Slashdot Mirror
Graph of Linux Vs. Windows System Calls
cgrayson recommends Richard Stiennon's blog on ZDNet — a post titled Why Windows is less secure than Linux shows a compelling graphical comparison between system calls on the two operating systems. The blogger tips Sana Security for the images. Quoting: "In its long evolution, Windows has grown so complicated that it is harder to secure... [T]hese images... are a complete map of the system calls that occur when a web server serves up [the same] single page of [HTML] with a single picture."
Posted in last year sometime on zdnet. Is slashdot that out of touch?
Accurate or not, it's a graph of Apache vs. IIS calls, NOT Linux vs. Windows. Also old as hell.
Another quality article from Slashdot.
If you had read digg about 10 months ago you would already have your poster hanging on the wall.
l ess_secure_than_Linux_
http://digg.com/linux_unix/%C2%BB_Why_Windows_is_
It's good that Slashdot is covering it, though. I do like the fact that we periodically get the chance to debunk some of the misinformation on the Web.
Taken completely out of its original context, the graphs are a useful way to compare real-world examples of C and C++ calling models, though. You'll notice that IIS (C++) has these "clusters" of activity where one routine acts as a nexus for calls into many others. This is fairly standard practice in C++ where you might have an accessor that triggers lots of behavior. In the C version, there's a much more visually procedural pattern where a function calls a few others, and then returns to a function that calls its tree of functions, but might overlap with a few calls to the previous function's utility functions, etc.
It's not hand drawn. They obviously used dot from graphviz. You can't mistake that layout once you've seen it.
The article says syscalls, not function calls. The difference between calling models has no relation to syscalls, which are between userland and kernel space.
More likely, the article shows the difference between Apache and IIS, on one side, and the glibc and however-it's-called windows' base library, on the other side.
Except for the whole: "[T]hese images... are a complete map of the system calls that occur when a web server serves up [the same] single page of [HTML] with a single picture."
RTFS: Read The Fucking Summary.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
It looks as is if it was made by graphViz, which draws diagrams based on a textfile containing the dependencies. So it's probably fair enough in that sense, but the posting the number of edges and the number of nodes would probably be nice as well. Though I'd prefer the source for those 2 images :D
Religion is regarded by the common people as true, by the wise as false, and by rulers as useful.
FYI, FireHose lets users affect submission acceptance by rating the submissions before (and after) they get approved -- this allows for pre-emptive action, and also feedback.
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
I agree with your question. I was thinking of a few ways to analyze the graphs:
The first gives us an idea of the total number of calls involved. The second gives us some idea of how many interactions each call is involved with - more branches would indicate more complexity.
You can lead a horse to water, but you can't make it dissolve.
there are graphviz viewers which allow some interaction, so you could drag nodes about a bit to make it less messy.
Hi Ietxa2000:
I agree with your post.
I like to further question the implicit assumption made by the author of this article: that simplicity is always equal to better security. Yes, a system with a simpler, more elegant design feels better to work with. Yet, it doesn't necessarily means better security.
Rather than looking at a system's design, I think a more meaningful measurement of a system's security is to look at: 1) the number of people looking for new security flaws, and 2) the time it takes for patches to be released given an exploit. (1) measures how much effort is put into finding not-yet-discovered exploits. If there are not enough people who are looking for new security flaws, then at best, the system is secured by obscurity. (2) measures the responsiveness and effort to fix known exploits. Naturally, if an exploit is found, a user wants that exploit fixed ASAP.
Looking a system's design (graph), then drawing conclusions about the system's security, is like saying that a system can be done right in the first cut. If the design is done well, then it necessarily results in a good implementation. (Granted, if design is poor, then it's harder to make the implementation good...)
Cheers.
B. Pascal
(I can't believe I'm feeding a troll, but I couldn't let this just slip by.)
Wrong.
Linux uses standard encryption algorithms, just like Windows. 3DES and DSA are the same everywhere. Private keys are still private (Linus didn't pack his GPG key into the latest kernel source, if that's what you're thinking), and public keys public.
OSS isn't run on the Wiki model. All submissions to open-source projects are looked over and verified by the project maintainers. At least with OSS I don't have to worry about backdoors added by certain ill-intended Americans.
Wow! Shocking! A valid point! Not exactly a problem with Linux itself, though...
Yes, this can be a problem. Linux is good, but not perfect for everything. There are some things Windows just does better. The proper response is to fire these idiots. They'd do just as much damage administrating a Windows server
Really? You should let IBM know about this.