client.
To keep my Linux system safe I have to install:
1. No anti-virus software.
2. No anti-spyware software.
3. No additional web-browser (whatever is installed is typically safe to surf the web with).
4. No additional e-mail client (whatever is installed is typically safe to read e-mail with).
And my point is, it is pathetic to have to assume that your machine will be compromised for running a user-space application. I routinely download patches for applications from the server they are going on. That requires firing up a web browser. The difference, perhaps, is that I do that from Mac OSX and Linux machines. Provided I am not doing something like running the browser as root, I do not fear a compromise.
Call me lax, but I've never had a compromise in 10+ years.
All that is necessary for the triumph of good is that evil men do nothing.
It's not like you need to reboot windows very often.
According to secunia NT4, XP Pro, Win2k, Win2k3 ALL have unpatched vulns. SLES9 RHES3 have 0.
And check this out. Debian Linux 3 (woody)
"Currently, 3 out of 488 Secunia advisories, is marked as "Unpatched" in the Secunia database."
Everybody can patch better than microsoft it seems. Even a 3 year old distro with almost every piece of software under the sun.
And they dont make you wait up to a month for the patches either. And the patches are open source. And you could have patched the software yourself even earlier then your vendor. Try doing that with MS junk. And all these numbers dont take into account the high probability that more open source bugs are uncovered quicker than closed source counterparts.
You dont really expect us to believe that MS code quality is so much higher than FOSS do you? Tell it to Coverity.
That means that if they code quality is about equal, there are X more UNKNOWN vulns out there for closed source wincrap than for FOSS. Unknown to you and I, but possibly well known to many of the nasties out there and likely MS as well.
The simple conclusion is that not only does open source have a much higher potential for security, it actually has higher security.
This is the rule of thumb. Whatever MS says about its linux should be deemed as credible as what Mr. Iraqi information Minister had to say.
In fact they should just shut up. Let me hear from coverity about studies done on MS code before I hear any more patch number quotes.
The patch for the vulnerability that the blaster worm exploited came within 24 hours of the worms analysis. Not before.
You are thinking of Sasser, which exploited a vulnerability which had a patch 25-30 days before the first variation of Sasser was written.
...No mention of the C2 Orange Book certifications that Windows has and no Linux version does? I'm ashamed of you MS, you're slipping.
Ok smart boy from microsoft... you harden a windows server 2003, I'll harden linux.
Put a webserver and a database on each, and hang them both naked on the internet, with nothing but a router in front of them, in the same ISP, announce it to the world, and lets see which one lasts longer. That will show which is more secure.
Until this happens, I think I'll keep my linux boxes, TYVM.
l8,
AC
-NT-
Ok, Microsoft in all their brilliant dreams claims to release fewer patches than Linux... Now let's even the playing field. Let's take a look at all the patches for the Linux O/S versus Win2k3, 0 vs 15. When we take a look at all the patches that MS deployed for all their products in cluding Office, IIS, and Win2k3 and the like and MS has a release of about 4 to 1 over Linux. I guess some people have a price tag on their credibility. On another note, MS is on a monthly patch release schedule. How many months are in a year? What calendar are they looking at?
Statements like this are frustrating, not for people who have followed the long, yet secure history of using MS products, but to the people who actually administer these systems (this on top of the burden of HAVING to administer Windows systems). Whenever something like this is spewed, historically there is an influx of people out to "prove" him wrong and creates more work for us. I just think making statements like this is incredibly irresponsible. Let the product speak for itself!
sure it is and sco has evidence.
How much people want to bitch about the big guy. We run hundreds and hundreds of MS servers here at work, all of our expernal facing servers are MS (Mostly win2k) with a little bit of time and effort we have mannaged to never be hacked in the 8 years I have been working here while getting several million hits a day. As to patch numbers, it was silly for MS to do apples to peachs like that but lets be honest. Linux destros release as many crittical patches as MS does each year. As to those that love to pull out the 'security through obfuscation' line seem to always forget that the biggest target is the one that gets attacked. So when speaking of Linux maybe we could call it 'security through being unused' or 'security through being a small target'. What are they going to do when Linux really does become a big player and the hackers and script kiddies really go after linux? Why can't you guys just settle with the idea that MS has improved their security and stability to the point where they easily match or beat just about any OS out there? Sure it took them longer than it should have but you really should stop bashing on MS for products no one uses anymore and is totally out of date. (Last I checked the Ford T was not much of a car in todays market)
Dog bites Man! Details at 11. Really, what does anybody expect the guy to say? There was bound to be some metric out there that could be twisted to show that Windows is more secure than Linux, and it is Mike Nash's job to find it and promote it. Nobody likes Windows less than I do, but the server version has made a lot of progress w/r/t to security. It still isn't good, but it is better than it used to be.
You would still have to be a complete idiot to think that Windows Server represents a good IT investment. Even if it was just as secure as Linux , and it isn't, it is wildly more expensive and feature poor. Desktop Windows has the advantage of driver and application availability over Linux. Both are valid, though over rated points. That isn't true on the server side. The application availability is roughly the same, and the number of wierd devices is low.
There are good reasons that Linux has a much higher growth rate than Windows in the server market, so Mr. Nash has his work cut out for him.
>> And IE exploits run from non trusted sites
7 233,00.as p
2 0/225 6242&tid=172&tid=95
not necessarily the case...
http://www.eweek.com/article2/0,1759,161
at the time, there was some dispute as to which 'high traffic sites' had been infected, as nobody who knew the names of these sites would actually come forward to name-and-shame them.
unsurprisingly, there was a discussion right here about it:
http://it.slashdot.org/article.pl?sid=04/07/
We'll see how their song changes, when someone sues them for blatant misrepresentation and false advertizing.
To the people it actually matters, PFFFT; who else are they trying to pull the wool over their eyes for? PHBs?
Probably. It's still wrong. Sue.
See SCO suit.. they can't prove their claims, now we're just awaiting the damage is.
Companies should not be allowed to mislead people with false claims, just because they, somehow in their own twisted way, believe it so.
AC
Microsoft is composed of a bunch of lying sacks of shit. ANY public - or blog - statement made by ANY Microsoft employee is about as reliable as something coming out of the mouth of Bush. It's not only a falsehood, it's a deliberate lie made by people who don't give a damn what anybody else thinks about them or the messes they've made because they are personally profiting from those messes.
NO ONE at Microsoft gives a RAT'S ASS about security. Period.
Bill Gates has NEVER cared about ANYTHING except sucking as much money out of other people's pockets (since his poker days at Harvard) as he can. He learned this from his lawyer father (the same one that runs his "charitable foundation" which exists for the sole purpose of concentrating influence over various corporations through investments.)
The dweebs he has working (and speaking - including on
The CIOs who buy his crap aren't concerned about anything but covering their asses to their bosses.
"Nobody ever got fired for buying IBM^H^H^HMicrosoft."
The
The bottom line is this: you're either a free man working for yourself, or you're a punk working for Microsoft.
An ABC News article yesterday actually dared to raise the concept that Microsoft is dying. They have nothing left except a bloated, unfinishable OS called Longhorn - on which they're about to get shafted.
And it's about time, too.
Mod this troll, mod this flamebait! Is that all you got, huh? Are you nuts? Come at me!
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
Which is more secure an OS with more small holes or an OS with large holes but fewer of them?
That is very similar to the Bush Administration talking about 'Sound Science' which is viewed, by many people, to mean Science that meets the predetermined policies envisioned by the Bush Administration.
Therefor, it is important to determine what the definition of 'Reasonable Metric' actually means when being spoken by speaker taken from the original article. Just as it is important to know exactly what the Bush Administration means when it says 'Sound Science'.
If you ignore the other uses of a tool, does that make the tool less useful, or you less useful?
Mr Nash, it's interesting that you claim Windows is more secure than Linux. Tell me, does Windows have...
1) The ability to have the entire operating system compiled with the propolice buffer overflow protections, as well as libsafe, to guard against stack-smashing attacks?
2) The ability to install the OpenBSD Project's OpenSSL directly into the system for both local and remote system logins, as well as password shadowing even if a person doesn't install OpenSSL as well?
3) Close to a dozen different encryption algorhythms optionally supported by the kernel?
4) The ability, if a person is a software developer or programmer themselves, to personally audit *any* of the source code for security vulnerabilities?
5) An extremely robust multi-user implementation built fundamentally into the operating system?
6) Application configuration files whose format is completely transparent, plain text, rather than an obscure, binary-only database which is a virus-writer's dream with regards to hiding rogue processes, and which grows exponentially to the point where a user is forced to reinstall the entire system?
Of course, I'm being cruel. These questions are rhetorical...I don't need to ask them really, because I already know the answer. Windows does not provide for any of these things. I would *never* personally install any product from Microsoft for use in commercial server-side networking, and I believe very emphatically that nobody else should either. Windows is good for client-side networking, graphical applications, and games...and for those uses, XP is reasonably decent. As far as server side networking and network security are concerned however, ALL of Microsoft's operating systems are critically flawed at a fundamental level. Microsoft initially specialised in developing a single-user operating system, and have, comparitively speaking, virtually no experience with the Internet whatsoever.
Any claim that Windows is more secure at the network level than virtually *any* other operating system on the planet is a complete lie. It's that simple.
I'm sorry, no, saying "you should not go to that site" is not good enough. For a start, it makes your security equal to the worst of every random web admin for any site you use, not a good situation to be in. But even then, I should be able to visit untrusted sites. Because it's the whole internet out there. The whole point of it is to connect me to people I don't know. A web browser should be safe, and certainly can be safe. Using konqueror on linux I have no need to worry about whether I trust the sites I'm visiting. There is no way for them to affect my actual computer without explicit permission from me, just what is temporally displayed on my screen and played through my speakers. Why can't windows be the same?
I am trolling
Although I use Firefox for 95% of my browsing because I consider it more secure for everyday browsing and more resilient against spyware, I do not use Firefox for my Internet banking. I use IE instead as it is more secure and bug free in that regard.
I use use Internet banking sites one for a regular bank and one for Internet only bank. For one of them however, Firefox has a ugly bug where using the keypad and double clicking the button results in 3 of the same number being input. Although not a security risk it has caused a number of invalid logins. The keypad was implemented as a security feature against key loggers more than a year ago.
The other one has a serious security bug, where after logging out, all I have to do is press the back button enough times and Firefox will prompt me to resubmit POST data(the login) and it will log me right back into Internet banking without having to type in my account number or password. This happens even though I am accessing a secure site, and despite the fact that Firefox was instructed to not cache passwords.
In addition numerous rendering bugs causes some features of my banking to be unusable.
You can't really claim that one piece of software is more stable or secure than another by using the number of vunerabilities fixed as the only argument. According to this flawed logic, I could write a large piece of software, run one test, work fine for that one test, and claim that mine is more stable than another piece of software that has been thoroughly tested and has had bugfixes.
I guess Nash has also forgotten the old saying that testing can only show the existence of bugs, not the absense.
I'm running Linux servers at work that do not have Apache installed. Not at all.
So they will never be affected by any exploit that might be found for Apache.
Now, it is possible for a local exploit on a Windows system to activate a service that is currently de-activated.
To be safe, that code has to be removed. 100% off the system. Gone.
That's why I prefer Debian. It's easy to build it with just the features I need.
hahaahahahahahahahahahahahahaha ...oh I needed that.
well, IMO, MS users are still only more likely to be hacked for a few reasons... 1. it's popular! pretty much everyone and their momma, and their 5th cousin, twice removed runs it. i run windows. keep an anti-virus handy, along with a firewall, practise inteligence with email attachments from people i don't know and most that i do. i visit windows update every week. i also run linux, though i don't use it on the net, mainly as my main use for the net (online MMORPG) doesn't have a linux version and i have failed to get it to work on linux. 2. staff. even as massive as microsoft is, it pales in compairison to how many programers there are in the OSS community. 3. most vulnribilities are only taken advantage of after the patch is released. there's that lag time always there from when the patch is released and when so many people have it, it's no longer worth looking for. i'm no MS zealot, just a realist. go ahead. mod me as you will.
upon the advice of my lawyer, i have no sig at this time
Why would I need to shut down a production server because I applied an update to Exim?This isn't about what the customer sees.
This is about the system itself.
If you feel the need to re-boot your system after anything other than a kernel patch, you need to either:
#1. Get yourself some education so you can maintain a decent system.
#2. Switch to a stable system that doesn't corrupt itself.
When the systems are stable and maintained correctly, the customers will see nice uptime. Don't confuse one of the results with the primary goal.
Is that 300MB Service Pack 2 file one patch or 300 million patches?
Sure Win2003 has far fewer patches than Redhat...
Win2003 has far fewer market share than RedHat (by an order of magnitude of 10.)
(Smile).
Is this a case of a "too Late in the game?" This VERY RECENT Slashdot story stated that Windows 2003 lost a market opportunity of 560 WinTel (compared to 30 Solaris) to just one RedHat mainframe for a huge Bank.
Wait... Microsoft has a Chief Security Executive?
Now that's what I wanna see when I type "define: oxymoron" into Google!
> MS Security Chief Says Windows is Safer Than Linux
umm... yeah. BIG SURPRISE, FOLKS.
Cripes- why does this same statement come up.
Microsoft:
OS Kernel, GUI, web browser. networking
- been around a while, and they have secured entry points
Linux:
OS Kernel, GUI (X), Frontend to GUI (KDE, Gnome, etc), web browser (Mozilla, Konqeror), networking (Samba)
Fine- now lets add to Linux: SSH client, graphics libraries, multiple shells, web servers, mail clients, chat clients, etc.
So what's been updated in Linux? Well probably many non-critical security updates, followed by updates to many applications most users don't need or run. Probably 3 of those updates are to Apache2 (which keeps coming out with Patches).
This is silly- Combine office and hundreds of applications into Windows and watch the updates fly.
The open source also means that we catch these bugs and fix them, because people can find out how to exploit them. With M$ it's usually not as simple- so they just patch what they feel is a threat.
-M
when you see the word 'Linux', drink!
This guy has to be kidding!! I do not complain about how vulnerable ALL M$ products are because I make a living cleaning up the mess on M$ customers' computers. And I live well. :)
Of course, my office, my home, all my computers are vulnerable because I only use Linux. :-D
these patches, were they all of the same rating?
were these all highly critical patches?
what about ones ms missed
what about patches for software for which microsoft does not provide an equivalent (or at least include IIS's patches if your going to include apache, for example)?
also, there's open source antivirus software for linux, and there's NO spyware that targets linux (that i know of, and im sure there isn't any) so whats the point in anti-spyware software for linux?
YEAS, YEAS. Much Safer! FOR ME TO POOP ON!!!
... I'd like to have some of whatever it is you're smoking.
Microsoft is no where near as safe as Linux... never has been... never will be. Dream on Microsoft.
Buy an antivirus company and make money from them!!
MS employee says Windows is safer because using Linux puts him in danger of being fired.
Yet they always fail to mention that "ALL" of the Linux holes are 100% patched quickly, the majority are non-critical, and they are not all related to the OS, unlike the MSFT patches that they seperate into OS, application, but wait isn't IE a part of thier OS? According to them it is! Down with MSFT, pezzo de merda!
I bet that was written by Jorge Lopez from Division Two
hehe!
No matter who or what you are talking about, when there is interest involved, you cannot believe or take directly to heart, the statements of those who can benefit from such statements. Ever. Even if RedHat were to say something so crass as "We're safer than Windows" you could not place credible value in their statements alone.
Third parties which are completely objective, and have nothing to gain from the truth, are the only trustworthy source. Everybody is caught up in this dramatic bullshit that makes it analagous to a presidential debate. The fact is, that you MUST require the view points of many sources outside of Linux, Windows, and Macs altogether to know which, if any, are safer than the others.
Such views exist. And the only ones, with facts and data and evidence, that cheer for M$... are the ones that get paid by them. That alone should be enough to make any analytical intelligence give pause to joining a bandwagon.
Choose ye this day which OS shall serve you, but for me and my house, we shall run Debian.
(This also means you should tollerate the ignorance and free-will of others, regardless of whether or not YOU or I think ill of their choices.)
Thank you for reading One Man's Opinion. No participation necessary. Offer void where deemed by law or PATRIOT Act.
Does Microsoft really think anyone one will believe this statement?
Which OS gets all the news with virus attacks crippling systems worldwide?
Given a Choice of an OS to serve Information onto the Internet which would you choose?
...is Linux.
Seriously though, the local churches must do a brisk business at the confessional on Sundays in Redmond Washington.
I would almost believe their message, if it wasn't for the "I really don't like you but will pretend that I do" grins Balmer and Gates manage to eek out during public appearances. You can see it in their eyes - they don't believe what they are saying, they just want you to buy it.
Tell me honestly, if those guys weren't rich and in charge of Microsoft, would anyone listen to them at all? I don't know many used car salesmen I would enjoy spending the evening with - and that's what high level Microsoft employees remind me of.
Lodragan Draoidh
The more you explain it, the more I don't understand it. - Mark Twain
he staunchly defended Microsoft's record on security
Get off the pipe.
And users like you are keeping Microsoft in business, so you get what you deserve.
While windows has had a few total lobotomys
Liberty freedom are no1, not dicks in suits.
And both are swimming in pools of denial. Amazing how folks spin reality.
home !=
Microsoft seems totally obsessive about claiming Windows is more secure than Linux. They just keep saying that. It's getting old. Don't they have anything else to say?
Of course, not only is that claim not true, but it also doesn't mean squat when you know what Microsoft means when they say "security". Maybe what they need, after all, is a dictionary.
My polite and nice debian stable box just sits there. I receive almost daily a mail or two telling me that I have a security problem or there is a new version of some of the packages installed. I run "apt-get update", "apt-get dist-upgrade" and everything just keeps working. No reboots, no nothing.
Of course the software in the stable branch is quite old, but still I'd like to see MS telling me what's wrong in the product they are about to push to me.
Iran's grand Ayatollah says Islamic Republic grants more freedom than US democracy ...
Come on, this kind of statment will be news when MS security chief says Linux is safer; but he wouldn't hold his position for long.
so they won't spend more time improving Linux instead of reading about how (cough LIES cough) secure Windows is.
The best way to win at this game is submit code.
-- Tigger warning: This post may contain tiggers! --
"A vulnerability is not a vulnerability till somebody discovers it..."
Warning: Could be fatal if taken seriously
http://shit.slashdot.org/article.pl?sid=05/02/11/1 413208
can't ms notice that those patches are not only for the os itself, but also for the thousands of other packages in rh/suse's software databases? these guys are idiots.
What? Is this guy seriously trying to claim that you can gauge a product's level of security by how many security flaws have been FIXED?
Holy crap, someone needs to lay off the drugs... seriously.
Oh, look!
There goes Micro$oft trying to plug some more holes!
How's life in a seive, Mike Nash? They don't float very well, do they?
David
Holes in Apache and PHP for Linux. are often also holes in Apache and PHP for Windows. In addition, they're analogous to holes in IIS and ASP. Are those included?
Likewise, gcc and make don't count because I didn't see Microsoft including Visual Studio bugs in its count.
Xpdf doesn't really count because most Windows users use acroread instead. Acroread doesn't count because it's an Adobe product, not a Microsoft product, and this is a count only of holes in specific Microsoft products.
...if microsoft is so much safer than linux. Why did I spend 5 hours tracking down and eliminating a virus (actually 5 viri) that I aquired by visiting a site with malicious code in their scripting 2 days ago?
It was rather nasty too. Made my taskmanager so I couldn't kill processes unless I was tricky about it. Hijacked my desktop and displayed adverts from crap I didn't want. Installed 3 bits of adware that were pesky buggers to eliminate. Nothing that really killed my system, but it definatly made browsing an system usage not as it was intended.
go to the same site with my linux box, it doesn't miss a beat.
Oh yeah, Microsoft is much safer than Linux. (/sarcasm off)
Who cares about the ozone layer?...thanks to CFC's I can write my name......IN CHEESE!!!
I'm not letting a windows machine onto the net without adult supervison (eg. hardware firewall running embedded linux with decent filtering rules).
X-D
They must be kidding, mustn't they?
http://secunia.com/product/4368/ :D
If Win2k3 is so much more secure than Linux, why doesn't M$ let us have it for free? Oh, I get it, giving stuff away is too much like the open source community, the same one that is bashing them right now.
Anyone who runs is V.C. Anyone who stands still is well-disciplined V.C.
Door Gunner, Full Metal Jacket
Why would the outcome be if this M$ security officer would be brought to court for this claims since they can't be justified by any measure?
The notion coming from MS that it's prducts are secure is stupid to say the least. What does anyone expect them to say!..."our products are crap"? If one finds patchware acceptale then rock on...SUCKER!!!
Wow, I guess I should stop using Debian Sarge, as I get over 10 updates every day
Comment removed based on user account deletion