More Than Half of Known Vista Bugs are Unpatched

MsManhattan writes "Microsoft security executive Jeff Jones has disclosed that in the first six months of Vista's release, the company has patched fewer than half of the operating system's known bugs. Microsoft has fixed only 12 of 27 reported Vista vulnerabilities whereas it patched 36 of 39 known bugs in Windows XP in the first six months following its release. Jones says that's because "Windows Vista continues to show a trend of fewer total and fewer high-severity vulnerabilities at the six month mark compared to ... Windows XP," but he did not address the 15 unpatched flaws."

Comments

Why would you ever.....

[otacon]

announce something like that? That's not exactly the best PR for Vista. Then again Vista isn't exactly good PR for Microsoft.

Re:Why would you ever.....

[Anonymous Coward]

This is only half of a problem because the other half refuse or are forbidden to use it.

Re:Why would you ever.....

[ThinkFr33ly]

Well, they didn't.

If you RTFA, you'll see that Vista's unpatched vulnerabilities are not considered "critical" because, thanks to Vista's improved security model, are virtually impossible to exploit.

Slashdot actually managed to spin a highly positive analysis of Vista into something that suggests Vista is not only worse than XP, but Microsoft is somehow going out of its way *not* to fix it.

Gotta love it. Slashdot is the GOP of technology news sites.

Re:Why would you ever.....

[SwordsmanLuke]

Actually, they didn't announce anything *like* that. This article has more slant than... well the original *very slanted* report. The report this article is referencing is actually trying to make the point that Vista is (according to Microsoft's metrics) teh most secoor OS EVAR!!! The report compares the number of bugs disclosed in the first 6 months of the OS' existence which remained unfixed after 90 days. It seems to me that a more telling metric for security would be the longer term trend of bugs disclosed vs. patched, but hey, I'm not a security researcher.

If you want to read the actual report, check out the link to the PDF from this page: http://www.vnunet.com/vnunet/news/2192615/microsof t-claims-vista-secure/

Re:Why would you ever.....

[morgan_greywolf]

If you RTFA, you'll see that Vista's unpatched vulnerabilities are not considered "critical" because, thanks to Vista's improved security model, are virtually impossible to exploit.

And I think you'll see that thanks to my new and improved door lock, the fact that I leave my windows unlatched is not a critical security issue.

Re:Why would you ever.....

[ThinkFr33ly]

And I think you'll see that thanks to my new and improved door lock, the fact that I leave my windows unlatched is not a critical security issue. What a completely nonsensical and inaccurate comparison. Microsoft's Secure Development Lifecycle has almost certainly dramatically improved the quality of their code. This report, plus 3rd party counts of vulnerabilities, support this conclusion.

But no matter how good your code is, things will be missed. That's the point of having things like Address Space Layout Randomization, IE 7 Protected Mode, Session 0 Isolation, and the dozens of other security layers that Microsoft added to Vista.

Furthermore, being rated non-critical can often mean that it requires significant user action (like turning off multiple security features) in order to make a user vulnerable.

What's next, are you going to blame Microsoft when a user smacks their motherboard with a hammer?

The fact of the matter is, that at least so far, Vista is proving to be the most secure OS on the market. (Aside from perhaps OpenBSD, of course. :) If you have data that suggests otherwise, then provide it.

Otherwise, keep your silly analogies to yourself.

Re:Why would you ever.....

[Chris_Mir]

Slashdot actually managed to spin a highly positive analysis of Vista into something that suggests Vista is not only worse than XP, but Microsoft is somehow going out of its way *not* to fix it.

Yeah, Microsoft would never spin facts around into their own advantage!

Re:Why would you ever.....

[Zeek40]

I think a more apt comparison would be: "And I think you'll see that thanks to the fact that everything I own is either bolted to the floor or inside a vault, the fact that I leave my windows unlatched is not a critical security issue."

Re:Why would you ever.....

[sogoodsofarsowhat]

You are wrong...seeing as My MACS have never been compromised then i guess your wrong. My windows Vista / XP and 98 systems all sooner or later were compromised, but the MAC's NEVER! I own a good size company and thus have lots of desktops. We are migrating as many as possible to the Macs simply because of security and no stupid EULA restrictions like in the new VISTA licenses. You sir should think before you post.

Re:Why would you ever.....

[ThinkFr33ly]

You sir should think before you post. You might want to follow your own advice.

You're committing a logical fallacy in your post. You equate the fact that your Macs have never been compromised (that you know of) to the their actual security. This is an invalid equation.

I could write a piece of software that had a 1000 known critical security vulnerabilities, but it might never get hacked. Does that then mean that my software is secure? Of course not.

Factors that contribute to whether or not something gets compromised include the number of vulnerabilities in the code, but it's not limited to just that. Usage is a big factor. In the cause of my buggy piece of software, if I'm the only one who uses it, it's unlikely to be a target.

Similarly, Mac OS X is used by far fewer people than XP. And, as of April, Vista was used by about 50% as many people as use Mac OS X. Change are, Vista is now used by more people than Mac OS X. So a direct comparison is now at least more valid.

Macs have had far more known vulnerabilities than Vista, and even than XP in recent years. That's an objective fact. A fact that can't be changed by how much Steve Jobs coolaid you drink.

Re:Why would you ever.....

[Ucklak]

Don't have to RTFA

Microsoft has fixed only 12 of 27 reported Vista vulnerabilities whereas it patched 36 of 39 known bugs in Windows XP

As most analogies suck, if the OS was akin to a house, the 15 vulnerabilites should be something like:

1. Doorbell light not working
2. Doorknobs dirty and stick sometimes.
3. Windows have bad seals and moisture is visible inside.
4. Garage has unfinished walls
5. Backyard is not landscaped
6. House needs to be painted
7. Carpet needs to be replaced
8. House backs to a busy street
9. House is near train tracks
10. Roof will need replacing within 5 years
11. Hot water heater will probably need replacing within 5 years
12. There is a creak on the floor on the second level near the bathroom
13. Refrigerator and dishwasher are not included
14. There are cracked tiles in the kitchen
15. Ceiling fans don't work in 2 rooms

But hey, all the doors and windows lock and the roof doesn't leak. Sounds lovely.

Re:Why would you ever.....

[bmw]

The fact of the matter is, that at least so far, Vista is proving to be the most secure OS on the market. (Aside from perhaps OpenBSD, of course. :) If you have data that suggests otherwise, then provide it.

That's quite a statement. I don't have evidence supporting anything either way but I still have a hard time swallowing that one given my past experiences. More secure than previous Windows systems, perhaps. Most secure OS on the market? That's probably a bit of a stretch. Personally, I would still be far more comfortable with the security of any of the BSDs, Linux, Mac OS X, Solaris, or any other flavor of UNIX. Not to mention more obscure operating systems.

Furthermore, it's extremely difficult to prove such things. Simply looking at the number of vulnerabilities is nowhere near adequate and, given your statement, I think the burden of proof would be on you.

Re:Why would you ever.....

[Anonymous Coward]

"Objective fact" for which you only provide an assertion and not a shred of evidence. Put up or shut-up.

Re:Why would you ever.....

[Enrique1218]

OSX has more vulnerabilities than XP or Vista. Where do you get that number? Please publish the links to at least 3 source of said number. I am just curious. This being slashdot and all. I am befuddled how so many haven't mastered citing a reference.

Re:Why would you ever.....

[nusuth]

Then again Vista isn't exactly good PR for Microsoft.

I recently bought a notebook with Vista Home Premium preloaded. Due to all negative things I've heard about Vista, I was prepared to downgrade. I was determined not to waste my time fixing a broken OS just because I could. However I was pleasantly surprised. It is, of course, nothing like what was promised a few years ago but it is an improvement over XP. The only problem I've had (about networking with XP) took five minutes to solve. It has also been rock solid so far (with a directx 10 card, despite all horror stories.) I still don't see any reason to upgrade my XP boxes but I also don't see any reason to avoid Vista.

Re:Why would you ever.....

[Anonymous Coward]

Now, let's wait for WOW ;)

WOW - Wrath of Weirdoes

Re:Why would you ever.....

[Lesrahpem]

I think the security industry has a pretty skewed idea of "virtually impossible" to exploit. The people who are saying these bugs are impossible to exploit are engineers and PR people, not people who actually have experience exploiting such bugs in the real world.

Re:Why would you ever.....

[TheRaven64]

Vista is proving to be the most secure OS on the market. (Aside from perhaps OpenBSD, of course. :) I believe the most secure OS on the market at the moment is probably OpenVMS. Certain others, like Symbian, seem to do well too. I don't know of many Symbian compromises, in spite of the hundreds of millions of Symbian devices that spend 100% of their time connected to the network. I believe even WinCE has a better security record than Vista to date, so it's not even the most secure Microsoft operating system out there... OpenBSD has had a couple of security holes recently, but probably less than Vista.

It's very difficult to compare the security of OpenBSD to Vista, because of what is included. OpenBSD, for example, doesn't include a web browser in the base system. It includes X11, but not a complete desktop environment. For it to be a fair comparison, you would have to compare OpenBSD + GNOME (for example). On the other hand, OpenBSD includes a number of things that aren't in Vista, such as a compiler, so you might have to throw in Visual Studio. But that's an IDE, so maybe throw Eclipse into the OpenBSD pile...

Re:Why would you ever.....

[Chris Kamel]

The same report, in fact, also says:
In the first 6 months, Red Hat fixed 119 of the 129 that had been publicly disclosed at release time, but new disclosures during the period meant that 65 issues were widely disclosed, but unpatched at the end of the first 6 months. 12 of the unfixed issues were High severity and 7 were Medium severity according to NVD ratings.
and
During the first 6 months, Ubuntu fixed 145 vulnerabilities affecting Ubuntu 6.06 LTS. 47 of those fixed were rated High severity in the NVD. At the end of the 6 month period, there were at least5 20 publicly disclosed vulnerabilities in Ubuntu 6.06 LTS did not yet have a patch from Ubuntu.
and
During the first 6 months, Apple fixed a total of 60 vulnerabilities affecting Mac OS X v10.4, of which 18 were rated High severity in the NVD. At the end of the 6 month period, Mac OS X v10.4 still had 16 publicly disclosed vulnerabilities that did not yet have a patch from Apple, 3 of them rated High severity.
But of course we don't care about all that here on /.

Re:Why would you ever.....

[Corporate Troll]

OpenBSD, for example, doesn't include a web browser in the base system.

Whoa, whoa, stop right there! My OpenBSD system doesn't have X11 installed, but it most certainly has a browser with the default packages (from CD) installed:

jorg@mako:~$ uname -a
OpenBSD mako.sharks 3.9 GENERIC#1 amd64
jorg@mako:~$ lynx -dump -head http://slashdot.org/
HTTP/1.1 200 OK
Date: Fri, 22 Jun 2007 15:59:07 GMT
Server: Apache/1.3.37 (Unix) mod_perl/1.29
SLASH_LOG_DATA: shtml
X-Powered-By: Slash 2.005000163
X-Fry: These new hands are great. I'm gonna break them in tonight.
Cache-Control: private
Pragma: private
Connection: close
Content-Type: text/html; charset=iso-8859-1

jorg@mako:~$

lynx is a browser, and I can guarantee you that if you're in deep shit and you don't have another machine handy, it often is enough to find the information you need to get back up and running.

But I agree, it's hard to compare OpenBSD and Vista.... OpenBSD is better ;-)

Re:Why would you ever.....

[molarmass192]

Macs have had far more known vulnerabilities than Vista, and even than XP in recent years. That's an objective fact.

No ... that's a SUBJECTIVE fact. That's the most full of shit statement I think I've ever seen posted here. You're comparing a MS OS built primarily for playing video games and running a web browser to an OS built on a core designed to be a hardened server on the internet. I've never EVER had a Linux / Solaris / Mac box compromised while I routinely see compromised XP boxes. Also, I know of exactly 1 person using Vista, and that's in a VM. The consensus outside of Redmond is that Vista is the epitome of bloated resource hungry software. Vista is a failure ... for now, that may change with SP1, but I doubt it ... it will only gain traction when MS EOLs XP and that's by force.

Re:Why would you ever.....

[iago-vL]

You appear to be confusing "security vulnerabilities" with "bugs".

Re:Why would you ever.....

[Anonymous Coward]

That's not remotely the same - you didn't even try. Just typical Slashdot trolling. Pathetic.

Re:Why would you ever.....

[Anonymous Coward]

The best part is...it hasn't been 6 months since release either...
That would be late August...

Re:Why would you ever.....

[Christopher_G_Lewis]

Well, yes, if the windows are on the 2nd floor and are covered with bars.

Re:Why would you ever.....

[RenderSeven]

By demanding this, you of course are offering to produce 3 links yourself? I thought not.

FWIW having programmed drivers on both platforms (and Linux) I havent found Macs to be any more or less secure and stable than anything else, on a code-for-code basis. Macs' effective and perceived strengths IMO largely come from limiting options and complexity. They support less hardware, less software, and have a smaller installed base, all of which reduce their risk profile.

Due to the perception that they are utterly secure, the first kiddie script that targets a Mac will probably wipe out the entire population. From the haunted looks on the faces of all the Mac developers I know they will probably all be relieved when it happens :-)

Re:Why would you ever.....

[JonXP]

Well, I don't know if you'll accept one well-trusted source instead of three random blogs, but here you go:

According to Secunia (for 2007):
Vista - 7 advisories, 2 unpatched (unpatched vulns listed as not critical)
OSX - 16 advisories, 3 unpatched (unpatched vulns listed as less critical)

There's too few to have a meaningful comparison of vuln severity levels, but OSX would win on percentages.

For what the original poster actually said "...even more than XP in recent years..."

Here is 2006:
XP - 45 Advisories (36% rated "Highly Cticial" or above)
OSX - 24 Advisories (42% rated "Highly Critical" or above)

Doesn't really hold water unless you compare the severity levels. Even then, that's sort of a shaky argument, but hey, that's what the internet was made for.

Re:Why would you ever.....

[arminw]

......Similarly, Mac OS X is used by far fewer people than XP.......

Always that old security by obscurity mantra. Who cares WHY I don't get my Mac house burgled as often as my neighbors Windows house. Maybe my house doesn't have bars on the windows and bank safe doors and locks either. What is nice is that burglars bypass my house and go to the ones down the street. I also don't have to waste money on added security and guard services. The bottom line is that there are NO Mac botnets, whereas there are thousands if not millions of Windows machines in the service of criminals today. Theoretical vulnerabilities mean nothing in the end, but the number of compromised computers is what counts.

Re:Why would you ever.....

[danbert8]

I would argue that MS-DOS is more secure than Vista because you have to be physically present to run programs and you can't run malware in the background.

Re:Why would you ever.....

[chthon]

When I started in 1990 in the PC industry, there where Mac viruses plenty. The Mac was even more vulnerable than a PC, due to the auto execution of code when a floppy was inserted. I suppose most Mac viruses went the way of the dodo after the move to OS X, or maybe earlier after the move to the PowerPC platform.

Re:Why would you ever.....

[arminw]

.....The consensus outside of Redmond is that Vista is the epitome of bloated resource hungry software.......

Indeed true. I Installed VISTA in Parallels on my Mac and it is dog slow compared to XP. I got VISTA not so much to use it, but just to learn about it first hand. I actually USE a few Windows programs only in Win2K and XP. Win2K runs the same software MUCH faster than XP. VISTA's activation scheme is a lot more fragile than XP. It has already asked to be activated twice. It did do it though.

You are right. VISTA will get widely used only after MS stops XP sales and support. There is no reason now. to get a new computer with VISTA installed. For many purposes even Win2K is plenty good enough.

Re:Why would you ever.....

[Anonymous Coward]

"If you RTFA, you'll see that Vista's unpatched vulnerabilities are not considered "critical" because, thanks to Vista's improved security model, are virtually impossible to exploit."

Ah, but not impossible? Why do people continually think that hackers aren't dedicated enough to exploit stuff like this if they want to? I mean, look at the whole HD-DVD debacle. They keep underestimating the people with the will to hack HD-DVD and it's becoming ridiculous. Sure, less will probably take a crack at it, but I'm sure someone will, and then MS will have to fix it up anyway.

Re:Why would you ever.....

[skarphace]

Theoretical vulnerabilities mean nothing in the end, but the number of compromised computers is what counts.

Not when you're debating system security. You may as well run Windows 1.0 if you think being in a group so small that no cracker would waste their time on writing a worm for your system actually makes you secure.

Always that old security by obscurity mantra. Who cares WHY I don't get my Mac house burgled as often as my neighbors Windows house. Maybe my house doesn't have bars on the windows and bank safe doors and locks either. What is nice is that burglars bypass my house and go to the ones down the street. I also don't have to waste money on added security and guard services. The bottom line is that there are NO Mac botnets, whereas there are thousands if not millions of Windows machines in the service of criminals today.

Your analogy doesn't hold anything to your argument. You're not debating security, you're debating odds here. It's more like having a house so far from civilization that no burglar would waste his time driving all the way out to your house just for some of your crap.

Mac OSX has decent security. But please debate facts, not garbage like this.

Re:Why would you ever.....

[Knuckles]

But of course we don't care about all that here on /.

Exactly, because for RedHat and Ubuntu they count the fixes for all applications that come with the OS. For example, Ubuntu released Ubuntu Security Notice USN-467-1 on May 31, 2007: "gimp vulnerability". The numbers for Windows, however, do not include the vulnerabilities in Photoshop.

Re:Why would you ever.....

[zippthorne]

Ok, I'll bite. Why GOP?

Re:Why would you ever.....

[bhirsch]

You should care. In fact, you should be thankful for Windows' success; it is what you owe your Mac's safety to. The more people who switch to Apple computers, the more dangerous they are to use.

Re:Why would you ever.....

[shaitand]

'vulnerabilities are not considered "critical"'

By one source. And yes, this is the same bozo who attempts to claim critical flaws aren't critical at all because there are exploitable and unproven fail-safe security measures that might prevent them from being exploited.

'Slashdot actually managed to spin a highly positive analysis of Vista'

Actually you have it reversed. This was Microsoft's attempt to spin an extremely poor security effort in a positive manner.

'Microsoft is somehow going out of its way *not* to fix it'

Not at all, it doesn't require effort to NOT do something. They don't have to go out of their way to sit on their hands.

Re:Why would you ever.....

[xhrit]

I know how to make a PC work without letting crap infect the system : I install Linux.

The statement about 'very poor use of the computer' is a cop out. There is only one way to use a computer - and that is to run software on it. 99% of the problems of infections come from 'use of very poor software.' I can use Linux how ever the hell I want and not worry about stupid OS design and bad programming letting infectious software damage my system.

Now if we can just teach you retards once and for all that there is no need to be an apologist for bad software.

Re:Why would you ever.....

[Mnemen]

Gotta love it. Slashdot is the GOP of technology news sites. Ouch dude....ouch

Re:Why would you ever.....

[kat_skan]

For it to be a fair comparison, you would have to compare OpenBSD + GNOME (for example).

This isn't strictly true. OpenBSD deliberately ships without a desktop environment to avoid the security issues inherent in including so much and such complex software. Vista deliberately ships with a GUI and numerous support services to make it easier to use as a desktop operating system.

Their goals are different, but if the question is simply "is Vista the most secure?" then it's perfectly fair to compare the two as configured out-of-the-box. I mean, it's not like Theo DeRaddt snuck in to Redmond HQ and added a notoriously buggy and insecure web browser to their OS when they weren't looking.

Re:Why would you ever.....

[CodeBuster]

Vista: The program ~_AllofTheBestOffers.exe is attempting to escalate its privilege level, Cancel or Allow?

User: Allow, Allow, Allow (dangit where is the free pron already?)

Vista: The program ~tracker.exe is attempting to change the firewall settings, Cancel or Allow?

User: Change the what? Allow...come on

Vista: The run32.dll has been altered since the last system scan do you wish to proceed? Cancel or Allow?

User: sigh....Allow

Vista: Windows has been updated and must be restarted, Cancel or Allow?

User: hmmmm....don't remember getting updates but updates are good...Allow

Several weeks later....

User: What is going on with all of these popups and free pron offers? Isn't Vista supposed to be more secure?

Support: Did you try rebooting?

User: yes, yes, yes I have already done that.

Support: Well, we can send you a new motherboard w/installation instructions....

User: Thanks, but my bank is on the other line...I am having some trouble with my accounts. Can I call you back?

Support: We are here to serve all of your customer service needs.

User: Uh, yeah whatever, bye.

The moral of this story is that no matter how many times the user is forced to click Allow, I agree, Yes, or Continue in order to shoot themselves the foot they will find a way to do it guaranteed. It may be true that Vista is better than XP is or was out of the box, but they have to assume that even though the user would have to click Allow ten times for some malware to get through that it will happen and not just to a couple of people either. They should at least tell people that they are working on the fixes instead of saying, "well if you are smart you wont get hacked, just don't always click allow."

Re:Why would you ever.....

[Anonymous Coward]

I take offense to that... /. is NOT the GOP of tech news sites... it is the Fox News of tech news sites.

Re:Why would you ever.....

[shaitand]

'What a completely nonsensical and inaccurate comparison.'

Your right, let me fix it. A comparable view would be not locking the doors or the windows because you have an alarm that would sound if they are opened.

'This report, plus 3rd party counts of vulnerabilities'

This report is from the vendor, it doesn't support anything. As for vulnerability counts, despite Microsoft's love of them it has been well established that they provide no meaningful metric of security.

'almost certainly dramatically improved the quality of their code'

Almost certainly? Where does the certainty come from?

'But no matter how good your code is, things will be missed.'

True, and when you discover one of those things you make it a top priority to fix it. Safety nets are fine and dandy as a backup measure but it is hardly safe to assume they will work.

'like turning off multiple security features... What's next, are you going to blame Microsoft when a user smacks their motherboard with a hammer?'

Are you seriously comparing turning off obtrusive features that break numerous common applications and cause a number of built in windows functions (like network printing) to fail to pulling out a motherboard and beating it with a hammer? Most users who disable vista security 'features' consider themselves to be FIXING the system. Further, that view shouldn't be especially harmful since those features are merely a backup security measure and aren't SUPPOSED to be considered a first line of defense.

Here is another analogy. A medieval castle with bridge and giant gap in the wall that fails to consider the gap critical because there are guards inside the walls who might stop intruders.

'The fact of the matter is, that at least so far, Vista is proving to be the most secure OS on the market.'

LOL

'If you have data that suggests otherwise, then provide it.'

I'm fairly sure you are the one making the ridiculous statement so the burden is on you to provide proof. And don't bother to provide vulnerability counts, as I've already mentioned these numbers have been proven to be worthless for any kind of security assessment in so many ways that it isn't worth repeating.

Re:Why would you ever.....

[morgan_greywolf]

Maybe you should.

Take this piece of psuedo-Python code:

success = False
while success != True:
        print 'Password:'
        pswd = read_password()
        if pswd != 'h4x0r':
                  success = authenticate_password(pswd)
        else:
                  success = True


Now, this code has an obvious security vulnerability: a back door. Yet, it has never been hacked. Why? I just wrote it! The question is: does the fact that the code has never been hacked matter from a security standpoint?

If you answered 'no', then you might want to think about retracting your statement.

Re:Why would you ever.....

[Wicko]

You, my friend, need to learn how counterexamples work. http://en.wikipedia.org/wiki/Counterexample

Re:Why would you ever.....

[partenon]

Links please?

Statistics for 2007, directly from Secunia website:

- OSX
Affected By 103 Secunia advisories
Unpatched 5% (5 of 103 Secunia advisories)

- XP
Affected By 186 Secunia advisories
Unpatched 16% (30 of 186 Secunia advisories)

- Vista
Affected By 10 Secunia advisories
Unpatched 20% (2 of 10 Secunia advisories)

Source:
http://secunia.com/product/13223/?task=statistics_ 2007
http://secunia.com/product/22/?task=statistics_200 7
http://secunia.com/product/96/?task=statistics_200 7

Re:Why would you ever.....

[TheNetAvenger]

That's quite a statement. I don't have evidence supporting anything either way but I still have a hard time swallowing that one given my past experiences.

Numbers are out there... Dare I suggest, "Open up and say ahh." ;)

Re:Why would you ever.....

[Anonymous Coward]

"I can use Linux how ever the hell I want and not worry about stupid OS design"

Really? That's funny. Make a change to a setting in Gnome and tell me where it's stored. ~/.gnome? ~/.gnome2_private? ~/.gconf? /etc? /usr/local/etc? It's a lottery. Couple that with applications that explode files all over your hard drive (/usr, /usr/lib, /opt, /etc and so forth) and you have an absurdly complicated, clumsily constructed OS built from thousands of components from a massively splintered development group.

It's pretty stupid OS design. Sure, it's better than Windows in some respects, but go look at OS X, VMS or Syllable for proper OS design.

"bad programming letting infectious software damage my system"

How utterly laughable. There have been 123 security advisories for kernel 2.6.x. Ubuntu 6.06, the Long-Term Support release, has had 145 advisories. Core libraries and components have suffered major vulnerabilities. Do those numbers not bother you? Linux is pretty weak security wise. Sure, nobody is crafting exploits for the tiny percentage of desktop Linux users right now, but it's still shockingly bad.

Your post sums up the massive blind zealotry in the open source world that puts many of us off using Linux. It's a vast, hugely complicated OS with many security problems cropping up regularly. Just because it isn't exploited to the same level as Windows doesn't change that fact.

But congratulations on the supreme ignorant zealotry in your post. Keep your fingers in your ears and singing "blah blah blah" when any problem is mentioned!

Re:Why would you ever.....

[IamTheRealMike]

Who cares WHY I don't get my Mac house burgled as often as my neighbors Windows house.

Smart people would care.

The problem with your line of reasoning is that it is self defeating. Let's say I go around telling everybody that Macs are more secure than Windows PCs. This isn't true if you take security in the objective sense - Mac OS X is of the same design era as Windows and Linux, and has lots of vulnerabilities. What's more, Apple don't seem to have any equivalent to the Secure Development Lifecycle judging by the latest release of Safari.

But OK. Let's say that in practice it's true, because statistically they are attacked less often. Now what? Well, I guess a bunch of people will listen to me, and say "gosh, I should buy a Mac, all these IT guys tell me it's more secure than a Windows PC". So Apples marketshare goes up. The case of Firefox seems to show that around 10-12% market share is when you get interesting to attackers. Apple are some way off that mark yet, but if lots of people by Macs thinking they are safe from attackers, one day that will no longer be true. When it stops being true, it won't be their fault, it won't be that the hardware they bought changed - it'll be because they were fed fallacious reasoning by people they trusted.

I used to believe Firefox was more secure than Internet Explorer. Judging by the number of vulnerabilities it's had, I think this is hard to argue these days. I promote Firefox for other reasons, and you can promote Apple for other reasons, but please - don't mislead people by telling them obscurity is security.

Re:Why would you ever.....

[soulhuntre]

Your right, let me fix it. A comparable view would be not locking the doors or the windows because you have an alarm that would sound if they are opened.

Still wrong. It's a lot more like...

I have some locks on the windows and doors, but I am not worried about "bump keys" because what looks like a house is really jsut the garage and if you try and leave into the main house a giant robot beats you to deat with your own appendix.

Re:Why would you ever.....

[IamTheRealMike]

Certain others, like Symbian, seem to do well too. I don't know of many Symbian compromises, in spite of the hundreds of millions of Symbian devices that spend 100% of their time connected to the network.

Are you kidding me? Try switching your phones Bluetooth on and walking around a city for a few days. You'll almost certainly be asked to receive a .sis file - this is a Symbian virus. The most common exploit in Symbian is actually not a buffer overflow from what I understand but a GUI modality exploit .... when receiving a SIS file you can't do anything else except say yes or no, and if you say no the sender is notified and can immediately ask again. So these viruses simply dos the GUI until you accept, at which point, your phone is infected. ActiveX had a similar problem but Microsoft fixed it with XP SP2

Re:Why would you ever.....

[ThinkFr33ly]

Most analogies do indeed suck... especially ones that compare something as incredibly complex as a modern operating system to something as relatively trivial as a house.

Re:Why would you ever.....

[JonXP]

Those numbers are total for all time, not for the year. Please scroll down to the actual numbers, not the first thing you see on the page.

Re:Why would you ever.....

[pD-brane]

By demanding this, you of course are offering to produce 3 links yourself? I thought not. Why should Enrique1218 have to do that? He is not the one making bold statements.

Re:Why would you ever.....

[pD-brane]

"Numbers are out there..."?!
What kind of silly non-information is this... oh wait, this is slashdot.

Re:Why would you ever.....

[greenbird]

Numbers are out there... Dare I suggest, "Open up and say ahh." ;)

And the "numbers" people like you point to are complete BS. Vista is simple an operating system and a very basic one at that. Yet you compare the number of vulnerabilities in it to the number of vulnerabilities in a full blown linux distro that provides a million times as much functionality. Lets see, Vista, very basic OS functionality, linux distro, very advance OS functionality plus 1000 applications. Yeah, that's a valid comparison. Hell, even the most basic linux or unix setup provides far more functionality than Vista. And even worse than that in many comparisons the linux vulnerabilities are counted multiple times. They count the same vulnerability in a dozen different distros. So you keep trotting out your "numbers" while those of us who actually have experience and know a little about security sit back in our digital fortresses and watch you Vista fools scramble every time the next IE 0-day comes to light. The scary part is that most PHBs buy your disingenuous numbers rather than listen to the people who actually know what they're about.

Re:Why would you ever.....

[Anonymous Coward]

are you going to blame Microsoft when a user smacks their motherboard with a hammer?

Well, yes. They only do it because Vista frustrates them so much! They think it will help delete files faster if they smash them into smaller pieces.

Re:Why would you ever.....

[arminw]

......that no cracker would waste their time on writing a worm for your system.........

Is that not just great?! It's not just that there are fewer Macs, but also that the vast majority of hackers have lot of experience in how to break into Windows boxes. There are lots of tools around to help them break into those. Hackers are lazy bastards, otherwise they would get honest jobs. Learning all about how Macs work and building hacking tools, in order to break into them is a lot of work. So even if there were an equal number of Macs and Windows systems, the learning hurdle would still have to be overcome.

Windows, because of backward compatibility, is STILL at heart a single user system. *NIX based systems were and are conceived from the ground up as multiuser systems, inherently more secure from day one. Multi-user capability was added piecemeal to Windows over time. The continued existence of the registry is a weak point that *NIX based systems don't have. This means that the incentive for present and future hackers to surmount these hurdles has to be more than 50% of installed base. If you were a hacker, which half of all computers would you rather attack? The half you know and have hacking tools for, or the other half for which you have nothing and are inherently harder to crack? There is no reason to assume that a hacked Mac would be more valuable to a criminal wanting to steal your private data than a hacked Windows system.

Re:Why would you ever.....

[arminw]

.... The more people who switch to Apple computers, the more dangerous they are to use.......

Not true. Even if 50% of all computer were Macs, the number of Mac hacks would not rise dramatically. Hackers are lazy, otherwise they'd get real jobs. If you were a hacker, which half of all computers would you rather attack? The easy half you know and have hacking tools for, or the other half for which you have nothing and are inherently harder to crack? There is no reason to assume that a hacked Mac would be more valuable to a criminal wanting to steal your private data than a hacked Windows system.

Re:Why would you ever.....

[arminw]

.....The case of Firefox seems to show that around 10-12% market share is when you get interesting to attackers......

So which version of Firefox gets hacked? The Windows version or the Linux/Mac versions? Hackers know how to hack Windows and its apps, but few of them know much, if anything about Macs. There are also few hacking tools out there for script kiddies to use. Hackers are lazy. Even with 50% Macs, they would be hacked much less than Windows machines because to to so is much more work. If hackers wanted to work, they would get real, honest jobs.

Re:Why would you ever.....

[bhirsch]

Fair enough. It isn't a direct correlation. But once that scale tips, it would be.

Re:Why would you ever.....

[drsmithy]

Windows, because of backward compatibility, is STILL at heart a single user system.

Windows NT was designed and built as a multiuser system from day 1.

*NIX based systems were and are conceived from the ground up as multiuser systems, inherently more secure from day one.

False. UNIX was "designed" as a single user system first, multiuser functionality was added later.

The continued existence of the registry is a weak point that *NIX based systems don't have.

How so ?

There is no reason to assume that a hacked Mac would be more valuable to a criminal wanting to steal your private data than a hacked Windows system.

Technically speaking, there's at least one - the inherently less secure design OS X has incorporating a superuser.

Re:Why would you ever.....

[Anonymous Coward]

Actually, the most secure OS on the market is the AnonymousCowardOS, so secure than i can't even start to write it (the security subsystem prevent it so i won't introduce unsecure code). Everyone can order it, but there is a 15 billion years wait in shipping & handling.

Re:Why would you ever.....

[arminw]

But once that scale tips, it would be

If the situation became reversed in Windows and Mac numbers, then the scale would have tipped, true. That is however highly unlikely. Discussing "what if" scenarios is mostly foolish fun. Getting back to reality is the fact that Macs have essentially zero amounts of malware circulating in the present Internet, compared to tens of thousands or more attacks on Windows systems each and every day. That fact can safely be told to future computer buyers TODAY. Tomorrow that may change, but let tomorrow come first.

Re:Why would you ever.....

[IamTheRealMike]

It's not so hard to write a Firefox hack that works on all platforms. But most hackers are interested in installing malware onto your system, and that tends to be written for Windows. But you've done a good job of missing my point - market share is what matters. I can guarantee you that if MacOS had 15% market share there'd be people out there attacking it, and succeeding. Deal with it.

Re:Why would you ever.....

[arminw]

.......How so ?.....

If a hacker can mess up the registry, more damage can be done to the whole computer than in *NIX systems where critical information is more distributed. It is not all concentrated in a single file, especially one that many present programs, for no reason, want write access to.

I know of Windows programs which will not run properly unless the user is and administrator. There are NO Mac programs I know of that require the user to have admin privileges. Ordinary users, such as kids in school do not even know the admin password. So exactly what do you mean with: "the inherently less secure design OS X has incorporating a superuser"?

Re:Why would you ever.....

[TheRaven64]

I always leave my phone with bluetooth switched on, and have only encountered this once, in a cafe in Portugal (never here in the UK). If I ignored it, I could switch out of messaging mode and do other things. I've tried sending .sis files from my computer, and even if I do accept them, it just stores them in my inbox, it doesn't run them automatically. If that's a security hole, then so is any email client that allows you to receive executable attachments and then manually execute them.

Re:Why would you ever.....

[arminw]

.......I can guarantee you that if MacOS had 15% market share there'd be people out there attacking it, and succeeding........

My goodness, you must be clairvoyant about the future! Maybe you should be a stock analyst! I don't know the future any more than you do, but I know a little about human nature.

It's not just that there are fewer Macs, but also that the vast majority of hackers have lot of experience in how to break into Windows boxes. There are lots of tools around to help them break into those. Hackers are lazy, otherwise they would get honest jobs. Learning all about how Macs work and building hacking tools, in order to break into them is a lot of work. The absence of easy to use Mac hacking tools also eliminates the army of script kiddies from turning their attention on Macs. So even if there were an equal number of Macs and Windows systems, there would have to be a much stronger incentive to break into a Mac than a Windows box. Can you point to such an incentive?

Re:Why would you ever.....

[jnf]

I would still be far more comfortable with the security of any of the BSDs, Linux, Mac OS X, Solaris, or any other flavor of UNIX

That's interesting, and I wonder why you've made those choices. For the record, I was 'raised' on Linux, it's where my heart is, but I audit code and write exploits for a living, so I get around the various operating systems. It's sad to say, but in all honesty Vista *is* indeed more secure from an exploit developers standpoint than almost all of the OSs you listed. Both FreeBSD and NetBSD are laughably ~10 years behind in security, and OSX is even worse (for instance it will be a *long* time before you see any real ASLR in OSX because of deficiencies in the Mach-O spec (think 1996 and a.out)), Solaris really isn't any better although I haven't kept up with them, they may be building everything w/ ASLR and SSP these days.

Here's what I experienced yesterday on XP SP2 against an application that was compiled with VisualStudio 2005 (so we're not even talking about Vista, which has more security features). I found *4* remotely exploitable vulnerabilities in this application in a very short timeline, the first wasn't exploitable because wvsprintf() truncates at 1k (it seems this is obscure but documented behavior from quite a ways back), and all of the other three were basic stack overflows and none of them were exploitable because VS2005: reordered local variables so I didn't overwrite any other variables, moved the SEH record to the other side of my buffer (allocate space first, then mov eax, fs:[0] push eax), and finally the /Gs stuff (stack cookies) kept me from being able to touch the return address.

So think about this, seriously, security enhancements in Windows or their compiler stopped four real-life bring-down-the-house remote vulnerabilities, the only ones that I know of that could've done that in your list would've been OpenBSD and Linux with third party patches (i.e. grsec/pax).

What I had to realize, and what you and everyone else should realize is that over the past few years Microsoft has thrown *a lot* of money at their security problems and purchased a huge chunk of the 'underground' industry, and as such have made an incredibly impressive about face.

Re:Why would you ever.....

[TheNetAvenger]

Lets see, Vista, very basic OS functionality, linux distro, very advance OS functionality plus 1000 applications. Yeah, that's a valid comparison.

Actually the original article compared only features in Vista that were also installed by *nixes. So since Vista doesn't have a mail server, all the vulnerbilities in relation to mail servers was NOT INCLUDED in the *nix distributions.

So if the feature wasn't in Vista or installed by default in Vista, it wasn't compared, so things like Apache, etc were omitted from the *nixes.

So you are basically making a good point, but the original articles and comparison already took this into account and took them out of the *nix pool. So they did what you ask, even though you didn't seem to read that far.

Also, why not look beyond just Vista, how about Windows Server 2003, which does ship with a lot of servers and services, it has had very little patching as well in comparison to *nix distributions and it is based on the old NT fork. When MS does do something right, it is retarded to pretend they haven't just to feel better about your OS religion or to find a way to hate them.

Hell, even the most basic linux or unix setup provides far more functionality than Vista

How much would like to wager on this?

Show me one *nix distribution that has a GPU model that allows pre-emptive multi-tasking of the GPU or will do SMP across multiple GPUs and also virtualize GPU RAM for gaming. Um, ya none exist.

Ok, I'm being a dick here, but there are lot of things that Vista does that truly cannot be done on other OSes at this time. People forget this, and it has a bit of importance in the upcoming technologies of the next few years.

As for the number of applicatons available for *nix compared to Vista, you do realize Vista ships with a full BSD subsystem, and it can run pretty much any *nix application natively.

Vista isn't perfect, but Windows stopped being a PoS OS around XP SP2 and I am really tired of the *nix wannabes pretending like this is 1998 and we are dealing with a DOS Hybrid Win98 as the example of Windows and how horrible it is.

Just the GPU WDDM model in Vista is more advanced than anything going in the OSS world and will kill any desktop wannabes in the next few years if we don't wake up and meet or beat them at this game. (OS X is not even attempting to compete in the WDDM area, so don't expect Apple to do this for us.)

I have been involved 'deeply' in both *nix and Windows for over 25 years now, and when each side should be benefiting from each other, one side is sticking its head in the sand and pretending that Windows still sucks as much as it once did.

In the OSS world and *nix world we can learn from the MS research group and what they and the MS engineers are getting right and are pushing into Windows, and we should at least be keeping up, instead of pretending like Windows is still a Piece of S**t and looking the other way and remaining ignorant.

Re:Why would you ever.....

[bhirsch]

So it's Microsoft's fault for being popular?

Re:Why would you ever.....

[toddestan]

Not true. Even if 50% of all computer were Macs, the number of Mac hacks would not rise dramatically. Hackers are lazy, otherwise they'd get real jobs. If you were a hacker, which half of all computers would you rather attack? The easy half you know and have hacking tools for, or the other half for which you have nothing and are inherently harder to crack? There is no reason to assume that a hacked Mac would be more valuable to a criminal wanting to steal your private data than a hacked Windows system.

I dunno, I might go after the Macs. Lets look at the facts:

1. Most Mac users seem to care very little about security beyond not running Windows. They don't run anti-spyware tools, very few of them run anti-virus, and they also generally don't run a firewall. If your malware doesn't make it's presence obvious (say, by crashing a lot or spawning pop ups) you could go unnoticed on the typical Mac for quite some time. Compare to the Windows users who can be downright paranoid about security.

2. The typical Mac user has more money than the typical PC user, given the cost of the computer. Their personal data is likely more valuable.

Re:Why would you ever.....

[greenbird]

Actually the original article compared only features in Vista that were also installed by *nixes. So since Vista doesn't have a mail server, all the vulnerbilities in relation to mail servers was NOT INCLUDED in the *nix distributions. So if the feature wasn't in Vista or installed by default in Vista, it wasn't compared, so things like Apache, etc were omitted from the *nixes. So you are basically making a good point, but the original articles and comparison already took this into account and took them out of the *nix pool. So they did what you ask, even though you didn't seem to read that far.

Again I call BS. Are you going to try and tell me that for example iptables is equivalent of the Vista firewall or that bash is the equivalent of command.com? In the vast majority of the equivalent apps the linux app will provide orders of magnitude more functionality. So even trying to compare equivalent apps isn't fair. I would need to see a package list, which wasn't provided, to determine how good a job he did excluding everything that isn't included in a Vista install. There are a lot of packages install in a default RHEL install that aren't in Vista. Just as an example which file systems did he count since default RHEL includes many more than the 2 that come with Vista.

How much would like to wager on this?

I would bet a years salary.

Show me one *nix distribution that has a GPU model that allows pre-emptive multi-tasking of the GPU or will do SMP across multiple GPUs and also virtualize GPU RAM for gaming. Um, ya none exist. Ok, I'm being a dick here, but there are lot of things that Vista does that truly cannot be done on other OSes at this time. People forget this, and it has a bit of importance in the upcoming technologies of the next few years.

And the majority of the things you can do on a linux/unix system can't be done or can be only very basically done on Vista. Just to name a few off the top of my head: bash, packet filtering, encrypted file systems, running off a serial console, LVM, RAID. I could probably fill pages if I wanted to take the time. You could probably count the things Vista does that linux/unix doesn't without taking your shoes off.

I've got 100's of linux boxes with no keyboard/monitor deployed exposed to the public internet. I don't have to worry about them because I was able to secure the systems such that even with a determined effort by experts it would be difficult if not impossible to crack them. They only needed limited functionality so I was able to only start exactly what was needed and know that was all that was running. You most assuredly can't do anything like that with Vista.

Re:Why would you ever.....

[arminw]

....If your malware doesn't make it's presence obvious (say, by crashing a lot or spawning pop ups) you could go unnoticed on the typical Mac for quite some time........

If your malware wants to gets itself run every time the computer started it would have to get sudo rights to install itself. That requires an admin password. If the password is given, then the malware can install. Many users, in schools for example, don't know that password. In that case the malware can only access user space. The system startup file is outside of that and there is no registry where the worm can insure that it runs on a re-boot. Any malware can therefore only run that one time the user actually starts it. It can at that time access any user file, which of course is bad enough. In summary then: To make a worm for a Mac is much harder compared to Windows. Even when a worm does get in, it is much easier to find and eradicate, because in the Mac file system there are fewer places to hide. Only software that needs to and is given special permissions to install drivers, needs some sort of uninstall programs such as almost every Windows program needs. On Macs the program is simply dragged to the trash and ALL of it is gone forever.

It is likely that Mac users may be more affluent, but they may also just be more concerned with cost of ownership over the longer term, rather that first cost. In that department, Macs are generally less costly. The hacking difficulty of a Mac, especially in the absence of readily available hacking tools, is proportionately much higher than Windows. Even a simple NAT router is somewhat effective as a firewall. Most Cable/DSL setups use these. This precludes many attacks from the outside Internet. Macs also have a built in firewall which is however not turned on out of the box.

Re:Why would you ever.....

[innocent_white_lamb]

"Your computer is now stoned."

Re:Why would you ever.....

[Overly Critical Guy]

Gotta love it. Slashdot is the GOP of technology news sites.

Uh, right, because the innocent DNC never tries to lie about anything or spin positive news into negative.

Re:Why would you ever.....

[Overly Critical Guy]

Similarly, Mac OS X is used by far fewer people than XP.

Microsoft's IIS is used less than Apache yet IIS has more security vulnerabilities. Hear that sound? It's this usual anti-Apple canard crumbling into dust.

Macs have had far more known vulnerabilities than Vista, and even than XP in recent years. That's an objective fact. A fact that can't be changed by how much Steve Jobs coolaid you drink.

Absolutely, completely 100% false. Put down the MSDN marketing brochure and breathe the free air.

Re:Why would you ever.....

[drsmithy]

If a hacker can mess up the registry, more damage can be done to the whole computer than in *NIX systems where critical information is more distributed.

In both cases, the system can be rendered unusable, or important changes made, relatively trivially (probably easier on the UNIX system, since the configuration files are more frequently manipulated directly, and hence better understood). At most, it's equivalent.

It is not all concentrated in a single file, especially one that many present programs, for no reason, want write access to.

The Registry is not a single file, it is multiple files. Further, it is a fully transactional database [0] with ACL permissions on individual keys. It's _significantly_ more reliable and secure than the UNIX equivalent (textfiles in /etc, et al).

I know of Windows programs which will not run properly unless the user is and administrator. There are NO Mac programs I know of that require the user to have admin privileges. Ordinary users, such as kids in school do not even know the admin password. So exactly what do you mean with: "the inherently less secure design OS X has incorporating a superuser"?

Because on a (traditional) UNIX system, the superuser quite literally can do anything - they circumvent the entire security infrastructure of the OS. In Windows, Administrator is just another user (albeit with one that has significantly privileges out of the box). The concept of a superuser is an inherent feature to (traditional) UNIX's less capable security model.

Further, those broken applications - and it is 100% the fault of the application - that "require" Administrator access, almost certainly only really "require" access to a couple of files and Registry keys, all of which can be individually modified without having to go the whole hog and run as Administrator all the time. In a remotely competently managed Windows environment, this should be exactly what happens - not granting every user Administrator access (which is both unnecessary and stupid).

[0] Strange how I never see people complaining about how much, say, MySQL, PostgreSQL, et al suck and that everyone should be flat text files instead...

Re:Why would you ever.....

[toddestan]

On the otherhand, given a proper locked down Windows box, you would have similar problems. You can't write anywhere but the user's folders, you can't change system files, you can't install or start services, you can't install drivers, etc. The public Windows computers at the library seem to do fine despite patrons doing who knows what on them. Of course, Windows XP and all previous versions had the default being wide open, hence the malware problem on Windows. Vista attempts to fix a lot of that by having security out of the box, so by default programs can no longer do whatever they want behind the user's back.

Of course, that doesn't mean your safe. Root kits are out there for Linux, and they can be very insidious. You could play many of the same games on a Mac or a locked down Windows system. You don't need sudo rights, you can just use some local privilege escalation exploit to gain yourself root, then you do whatever you want. Heck, on a Mac you wouldn't even need to do that if you can get the user to run the program once - just attach your rootkit to something like Firefox (which can be user installed, and seems to update itself just fine in a user account without the Administrator password, so no special tricks needed). Cloak your files, hide yourself best you can, and get to work. Getting a good rootkit out is not as easy as dragging it to the trash, and the only way to really be sure is to reformat and reinstall from backup.

Re:Why would you ever.....

[IamTheRealMike]

All your arguments could have been said about Firefox as well, but they still wouldn't have held true. Go look up InputManager injectors and Leap-A. And it's not anywhere near 15% market share yet.

Re:Why would you ever.....

[reclusivemonkey]

Furthermore, being rated non-critical can often mean that it requires significant user action (like turning off multiple security features) in order to make a user vulnerable.

Like turning the security features off because they are invasive and annoying? Not heard of anyone doing that in Vista.

It amazes me that people are claiming Vista is secure. No one is even using it yet! Wait till its got 50% market share, and its worthwhile attacking. Then we'll see how secure it is. Talk about security through obscurity...

Re:Why would you ever.....

[Anonymous Coward]

It's true that Linux has more server-oriented features than Vista but that doesn't make it more secure. For example, since hardly anybody wants to run Vista headless, the fact that it can't do it isn't important - it's certainly not important in a discussion on security.

In terms of functionality, you'd have to give iptables and terminals to Linux. But bash v command.com isn't fair: it's bash, WMI, Group Policy or Powershell. And Vista has plenty of functionality that Linux doesn't: kernel-mode transaction manager or Windows Presentation Foundation, or the encrypted filesystem, for example.

Re:Why would you ever.....

[arminw]

.....All your arguments could have been said about Firefox as well......

Except that Firefox is only an application, not a whole OS. Which version of Firefox is subject to all that malware? Is it the Windows version or the Mac/Linux versions? If the underlying OS is more hackable, then its applications will be also. Every time there is a story about a major worm or virus, a little phrase is buried somewhere in the media stating that Macs and Linux are not affected. If the OS is secure, then its apps have a better chance to be also.

Re:Why would you ever.....

[arminw]

.....if you can get the user to run the program once ......

That's called social engineering and against that there is no technological defense. I am a fairly knowledgeable Mac and Windows user, but am not intimately acquainted with the intricate innards of either. Since there is a LOT more software for Windows, both good and bad than for the Mac, the tools for invading a Windows box are plentiful and sophisticated. Even if Macs suddenly had 25%-50% market share, the hacking tools would still need to be developed. Since developing such tools is considerably more difficult for Macs than for Windows, the amount of malware for Macs will always be much less.

Because of compatibility, many Windows programs, including malware and hacking tools, will still work in VISTA. I do believe however, that the days of the large scale "blaster" type rapidly proliferating worms are over.

Re:Why would you ever.....

[arminw]

.....In a remotely competently managed Windows environment, this should be exactly what happens.....

The key words are competently managed. When I was IT manager at our school district, that is exactly what I did for almost all computers. We were running NT4 back then. Windows can be made quite secure actually. How many consumer computers are competently managed? Macs are MUCH more secure out of the box. Now with VISTA, that aspect of Windows certainly seems to have changed for the better. The price however is a considerable increase in hardware requirements. With Windows each succeeding generation has been slower on the same hardware. Mac OSX 10.4 still works acceptably well on my old G4 with 512M of memory. It runs faster on that than the 10.1 it shipped with. In practice however, VISTA's steep hardware requirements won't be too troublesome, since it will mostly come installed on new hardware with enough power to run it well. I installed VISTA Home premium as a VM on my Mac, just so I could learn about it. It is considerably slower than the XP VM on the same machine.

Re:Why would you ever.....

[IamTheRealMike]

You need to distinguish exploiting the browser and what you do with that exploit, which you aren't doing currently.

There have been many cross-platform exploits available for Firefox in the past, largely around breaking JavaScript security and gaining chrome privileges. Once you have them you can do anything Firefox can, including downloading extra code and running it. Now you have taken control of the browser most attackers downloaded Windows malware and ran it, because MacOS X and Linux don't have enough market share to bother with. But that's not inherent to the Firefox bug. The exploit could easily have had an if (linux) conditional in it which downloaded and ran an equivalent trojan for Linux.

So the fact that most Firefox exploits are "Windows only" is true only because it's easier to write a good trojan in C++/Win32 than XPCOM based JavaScript. If somebody decided to write malware that didn't rely on Windows only code (perfectly possible) then it'd work on all platforms Firefox supports. Hence Firefox has had security problems.

Re:Why would you ever.....

[greenbird]

It's true that Linux has more server-oriented features than Vista but that doesn't make it more secure.

No the ability to have complete control of every aspect of the operation of a linux/unix computer makes it more secure, I can shut off everything that remotely access the computer except ssh and run that on a non-standard port.

For example, since hardly anybody wants to run Vista headless, the fact that it can't do it isn't important - it's certainly not important in a discussion on security.

I know plenty of cases of applications that would be better without a windowing interface but all that additional stuff is there because there is no other way under Windows. The fact that they are forced to run all that additional software isn't relevant to a discussion on security? So I guess your claim is that all that unneeded software is perfect and bug free.

But bash v command.com isn't fair: it's bash, WMI, Group Policy or Powershell.

Linux still wins with a long list of scripting tools tailored for a verity of different uses.

And Vista has plenty of functionality that Linux doesn't:

Windows Presentation Foundation

There are a number of frameworks that provide similar functionality. I haven't used WPF so can't speak to how much better it is.

the encrypted filesystem

You've got to be kidding. Linux has for years provided for filesystem encryption far more advance and flexible than that provided by Windows.

Re:Why would you ever.....

[Anonymous Coward]

"I mean, it's not like Theo DeRaddt snuck in to Redmond HQ and added a notoriously buggy and insecure web browser to their OS when they weren't looking."

How can you be so sure?

Re:Why would you ever.....

[drsmithy]

The key words are competently managed.

Indeed they are, because an incompetently managed UNIX environment is likely just as dangerous (although its exploits will probably be different due to different user demographics).

When I was IT manager at our school district, that is exactly what I did for almost all computers. We were running NT4 back then. Windows can be made quite secure actually. How many consumer computers are competently managed? Macs are MUCH more secure out of the box.

Like many, you fall into the trap of conflating "less exploited" with "more secure".

Now with VISTA, that aspect of Windows certainly seems to have changed for the better. The price however is a considerable increase in hardware requirements.

Vista runs acceptably on ~6 year old hardware with minor upgrades (RAM and, if you want the flashy visuals, a $30 video card). That's not "steep".

With Windows each succeeding generation has been slower on the same hardware.

Only at the low end. Higher up in the market, once you're over the "hump", the newer versions are faster. A HT P4 or multiprocessor box with a couple of gigs of RAM, for example, is much better off running XP than Windows 2000.

Mac OSX 10.4 still works acceptably well on my old G4 with 512M of memory. It runs faster on that than the 10.1 it shipped with.

If you find OS X 10.4 "acceptable" on old hardware like that, you'll find Vista similarly "acceptable" on similarly old hardware.

I own a few Macs, the slowest is my 1Ghz/768MB RAM iBook. I find OS X on it too slow for anything except very basic web browsing (few tabs at once), email, watching DVDs and pulling photos off my digital camera - and certainly not all at the same time.

It's true that OS X has been getting faster with each release. The flipside, however, is how mind bogglingly slow it started off (and remained, IMHO). Windows does not have this problem. It runs quite well on the contemporary hardware of its day (with the exception of Windows NT 3.1) and acceptably well back to about the 6-7 year old mark, with minor upgrades (typically RAM). This has been true pretty much forever. OS X, for me, needs at least a G5 level Mac for acceptable performance (and even my Mum's G5 iMac becomes frustratingly unresponsive at times).

Vista's hardware requirements, for a similar end user experience, are basically the same as OS X's (somewhat higher end video card because Microsoft didn't bother with a software mode Aero - the reasons for that should be obvious). The whole "but Vista needs so much hardware" argument is pure FUD. The slowest machine I've run Vista on was a 500Mhz, 512MB RAM P3 (which dates from about 1999). It was, indeed, quite slow - but no slower than OS X on an equivalent Mac. The 900Mhz P3 with 768MB RAM and GeForce 5200 that I keep around for playing old DOS games runs it fine - and *much* better than my iBook runs OS X.

Re:Why would you ever.....

[vuffi_raa]

they didn't fix the Millennium Edition issues either- let's hope vista goes to the same place

Re:Why would you ever.....

[TheNetAvenger]

No the ability to have complete control of every aspect of the operation of a linux/unix computer makes it more secure, I can shut off everything that remotely access the computer except ssh and run that on a non-standard port.

See right here you show everyone you have no idea when it comes to Windows. You can turn off every freaking port as well, and run a simple SSH server, or telnet server, or Remote Desktop with NO OTHER ACCESS (Take your pick). PERIOD.

You've got to be kidding. Linux has for years provided for filesystem encryption far more advance and flexible than that provided by Windows.

Ok, what reality are you going for here? The only real FS for Linux that support encryption is Reiser4, and it was designed in 2004, and still hasn't been merged into the kernel. There is a lot of controversy with both the original ReiserFS and Reiser4 as they sometimes do things a bit different and can cause corruption with some apps.

However, encryption technologies have been around for Linux, but they are NOT FS encryption. You need to have a basic understanding of the difference before this will make sense to you.

If you want to fully encrypt a volume, you can do so on Linux using PGP or whatever, but what you forget is most of these technologies are also available for Windows and have nothing to do with FS level encryption.

Even ZFS doesn't have FS encryption, and this is something NTFS has been doing well for a long time. And Vista has upped the stakes a bit with a combination of FS level encryption and full volume cryptographic support with BitLocker. Both BUILT IN, and NOT AVAILABLE IN 99% of Linux Distributions.

Linux still wins with a long list of scripting tools tailored for a verity of different uses.

I think you should look up PowerShell before you make this claim. There are also this like the inherent scripting technologies in Windows that can provide the functionality of a full application in addition to doing some serious scripting. From DOS/NTCMD/VBS/WSS/PSS/etc etc.

Also you seem to think that the scripting and command line tools people use on Linux haven't been ported to Windows, how could anyone assume such a stupid thing? And again you are also forgetting the *nix geeks like myself that use Windows and spend time in the BSD subsystem, running almost the same scripts and commands you would.

Re:Why would you ever.....

[Anonymous Coward]

What a spin clap clap, this even tops fox news.

Read the the full story

http://arstechnica.com/news.ars/post/20070624-vist a-the-most-secure-os-according-to-researcher.html

Shame on you Zonk, you should apply for a position at the white house.

Re:Why would you ever.....

[tehcyder]

What's next, are you going to blame Microsoft when a user smacks their motherboard with a hammer?

On slashdot, the answer to any question beginning "are you going to blame Microsoft..." is "yes".

Re:Why would you ever.....

[plague3106]

Did you stop to consider that the bug may manifest very, very rarely? Enough that it isn't worth fixing? Its comments like these that make me wonder if more than a few software developers frequent the site..

Re:Why would you ever.....

[plague3106]

Its frightening that people like you are even employeed in IT at all.

Re:Why would you ever.....

[plague3106]

Last time I checked being very widely used wasn't considered a security flaw of the OS. They only bypass your "house" because your living on a 100 acre lot with nothing else around it. Its not worth the time it takes to get to your house when there's a whole city nearby.

Wrong title

[trifish]

First, the author of the submission doesn't know the difference between a bug and a vulnerability. Second, the title ought to read: "Vista Vulnerabilies are Less Serious than in XP" (and there are fewer vulnerabilities in Vista than in XP in total).

That's the reason why only half of them were fixed while in XP most of them.

Re:Wrong title

[Anonymous Coward]

yeah, but that wopuld hurt litlle fuzzy wuzzy leenooks zealots' feelings, aww :( We can't do that to our community, oh no!!

Re:Wrong title

[Anonymous Coward]

Oh, stuff it.

As the OpenBSD guys say "the difference between a bug and a vulnerability is the intelligence of the attacker".

Re:Wrong title

[Anonymous Coward]

I'm sorry, stuffing it is not compatible with my linux. The world is not ready for linux or stuffing things. It's everyone else's fault, but not linux's.

Re:Wrong title

[LingNoi]

Second, the title ought to read: "Vista Vulnerabilies are Less Serious than in XP"

GNU/Linux vulnerabilities less serious then Vista.

Re:Wrong title

[MMC Monster]

Absolutely. Congrats should go out to MSFT that their new OS is more secure than their previous OS.

Of course, this being /., people will gripe that the default installation has any security flaws at all. That being said, most vulnerabilities could be mitigated by user education, anyway.

Re:Wrong title

[truthsearch]

Congrats should go out to MSFT that their new OS is more secure than their previous OS.

Yeah, according to Microsoft. Please swallow only with a humongous grain of salt.

For all we know there can be critical vulnerabilities which Microsoft discovered but simply hasn't disclosed.

Re:Wrong title

[neoform]

"and there are fewer vulnerabilities in Vista than in XP in total"

Vistas been out for a few months; XP has been out for more than half a decade. Obviously there are more known bugs in XP than Vista.

Re:Wrong title

[Jugalator]

Exactly -- the first thing that popped into my head when seeing this was "but how SERIOUS are they then? are we talking of stuff requiring local systm access and a bootable Vista CD, remote attacks, or what exactly?"

Since the article didn't say outright in the summary, and it would have used the first opportunity to do so if they were serious (because this is Slashdot), I just assumed they were as little problematic in possible exploits as the currently unpatched minor security problems in multiple Linux kernels.

Re:Wrong title

[Jugalator]

Secunia reports 9 unpatched vulnerabilities in OpenBSD 4. Vista currently has 15 according to this report.
Sure, OpenBSD "wins" in such as stupid comparison, but seriously... Is it a big deal...?

Re:Wrong title

[trifish]

the difference between a bug and a vulnerability is the intelligence of the attacker

The difference can be observed on the numbers: There are hundreds of known bugs, but only a few known vulnerabilities in Windows. Claiming that all bugs can be turned into vulnerabilities is ... inherent (and in some cases even provable) nonsense.

Re:Wrong title

[trifish]

Vistas been out for a few months; XP has been out for more than half a decade. Obviously there are more known bugs in XP than Vista.

You're obviously good at taking things out of context. If you read TFA (or at least the Slashdot summary), you'll know the context. TFA talks about vulnerabilities discovered in the 6 months after Vista release. You didn't really think I claimed that there were only 36 vulnerabilities discovered in XP in 6 years of its existence?

Re:Wrong title

[brunascle]

no, all 9 are patched. 0 unpatched.

Re:Wrong title

[Anonymous Coward]

The listed vulnerabilities came from sites like secunia.org. Yea, that's quite a MS biased site there. If the ABM'ers ever used facts they might be a threat, I'm sure MS Is glad you fools can't open your mouths without sticking your foot into it, I'm sure THAT doesn't matter to everybody who passes up free linux to go pay for windows. It's so sad, the OSS and Mac communities never tell the truth and so will never have a large user base because they don't understand people don't like bullying liars. Condemned to eternal obscurity through their own stupidity is how history will view OSS/Mac. I would rather use linux/mac if they admitted they had more vulnerabilities in the major distros than Vista even with reduced installs (non-office/graphics/server/non-default software) then if they tell me vista is more insecure and sucky when I can read the damn report and messages from others who obviously aren't windows-fanboys who tell the truth and see that it has the fewest vulnerabilities. I also steer all friends, acquaintances, random strangers that I chat with, etc. away from oss/mac because of this and I'm sure many many other people do that same. Yell monopoly tactics till you faint if you want, you guys did it to yourselves with all your bs meme-wannabes you flood the internet with. People are not as stupid as you think they are, they can tell when someone is acting like they know something even if they can't prove it. Whether they act on that or not, is not always certain, but in this case, it's apparent more are.

Rubbish.

[onion2k]

I've got two older brothers, I don't think that makes me stupid. ;)

Re:Rubbish.

[chalkyj]

As demonstrated by your uncanny ability to reply to the correct article, right?

Re:Rubbish.

[Anonymous Coward]

I've got two older brothers, I don't think that makes me stupid. ;)

Kinda of funny to post THAT on the wrong article, isn't it.

Re:Rubbish.

[Aqua_boy17]

I've got two older brothers, I don't think that makes me stupid. ;)

It doesn't. Only doing something like posting in the wrong thread would do that.

/chain yanking

Re:Rubbish.

[onion2k]

That was the joke. Hence the ;). Slashdot mods didn't get it though.

Re:Rubbish.

[janrinok]

LOL! Perhaps having 2 older brothers doesn't make one stupid, but it doesn't mean that YOU are not stupid. For example, do you know which thread you are in .....?

Re:Rubbish.

[MysteriousPreacher]

I got it - nice joke, it's more interesting than this Fox Newsesque presentation of the article as yet another "OMG, VISTA SUX0RS COMPARED TO XP!!1!" piece.

Re:Rubbish.

[suv4x4]

>Kinda of funny to post THAT on the wrong article, isn't it.

That was the joke. Hence the ;). Slashdot mods didn't get it though.

We have our first trans-article Slashdot joke. Party tonight :)

Re:Rubbish.

[MiniMike]

I would believe that this is a joke, if it weren't for the many posts in support of Vista that you submitted to the other article...

Re:Rubbish.

[porpnorber]

...Er. That's XP and DOS, right...?

Re:Rubbish.

[iago-vL]

And a good one, at that. Now let's just hope that this doesn't "catch on," I've tackled enough spaghetti code in my day, the last thing I need are spaghetti comments!

Re:Rubbish.

[Anonymous Coward]

the two older brothers being Windows 2000 and Windows XP

Re:Rubbish.

[Anonymous Coward]

Actually, according to the latest Scientific American, yes it does. Eldest children are more likely to have a high IQ than younger children of the same mother.

Simple Explanation

[Aqua_boy17]

From TFA:

"it will be more interesting to look at vulnerability statistics once Vista becomes more popular than XP, and the target of more hackers."

I for one am glad Microsoft releases fixes for XP problems in a more timely fashion than Vista. I would expect that when Vista deployments outnumber XP, the situation will reverse itself. So where's the story here?

Re:Simple Explanation

[TheNetAvenger]

for one am glad Microsoft releases fixes for XP problems in a more timely fashion than Vista. I would expect that when Vista deployments outnumber XP, the situation will reverse itself. So where's the story here?

The story is, Vista now is more widely used than OS X and many *nix distributions, and with comparison to them, it is significantly ahead of all of them in terms of security. This is no longer about Vista vs XP or based on installations with Vista vs XP.

So one example coming from this report is now that Vista is more prevalent than OS X, it is still tighter and better patched than OS X and other OSes that have been held in high regard in terms of vulnerbilities and security.

i.e. MS if finally doing something right in terms of security, and it is not just better than Windows, it is better than most OSes out there.

Big deal...

[Kainaw]

Big deal. The VA has been trying fix VistA since 1985.

And so...

[Lookin4Trouble]

This should be news to whom exactly?

Why would anyone bother putting out security patches for an OS that nobody uses yet? Security through obscurity and all of that nonsense.

What I'd really like to know is why critical vulnerabilities in IE7 are thoroughly ignored, even though it's available to install on XP (and yes, hard as it is to believe, people are actually using it _instead_ of Firefox/Safari/Your Favorite Flavor here...)

Re:And so...

[BigBadBus]

Talking of an OS that no-one uses.... These stats are from my website, which has been running since February: Windows - all flavours - 10,307 hits, 90.56% Apple - all flavours - 740 hits, 6.50% Linux/Unix - all flavours - 225 hits, 1.98% or, more specifically: (OS - hits - %) Windows XP 9,155 80.44% Mac OS X 716 6.29% Windows 2000 526 4.62% Windows Vista 389 3.42% Linux 221 1.94% Windows 98 206 1.81% Other/Unknown 99 0.87% Macintosh 24 0.21% Windows NT 21 0.18% Windows ME 7 0.06% WebTV 5 0.04% OS/2 3 0.03% FreeBSD 3 0.03% Windows 95 2 0.02% SonyEricsson Phones 2 0.02% SunOS 1 0.01% Windows 3.1 1 0.01% - Vista had a slow start, but it even took over Linux after a few weeks. How come people don't say "its an OS that no-one uses" when talking about Linux?

Re:And so...

[BigBadBus]

.....and my html line breaks got missed out. Grrr!

Re:And so...

[Doctor Crumb]

Let's dig up one of the old /. favourites:

"The only reason XP is the target of so many viruses is because it is so widely used! If Vista was as popular as Windows XP, there would be just as many viruses written for those platforms!"

(firmly tongue in cheek, I'm aware that Vista's UAC is still a pale imitation of a real security model).

Re:And so...

[TheRaven64]

Interesting numbers. What's your target audience? I'm surprised Mac OS X is so popular (6.29% doesn't sound like much, but it's over the 3-5% I usually see for OS X market share).

Re:And so...

[TheNetAvenger]

Why would anyone bother putting out security patches for an OS that nobody uses yet?

And sadly it is used more than OS X and most *nix distributions already.

So if we take OS X as an example, with regard to security and patches and vulnerbilities, Vista is more widely used and had far less patches and remains more secure to date.

This is where the Apple people should say, "oh crap..."

In Other Words

[camperdave]

Jones says that's because "Windows Vista continues to show a trend of fewer total and fewer high-severity vulnerabilities at the six month mark compared to ... Windows XP,"

So, they're not fixing the bugs because Vista is less buggy than XP? Whatever happened to fixing it because it was broken?

Re:In Other Words

[niceone]

Whatever happened to fixing it because it was broken?

The saying is: If it ain't broke, don't fix it. If it was the way round you said, the software industry would disappear under an infinite pile of gant charts.

Re:In Other Words

[ThinkFr33ly]

Microsoft quickly patched all of the critical vulnerabilities in Vista. Those vulnerabilities that are not rated critical, which comprise 100% of the unpatched vulnerabilities mentioned in the article, are simply not very likely to cause issues for people.

Microsoft often waits to patch these kinds of vulnerabilities until they've taken care of more important things, like critical bugs, and sometimes chooses to roll them up into a service pack. This allows for more thorough testing and decreases the chance that the minor fix causes a major regression issue.

Despite what people think, Microsoft doesn't have unlimited resources.

Re:In Other Words

[harry666t]

Microsoft often waits to patch these kinds of vulnerabilities until they've taken care of more important things, like critical bugs, and sometimes chooses to roll them up into a service pack. This allows for more thorough testing and decreases the chance that the minor fix causes a major regression issue.

Then... I just wonder. Why virtually no linux distro is using things like SPs and still virtually all of them remain much more secure and stable than any Windows version ever was?...

Re:In Other Words

[ThinkFr33ly]

Then... I just wonder. Why virtually no linux distro is using things like SPs and still virtually all of them remain much more secure and stable than any Windows version ever was?... I wonder what you're basing that conclusion on since the data that is readily apparent seems to suggest otherwise.

Re:In Other Words

[lseltzer]

I think the delay is more likely attributable to them putting less-severe bug fixes on a longer and more rigorous test cycle.

Re:In Other Words

[Churla]

Maybe it's because whereas the geekcore like the idea of seeing dozens of small patches/updates to packages come down when they do an apt-get update the general populace likes seeing one package which fixes several bugs.

This is the difference between using Service Packs and using individual patches for individual packages/applications. It's a Monolith versus granular approach.

Because of the scale MS has to work on and support people it's far easier for them to work within the monolithic model.

As for why they choose to fix certain bugs in certain order , it's called prioritization. If they were dumping everything to fix every Vista bug then people would be bashing them for ignoring XP where the majority of their installed base still is. As it is they're handling the biggest fires first, then probably heading to take care of the medium and small sized ones next. In general this whole story is a heaping steaming pile of "meh" to me.

P.S. - If you're trying to earn some kinda Linux windows-bashing geek cred you're gonna need to step up the game a little to impress the judges around here, they're really finicky.

Re:In Other Words

[Anonymous Coward]

Just curious, what do you do at Microsoft?

Re:In Other Words

[drsmithy]

This is the difference between using Service Packs and using individual patches for individual packages/applications. It's a Monolith versus granular approach.

You do realise a SP is basically just a bunch of individual patches bundled up together into a single, easily installable entity, right ? Like, say, Red Hat does with their regular repackaging to "RHAS 4 Update 3", etc.

Re:In Other Words

[Anonymous Coward]

Why don't you call yourself MSFeely

Microsoft quickly patched all of the critical vulnerabilities in Vista.

Yeah right, here is your list of denial-of-service zero-day vulnerabilities.


Internet Connection Sharing DoS
Days of Exposure
Vendor: Microsoft
Application: Windows
Severity: Medium
Date Disclosed: 10/28/2006
Days of Exposure:

237

Microsoft Office 2003 PPT Local DoS
Days of Exposure
Vendor: Microsoft
Application: PowerPoint
Severity: Medium
Date Disclosed: 10/12/2006
Days of Exposure:

253

RPC Memory Exhaustion
Days of Exposure
Vendor: Microsoft
Application: Windows
Severity: Low
Date Disclosed: 11/16/2005
Days of Exposure:

583

Re:In Other Words

[Churla]

Yes, exactly.

RHAS 4 Update 3 == SP for linux.

You can tell if when troubleshooting something you ask them "What SP/Update/Cluster Patch (for solaris) are you on?"

It's in how it's presented and perceived by the end users. Windows end users often don't want to see every little thing and every little fix. They want some big fix which hits on a regular schedule that they can install.

Re:In Other Words

[Anonymous Coward]

Because Low/Medium denial-of-service attack vectors are the most important to address.

DoS is simply not in the same realm as escalation or arbitrary execution vulnerabilities, and lord knows what you're fishing for here with this statement. BEcause it has nothign to do with with the post you are responding to about Critical vulnerabilities.

Vista is the youngest in the series

[Anonymous Coward]

So naturally his IQ is 3 points lower than his older brother XP.

Apparently the developers of Vista are following that trend too!

Re:Vista is the youngest in the series

[Anonymous Coward]

You're suggesting that Windows 1.0 has a higher IQ than Windows 2000? I think I just threw up in my mouth.

Re:Vista is the youngest in the series

[Anonymous Coward]

No, DOS 1.0 has the higher IQ.

Re:Vista is the youngest in the series

[feedmetrolls]

Wouldn't that make Windows 1.0 the smartest of all? Weird.

I know we slag them off...

[monk.e.boy]

I know our hobby is slagging of microsoft, but hey, copying Linux seems to be working out for them.

Oh, damn. My carefully crafted, pro microsoft reply, slipped into the usual M$ bashing. They are such an easy target. I can't help my self. Just like women drivers. I don't mean to joke at their expense, but sometimes the jokes, they slip out. I mean, I asked my girlfriend if my indicators were working and she said 'Yes. No. Yes. No.'

An oldie but a goldie. Feel free to use that one.

monk.e.boy

Re:I know we slag them off...

[Bacon Bits]

I mean, I asked my girlfriend if my indicators were working and she said 'Yes. No. Yes. No.'

An oldie but a goldie. Feel free to use that one.

A slashdot user with a girlfriend? That is a good joke.

Re:I know we slag them off...

[NotoriousBOG]

monk.e.boy: I mean, I asked my girlfriend if my indicators were working and she said 'Yes. No. Yes. No.' At least be honest. You don't have a girlfriend.

Vista flaws are not as critical as XP

[erroneus]

The simple fact is, there are still more XP loaded systems than Vista. Vista isn't yet a target except in areas where XP and Vista share the same flaw. ...I kinda hope it stays like that for a while too.

Talk about spin

[Anonymous Coward]

http://www.engadget.com/2007/06/22/report-vista-mo re-secure-than-os-x-and-linux/
An article on engadget that is pointing to the EXACT same data...yet the title there most certainly provides a seriously different outlook does it not? I do not blame anyone, however, as if I had seen an ACTUAL nuetral title along the lines of 'microsoft employee posts dubious data of questionable usefulness to anyone except PR departments' I would without doubt have just scrolled on...

Re:Talk about spin

[GrayCalx]

I do not blame anyone...

Wait wait wait... you mean you're not blaming Microsoft or the Government?!? What kind of slashdot poster are you?

So damned complex

[mulvane]

They have made the underlying security model so damned complex that it takes 6 months to figure out how to patch a bug/whole.

Re:So damned complex

[sweetlipsbutterhoney]

They have made the underlying security model so damned complex that it takes 6 months to figure out how to patch a bug/whole.

Microsoft engineers must be geniuses if they figured out how to patch something that is already "whole."

They are not security holes. They are the patents

[140Mandak262Jamuna]

Those 27 disclosed vulnerabilities cover some or all of the 237 patents that Microsoft has. Dont you dare fix any of them with a third party tool. You will be violating the patent rights of MSFT!

some one will eventually say it..

[MXPS]

so I might as well as say it, use linux.

Interesting

[ta bu shi da yu]

I wonder exactly what the data would be like if you compared vulnerabilities in 3rd-party software AND Microsoft issues vs. security problems in Linux distributions?

Re:Interesting

[DevStar]

Did you read the study? He attempts to control for this:

"Red Hat and other Linux distribution vendors add value to their workstation distributions by including and supporting many applications that don't have a comparable component on a Microsoft Windows operating system. It is a common objection to any Windows and Linux comparison that counting the "optional" applications against the Linux distribution is unfair, so I've completed an extra level of analysis to exclude component vulnerabilities that do not have comparable functionality shipping with a Windows OS. You may read Red Hat and Windows - Defining an Apples-to-Apples Workstation Build for more details, but basically I install a rhel4ws computer and:
  I exclude any component that is not installed by default, which includes all optional "server" components that ship with rhel4ws.
  I additionally exclude text-internet, graphics (the gimp stuff) and office (OpenOffice) and Development Tools (gcc, etc) installation groups.
  I use the rpm command to list out all packages that get installed and use that package list to filter vulnerabilities."

Re:Interesting

[ta bu shi da yu]

Control sounds dodgy.

Yawn

[Anonymous Coward]

Film at 11.

I, For One, Welcome

[Anonymous Coward]

Our new Botnet Overlords.

Cheers,
Kilgore Trout

Actual quote?

[sobachatina]

What I would like to know is what the guy actually said. The article starts by saying that half the BUGS were fixed and then starts talking about half of the vulnerabilities and then uses the two words interchangeably.

Did the guy say half the bugs or half the vulnerabilities? Half the vulnerabilities seems bad to me. Half the known bugs is not bad at all- in fact I would consider that somewhere around par for software development.

Either way I agree it sounds bad.

Re:Actual quote?

[ThinkFr33ly]

Then read the actual report: http://www.csoonline.com/pdf/6_Month_Vista_Vuln_Re port.pdf

It sounds bad because the person who posted it to Slashdot, and Slashdot's editors, want it to sounds bad. Are you new here or something?

Re:Actual quote?

[sobachatina]

Thanks for the link. That clears things up nicely.

While not exactly 'new here', I try to turn a blind eye to inflammatory contributions by the editors. I like Slashdot a lot and still hope that some day it will grow up and stop trying to make everything sound like a scandal just to get page hits.

Incidentally, in this case, the bad wording is actually from the article.

More Than Half of Known Vista Bugs are Unpatchable

[motumboe]

oh my!!!

Journalism?

[br14n420]

The little girl who got paid to write this article needs to keep doing whatever physical favors she is performing for the publisher to keep her job. Obviously, writing factual articles is not her cup of tea.

Vulnerabilities aren't bugs and bugs don't always get fixed. Note how nothing in her FUD-laden drivel there's nothing about anything actually impacting her. It's all about the things that don't affect her, she doesn't understand, and shouldn't be spewing forth on the internet in paid fashion.

Re:Journalism?

[Anonymous Coward]

Vulnerability = bug someone has figured how to exploit to circumvent normal execution privileges

I just love it when you astroturf.

[Anonymous Coward]

You are so good at it.

Vista has nothing I need

[PorkNutz]

I have tried Vista. The betas, a friend has a new machine with Vista. I even have a machine that is more than capable of running Vista. I just have no need for it.

It's not that it brings nothing new to the table, it just doesn't bring anything new that I need. The interface is pretty, but that alone is not worth the cost.

XP works for me. It does everything I need it to do, runs all the software I need it to run. Maybe in the future that will change, but seeing as I am only 6 months into my typical 2 year upgrade cycle, I don't see me needing Vista for at least another 18 months. Maybe by then it will have matured a bit and the vulnerabilities will be patched adequately. Then again, maybe XP will support the new tech that I will upgrade to, and I can milk this XP license a while longer

-----
Übergeek Necktie T-Shirt
Funny Shirts @ ProStoner.com

Is this the same guy who was bragging...

[jpellino]

About their patch time being 29 days to OSX's 46 and hundreds for linux?

Does this count all the secret fixes?

[argent]

Jones argued that Vista had a lower number of vulnerabilities than competitive operating system products such as Red Hat Enterprise Linux and Mac OS X.

Microsoft has acknowledged that they include secret undocumented patches in hotfixes, patches that would count against their "score" if they were required to count them... open source software doesn't have the luxury of hiding their dirty laundry like that. And it's not just Linux that suffers from that "disadvantage", OS X has an awful lot of open-source components, and many of Apple's updates have been patches rolled in from them.

Microsoft's gaming the system here. Statements like this should be granted no credibility.

Re:Does this count all the secret fixes?

[ThinkFr33ly]

Microsoft has acknowledged that they include secret undocumented patches in hotfixes, patches that would count against their "score" if they were required to count them... open source software doesn't have the luxury of hiding their dirty laundry like that. While I've certainly heard of Microsoft not disclosing the vulnerabilities until their patches are released, I've never heard of them patching things completely in secret. Do you have any citations to back that up?

And it's not just Linux that suffers from that "disadvantage", OS X has an awful lot of open-source components, and many of Apple's updates have been patches rolled in from them. It's interesting that you attack Microsoft for secrecy but say nothing about Apple, which is famous for its hostile attitude towards people who discover exploits as well as their secrecy about their patches are what they fix.

Microsoft's gaming the system here. Statements like this should be granted no credibility. Well, based on the evidence, the statement is true. Compare the vulnerabilities yourself. Find flaws in their reasoning. Poke holes in their report.

Re:Does this count all the secret fixes?

[Goaway]

Apple, which is famous for its hostile attitude towards people who discover exploits as well as their secrecy about their patches are what they fix.

Famous in Slashdot-land, maybe. In the real world, not so much. Perhaps you should start being a little more critical of what the internet tells you.

Re:Does this count all the secret fixes?

[argent]

While I've certainly heard of Microsoft not disclosing the vulnerabilities until their patches are released, I've never heard of them patching things completely in secret. Do you have any citations to back that up?

Skeletins in Microsoft's Patch-day Closet

It's interesting that you attack Microsoft for secrecy but say nothing about Apple, which is famous for its hostile attitude towards people who discover exploits as well as their secrecy about their patches are what they fix.

You seem to be under a misapprehension here. I'm not defending Apple. I'm simply pointing out that Microsoft has more ability to hide security flaws in their software than any company that uses a significant amount of open-source software, and thus they can artificially reduce their "score" in this game to a far greater extent than either of the other organizations mentioned by Jones. That is, regardless of Apple's motivations and actions, they are simply not capable of hiding patches as effectively as Microsoft.

So:

1. Microsoft has more ability to "game the system" than Red Hat, Apple, or any other organization using a significant amount of open-source software in their product.

2. Microsoft has acknowledged that they are engaged in gaming the system.

I would be happy to discuss Apple's past behavior in an appropriate context. In fact if you google around you'll find that I've been quite critical of Apple when I've felt it warranted. There's plenty of other skeletons in Microsoft's closet if you want to get into a fan war, but you'll have to find someone else for THAT debate... again, google around, you'll find I defend Microsoft when I believe it's warranted. Basically, I'm poorly equipped for the kind of debate that requires uncritical acceptance or dismissal of of one company's position on every subject.

Here and now, Microsoft's figures can not be accepted on face value. Unless Microsoft reveals ALL the details of the vulnerabilities they've corrected they can't be considered comparable to even Apple's figures with their heavy loading of open source software, let alone Red Hat's.

Re:Does this count all the secret fixes?

[motokochan]

And don't forget that without published detailed figures, any Linux distro can be made to look bad by counting security flaws in all packages they ship with (office suite, development tools, etc).

Simply pointing to raw numbers doesn't make a good or accurate comparison because the scope of items covered by the bugs listed for Windows and, say, RHEL, are different.

Re:Does this count all the secret fixes?

[ThinkFr33ly]

According to that ZDNet article, Microsoft did exactly what I described. They didn't release the details of the bug until they released the patch. But they did described those bugs in the bulletin for the patch release. In other words, they weren't secret, and they would be counted in the bug analysis.

Is it possible that Microsoft completely conceals bug fixes and never announces them, even after they are fixed? Sure. But there is no evidence of that.

As you said, it's true that it would be harder for open source to get away with this, but it's still possible. But I wouldn't claim it's happening unless I had evidence.

As a side note, I agree that Microsoft shouldn't only detail their bugs in their patch release bulletins. They should give basic summary information ahead of time. Not enough to give the baddies a chance to write exploits, but enough to let admins try and put protective measures in place to stop said baddies.

Re:Does this count all the secret fixes?

[argent]

They didn't release the details of the bug until they released the patch. But they did described those bugs in the bulletin for the patch release. In other words, they weren't secret, and they would be counted in the bug analysis.

Did you read it?

The summary said "This important update resolves two privately reported vulnerabilities in addition to other security issues identified during the course of the investigation."

The details describe two vulnerabilities. Not two vulnerabilities in addition to other security issues identified during the course of the investigation. Two vulnerabilities. If this was an open source project, the details of all the changes would be available in the source code control system and bug tracking database.

I agree that Microsoft shouldn't only detail their bugs in their patch release bulletins. They should give basic summary information ahead of time.

My point wasn't "Microsoft should have given details ahead of time". It was "Microsoft is able to count a smaller number of vulnerabilities because their release process is not public".

But I wouldn't claim it's happening unless I had evidence.

You have it right there. If this was an open source project, then the internally discovered vulnerabilities they fixed in this patch would have had to be counted as separate items. So this item was counted as "two items" for Microsoft, but would be counted as a higher number for Red Hat, and possibly for Apple as well. Therefore the numbers that Microsoft publishes are not directly comparable with anyone else's.

Re:Does this count all the secret fixes?

[ThinkFr33ly]

Ah, yes. You are correct. I misread the article.

I'd be interested to know how often this happens.

So, wait...

[kornkid606]

... who exactly is surprised by this? I mean, they could be not addressing the issues because the slow pickup of the OS or maybe due to some other patent issues, but the fact that M$ would push out a bugged OS and then not expediently address the bugs can't possibly surprise anyone. I would assume they just patch enough to keep the user base quiet and then figure "we'll get it right on the next one." Seems that many hardware and software developers have adopted this stance of instead of taking the time to refine and perfect one thing, they push out a bunch of crappier things in the hopes that they get it right on the next iteration. Infuriating!

Flawed Logic

[asphaltjesus]

First sentence is correct. Author didn't distinguish bug/vulernability.

The second sentence, while double-plus-good Microsoft PR speak, is critically flawed reasoning.

If the parent said "Known Vista vulnerabilities..." I would agree, but that still glides over many fundamental liabilities that Microsoft products push onto the customer like:
1. The concept of security in Microsoft products means protect Microsoft's intellectual property.
2. No one can reasonably predict the scope or scale of Microsoft vulnerabilities.
3. Given Microsoft's history of producing "secure" operating systems, it is reasonable to assume there is no evidence end-user security features makes it through to the end product. Note carefully, Microsoft has *very* talented programmers who can code securely after all their monopoly status affords them this luxury. I'm saying that their work doesn't make it all the way through the management gauntlet. UAC is a perfect example. It is not a security boundary. http://blogs.zdnet.com/security/?p=175

The Vista train will pull out of the station eventually because Microsoft's monopoly makes this a sure thing. As every other Microsoft OS has shown, there will be critical vulnerability surprises. It's a matter of when, not if.

Re:Flawed Logic

[ericrost]

"The Vista train will pull out of the station eventually because Microsoft's monopoly makes this a sure thing."

Windows ME.. cough.. cough...

Re:Flawed Logic

[Anonymous Coward]

Err... what? To summarise, you appear to be saying "Vista will be insecure because the MS track record says so"

Point 3 seems utterly irrelevant. The article appears to say that malware, etc. will simply be limited to the user account rather than running with full admin rights, and there _may_ be elevation vulnerabilities. Surely that's the point of UAC? To limit damage to the single user account its running under, just as in BSD, UN*X? Citing an article to justify your opinion, when all it contains is opinion? Is there any purpose to that? "This guy thinks the same as me, so I must be right"... hmmm...

virtually impossible to exploit

[hAckz0r]

Glad you set me straight on that one. I guess this means I woun't have to tell my office mate I 0wn3d his system late yesterday then. Didn't happen because that would be virtually impossible now wouldn't it? Must have just been my active imagination watching his reaction to his new Folding@home screensaver a minute ago. EAL4? Yea, right.

Bullshit meter: off the scale

[Anonymous Coward]

Care to give some details on what you did? I'm not going to hold my breath!

Re:Bullshit meter: off the scale

[hAckz0r]

Sorry, I can't do that in this forum, and certainly not for an 'Anonymous Coward' with an attitude. My employer has a very strict policy about going through the proper channels when it comes to these things and I kind of like my current job just the way it is. If you what to know the answer then go buy your own copy of IDA Pro and figure it out for yourself. It's really not that hard once you know what you are doing.

Windows ME is not an answer

[asphaltjesus]

One failed product does not damage a monopoly.

Re:Windows ME is not an answer

[ericrost]

No, but how about a string of them. Cairo, Longhorn... Win 95 was SUPPOSED to be Cairo, but all the features were stripped out before release and we ended up with a dressed up (and admittedly more stable) win 3.1 STILL on top of DOS. Then NT was supposed to be Cairo, but again, didn't make the cut. Then Win XP was supposed to be Cairo, but again, same story. Then they shifted to talk to Longhorn.... you can connect the dots. Microsoft has been selling vaporware to catch up with competitors for 20 years now. Wake up. http://www.roughlydrafted.com/RD/Q4.06/4E2A8848-57 38-45B1-A659-AD7473899D7D.html

Blame the source, which was not hard enough.

[twitter]

No, this is not Slashdot spin. It's a direct report of the original source, Security World:

A Microsoft Corp. security executive released data Thursday showing that, six months after shipping Windows Vista, his company has left more publicly disclosed Vista bugs unpatched than it did with Windows XP.

So that's the journalist's opinion.

You can also note the direct carry over of M$'s laughable position that Vista is doing better than XP. Windoze has never been and never will be a safe and secure place for your data and this shows, even if you accept the M$ numbers. They've wasted all their effort making life suck for the end user with digital restrictions and competitor sabotage instead of addressing fundamental security issues. Vista is more of the same from a company that does not care and lies through it's teeth about it every time. There can't be more than fifty people in the world ready to believe Vista is going to be any better than any other version of Windoze.

Re:Blame the source, which was not hard enough.

[SparkyFlooner]

My Fedora install downloads 2 or 3 security patches a week for various packages.

My college roommate, who was a linux sysadmin, had his linux box hacked - someone gained root access. How skilled he was at locking down a machine isn't really relevant. Were Linux to become mainstream tomorrow, the vast majority of people using it still wouldn't know half as much as he did about locking down a machine. (Also, people would start targeting Linux machines...)

Also, I've never had a virus on any of my 'Windoze' machines. ....why should I run screaming from Windows again? It seems I'd have pretty much the same worries were I to switch to Linux.

Re:Blame the source, which was not hard enough.

[farrellj]

Actually, Linux *is* mainstream today!

Based upon the latest figures from NetCraft.

Over half of the Webservers on the Net today run Apache, and the vast majority are hosted on Linux systems...so Let's be conservativer and say only half of the 53% of the systems running Apache are on Linux, that would give Linux a share, on the low end, of 26.5%. Add into that, lighttpd which runs mostly on Linux, which has 1.2%...so on the low end of the estimate Linux runs at least 27% of the web servers on the Net, and if we estimate something like 2/3rds of the Apache systems are running Linux, we get a high end of maybe 36%.

Microsoft, on the other hand has a share of almost 32%. So, if an OS has a share that is about the same as Microsoft's, wouldn't you say that is Mainstream?

As well, Linux's security model is based upon that of Unix. Unix had around 25 years of experience with with security when Linux came along. And Linux has had a over decade and a half of experience above that. Windows current security model only came into being with Windows NT, which came out just after Linux. NT's security model is probably better than Vista's. The hooks between IE and the kernel were not there, and that is what makes Win XP and it's offspring less secure.

ttyl

Re:Blame the source, which was not hard enough.

[SparkyFlooner]

I meant as a workstation OS (which, obviously, Windows dominates).

Obviously server system administrators aren't moms and dads checking email, browsing the web, and opening and installing anything and everything they can.

Re:Blame the source, which was not hard enough.

[Allador]

Windows current security model only came into being with Windows NT, which came out just after Linux. The NT security model is basically a variation of the VMS security model. It's not new.

NT's security model is probably better than Vista's. The hooks between IE and the kernel were not there, and that is what makes Win XP and it's offspring less secure. I'm not even sure what this means. Vista IS NT.

And what hooks are you talking about? IE has no magical hook into the kernel. IE simply leverages system DLLs for various utility functions. But since the DLL is called from iexplore.exe (which is running in userspace), the DLL runs under that process' privileges.

There's no magical back-channel between IE and the NT Kernel. IE is just another userspace application. The only real difference is that it has library dependencies on system DLLs, same as many, many other MS and non-MS applications on the market.

In fact, by default, IE on Vista runs in protected mode, which means its running with significantly LESS privileges than a non-privileged user. It cant write to anywhere in the OS except its own cache, etc.

Vista is marketed as secure, was XP?

[BobMcD]

Hindsight is getting blurry, but I seem to remember the world seeing XP as simply an 'upgrade' to 2000. People expected it to have vulnerabilities, be buggy, etc, but wanted the newness of it.

Vista was _supposed_ to be a total rewrite. A completely new animal, basically immune to XP's flaws.

Patching a ton of vulnerabilities right out of the gate would invalidate a TON of marketing effort.

Seems like not patching them (in public) is a good business decision for them. Not so very ethical, but it _IS_ MicroShaft we're talking about here.

Re:Vista is marketed as secure, was XP?

[binkzz]

XP was extensively advertised as the most secure, reliable and stable windows OS so far. It even says so when you install it.

No surprise there

[hAckz0r]

Their GDI privilege escalation (non-bug, non-vulnerability, buried topic, never mentioned anywhere at MS) started with NT 4.0 and was not "patched" until the GDI was rewritten for Vista. It was never "patched" because the design was fundamentally broken and could not be patched in any practical way. All you needed to exploit it was to get some application running at the SYSTEM privilege level to create and display a window and then the system was toast. Vista finally made the GDI just as secure as NT 3.5. Things are improving, No?

Re:No surprise there

[Anonymous Coward]

Er, that would be USER, not GDI. And it's not a buried topic, it's a basic principle of programming Windows.

There are always rules for secure coding. For example, on UNIX, applications running as root shouldn't offer shell escapes. In the same way, on Windows, services shouldn't create windows (and that' little "allow service to interact with the desktop" box shouldn't be checked).

Don't get me wrong, it "the desktop is the security boundary" isn't a great feature, to put it mildly - it's caught out many newbie programmers. But it's wrong to say it's a buried topic or has anything to do with GDI.

Where is the 12 out of 27 number coming from?

[figleaf]

There is no mention of 27 disclosed vulnerabilities in the report or on secunia.
Did someone make up the numbers so that it can be posted on Slashdot? ;)

Re:Where is the 12 out of 27 number coming from?

[figleaf]

Here is the original report http://blogs.csoonline.com/windows_vista_6_month_v ulnerability_report
and the secunia link for Vista : http://secunia.com/product/13223/?task=statistics

Not the article I read.

[twitter]

The article I read trashed M$'s sorry analysis and told me to expect more of the same from Vista as we've seen with every other M$ OS:

He published the data in an effort to show how Microsoft's software development methodology, called the Security Development Lifecycle (SDL) is yielding dividends. But his method of comparing Windows to Linux and Mac OS X is problematic, according to some.

"This is an apples-to-oranges comparison," said HD Moore, one of the hackers behind the popular Metasploit penetration testing toolkit. "If you want a more accurate view, try comparing the number of flaws between Microsoft-developed software and vendor-X-developed software. Most Linux vendors don't actually write the majority of the packages they include," he said via e-mail.

"Alternatively, force Microsoft to include all vulnerabilities in common third-party software," he added. "For example, the thousands of exploitable ActiveX controls that... vendors include with a Windows system."

So, the end user experience is likely to be unchanged, if they can even get Vista to work. As is always the case for a new Windoze release, the drivers are not there. Worse, new digital restrictions schemes make for poor performance even if they do get work. "Trip bits" and other nonsense make Vista a poor performer by design.

Re:Not the article I read.

[dedazo]

The article you read, is it the one that fails to make a distinction between a bug and a vulnerability? Because that's the one I read. Oh, wait. We're in the Spin Zone. Sorry. Um, "M$ Windoze suxxorz LOLOLZ LINUX ROXXORZ!!!one!!!1!" There, that sounds about right. Facts and reality are so annoying and distracting anyway. Who needs them.

Nothing has changed, that's news.

[twitter]

I would expect that when Vista deployments outnumber XP, the situation will reverse itself. So where's the story here?

Even if you buy the demonstrably false "popularity argument" for poor M$ performance, the real story here is that nothing has changed for the user.

Bottom line: M$ experience sucks.

[twitter]

the fact that your Macs have never been compromised (that you know of) to the their actual security. This is an invalid equation.

The fact that only M$ machines get screwed and die along with your work is a good reason to avoid the platform.

Re:Bottom line: M$ experience sucks.

[drinkypoo]

The fact that only M$ machines get screwed and die along with your work is a good reason to avoid the platform.

That, my friend, is a bunch of fucking bullshit.

I have a Dual G5 to my right. It is now running 10.4.10. At least under 10.3.whatever and 10.4.whatever-before-10 (

I also run on Linux and, I have to say, it still has problems resuming from the fucking screensaver if I close the lid. PATHETIC. Sometimes I can fix it by logging in remotely and killing the screensaver process[es]. Sometimes I have to log in remotely and kill X. If networking is not configured, I often have to power-cycle. Consequently I don't close the lid much.

Windows may be the worst OS around - I have tons of Windows stories that make these a bit basis for lullaby lyrics. But it's not the only OS with problems that cause grief, and anyone who claims it is is full of shit.

Re:Bottom line: M$ experience sucks.

[morgan_greywolf]

Notice how he doesn't say that he has any grief with Mac OS X. That's because Mac OS X is the height of perfection. Apple is such a great company that they produce what is quite possibly the world's most perfect OS. Look at the iPod! It's so simple and elegant, and that's exactly what Mac OS X is. Operating system perfection. Never had a lick of trouble with it.

I worship the Great Black Turtlenecked One! Ohhhmmmmmmmmmm!

Re:Bottom line: M$ experience sucks.

[drinkypoo]

Notice how he doesn't say that he has any grief with Mac OS X.

Do you mean me or the guy before me? Because I actually wrote a whole paragraph about how the OSX machine is crapping on me on a regular basis, and then apparently I lost it somehow. Probably I accidentally selected text and typed over it, but maybe it's a black turtleneck conspiracy. Can't blame it on Apple directly though, because I slashdot from Firefox on Ubuntu.

Re:Bottom line: M$ experience sucks.

[morgan_greywolf]

Heh. I was parodying Apple zealots in general. I knew your post wasn't a Mac fanboy post based on what I've seen you post in the past.

Re:Bottom line: M$ experience sucks.

[SageMusings]

Why are there so many sites devoted to diagnosing and fixing iPod issues? I recently had to turn to one myself when my iPod stopped playing iTunes-purchased music.

Perfection?

I am amazed at how many seemingly educated people worship at any alter, whether MS or Apple. Stop drinking the cool-aid, guys.

Two steps forward, one step back.

[fahrbot-bot]

My guess is that it may be harder to fix things in Vista without breaking something else (like DRM functions) ...

Interesting quote

[edxwelch]

Jeff Jones was further quoting saying that there was no need to patch vunerabilities in Vista, because "nobody uses it anyway."

Alternate headline:Vista more secure than OSX/Linu

[I'm Don Giovanni]

I find it fascinating that Engadget's headline on this very same story is:
Report: Vista more secure than OS X and Linux

Way to spin, slashdot!!

Slower adoption = fewer bugs found?

[sherriw]

I was under the impression that Vista sales are really low. And I can hazard a guess that those with Vista are so busy trying to get their old hardware and software to work, that they are unsure whether a bug is a real bug or a run of the mill compatibility problem.

So, I wouldn't be surprised that the number of bugs reported is lower than usual. Wait till the use of Vista grows- then the anti-MS hackers will start really pounding Vista.

Re:Slower adoption = fewer bugs found?

[secPM_MS]

From the data we have available, it appears that Vista has significantly reduced numbers of and severity of vulnerabilities compared to XP. Knowing what we did in Vista compared to XP, this is not surprising. Looking at the bulletin data, there seems to be at least a 2 fold reduction in issues. I would note that it is far easier to run in a safer default configuration in Vista than it is in XP, making such users all the more safer -- I am writing this from a notebook where I am running a LongHorn beta build as a normal user (my user account does not have administrative privledges). I also have IE7 in locked down mode and am not running IM or sidebar gadgets (reducing my attack surface). I am running Office 12, which has been greatly hardened with respect to Office 11 (At this point I believe that Office 12 is significantly less vulnerable to exploit than current versions of Open Office).

As a side effect of the OS hardening effort, we are seeing attacks move up the stack, as the applications are softer. Hence my use of Office 12. Softest of all targets is the wetware at the top of the stack -- it is vulnerable to social engineering.

Re:Slower adoption = fewer bugs found?

[I'm Don Giovanni]

Softest of all targets is the wetware at the top of the stack -- it is vulnerable to social engineering.

Well, that depends on the wetware in question. ;) For lots of people, the wetware is probably the hardest of all targets, not the softest.

Swing and a miss

[Anonymous Coward]

I know this is Slashdot and all, but shit, could the title be any more biased? So Vista has some known outstanding non-critical security bugs hanging out there. So what? Microsoft doesn't rush fixes for those kinds of bugs because they are generally difficult to exploit, or require the system to already be exploited. This bugs wait until a service pack, generally, which goes through a much stricter testing regimen than a high priority fix.

This is a GOOD thing. It means that Vista is overall more secure than Windows XP because Microsoft hasn't had to rush critical fixes and can take the time to study and test the less critical fixes.

But shit, this is Slashdot, so, uh, fuck M$ final nail coffin losers going down don't need it, yadda yadda yadda and so forth.

Relying on your Media Access Control

[Anonymous Coward]

for security is dumb. Any script kiddy these days can sniff them out of the air and spoof away. Please see http://en.wikipedia.org/wiki/Media_Access_Control before sprouting more about your MAC!

Re:Alternate headline:Vista more secure than OSX/L

[wanderingknight]

You should note that the chart, for Linux/OS X, covers not only OS-level vulnerabilities, but app-vulnerabilities, too. All in all, I find it an apples-to-oranges comparison, even more keeping in mind that the chart covers known and fixed bugs during the first 6 months of each OS after their respective release dates.

Paraphrasing a comment in Endgaget... Can someone grab me a copy of Windows XP: Jeff Jones edition? It looks much better than the public builds ;)

DUHH!!

[jhutchens]

....and Microsoft wonders why people are resistant to switching to vista.

Woops, bad formating.

[twitter]

The article I read trashed M$'s sorry analysis and told me to expect more of the same from Vista as we've seen with every other M$ OS. M$ again counts things incorrectly and fails to include all the problem children their sorry architecture encourages along with the gaping flaws they produce themselves:

He published the data in an effort to show how Microsoft's software development methodology, called the Security Development Lifecycle (SDL) is yielding dividends. But his method of comparing Windows to Linux and Mac OS X is problematic, according to some.

"This is an apples-to-oranges comparison," said HD Moore, one of the hackers behind the popular Metasploit penetration testing toolkit. "If you want a more accurate view, try comparing the number of flaws between Microsoft-developed software and vendor-X-developed software. Most Linux vendors don't actually write the majority of the packages they include," he said via e-mail.

"Alternatively, force Microsoft to include all vulnerabilities in common third-party software," he added. "For example, the thousands of exploitable ActiveX controls that... vendors include with a Windows system."

So, the end user experience is likely to be unchanged, if they can even get Vista to work. As is always the case for a new Windoze release, the drivers are not there. Worse, new digital restrictions schemes make for poor performance even if they do get work. "Trip bits" and other nonsense make Vista a poor performer by design.

only 25% fewer bugs in 1-6 mon? Most secure OS?

[Locutus]

If they continue to produce 'new' operating systems every 5 years with only a 25% better bug/vulnerability rate, just how long will it be before Bill Gates' statement of Windows Vista being "the most secure OS available" will actually become a publicly accepted true? I had to state it as "publicly accepted truth" since Microsofts version of the law, contracts, and truth are very different from what the general population understands and accepts as such.

Too bad the severities weren't listed but then again, we already know Microsoft seems to think the fact that an exploit can be spread via network is more important than data corruption/loss. You know, saving face is more important than the customer.

LoB

I'm not trolling...

[Anonymous Coward]

but could you please post a reference to these mac vulnerabilities? I'm a mac user, and I would love to know about them.

Thank you.

MOD PARENT UP!

[Futurepower(R)]

Mod parent up!!! Good point about Microsoft management. In my opinion, Microsoft programmers are not allowed to finish their work.

My rule number one in dealing with Microsoft: Unless forced by circumstances, never upgrade to a new version of Windows until the second service pack is released. Let other people have the grief.

The huge number of bugs in Windows XP before SP2 was very expensive for us. If I remember correctly, SP2 fixed more than 630 bugs, and some of the fixes were not documented. It is not only the vulnerabilities that are expensive.

Re:Alternate headline:Vista more secure than OSX/L

[wanderingknight]

Silly me, when I said "app-vulnerabilities" I meant "BUNDLED app-vulnerabilities"...

More Than Half of Known Vista Bugs are Unpatched

[dougdonovan]

More Than Half of Known Vista Bugs are Unpatched more than half of known vehicle drivers are drunk driving a vehicle right now, happy friday!

Vista is secure. The user isn't.

[Opportunist]

Repeat after me. Vista is secure. Vista is secure...

Vista is secure as long as the user doesn't "allow" anything bad to happen. The idea alone is a security risk in the making. Of course no security hole is "critical" as long as there's the omnipresent popup before it happens to affect your PC. Because then it's the user's fault. YOU clicked "allow", YOU are to blame.

It's pretty easy to say that. It would be akin to asking every time an executable starts to run whether the user really wants it to run, and blame the user when it does something unexpected or unwanted. But based on the "allow or deny" dialog, the user cannot make a qualified decision. Not even if he DID actually know what he's doing. He only gets information about what program (ok, without checking google, what's hidsrv? The program name usually doesn't tell people jack about the program. How many viruses exist that call themselves akin to a system executable?) tries to do something (with a cryptic information about its requested privileges, that basically only tell you what could be going down if you did know a thing or two about Windows and its inner workings).

Basing the security model on the user is very convenient for the system maker, but it is not the right approach. Especially not in an environment where the strict distinction between user space and system space did not exist for a long, long time.

But that's not the point this time. This time, we have "uncritical" system flaws. Which are only uncritical because they can be blamed easily on the user if they're exploited.

Re:Vista is secure. The user isn't.

[MadMidnightBomber]

Vista is secure as long as the user doesn't "allow" anything bad to happen. The idea alone is a security risk in the making. Of course no security hole is "critical" as long as there's the omnipresent popup before it happens to affect your PC. Because then it's the user's fault. YOU clicked "allow", YOU are to blame.

Whereas Linux stops the user from running trojans or doing anything else bad? I don't think so.

Vista has made major improvements in security with things like ASLR and it is harder to exploit what would have been wide-open vulnerabilities under XP. I'm not saying I like it, because I spend 95% of my time in Ubuntu on this dual-boot laptop, but it is on a par with a standard Linux security-wise these days. And that means they're not bad out of the box, but a bad admin can f*ck either up.

Personally, I'm paranoid and I have a better idea of what Linux is doing - therefore I choose Linux, but Vista is a major improvement over XP. Security-wise that is; the usability sucks donkey dick, but hey, it's a point oh release.

Re:Vista is secure. The user isn't.

[Opportunist]

With a clueless clickmonkey on the helm, any system is insecure. System security is by its very definition the minimum of system security and user security knowledge. The problem is that we want users to make decisions they simply cannot make, since most of them lack the information necessary to make such a decision.

Don't get me wrong...

[WWMPCDD]

I'm a Linux-only user. According to Secunia, for unpatched vulnerabilities: Windows Vista: 2 of 10; most severe being Not Critical. Windows XP Home Edition: 27 of 170; most severe being Highly Critical. Linux Kernel 2.6.x: 16 of 123; most severe being Moderately Critical.

Apples and..?

[Quantam]

Wow. There's a statistic in that article that really leaves an impression, and no, it's not 36/39 vs 12/27; it's 23 vs 1 - the number of severe security holes in XP and Vista found in the first six months. That brings up a few questions, like whether these metrics are the same (one person brought up the question of secret, unannounced fixes, another the issue of the number of people looking for problems). But if these numbers are comparable (heck, even if the Vista number is 3 or 4 times lower than is realistic), that's a huge improvement in Windows security, and an effort on MS' part worth applauding.

For your pleasure, a car analogy

[Anonymous Coward]

Because our new model car has an increased number of airbags, it don't matter that the brakes don't work that well.

Because our new model car uses a more efficient engine, it don't matter that the fuel tank leaks a bit.

But are all bugs the same, does this mean vista in insecure.

Well, let me use the humble car again. If you bought a new car, and found that the passengers sunflap mirror was broken, would you accept it?

MS really needs to start understanding that people just want their products to work. They don't wanna hear 2nd hand car dealer stories about how nobody used their front brakes anyway, not if they are paying new OS prices. Vista is the most expensive consumer OS so far, so why the fuck can't MS, a company with billions in profit, fix known flaws.

I as a consumer don't know if these flaws are serious or not, but MS attitude sure as hell don't convince me to risk it.

remember the story yesterday about MS almost begging people to use Vista and not wait to SP1? This is going to convince the doubters?

Some exploit details from Secunia

[einnar2000]

http://secunia.com/product/13223/?task=statistics Their numbers don't match the original articles numbers though. I'm sure there are others out there that report exploits, but this is the one I had bookmarked and could quickly share.

Security Development Lifecycle???

[Futurepower(R)]

Vista has something called a "Security Development Lifecycle".

Where there is "Life" there is death. Talking about a "Lifecycle" gives the impression that Microsoft's real interest is death. I'm guessing it is a mostly management policy to give a shorter "life" to Windows Vista than customers want.

Bill Gates is software's Dr. Death. It doesn't matter what the customer wants; Bill Gates, the richest man in the world, wants more money, and will drag everyone through his neurosis.

Sometimes it has seemed to me that Microsoft is not really primarily a software company, but primarily an abuse company that accomplishes abuse through software.

This comment has a "Comment Development Lifecycle". Management policy is that you cannot read it more than an hour after it is posted. However, since I'm a cooperative person, and not adversarial, and since I don't have a virtual monopoly, you are welcome to read it any time you like.

Also, when this comment is posted, it will have the title "Security Development Lifecycle???" However, after it has been posted for a time to be determined by management, the title will be changed in an attempt to make people think that it is an entirely new comment, instead of merely a new version.

Fallacy

[Anonymous Coward]

You sir should think before you post.
You might want to follow your own advice.

That goes for you too!

You're committing a logical fallacy in your post. You equate the fact that your Macs have never been compromised (that you know of) to the their actual security. This is an invalid equation.

I don't think this qualifies as an "invalid equation." Maybe if he was trying to say that a Mac is a PC, or that OSX is Vista, that would be an invalid equation.

What you are thinking of sounds much more like the fallacy of "affirming the consequent." Specifically:

If my OS is secure, then it will never be hacked.
My OS has never been hacked.
Therefore, my OS is secure.

Though the first premise may or may not be weak on its own grounds, the argument is formally invalid. In your post you even go on to demonstrate cases in which an insecure OS may never be hacked. This is the traditional means of demonstrating the formaly invalidity of the fallacy of "affirming the consequent."

Sounds like you had the right idea, but you mis-identified the fallacy in question. If you are going to serve as a logician, doing it properly will avoid some embarrassment.

Unpatched Bugs?

[Eradicator2k3]

Actually, ALL of Vista's bugs are unpatched. If they were patched, they wouldn't be bugs any more, right?

Still, it's better than Lunix and OSX

[Anonymous Coward]

Since both Lunix and OSX live and breathe the Kool-Aide that they have no flaws in their OS, they have fixed practially none of their documented bugs.

Every month is a MOAB, it's just that Apple's users don't know it.

Viva la security through obscurity!

additionally...

[twoboxen]

...less than 5% of Vista's bugs are known.

Re:additionally...

[NotSoSuperMario]

You're kidding, right? "They say no one sees them and lives to tell about it."

Care to compare CIS Tool 1.x scores anyone?

[Anonymous Coward]

http://forums.techpowerup.com/showthread.php?s=e4d 36eb2396773f558df8271fadcadf5&p=365996#post365996

That's a post showing an 84.735 score, using CIS Tool 1.x (highest I can get as of today) & methods I outline to achieve it, for Windows 2000/XP/Server 2003/VISTA users:

http://img.techpowerup.org/070618/APK14SecurityPoi ntsCISToolResult84735.jpg

That result was done using a tool I know of that runs across multiple platforms for a test of security online in CIS Tool 1.x (center for internet security)!

CIS Tool:

http://www.cisecurity.org/index.html

(& this test is the "scientific control method" in that it is the SAME test used across diff. OS/hardware platforms here)

CIS Tool runs on Linux, BSD (no MacOS X though), Solaris etc. et al (various *NIX variants), & Windows. Java runtimes are required (they were recently updated mind you, by SUN Microsystems).

Thing is, I have freely challenged Linux folks to run that test here & beat the score I had, shown above, here:

http://linux.sys-con.com/read/382946_f.htm

No takers, or rather, no respondents with scores exceeding mine on Windows Server 2003 SP #2 fully patched as of the date of the test I took it & yes, today.

They did suggest BSD - so I posted in regards to testing BSD vs. my score here, at slashdot:

http://bsd.slashdot.org/comments.pl?sid=238993&cid =19578849

Again, no takers (could be here though, it was buried too deep, slashdot's replies/forums system is way odd imo, by comparison to boards like this one imo, not as clean/easy to use/etc.).

Still, even from the "BSD" family (which is often noted to be the MOST SECURE UNIX etc., even by Linux folks (see the LINUX.SYS-CON.COM url above)), no takers.

All I know is this - I hear a lot of "Windows is insecure & (insert UNIX variant here) is more secure" etc. ... & yet, when it comes time to "put your money where your mouth is", on a test that runs across multiple OS platforms?

Nobody from the *NIX world has ever done so when I have asked them to try it @ least!

(& the test is sort of nerdy fun, you learn from it too, because it aids in securing yourself online).

And, the 14 points in the 1st URL above? For Windows NT-based OS like 2000/XP/Server 2003, & YES, VISTA??

They work!

(... & even *NIX folks agree many times they do)

I would like to see your scores here in fact, & IF you can exceed my score? We can all learn by it, & grow, as well as have a healthy competition in doing so!

Thanks! Any takers??

APK

Bill Gates Screwed GNU/Linux through ACPI. So?

[twitter]

I also run on Linux and, I have to say, it still has problems resuming from the fucking screensaver if I close the lid. PATHETIC. Sometimes I can fix it by logging in remotely and killing the screensaver process[es]. Sometimes I have to log in remotely and kill X. If networking is not configured, I often have to power-cycle. Consequently I don't close the lid much.

It's a shame, but ACPI was intentionally sabotaged by M$. It's hit and miss, but the same machine won't do much better under M$ because their other software can't deal with power management and uptimes blow anyway. APM works well and is more like power management should be, so use it if your laptop has it by the kernel options "noacpi acpi=off".

Of course, this has nothing to do with any kind of security. You are not going to become part of the botnet and your data will survive power cycling, especially if you use a journalling file system like ext3.

Re:Bill Gates Screwed GNU/Linux through ACPI. So?

[dedazo]

ACPI was intentionally sabotaged

You linking to that post is hilarious. You figure no one will notice this reply and the subsequent ones in that thread?

bugs or vulnerabilities?

[swordgeek]

Neither /. nor the original article seem to understand that not all bugs are security vulnerabilities. Is it the case that more than half the known BUGS in Vista are unpatched, or less than half the known SECURITY BUGS are unpatched?

Potentially huge difference.

only half?

[Anonymous Coward]

Wouldn't pretty much all known bugs be unpatched? I mean, once it's been patched, is it really still a known bug?

Re:Bill Gates Screwed GNU/Linux through ACPI. So?

[twitter]

You linking to that post is hilarious. You figure no one will notice this reply

I'm not afraid of that BS. People can read as much or as little of that troll infested thread as they like. Most people won't bother to read past the memo written by Bill Gates himself, as the intent is obvious. No one will tell you that ACPI is rationally designed and anyone who's read the memo knows why. Ultimately, the crap flood that follows me is just another sign of how desperately afraid of the truth and popular opinion M$ is. It's too bad they don't just fix their broken junk instead of pretending it's fixed while screwing over their competition in ways that waste everyone's time.

Re:Bill Gates Screwed GNU/Linux through ACPI. So?

[dedazo]

Most people won't bother to read past the memo written by Bill Gates himself

Of course therein lies your problem. If "most people" are like that then they're really no better than you. If they're not, then you're screwed because your FUD is exposed. Sucks either way.

Trolls?

[Anonymous Coward]

People can read as much or as little of that troll infested thread as they like

That thread looks like a bunch of people correcting your lies. Does that make them trolls?

no, not at all.

[twitter]

full time M$ defender and attack bot dedazo insists on arguing that Bill Gates has nothing to do with ACPI being a piece of shit that does not work well for anyone:

Of course therein lies your problem. If "most people" are like that then they're really no better than you. If they're not, then you're screwed because your FUD is exposed. Sucks either way.

If they read further in they run into posts by others complaining of the complexity of ACPI and how it's just another M$ "extensible" non standard. Between that and Bill Gate's little memo, the reasons for ACPI to suck are obvious. As he stated himself, he did not want Linux to work.

Re:no, not at all.

[dedazo]

Like I said, everyone can read posts and make up their own minds. That's the beauty of Slashdot, isn't it?

Wow! So many posts in defense of Vista!

[Anonymous Coward]

Do you work for Microsoft, or are you just one of those clueless gits who blew his trustfund on utterly worthless MS-certification and now spends all his time trying to justify it?

Does it matter?

[Anonymous Coward]

But no one is exploiting the rest 15 ;)

what about the too-dumb-for-words glitches?

[grikdog]

Screw security, what about a Vista that works in non-laboratory conditions, that is to say, in laboratory (and office, home, etc.) conditions? We do we still have users who are forced to reboot before logging in, to avoid the braindead "user profile error" that repairs itself every single time by rebooting!? I would really like to see Microsoft Q.A. people forced to take Real World Certification administered by a consortium of academics, government entities and businesses before they are allowed to sign off on any Microsoft release whatsoever.

Vista is just a Beta product

[pubwvj]

What fun. And just the other day someone complained that Apple's _BETA_ Safari 3.0 for Windows contained a couple of bugs, which Apple IMMEDIATELY patched. At least Apple acknowledges and fixes their errors in their beta software. Microsoft just releases the beta software as final product and then pretends everything is hunky-dory. Maybe they'll release a patch at the end of the year.

Windows Vista the Most Secure Operating System

[thisispurefud]

The results of the analysis show that Windows Vista continues to show a trend of fewer total and fewer High severity vulnerabilities at the 6 month mark compared to its predecessor product Windows XP and compared to other modern competitive workstation OSes linux and Mac OS X