Slashdot Mirror
The Annual US-CERT FUD Festival
Joe Barr writes "Joe Brockmeier and I have teamed up in a story on NewsForge to point out how the mainstream and trade press misrepresent the annual summary of vulnerabilities from US-CERT. They're doing it again this year to make it appear as if it is more secure than UNIX/Linux. Pamela Jones did a similar report at Groklaw over the weekend." From the article: "One figure represents the vulnerabilities found in Windows operating systems: XP, NT, 98, and so on. The other represents a total figure not just for Solaris, AIX, HP-UX, the BSDs, and Linux, but for a hundred different versions of Linux. The sum of all the unique vulnerabilities from all the Linux distros does not equate to the sum of vulnerabilities in any single Linux distro, and one could say the same about the various versions of Windows. That's why it is a completely meaningless exercise to discuss those totals as if they present an accurate picture of the relative security of Windows and Linux. " We've reported on the US-CERT list already this year. NewsForge is a sister site to Slashdot.org, both of whom are owned by OSTG.
The act of contrasting the vulnerabilities found in the few Windows operating systems with the vulnerabilities found in hundreds of Linux/Unix is bad enough, but when you consider that the Unix/Linux list contains duplicate items, it becomes positively shameful.
From the Groklaw article:
I honestly expected better from the CERT folks. I don't know why, but I really did.
____
~ |rip/\/\aster /\/\onkey
It's equally unfair to lump Windows 98, NT, 2000, XP all together. They could be looked at as different "distros" of Windows. Should pick the best or latest OS from each group with the least vulnerabilities to compare.
Considering Linux is a Kernel, to say there were 1000s of bugs again Linux is silly. Let's see how many were against the Linux kernel vs all the userland apps that don't touch anything system level. Now I'll admit bugs show up, and I think that's Open Source's strength; there's constantly ppl combing over the code finding f'd up stuff that no one would think to look at. This is only achieved through constant gazing at the source code, whereas with Windows a bug is usually found out after it's a vuln. Also, I'm happy that MS patched the issue so quickly, even if they were beaten to the punch, perhaps they'll take things (security) more seriously now that they're pushing 'trusted computing'. Not that I care that much, I'm sold on Linux, OS X on the desk and freeBSD on the server, but I did play with ReactOS the other night, and see a future for x-Windows folks who don't want to lose Windows compat when XP support goes away...
fak3r.com
Shouldn't we be asking the more pertinent question: why do all the various operating systems have so many vulnerabilities? When it comes to such things, this shouldn't be a competition. OS builders should be striving for zero tolerance to vulnerabilities and there shouldn't be an quibbling over the number that exist.
GetOuttaMySpace - The Anti-Social Network
But that's not the same - we're talking about basically one Windows product with its associated unique vulnerabilities, but when we talk about Linux distros, we talk about several different ones that have the *same* vulnerability counted multiple times because it exists in multiple distros. Just one look at the CERT list and you will see all the duplicates in there. And then of course, even if you remove the duplicates, you are still left with vulnerabilities that were only present in one distribution, but got counted against "Linux/Unix" although 99% of the distros were never affected.
Part of the contention is the repeat entries with the "updated" notation. So if you throw out all 141 "updated" occurrences in the Microsoft section, that leaves 671 (812-141=671).
If you throw out all 1437 "updated" occurences in the linux/unix secion, that leaves 891 (2328-1437=891). Subtracting Apple OS X (130) and Sun Solaris (77), Linux/Unix ends up with 13 more vulnerabilities than Windows (891-130-77=684), but it's for more operating systems, so it may be fair to divide that 684 further.
The theory of relativity doesn't work right in Arkansas.
Good point and I'd like to add, What about the time length between when vulnerabilities are found, and then patched? Surely, they thought about that. Linux and Unix can continue to have more "reported" vulnerabilities than Windows, but if they are patched faster than Windows, doesn't that count for something?
I have nothing clever to put here...
They're doing it again this year to make it appear as if it is more secure than UNIX/Linux.
What is "it"? Slight tinge of paranoia here, maybe?
Let's review the score here:
- It does not matter what material is published, the fact of the matter is that every Windows PC in the world regularly has visible and non-trivial security issues, while on Linux and OS/X these issues are generally theoretical.
- People's perceptions of Windows are very simple: it's a piece of crap that they use because it came with the box and everyone else uses it.
- The relative security of Windows vs. the World is not a deciding factor in most people's use of Windows. It's largely a captive, neutered market.
- For people who actually do care, no amount of statistics can change the visible and perceived situation. When I choose to ban Windows in my company, it's not because I read some website or article. It's because I'm sick and tired of removing spyware from people's PCs.
Complaining about these statistics is to give them credibility. Those who chose on the basis of security will ignore this data, and those who chose on other criteria won't care about this data.
My blog
I'm an automation officer in the U.S. Army, and I know for a fact that we're full of Microsoft shills and contractors with Microsoft loyalties. We don't employ Unix/Linux in an enterprise manner; the government sold its soul to Microsoft years ago. Unix is used on some Army tactical platforms, though. Food for thought.
- 11 of those alerts were for Windows platforms
- 3 were for Oracle products
- 2 were for Cisco products
- 1 was for Mac OS X
- None were for Linux
, and secondarily look at this quoteFolks, as other
...Open Source isn't the only answer -- but it's almost always a better value than the alternatives...
Using the patent-pending method of determining worth by comparing terms plugged into Google, I get the following:
Search for "Windows Bugs": 45,800
Search for "Linux Bugs": 23,400
Search for "Bunny Bugs": 31,100
From this method, I can determine that I should NOT watch Looney Tunes cartoons on my Windows Media Center PC. Or drink while posting.
Vincent J. Murphy
Spandex Justice
Considering Linux is a Kernel, to say there were 1000s of bugs again Linux is silly.
It would be interesting to see all of the Windows application vendors lumped into the "Microsoft security flaws" category in a similar manner. I've seen quite a few Windows applications from all sorts of software vendors with issues this last year and noticed they weren't listed. While one might argue at first that this would be unfair because of all of the commercial products available for Windows, I'm not sure Windows wouldn't still have an advantage. Just go to sourceforge.net and start counting up all the projects available there that could be lumped into Linux "security flaws."
Looking just at core operating system applications, Fetchmail doesn't make the cut. In fact, it's inappropriate to include GCC in there since I'm certain they didn't include Microsoft development environment tools in the Microsoft count. An apples-to-apples comparison isn't appropriate and perhaps for those uneducated technical journalists that like to make comparison stories, a kernel-to-kernel, browser-to-browser (e.g. IE vs. Mozilla vs. Opera), office suite to office suite, and other category-based comparison is the only appropriate approach.
They've got Apache vulnerabilities listed on the Linux side, but not on the Windows side - vulnerabilities that affected both places, I might add.
:)
This is true of most of the *nix vulnerabilities, actually.
So what we're really seeing is Windows-only vulnerabilities being compared to ones that are OS neutral. Not that its very suprising, though. Its 2006.
With the exception of software written specifically for Windows, most software is cross-platform.
This is the only really meaningful way to do this kind of a report because of this characteristic. The important thing to keep in mind in that, though, is that Windows has all of its own vulnerabilities AND most of the others.
Mod me down and I will become more powerful than you can possibly imagine!
I vote for the "solves-my-problem-but-not-yours" distribution, which is clearly the best.
Incidentally, I am also in favor of settling on ONE (1) tool for all mechanical uses.
I favor the two-handed hewing axe, but I might be persuaded to vote for the claw hammer.
Very false. just look for Larry Wall Perl Insecure Temporary File Creation (Updated). Three instances of the exact same item. And only in *nix even though ActiveState perl for Windows had the same issue. So, there are LOTS of issue with this report. Cert is more SNAFU, than not.
I prefer the "u" in honour as it seems to be missing these days.