Slashdot Mirror
Graph of Linux Vs. Windows System Calls
cgrayson recommends Richard Stiennon's blog on ZDNet — a post titled Why Windows is less secure than Linux shows a compelling graphical comparison between system calls on the two operating systems. The blogger tips Sana Security for the images. Quoting: "In its long evolution, Windows has grown so complicated that it is harder to secure... [T]hese images... are a complete map of the system calls that occur when a web server serves up [the same] single page of [HTML] with a single picture."
Where can I get a high res version of that image to print out poster size? That's great!
Those pictures look great.
Suddenly I am hungry for spaghetti.
mmmMmm Food.
Damn. Windows *is* evil. It is making me fat!
Posted in last year sometime on zdnet. Is slashdot that out of touch?
what can I say? I'm impressed, you can click on the larger images and still not see a god damn thing
I just checked out those pictures and all I have to say is wow. Unfortunately, from the given images, it's really impossible to follow any of those lines. It's amazing IIS even works....
If Bush wants to kill the terrorists, he should jump off a cliff.
Can anyone verify the accuracy of the "graphs"?
Interesting, they look hand drawn. I wonder if arbitrary complexity could be visually added by using a suboptimal drawing pattern.
Where is the Vista version?
""In its long evolution, Windows has grown so complicated that it is harder to secure... [T]hese images... are a complete map of the system calls that occur when a web server serves up [the same] single page of [HTML] with a single picture.""
Fine grained vs coarse grained. Whoo-pee.
The article is dated April 14th, 2006. Nice.
The photos are completely unreadable and mean absolutely nothing. Let's see the entire graph with labels so that we can know exactly what's going on during the calls. From that graph, for all we know, we could be looking at more than what they claim.
I'm pretty "anti-microsoft", but I still know it's pretty dangerous to deduce much from a single example. For example, are there any situations where the complexity is reversed? I'd guess not (or not as many), but you can't really tell ...
Clearly, the windows example is a bigger bowl of spaghetti, but the Linux version is also a mess of complexity.
Operating systems are complex beasts. This is all this non-scientific blog proves.
and I thought goatse was taken down.
it is only after a long journey that you know the strength of the horse.
It is tempting to add more and more features and functionality over time. Ultimatly, you risk getting consumed by "entropy".
KDE and Gnome developers also....lest XFCE surprise them both over time.
A goal is a dream with a deadline
NO! This is a terrible, terrible misuse of information. The person who came up with those graphs should be forced to read "The Visual Display of Quantitative Information" Edward R Tufte until their eyes fall out!
IIS is written in C++.
Apache is written in C.
These graphs show the different calling models of C++ and C.
That is *all* they show.
Never have I seen papers or research that implies the number of system calls correlates to security. What's next, implying MS-DOS is more secure than Linux based on numbers of system calls and lines of code?
Comparing the complexity of system calls made by two different programs on two different OSes and then using that solely to judge the two differing OSes seems like an astoundingly flawed comparison. Seeing as Apache runs on Linux and Windows it seems pretty obvious that they should've used at least used the same program to make this comparison even slightly relevant.
I'm not saying Windows isn't worse than Linux in this respect, just that this article proves nothing.
Spelling mistakes, grammatical errors, and stupid comments are intentional.
Sure, it shows that Windows is harder to secure on the system calls front because it makes so many more of them (with IIS). But to me, if the graphs aren't factise, it just confirms that Windows/IIS is way too bloated to be an efficient webserver. Same task, similar results, but Windows requires nearly twice the computing power to do it in the same time. No wonder Unix|Linux webservers can run on older/cheaper hardware and give satisfying results...
www.google.com seems to not work. Neither is www.gmail.com. I'm in the UK. It's been like this for about an hour - never had this problem before.
Secunia disagrees with the blog contents. I disagree as well - this is pure FUD.
(IIS 5 and IIS 4 are humiliating for mankind. Won't link those, but search yourself if you want to cry and have nightmares.)
IIS 6
Affected By 3 Secunia advisories
Unpatched 0% (0 of 3 Secunia advisories)
Apache 1.3.x
Affected By 19 Secunia advisories
Unpatched 5% (1 of 19 Secunia advisories)
Apache 2.0.x
Affected By 33 Secunia advisories
Unpatched 9% (3 of 33 Secunia advisories)
Apache 2.2.x
Affected By 3 Secunia advisories
Unpatched 33% (1 of 3 Secunia advisories)
> That is *all* they show
According to the blog author the graphs are maps of calls to memory locations which would also include calls made from the web server to the underlying OS (eg. calls from apache to glibc).
the NPG electrode was replaced with carbon blac
Well, not only that, but it has nothing to do with Windows and Linux. More like, Apache and IIS. You could run Apache on your Windows box, which I'm sure LOTS of people do.
The normal usage of syscall is something that has to transfer control to the system, from your program. Things like accept(), write() and sbrk() but not strcpy() or malloc(). While I haven't done an strace on Apache-httpd I have done it on my own webserver and I find it hard to believe that Apache-httpd is as bad as the graph in the article implies. And given there's no text in the graph it's hard to check.
At it's simplest a HTTP response is: accept(); read(); open(); fstat(); write(); sendfile(); close(); close();. A lot of servers will set options like: FD_CLOEXEC, O_NONBLOCK, TCP_CORK and call shutdown() at the end. You can also easily blow a few more syscalls on config. options which don't do anything for the simplest case, but the graph implies 50-100.
The confusing thing, to me, is that if by "syscall" they meant something like "library calls" then I'd expect much more for Apache-httpd (as large bits of code are in libapr etc.) ... but the comparison is worthless then anyway.
ustr: Managed string API with ave. 44% overhead over strdup(), for 0-20B
Windows is less sucure because more blimps are firing more laser beams at other blimps in its picture than in linux's picture. ??? Wouldn't the larger swarm of blimbs with more lasers make it more secure it has the better army?
Yeah, its Apache on Linux and IIS on Windows, but what about Apache on Windows. What are the system calls there. If they are about the same from Linux to Windows for Apache, then all this proves is that MS wrote a crappy Web server. But if there are more calls to be made with Apache on Windows, then I would say that Windows makes its programs do more system calls and possibly makes all programs more likely to be cracked into. But its not fair to put one program against another on different OSs, then say the OS is the problem.
-----BEGIN PGP SIGNATURE-----
12345
-----END PGP SIGNATURE-----
Twaddle. The report comes from a company that makes money selling security software for Windows. Scaremongering is good for their sales.
What would be interesting is an analysis of the types of system calls. What about a comparison of the functionality of IIS vs. Apache? Perhaps Windows provides some calls that Apache has had to implement in it's own application code. How many of those so called system calls trap in to the kernel?
This is just insubstantial FUD as far as I can see, backed up by indecipherable pictures.
Assuming the graphs generated are, in fact, accurate and not just a bunch of scribbles on a page (it would be nice if there was an expanded version that showed the whole thing, legibly..).
One of the principles of secure programming is to keep it simple (stupid). Simpler interfaces have fewer potential areas for exploitation. That said, the picture doesn't tell the whole story. For one, the blog title saying Windows is less secure, is possibly inaccurate (at least, it cannot be derived from that picture) - the additional complexity may make it HARDER for MS to secure Windows, but that says nothing really of the intrinsic security of either platform.
I am the maverick of Slashdot
Microsoft *is* His Noodlyness!
In other words, number of system calls tells us nothing useful about security.
Two pretty pictures. Two pretty, interesting looking pictures. Two pretty, interesting looking, but completely unlabeled printers. This is the sort of thing an IS representative would show at a meeting with non tech-savvy personnel. All it shows is two messes of lines, one more tangled at the top, the other the bottom. It would be more helpful if there was some indication of what was causing the different calls. On another note: How is this windows vs. linux? The article would indicate it was a comparison of windows and linux in general, but its actually comparing two types of web server, and last I checked Apache can be run on a windows machine...
I know both of them!
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
I think you'd have to resort to a lot of trickery, like stacking vertices on top of each other with zero-length edges, to make the Windows graph appear less complicated than the Linux one. Provided that you model them in the same way, it ought to be pretty apparent that one just has a lot more vertices and edges than the other, even if you did it in a multidimensional space.
Really, the graphs are just a way of artfully showing a simple fact, which is that Windows requires more system calls than Linux, to complete a particular task. If you assume that each system call is a potential vulnerability, and that less calls are inherently better and more secure, than the result is a foregone conclusion. But those are pretty big "ifs," and it seems like someone who was pro-Windows would do better to attack those premises, rather than trying to dispute the graph, if it's indeed representative of the true number of system calls.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Uh... Zero unpatched means all patched; or if you like the percentages, means 100% patched. That's the best of the bunch.
I'm sure the Microsoft folks have excellent debugging tools to work with.
Except for ending slavery, the Nazis, communism, & securing American independence, war has never solved anything.
This second image is of a Windows Server running IIS.
You are wrong.
This is a totally meaningless study. All you've shown is that for one relatively uncontrolled test, there were more system calls under Windows than under Linux. This could mean lots of things, and none of us can possibly know which:
1) MAYBE it means that Linux system calls tend to jam lots of diverse functionality into a single system call, with complex parameters to select which is desired. This would mean Windows has far more system calls than Linux. But this is also a horrible and insecure programming practice, implying Windows is better.
2) MAYBE it means that Windows did a better job of factoring common subroutines out into their own functions, which is a good programming practice and would imply Windows is better.
3) Or, MAYBE it means what you seem to be asserting, that if the average number of lines of code per system call is the same in both Windows and Linux, then Windows requires more lines of codes to be correct per task, so Linux is better.
Besides, when was the last time that you saw a web-server based bug that was a kernel vulnerability, in either Windows *or* Linux? The vast majority of remotely exploitable bugs are found in user-code, making this study yet more meaningless. Maybe next time show us a graph of user-level library calls for the two OSs. But then it's still meaningless because of the 3 points above.
Now, I'm not saying Windows is better, OR that Linux is better. I use both every day. What I am saying is that, being a rational systems researcher who really likes to know how these OSs might be measured, this piece of information adds nothing to the debate either way. It's just a sound bite.
http://blogs.zdnet.com/images/SysCallIIS.jpg 1. These are old
2. They have nothing to do with Linux vs Windows; they are Apache vs IIS
3. They are unlabeled, so they are only good for showing the difference between C (Apache) and C++ (IIS)
So this tells you that Apache is simpler than IIS, and C is simpler than C++.
The government can't save you.
Why are people modding a joke insightful? You're making a joke, right?
Which means absolutely nothing without having the server configuration information. FUD, and it got you hook, line and sinker.
Not surprising.
The greatest difference between the Windows and Linux traditions is that the Windows tradition is "be everything to everyone" while the Unix tradition is "do one job, but do it well".
There are problems/benefits associated with both approaches, and the charts illustrate just one example problem for the Windows approach.
34486853790
Connection too slow for X forwarding? Try "ssh -CX user@host"
Because you have people who dont know what they are doing using their computer like they would use a toaster oven or VCR! (and they STILL cant get the clocks set right!)
People who use Linux are tech savvy enough to realize you cant just plug a machine into a wall socket and expect it to be secure.
Windows owners who are wise to this fact have secure machines.
its a dumb argument.
If Joe Sixpack ever got ahold of Linux he would be logged in as ROOT!
Thanks to file sharing, I purchase more CDs
Thanks to the RIAA, I buy them used...
What are they actually measuring, though? They look like a subroutine call tree, very little to do with system calls at all, really.
The article says syscalls, not function calls. The difference between calling models has no relation to syscalls, which are between userland and kernel space.
More likely, the article shows the difference between Apache and IIS, on one side, and the glibc and however-it's-called windows' base library, on the other side.
I don't know what you're talking about. In TFA it's quite clear that the top graph is Apache on Linux, and the bottom is IIS on Windows, both serving the same page. So there are two factors (at least) between them, a different OS and a different webserver. It's not fair, as much as I'd like to, to attribute the increase in calls purely to the design of Windows -- that would only be possible if it was Apache vs. Apache (and even then, there would be other things to control for).
If you accept that more system calls are inherently bad, than the graphs might indicate that "IIS on Windows" is less secure than "Apache on Linux," but it says nothing about Apache on Windows, or Windows as a platform inherently.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Corporate Linux Fanboy: "As you can see here Gentlemen, the Linux web server has far less tubes going everywhere, which means the information travels a shorter distance through these tubes."
Board: "Oooohhh. Ahhhhh. Tubes..." *nod nod*
Corporate Linux Fanboy: "Now as we look at the Microsoft version of the same exact thing, you can see that the tubes snake every which way with no sense of order. Chaos ensues, and the tubes are tangled every which way. Obviously, less tubes means better."
Corporate Microsoft Fanboy: "Your Mom has more tubes!"
> This is just insubstantial FUD as far as I can see, backed up by indecipherable pictures
So your assertion is that an overhead road map of cities, such as New York, NY vs. Kalamazoo, MI, would be entirely useless in generalizing points of traffic congestion and points of traffic collisions?
Maybe you don't design operating systems (computer or civil), or, if you do, maybe you shouldn't.
the NPG electrode was replaced with carbon blac
this obviously is a dupe
but why would i believe any of it if i can't even read the names of the
function-calls, for all we know this could be as much fiction as scientology
I have prayed to the Flying Spaghetti Monster for guidance about these graphs, and yea, verily did He appear before me and said "What? No sauce?" Then he Frowned his Terrible Frown, and did drown my monitor in Parmesan, bellowing "Away, demons!" and vanished.
The more modular a program, the more its call graph will look like spaghetti. The function nodes don't indicate the complexity of the functions. I'm assuming these graphs cover all function calls. It looks too deeply nested to just be system calls.
Imagine if the call graph was much much simpler, like just one central node with branches to each system call. Anyone responsible for such a monolithic blob of spaghetti code would have trouble finding a new job.
I've seen these graphs several times already. With a date like "April 14th, 2006", I'm almost sure this is a dupe, but I don't feel like searching to prove it.
You didn't like the FUD in this article, so you posted more (and by your own admission) equally bad FUD to this site.
How's that an improvement?
#1. Old news
#2. Apples and Oranges (IIS on Windows versus Apache on Linux? Which are we comparing?)
#3. Lack of detail: You can't see what system calls are really involved. No indication of configuration. No version numbers.
So that puts it in the realm of FUD, although the blogger does explain that its just a blog.
From my experience with Linux and Windows, the philosophical difference has to do with what is doing most of the work. In Windows a great deal of functionality is granted by the Windows API. As most programmers throughout the 90's know, Microsoft created their API around the functionality they needed for their own development, and then the rest of us had to buy the 'Secret' API manual with all the treats.
In Linux the Kernel where all those system calls go, is pretty limited compared to Windows. Where most functionality is added for developers is in shared libraries. Windows of course has the too, but its more a matter of where the real action is running. Is it in the kernel or in userspace. With Linux mostly its userspace, so there is less issues with software errors being capable of interfering with the machine itself. Still there are ways developers, especially of servers requiring some superuser priveleges (listening to ports under 1024) have provided security holes in basic interfaces (Sendmail and Bind for example). Still thats not reserved to Linux. Beyond that, we talk about the fact that Linux users don't run as root, but I have seen alot of irc session where the username of root is in the GID. So SOME folks do run as root. Whether the distributions now make that less necessary, that is also how Vista is going.
Apache is a bad project to compare other software too. It has been remarkably well developed both for stability and resisting sneaky security issues. Obviously one can muck up their configuration to reduce their security, but Apache itself (despite its initial moniker of being A patchy webserver) is a terrific example of well run coding projects.
IIS on the other hand is one of the posterchildren of security problems, with early versions not checking for navigation of parent directories, along with other trivial insecurites, based in some ways on permitting the developer to easily integrate IIS with other Microsoft tools.
So yes, IIS on Windows is more insecure than Apache on Linux. And Apache on Linux has always kicked IIS's ass in market share. I wonder if we compared Apache on Linux to Apache on Windows what we would find.
it the CRT/CRTD.dlls if I remember correctly in Windows, when using Visual Studios.
34486853790
Connection too slow for X forwarding? Try "ssh -CX user@host"
Brilliant!!!
A goal is a dream with a deadline
I agree that there are hundreds of considerations which may affect the visual pattern of the graphs. I still feel that there is some useful information to be gained by this particular visualization.
Nobody is claiming that this is a quantitative, tit-for-tat, comparison. What is being suggested is that this is qualitative evidence in the security debate.
Apparently this article touched off some pretty severe nerves, though, because both the posters and the mods are going hog-wild with the flamebait.
the NPG electrode was replaced with carbon blac
But IIS is probably one of their best products, and most secure as far as security bulletins go.
I think the rest has been covered ad nauseum, as far as C versus C++ procedure calls.
The price is always right if someone else is paying.
The latest web survey showed further erosion of Apache compared to IIS? Do we need to spread a little marketing over at OSDL to try to turn that around?
It's kind of an old article, and the assertion made is pretty stupid. I don't see any other purpose.
that was my first reaction as well... what the hell do they mean by "system calls", 'cos that looks like a library call graph...
That image is as old as the internets.
Yes, I'm guilty of blasphemy. Send me to hell now :P
These pictures seem to show that IIS is much more tied in with the Windows OS than Apache is with the Linux OS.
I think that's credible, and that it illustrates that in case of Windows, the wider (and much more complicated) interface between applications and OS is real. I have no difficulty believing that this offers many more opportunities to compromise the OS, and hence is less secure.
This has to be the shittest, most uninformative article yet I've seen on Slashdot. I certainly won't be getting another subscription.
-Shippy
but i think windows is clearly a more artistic operating system than linux
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
He said 'syscall' right?
[ pasted from http://en.wikipedia.org/wiki/Syscall ]
System calls often use a special CPU instruction which causes the processor to transfer control to more privileged code, as previously specified by the more privileged code. This allows the more privileged code to specify where it will be entered as well as important processor state at the time of entry.
When the system call is invoked, the program which invoked it is interrupted, and information needed to continue its execution later is saved. The processor then begins executing the higher privileged code, which, by examining processor state set by the less privileged code and/or its stack, determines what is being requested. When it is finished, it returns to the program, restoring the saved state, and the program continues executing.
[ end paste ]
So, forgive me.. I could just be naive; but what does C or C++ calling semantics / methods have anything to do with calls into the OS? Seems like you'd have to make the same calls regardless of the language that you use, or more to the point, that the calls represent the facilities that the OS has made available to you. Seems pretty language independent from my readings.
write to steveb@microsoft.com, I'm sure he'll let you have the video ;)
if this is supposed to be a new economy, how come they still want my old fashioned money?
If it were that unsecure, why would it have zealots in the first place? Why would anyone stick with it? What about all those secure apache servers out there?
Good protocol can secure bad encryption more easily than good encryption can help bad protocol.
The Sana Security diagrams show us just how bad the windows internal protocols really are. There is no securing this system with Digital Rights management or any other encryption scheme. Any security method placed on top of a such bad messaging protocols will fail miserably because even if the encryption or other security suite is perfect... windows isn't. And the system will be compromised by drilling down through windows... not through the security system.
What good is a bullet-proof pad lock if you put the combination on a yellow sticky note next to the lock itself?
[signature]
I've said it before and I'll say it again: the minute I see a link pointing to ZDNet, I immediately dismiss it. They're all about getting people to see advertisements on their website. Anything that gets them there is AOK, no matter how ridiculous it is.
Just my opinion.
Exactly what I was thinking. WAMP vs. WIMP.
http://www.devside.net/
I dont know I would say it has *nothing* to do with Windows vs Linux.
It is a map of OS calls required to accomplish a task.
Your point is good, though, a better test would be apache on windows
versus apache on linux.
emt 377 emt 4
"If it were that unsecure, why would it have zealots in the first place?"
it's called money, as in, people make money from what they know about it, and lets face it, ms was just lucky, followed by having smart (for them) marketing practices, and finally, having good strong-arm tactics.
Or just an idiot?
The race isn't always to the swift... but that's the way to bet!
No they don't. They show *system calls*, into the kernel, not method or function calls within the user-space program. The language shouldn't make much difference at that level.
So, forgive me.. I could just be naive; but what does C or C++ calling semantics / methods have anything to do with calls into the OS?
/. of "I'm going to seem smart by discrediting the article, and the easiest way to do so is make something up without reading the article".
No, you're right, it has nothing to do with C/C++. The GP was just another example on
The enemies of Democracy are
This is confusing what's important for security.
To give an example, I work in a company where we have some legacy code in Tcl we're porting to Java. The nice new fully unit tested, input checked, security aware Java code has an order of magnitude more lines of code than the old procedural 10-year-old Tcl it's replacing. And, frankly, it probably has many more system calls. But to assume that means it's less secure than what it's replacing is idiocy.
And, no, this isn't Java advocacy. It's simply one of many obvious counterexamples to a stupid premise being presented as obvious and knowledgable information about security.
Wow cool, I'm glad we are measuring security by how many subroutines the OS has. This is great news because we can make the most secure OS ever, simply by having it do everything from a single main() call.
Wait...what?
In its long evolution, Windows has grown so complicated that it is harder to secure...
Long evolution? Correct me if I am wrong, but, tracing its roots back to Unix, doesn't Linux have an even longer evolutionary timeframe? I don't belive that Windows complexity is due only to the amount of time it has been around. And I don't think any relative simplicity in Linux vis-a-vis Windows is due to being around a shorter time.
These graphics were obviously generated by "dot" of the http://www.graphviz.org/ suite...
I were using those softwares to draw Myspace social networks.
I was convinced it was the more stupid use of Graphviz possible.
This guy demonstrates that I was wrong...
is the degree of lack of modularity in Windows.
Look at the Linux shot. Regardless of anything, the "top-down" nature of the calls is obvious.
Look at the Windows shot - everything is tangled up in several clear bottlenecks, with multiple calls on several levels, indicating "sideways" calls that are a no-no in proper programming.
This also seems to indicate that Microsoft code tends to be redundant. I suspect a lot of those "sideways" calls and apparent "bottlenecks" are actually calls to similar code in several different modules called from multiple places, with multiple entry points. All of which is bad news for program efficiency, security, reliability and testing.
No matter how you interpret the shots with regard to security, the Microsoft version does not look good.
Duh! Big surprise...
The Microsoft policy of hiring 24-year-olds out of college without a clue about proper program code design clearly reflects in their code.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
As well as wanting to know what the nodes represent (system calls or procedure calls?), I'd like to know what the edges represent. Control flow? Data flow? What are they supposed to be?
This article is unbelievable, apparently presenting a conclusion that the writer doesn't understand, using meaningless data.
>north
You're an immobile computer, remember?
Dupe - from about a year ago...
It is a map of OS calls required to accomplish a task.
And the task is being deliberately misrepresented to indicate that it's a good test of Linux vs. Windows as opposed to Apache/Linux and IIS/Windows. In fact, if I had to make a guess, I'd say that the choice of Apache and IIS would have more to do with the difference.
- or at least a Web server - is more efficient than Windows.
This explains why Linux server editions tested in the past tend to outperform Windows Server versions by a factor of two in number of users they can handle linearly.
They obviously are calling a hell of a lot less than Windows is.
And it's not clear that those Windows calls are really necessary. I suspect they are mostly redundant calls to multiple versions of the same code from multiple calling modules. This is a result of the size of the Microsoft development teams re-inventing each others code regularly with every new release of the OS. This is pretty clearly what is going on based on Jim Allchin's remarks two years ago about how Vista would "never" be done if they didn't change their development practices.
And it's the only thing that explains the millions of new lines of code in each new release of the OS, without a concomitant increase in OS capability. Vista has what, twenty million new lines of code? For what capability over XP - DRM? I doubt it.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
You guys sound like Clinton trying to redefine "is" or the Bush administration trying to justify Iraq. The graph shows system calls.
Why does the Linux graph look simpler? Because Linux is designed simpler! In Linux, you tell it to do a job and it does it. In Windows, you tell it to do a job, and it has the additional overhead of keeping the system top secret so nobody can reverse engineer it, obfuscating the hell out of everything so nobody can program it without an MSCE certificate, checking if it's being pirated, checking the DRM on the image, authorizing fair use for this instance, running the three spyware apps in the background, and popping up a dialog box in your face every two minutes to ask if you're "sure" you want anything to happen at all. Oh, yeah, and making everything sparkly-pretty to meet the market research panel's idea of a slick interface.
Linux (and any other free system) doesn't have to make all those pretensions. It's just a computer operating system, not a proprietary cash cow. Who'd think?
No, I didn't make that assertion. But yes I could, if it was just a load of lines with no context and didn't show other ways of getting around and various obstacles. If somebody told you how many millions of trips occurred in London everyday, a street map isn't going to be enough because a huge proportion of those trips occur on the tube, or are affected by the congestion charge tolls in key areas. So I stand by my assertion that those piccies of squiggly lines are useless and cannot be interpreted in any meaningful manner.
If for example these piccies showed a system call on Win32 for something that is done as a method within Apache's application code, it doesn't mean there are more memory copies (and thus risks) on Win32 because the same stuff could being done in Apache. A system call also doesn't necessarily mean a trap in to the kernel, and so such a memory copy is no more risky in the Win32 case than in the Apache case.
Is it possible that some intra-OS calls show up as "system calls" in the Windows call graph but similar calls are not shown in the Linux one? Linux is monolithic and Windows is partially micro-kernel.
Not that I doubt that Windows is horribly bloated and overly-complex... but if there were that many userspace to kernel calls in IIS, you'd expect huge performance problems.
I dont know if the representation is deliberate or not. It might
be naive. The point is not perfectly on the mark, but it is not
wholey off the mark either. A better test would be apache/windows
versus apache/linux.
As to apache and iis as the choices, they have bearing in that
apache will likely be the choice on linux, and iis will likely
be the choice on windows. And if iis has that much to do with
the chart, then why is the graph *that* much more involved?
Is it doing it's task inefficiently? Are the hooks for ASP or
other things that numerous?
emt 377 emt 4
It seems clear which OS is preferred by the Flying Spaghetti Monster. I feel safe knowing that my web server is doing homage to His Noodly Goodness every time I refresh a page. After all, what is really going to help secure your site: a bunch of fancy-smancy kernel programmers or the divine protection of His noodly appendage?
So really what you're trying to say is: "You should quit because, whatever it is you're trying to do, it's working."
Heh. You sound just like my former management. Are you scoring two promotions or blowing away quarterly expectations by working me over? You fit right in with the harassment which I fully expected to take. Congratulations on being such a good little dog. So easily trained. So predictable.
I don't make myself difficult to find. You're the one hiding behind AC (though the Slashdot mgmt. has your IP conveniently logged and I'm pretty certain that the IT overlords have their own special way of addressing people like you--maybe you could ask Pudge). If you really have such a large problem with me perhaps you could come and visit SoCal. You'll have to buy the coffee, though, since I don't have any cash. I can help you find peanut butter and jelly sandwiches and we can resolve our differences peacefully. For $500/hour I can even train you to wash your filthy mouth of the language you choose: language which wouldn't even be fit for the nation's worst rejects.
You do realize that the intersection between the Internet and real life (a topic of many of my journal entries) is soon going to be a major media topic (if the history of gossip means anything to you) and I fully intend to be helping to ensure that the arena remains as level and as clean as possible. Judging by the verbage in your post you've already been disqualified from play.
the NPG electrode was replaced with carbon blac
Using a tool such as (subtle plug) rtprof. It makes pretty call graph visualisations of programs as they're running. It's not very robust and probably doesn't even compile given that I haven't touched it for nearly 4 years, but there you go. Go open source! (And for the record I think making statements about security by comparing the call graphs of two competing products is, well, dumb).
This message has been brought to you by the ayatollah of rock'n rolla in the Church of the Flying Spaghetti Monster.
Who will you god kill.
The point is not perfectly on the mark, but it is not wholey off the mark either.
That's right. It's close enough to the mark that it looks like it's making a good point while masking the point that drawing any conclusions besides "this might be why Windows is less secure" is complete BS.
As to apache and iis as the choices, they have bearing in that apache will likely be the choice on linux, and iis will likely be the choice on windows.
Ahhhh, now might be a reasonable conclusion.
However, that's not what the article says. The article says "these graphs are why Windows is less secure", not "these graphs are why IIS/Windows is less secure than Apache/Linux" or even "this is why web servers on Windows are less secure than web servers on Linux."
And if iis has that much to do with the chart, then why is the graph *that* much more involved? Is it doing it's task inefficiently? Are the hooks for ASP or other things that numerous?
I don't know. It's not ASP, because they're serving the same page from both. At the same time, I can't imagine what all the additional system calls that Windows would need are either. Some investigation seems to indicate that the APIs are about the same, so why would you need more calls on one than the other?
The only other thing I can think of besides "IIS sucks" is that the Windows subsystem is making multiple syscalls for each library call. For instance, on a read or write the library hides the fact that sometimes not all the data is transfered by making multiple syscalls, while on Linux the kernel hides that fact. But this doesn't necessarily indicate a problem with Windows at all -- quite the contrary, it means that in that respect the Windows kernel is actually simpler because that logic moves to user space.
Well, thats wikipedia's definition of a "system call", which is a nice straw-man. Who knows what the author's definition is? I have no idea, and neither do you.
If they are indeed using "ring zero transitions" as a definition of "system call" (which I really doubt), than all this graph would show is that linux rolls more functionality into a single kernel-mode call, while windows requires multiple kernel-mode transitions.
As others have said, without much more information, these graphs are meaningless.
"Windows subsystem is making multiple syscalls for each library call"
That may be, but I would expect the same for Linux. I could be wrong.
One thing your comment made me remember is there are some Windows calls
where you get back an array of items, you have to call the function
once with a null pointer and some other param changes, and you get back
the count of items, then you allocate the memory for the items, then
you call again. I would not expect that to make *that* much difference,
but it is there.
emt 377 emt 4
I do not think so, however we do know that any gains being made by IIS are related to microsoft purchasing them.
Got Code?
Granted both are only serving static HTML, but that's all a base install of Apache does. IIS comes with ASP scripting and a whole heckuvalot more switched on by default. Toss in a comparable number of modules for Apache and then do a comparison. This also has little to do with security. (how often do web server exploits surface? It's almost always bad coding in the web application that's to blame.)
glibc is not part of the operating system
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
So ultimately, the author's argument boils down to "a system with X lines of code is more insecure than a system with X/4 lines of code". If he tried to present some other argument based on something else, I've missed it in his article.
Personally I'd be more inclined to look at what that code does in order to try to quantify how secure it is.
Pass.
... so why do you insist on eating mine?
Has his noodly appendage touched you?
Accept that IIS6 is more secure than Apache 2.x. Go to secunia.com and compare the two security records since 2003 (when IIS6 was released). IIS6 has had only three vulnerabilities since then, all minor, and all patch. During the same time period, Apache 2.x has had over 30 vunlerabilities, multiple them rated as "critical", and some are still unpatched today, and others are only partially patched.
So, not only does the article fail at attempting to say why Linux is more secure than windows, the example they use doesn't even show that apache is more secure than IIS.
-- "I never gave these stories much credence." - HAL 9000
That may be, but I would expect the same for Linux. I could be wrong.
I would be a little surprised if there were that big a difference too (the more I've learned about Windows architecture the more they look the same), but remember that there is a big difference between how Linux and Windows treat system calls. On Unix, I don't think it's terribly uncommon to make system calls directly even though the C library is available. If you call open() or read() from a C program on Unix, that's pretty much just a marshaling function. However, if you make a call to functions in the Windows API, they aren't going directly to the kernel; they go through the Windows subsystem first, and it's not uncommon that this does non-trivial work. The actual system calls in ntdll are largely undocumented, and it's very rare to call to them. Because of this, I could see the behavior that hides the fact that read() may not return enough being in the Windows subsystem in Windows and the kernel in Linux.
One thing your comment made me remember is there are some Windows calls where you get back an array of items, you have to call the function once with a null pointer and some other param changes, and you get back the count of items, then you allocate the memory for the items, then you call again. I would not expect that to make *that* much difference, but it is there.
Blah. Yeah, that sort of sucks. Though again, there's a (small) chance this is not reflect in the system call interface.
I don't follow the argument that simple call graphs == simple functions. At the extremes you could argue that you can have a monster of a function that is a total of mess that doesn't call any other functions and has a simple call graph.
Knocking down straw men is fun.
My overall point is that a well factored program will more than likely have more function calls than a non-well factored one. If factoring a program better leads to better overall comprehensibility (and hence security according to a model), then these graphs might well imply the inverse.
My true belief is that call graphs won't provide a good data point for this type of analysis. I think program comprehensibility is tough analyze and requires a number of different metrics. Although Lisp is provably better than anything. Left as exercise to reader.
This is not Windows vs Linux, it is IIS vs. Apache. Where's the test running Apache on Windows?
Well, I got to the firehose page, and it looks a lot different to me than the front page.
Unfortunately, it requires that JavaScript be enabled in order to premoderate the articles.
For people like me (people who have all scripting disabled for security reasons), this make firehose pretty useless (except maybe to see articles and such that will later be rejected).
Those who sacrifice security to condemn liberty deserve to repeat history or something. - Benjamin Santayana
You may have to have "Willing To Moderate" turned on in order to get to the firehose page, or perhaps you need to have good kharma, or both.
I don't know; the GP's post is the first I've ever heard of Firehose, and it worked for me first time when I clicked on his link.
Those who sacrifice security to condemn liberty deserve to repeat history or something. - Benjamin Santayana
Well, I can't read the names on those graphs, but a system call is only ever entered and left, it never calls out to another system call, so there can't be a spaghettiesque graph of system calls calling each other.
IIS6, all it does by default is static HTML pages. All that extra functionality like ASP or ASP.NET is disabled by default.
Other features you have to have the administrator turn on to use, just like you load modules into Apache.
IIS5 was different with everything activated by default and with numerious sample scripts and other junk enabled by default. The biggest security improvement with IIS6 is that they turned all that off by default.
(I can't believe I'm feeding a troll, but I couldn't let this just slip by.)
Wrong.
Linux uses standard encryption algorithms, just like Windows. 3DES and DSA are the same everywhere. Private keys are still private (Linus didn't pack his GPG key into the latest kernel source, if that's what you're thinking), and public keys public.
OSS isn't run on the Wiki model. All submissions to open-source projects are looked over and verified by the project maintainers. At least with OSS I don't have to worry about backdoors added by certain ill-intended Americans.
Wow! Shocking! A valid point! Not exactly a problem with Linux itself, though...
Yes, this can be a problem. Linux is good, but not perfect for everything. There are some things Windows just does better. The proper response is to fire these idiots. They'd do just as much damage administrating a Windows server
Really? You should let IBM know about this.
So you accuse the post of being FUD and use FUD to prove your point ? Nice...
Next time you put some security statistics... Please do a full breakdown on the SEVERITY of those vulnerabilities...
Like for example a vulnerability that require you have console access to the machine itself, and that the stars are in the right alignment, might cause cause the server to crash, is *NOT* the same thing as a vulnerability that give root access to the box, just by making an HTTP call to it
Oh, and since you're at it, you could do a small statistical work on how many of the counted vulnerabilities have been found because people have access to the source code, just that you can make a guesstimation of how many lay hidden in the IE codebase.
The GP was just another example on /. of "I'm going to seem smart by discrediting the article, and the easiest way to do so is make something up without reading the article".
Don't forget about "... and hopefully get moderated up in the process".
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0 Whoops, silly middle mouse button...
Prove it. I dare you to put a freshly installed M$ system and a freshly installed linux box side by side outside your firewall and see which gets pwned first. My last attempt the XP box lasted precisely 24 seconds. Try it, it will be an eye opener...
I think it's a Windows guy pretending to be a Linux guy spreading FUD so IIS looks bad and Apache looks good. This way it will make the Linux community look as if they are the ones spreading the FUD. "Sneaky little hobbitses." (Gullum)
./ has really gone out of their way to not look at the actual content... I saw
those pics what, two years ago?? I recall reading them on a site and actually
seeing them printed out in the halls of a CS department some time back.
If these graphs are what the article says they are, i.e., system calls made by Apache on Linux vs those made by IIS on Windows, in the course of serving up a web page, then they are maps of logic flow of the Apache and IIS applications (together with the contents of the C and C++ library calls used), not of the OS, and probably reflect very little that is OS specific. So the argument of Windows being more complex than Linux (and therefore "harder to secure") is unsupported by this. It may imply that IIS is more complex than Apache, and I'm sure that that it in fact is. However, of course, the complexity of an application has no necessary correlation to its security.
Gives new life to term "spaghetti code"
ha
I would have written a long response about exactly why this is just bunk but this guy already said what needed to be said:
- development/?p=32
http://blogs.techrepublic.com.com/programming-and
I call bullshit. If you pay attention, you'll notice that most of the mess in the IIS graph is because there are several shared functions being called from all over the place. This makes for craploads of edges all around the graph. I don't know what those functions are since the images are too small to read the texts, but if those commonly used functions were nuked you'd have a damn lot simpler graph. This could happen inside a compiler through function inlining, so the graph would end up cleaner but the code would be the same. Imagine every memcpy having a separate function call there for example. Instead of just showing images and saying "look how messy the other one is", it'd make more sense to have an expert view into what causes the other one to be so messy.
Also, what the heck does he mean "system call"? Library calls counted in hierarchially, I assume, since it's a graph and not a list. So, what exactly is being listed for each platform and is this fairly chosen? I'm pretty damn sure the compiler settings favor apache in this case, and I'm claiming the images mean nothing at all. If the texts were visible, then I could make my own conclusions but they're not. They're just two fancy graphs with vaguely defined meaning. Complete and utter bullshit FUD.
It's hard to know where to begin and others have commented on many of the problems with this so-called analysis, but I want to take issue with one of the core statements in the article:
Huh? This is perhaps the most oversimplified and outright incorrect statement about what it takes to create secure applications that I have ever seen.
Let's take one very simple counterexample. Let's imagine that in the Apache* scenario, all string operations use the legacy C APIs (strcpy, strcat, sprintf, etc.) and the developers were too lazy to even add the manual error-prone bounds checks, whereas in IIS6, all string operations use Microsoft's strsafe.h replacement APIs (StringCchCopy, StringCchCat, StringCchPrintf, etc.) with extra diligence to make sure they are correct and even protect against integer overflows. Now which application is more secure, regardless of whether one has more lines on a graph?
I'm guessing the author's intent was to talk about attack surface area and how it relates to securing applications, but this is an extremely poor way to do it.
* - For the pedants, I'm not saying this is really the case with Apache.
Most of the un-patched vulnerabilities listed are crap.
2 90974
Starting with this one.
http://secunia.com/advisories/13925/
If Anyone here actually checked, it's a not a 2.0 bug but a 1.3 one. And it was fixed in Jan 2005!
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=
Secunia seems suspect in general, So I would have to give as much credit for the graph as the vulnerabilities.
"think of it as evolution in action"
I doubt that many people run Apache on Windows on production systems. The Apache 1.3 documentation says "Apache still performs best, and is most reliable on Unix platforms.". This does not apply to 2.0 but most people still seem to be using 1.3 because of PHP.
For a moment there I saw Richard Stiennon as Richrard Stallman, I was like WTH?!
...beyond which more calls means unmanageable complexity, which leads to security problems.
For example, if I had to code an algorithm with 1000 functions and one of them is 'strncpy', I could easily make a buffer overflow in that function and compromise security because my attention would be on taming the beast (the other 999 functions).
...of how NT-based Systems are misdesigned are the security design and implementation in general.
For example, to get the current SID (Security Identifier, "user id") of the current process on NT, one must:
* Open a handle to the current process
* With that handle, open a handle to the process token of the current process
* Call GetTokenInformation with a NULL pointer to query the length of the data it would return
* Allocate memory for a buffer receiving Token Information
* Call GetTokenInformation again with a pointer to that buffer
* Resolve a pointer in the data received to get the SID_AND_ATTRIBUTES structure
* Resolve a pointer in that structure to get the actual SID
The length of the SID is unknown, so to compare two ore more SIDs, one must use additional library functions
After using all that information, don't forget to close all the handles and to free the memory you've allocated.
NOW THE SAME THING ON UNIX:
uid_t myUID = getuid();
ONE line of code. Guess on what platform you can mess that up easier.
Or another example:
===================
As a privileged user, create a file in a certain directory.
On NT, you need SeTakeOwnership, SeRestore and SeBackup privileges.
You can't use existing applications, because CreateFile() / CreateFileEx() will fail, even when you have the privileges enabled. You have to write your own application, which uses the FILE_FLAG_BACKUP_SEMANTICS flag in these API calls, so the privileges will actually be used (well-designed operating systems use a unified method called privilege bracketing instead of different flags for every system call).
Now you could theoretically create the file regardless of the ACL, IF THE DIRECTORY ALREADY EXISTS.
If the directory does not exist, you have to create the directory first.
Unfortunately, CreateFile() / CreateFileEx() can OPEN directory handles, but you can't create directories using these APIs. But the API for creating directories does not have a FILE_FLAG_BACKUP_SEMANTICS flag, so the privileges are ignored, and you can't create the directory, if you don't have access because of the ACL of the parent directory.
So, what are you going to do?
One solution would be the following:
* Open a handle to the parent directory
* Backup the current security descriptor of the directory
* Initialize a new security descriptor for the directory
* Place your own SID into the security descriptor as owner (see above on how to get your SID, it's a lot of fun)
* Initialize a new empty discretionary access control list
* Initialize a new access control entry with your SID and a full-access permission
* Place the access control entry into the discretionary access control list
* Place the discretionary access control list into the security descriptor
* Write the new security descriptor to the directory
* Then CLOSE the handle and REOPEN the handle to the directory (with different access flags)
Now you can create the file. After you've done that, undo the operations above. If the program gets killed while you're doing that, you have messed up the ACL of the parent directory (because this method is not transaction-safe).
This is maybe the WORST API design I have ever seen.
If you want to do the exactly same thing on, for example, Solaris, you just enable file_dac_write and file_dac_search privileges (from the permitted privilege set into the effective privilege set), create the directory using mkdir() and the file using creat().
No need to write your own program, Solaris has utility programs to let you change the privileges of your shell. Even if you write your own program, privilege bracketing is much easier on Solaris than on NT, although the Solaris privilege model is much more powerful than the one of NT.
=============
There are numerous examples of that sort.
This is why I am totally convinced that NT is a poorly designed operating system. There is no unified API. One system call works c
If the nodes are syscalls, they should all be leaves on the graph. And graph consisting of only leaf nodes would be pretty uninteresting.
More of the latter, but sans the snot. It's equally easy to tell the leeches that are paid by grant money or by big enviros. What's difficult is to look objectively at the evidence and form ones own opinion. It's apparently a foreign concept in the area of environmentalism, since any look at the other side results in endless ad hominem attacks and not one rebuttal of the FACTS.
Can I borrow for my String Theory report?
You should be ashamed of yourself.
1) Interestingly enough, the grandparent post was a Linux troll, and you responded about MS.
2) Whether or not you like MS (and i don't really, though i grudgingly call them useful at times) they weren't really lucky. They seized opportunities others didn't see, capitalized on other's mistakes, relentlessly focussed on how to usurp their competitors and steal their customers, saw the value of network effects and also leverage their dominance in one area to another. None of it was real luck. Though he likes to think of himself as a technical genius (which i don't really) Bill Gates really is a business genius, a true shark amongst techs without business acumen, and used it to amass a huge fortune.
MS strongarm tactics require them to have a market dominance in some field. At one time, MS was just another company, smaller than Lotus and others. Yet they grew to where they now can use strongarm tactics. They bought code from others, polished it, made it work together very well (to the exclusion of others) and make a lot of money from that.
As far as marketing, their consumer marketing really sucks. Seeing an ad saying "WOW" really isn't making me want to buy Vista. The dinosaur ads really don't make me want to buy Office.
If the Linux desktop is to succeed, they will need to take an honest look at how MS succeeded, and how to counter that. When MS saw a market dominated by a competitor (Lotus) they looked at every reason why someone would stay with Lotus and came up witha counter, when most Linux geeks look at MS market dominance, they say "luck" or "marketing" and just sit and wait for people to somehow realize Linux is technically better and then sit and wait until everybody switches.
Damn, if that's true. Why did it take 10 years for Microsoft to figure that out?
You're missing an important point. The oil lobby have massive funds to throw at propaganda, and all of their 'activists' are of the same type: the paid type. The environmental lobby, on the other hand, is largely grass-roots activists.
... apart from trying to help avoid the oncoming catastrophe that we're well on course for. This is the big FACT that the the oil ( and nuclear ) lobby refuse to admit. The only point that the energy lobby ever put forward is that sustainable living will cost money. But they fail to mention who's money ... it's not our money ... it's not even their money, it's their profits . And that's just too bad.
Sure there are some personalities who push the message a little further than the rest of us can, due to their fame. But I don't see where you think the ulterior motive is on the environmental side. It's not like being an environmental activist actually pays in monetary terms. At least I've never, ever, known anyone who is getting paid for it. As for people getting 'grant money', that's actually essential. You see, without public money going into scientific research, how is the public ever supposed to get any scientific knowledge that doesn't come to us through the corporate filter ( for example the oil lobby filter )? And I'm really not sure about the 'big enviros' that you talk about.
Anyway, whether 0.1% of the environmental movement is being paid for their work or not, I don't get paid, and don't have any ulterior motives
A clickable map of the Linux kernel. Who says Linux is a rat's nest of calls? I can clearly see it's a dinner plate.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
and as for the claim "... that sustainable living will cost money.", yes it will, but unsustainable living will cost even more -- it's just that the cost is delayed by a bit.
You can understand this more easily if you jump back to the arguments over deficit financing... because money i little more than a mathematical artifice, it's easy to see that running a deficit now will force our kids and/or grandchildren to pay for our high life. With things like global warming, overfishing, groundwater depletion etc. etc. we are running an ecological deficit. The difference is that it's easier for a group of PR weenies to convince people that Global Warming (and/or it's causes) are unproven, and harder to convince Mother nature that it's a bad idea to call in the loan.
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
No, you're right, it has nothing to do with C/C++. The GP was just another example on
What's more, the article is skimpy as heck, so the fact that I read it really doesn't help.
This is fluff, and bad statistics based on its own fluff to boot. Just ignore the article.