Slashdot Mirror
Graph of Linux Vs. Windows System Calls
cgrayson recommends Richard Stiennon's blog on ZDNet — a post titled Why Windows is less secure than Linux shows a compelling graphical comparison between system calls on the two operating systems. The blogger tips Sana Security for the images. Quoting: "In its long evolution, Windows has grown so complicated that it is harder to secure... [T]hese images... are a complete map of the system calls that occur when a web server serves up [the same] single page of [HTML] with a single picture."
Those pictures look great.
Suddenly I am hungry for spaghetti.
mmmMmm Food.
Damn. Windows *is* evil. It is making me fat!
what can I say? I'm impressed, you can click on the larger images and still not see a god damn thing
Can anyone verify the accuracy of the "graphs"?
The article is dated April 14th, 2006. Nice.
The photos are completely unreadable and mean absolutely nothing. Let's see the entire graph with labels so that we can know exactly what's going on during the calls. From that graph, for all we know, we could be looking at more than what they claim.
and I thought goatse was taken down.
it is only after a long journey that you know the strength of the horse.
Comparing the complexity of system calls made by two different programs on two different OSes and then using that solely to judge the two differing OSes seems like an astoundingly flawed comparison. Seeing as Apache runs on Linux and Windows it seems pretty obvious that they should've used at least used the same program to make this comparison even slightly relevant.
I'm not saying Windows isn't worse than Linux in this respect, just that this article proves nothing.
Spelling mistakes, grammatical errors, and stupid comments are intentional.
Well, not only that, but it has nothing to do with Windows and Linux. More like, Apache and IIS. You could run Apache on your Windows box, which I'm sure LOTS of people do.
The normal usage of syscall is something that has to transfer control to the system, from your program. Things like accept(), write() and sbrk() but not strcpy() or malloc(). While I haven't done an strace on Apache-httpd I have done it on my own webserver and I find it hard to believe that Apache-httpd is as bad as the graph in the article implies. And given there's no text in the graph it's hard to check.
At it's simplest a HTTP response is: accept(); read(); open(); fstat(); write(); sendfile(); close(); close();. A lot of servers will set options like: FD_CLOEXEC, O_NONBLOCK, TCP_CORK and call shutdown() at the end. You can also easily blow a few more syscalls on config. options which don't do anything for the simplest case, but the graph implies 50-100.
The confusing thing, to me, is that if by "syscall" they meant something like "library calls" then I'd expect much more for Apache-httpd (as large bits of code are in libapr etc.) ... but the comparison is worthless then anyway.
ustr: Managed string API with ave. 44% overhead over strdup(), for 0-20B
Windows is less sucure because more blimps are firing more laser beams at other blimps in its picture than in linux's picture. ??? Wouldn't the larger swarm of blimbs with more lasers make it more secure it has the better army?
Obviously, the solution is to code everything as a single function. Then the graph will look very nice and tidy.
Twaddle. The report comes from a company that makes money selling security software for Windows. Scaremongering is good for their sales.
What would be interesting is an analysis of the types of system calls. What about a comparison of the functionality of IIS vs. Apache? Perhaps Windows provides some calls that Apache has had to implement in it's own application code. How many of those so called system calls trap in to the kernel?
This is just insubstantial FUD as far as I can see, backed up by indecipherable pictures.
In other words, number of system calls tells us nothing useful about security.
It's not hand drawn. They obviously used dot from graphviz. You can't mistake that layout once you've seen it.
I think you'd have to resort to a lot of trickery, like stacking vertices on top of each other with zero-length edges, to make the Windows graph appear less complicated than the Linux one. Provided that you model them in the same way, it ought to be pretty apparent that one just has a lot more vertices and edges than the other, even if you did it in a multidimensional space.
Really, the graphs are just a way of artfully showing a simple fact, which is that Windows requires more system calls than Linux, to complete a particular task. If you assume that each system call is a potential vulnerability, and that less calls are inherently better and more secure, than the result is a foregone conclusion. But those are pretty big "ifs," and it seems like someone who was pro-Windows would do better to attack those premises, rather than trying to dispute the graph, if it's indeed representative of the true number of system calls.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
This second image is of a Windows Server running IIS.
You are wrong.
The article says syscalls, not function calls. The difference between calling models has no relation to syscalls, which are between userland and kernel space.
More likely, the article shows the difference between Apache and IIS, on one side, and the glibc and however-it's-called windows' base library, on the other side.
Of course DOS is more secure than Linux. It doesn't do networking...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
#1. Old news
#2. Apples and Oranges (IIS on Windows versus Apache on Linux? Which are we comparing?)
#3. Lack of detail: You can't see what system calls are really involved. No indication of configuration. No version numbers.
So that puts it in the realm of FUD, although the blogger does explain that its just a blog.
From my experience with Linux and Windows, the philosophical difference has to do with what is doing most of the work. In Windows a great deal of functionality is granted by the Windows API. As most programmers throughout the 90's know, Microsoft created their API around the functionality they needed for their own development, and then the rest of us had to buy the 'Secret' API manual with all the treats.
In Linux the Kernel where all those system calls go, is pretty limited compared to Windows. Where most functionality is added for developers is in shared libraries. Windows of course has the too, but its more a matter of where the real action is running. Is it in the kernel or in userspace. With Linux mostly its userspace, so there is less issues with software errors being capable of interfering with the machine itself. Still there are ways developers, especially of servers requiring some superuser priveleges (listening to ports under 1024) have provided security holes in basic interfaces (Sendmail and Bind for example). Still thats not reserved to Linux. Beyond that, we talk about the fact that Linux users don't run as root, but I have seen alot of irc session where the username of root is in the GID. So SOME folks do run as root. Whether the distributions now make that less necessary, that is also how Vista is going.
Apache is a bad project to compare other software too. It has been remarkably well developed both for stability and resisting sneaky security issues. Obviously one can muck up their configuration to reduce their security, but Apache itself (despite its initial moniker of being A patchy webserver) is a terrific example of well run coding projects.
IIS on the other hand is one of the posterchildren of security problems, with early versions not checking for navigation of parent directories, along with other trivial insecurites, based in some ways on permitting the developer to easily integrate IIS with other Microsoft tools.
So yes, IIS on Windows is more insecure than Apache on Linux. And Apache on Linux has always kicked IIS's ass in market share. I wonder if we compared Apache on Linux to Apache on Windows what we would find.
Not defending Windows security, but it's entirely possible that the graphical depiction is not "optimized" so that it intentionally looks like spaghetti. It's hard to see what's going on with the resolution given, but some of the call "bubbles" seem to be unnecessarily placed far away from whatever called them with a long strand of spaghetti between them. This isn't necessarily an indication of spaghetti or bad design, but a bad graphical depiction. Also, just because lots of places make a call to the same API (which causes the graph to look like spaghetti) does not mean bad design--to the contrary, it can be very good design.
I hate Windows as much as the next guy, but I'm not sure this is really a good case for why.
These pictures seem to show that IIS is much more tied in with the Windows OS than Apache is with the Linux OS.
I think that's credible, and that it illustrates that in case of Windows, the wider (and much more complicated) interface between applications and OS is real. I have no difficulty believing that this offers many more opportunities to compromise the OS, and hence is less secure.
He said 'syscall' right?
[ pasted from http://en.wikipedia.org/wiki/Syscall ]
System calls often use a special CPU instruction which causes the processor to transfer control to more privileged code, as previously specified by the more privileged code. This allows the more privileged code to specify where it will be entered as well as important processor state at the time of entry.
When the system call is invoked, the program which invoked it is interrupted, and information needed to continue its execution later is saved. The processor then begins executing the higher privileged code, which, by examining processor state set by the less privileged code and/or its stack, determines what is being requested. When it is finished, it returns to the program, restoring the saved state, and the program continues executing.
[ end paste ]
So, forgive me.. I could just be naive; but what does C or C++ calling semantics / methods have anything to do with calls into the OS? Seems like you'd have to make the same calls regardless of the language that you use, or more to the point, that the calls represent the facilities that the OS has made available to you. Seems pretty language independent from my readings.
write to steveb@microsoft.com, I'm sure he'll let you have the video ;)
if this is supposed to be a new economy, how come they still want my old fashioned money?
Except for the whole: "[T]hese images... are a complete map of the system calls that occur when a web server serves up [the same] single page of [HTML] with a single picture."
RTFS: Read The Fucking Summary.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
It looks as is if it was made by graphViz, which draws diagrams based on a textfile containing the dependencies. So it's probably fair enough in that sense, but the posting the number of edges and the number of nodes would probably be nice as well. Though I'd prefer the source for those 2 images :D
Religion is regarded by the common people as true, by the wise as false, and by rulers as useful.
If it were that unsecure, why would it have zealots in the first place? Why would anyone stick with it? What about all those secure apache servers out there?
Good protocol can secure bad encryption more easily than good encryption can help bad protocol.
The Sana Security diagrams show us just how bad the windows internal protocols really are. There is no securing this system with Digital Rights management or any other encryption scheme. Any security method placed on top of a such bad messaging protocols will fail miserably because even if the encryption or other security suite is perfect... windows isn't. And the system will be compromised by drilling down through windows... not through the security system.
What good is a bullet-proof pad lock if you put the combination on a yellow sticky note next to the lock itself?
[signature]
I dont know I would say it has *nothing* to do with Windows vs Linux.
It is a map of OS calls required to accomplish a task.
Your point is good, though, a better test would be apache on windows
versus apache on linux.
emt 377 emt 4
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
No they don't. They show *system calls*, into the kernel, not method or function calls within the user-space program. The language shouldn't make much difference at that level.
So, forgive me.. I could just be naive; but what does C or C++ calling semantics / methods have anything to do with calls into the OS?
/. of "I'm going to seem smart by discrediting the article, and the easiest way to do so is make something up without reading the article".
No, you're right, it has nothing to do with C/C++. The GP was just another example on
The enemies of Democracy are
- or at least a Web server - is more efficient than Windows.
This explains why Linux server editions tested in the past tend to outperform Windows Server versions by a factor of two in number of users they can handle linearly.
They obviously are calling a hell of a lot less than Windows is.
And it's not clear that those Windows calls are really necessary. I suspect they are mostly redundant calls to multiple versions of the same code from multiple calling modules. This is a result of the size of the Microsoft development teams re-inventing each others code regularly with every new release of the OS. This is pretty clearly what is going on based on Jim Allchin's remarks two years ago about how Vista would "never" be done if they didn't change their development practices.
And it's the only thing that explains the millions of new lines of code in each new release of the OS, without a concomitant increase in OS capability. Vista has what, twenty million new lines of code? For what capability over XP - DRM? I doubt it.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
Remember that your are comparing public results about a peer reviewed application against a development black box we cannot see into. Personally I don't think that is a very good comparison. Also I think they should have compared apache on both platforms.
Yeah, spaghetti... obey your noodly master.
Next thing you'll be talking about is global warming, then pirates, and the love of Him that is noodly.
ZERO ZERO ONE ZERO ONE ZERO ONE ONE! Just brushing up for my next big invention: Ethernet over Voice (EoV)
1) Interestingly enough, the grandparent post was a Linux troll, and you responded about MS.
2) Whether or not you like MS (and i don't really, though i grudgingly call them useful at times) they weren't really lucky. They seized opportunities others didn't see, capitalized on other's mistakes, relentlessly focussed on how to usurp their competitors and steal their customers, saw the value of network effects and also leverage their dominance in one area to another. None of it was real luck. Though he likes to think of himself as a technical genius (which i don't really) Bill Gates really is a business genius, a true shark amongst techs without business acumen, and used it to amass a huge fortune.
MS strongarm tactics require them to have a market dominance in some field. At one time, MS was just another company, smaller than Lotus and others. Yet they grew to where they now can use strongarm tactics. They bought code from others, polished it, made it work together very well (to the exclusion of others) and make a lot of money from that.
As far as marketing, their consumer marketing really sucks. Seeing an ad saying "WOW" really isn't making me want to buy Vista. The dinosaur ads really don't make me want to buy Office.
If the Linux desktop is to succeed, they will need to take an honest look at how MS succeeded, and how to counter that. When MS saw a market dominated by a competitor (Lotus) they looked at every reason why someone would stay with Lotus and came up witha counter, when most Linux geeks look at MS market dominance, they say "luck" or "marketing" and just sit and wait for people to somehow realize Linux is technically better and then sit and wait until everybody switches.