Slashdot Mirror

← Back to Stories (view on slashdot.org)

More Than Half of Known Vista Bugs are Unpatched

Posted by Zonk on from the bugtracker-is-half-empty-attitude dept.

MsManhattan writes "Microsoft security executive Jeff Jones has disclosed that in the first six months of Vista's release, the company has patched fewer than half of the operating system's known bugs. Microsoft has fixed only 12 of 27 reported Vista vulnerabilities whereas it patched 36 of 39 known bugs in Windows XP in the first six months following its release. Jones says that's because "Windows Vista continues to show a trend of fewer total and fewer high-severity vulnerabilities at the six month mark compared to ... Windows XP," but he did not address the 15 unpatched flaws."

8 of 257 comments (clear)

  1. Why would you ever..... by otacon · · Score: 3, Insightful

    announce something like that? That's not exactly the best PR for Vista. Then again Vista isn't exactly good PR for Microsoft.

    --
    In a world of acronyms, the words are the real victims.
    1. Re:Why would you ever..... by ThinkFr33ly · · Score: 5, Insightful

      Well, they didn't.

      If you RTFA, you'll see that Vista's unpatched vulnerabilities are not considered "critical" because, thanks to Vista's improved security model, are virtually impossible to exploit.

      Slashdot actually managed to spin a highly positive analysis of Vista into something that suggests Vista is not only worse than XP, but Microsoft is somehow going out of its way *not* to fix it.

      Gotta love it. Slashdot is the GOP of technology news sites.

    2. Re:Why would you ever..... by ThinkFr33ly · · Score: 4, Insightful

      And I think you'll see that thanks to my new and improved door lock, the fact that I leave my windows unlatched is not a critical security issue. What a completely nonsensical and inaccurate comparison. Microsoft's Secure Development Lifecycle has almost certainly dramatically improved the quality of their code. This report, plus 3rd party counts of vulnerabilities, support this conclusion.

      But no matter how good your code is, things will be missed. That's the point of having things like Address Space Layout Randomization, IE 7 Protected Mode, Session 0 Isolation, and the dozens of other security layers that Microsoft added to Vista.

      Furthermore, being rated non-critical can often mean that it requires significant user action (like turning off multiple security features) in order to make a user vulnerable.

      What's next, are you going to blame Microsoft when a user smacks their motherboard with a hammer?

      The fact of the matter is, that at least so far, Vista is proving to be the most secure OS on the market. (Aside from perhaps OpenBSD, of course. :) If you have data that suggests otherwise, then provide it.

      Otherwise, keep your silly analogies to yourself.
    3. Re:Why would you ever..... by ThinkFr33ly · · Score: 3, Insightful

      You sir should think before you post. You might want to follow your own advice.

      You're committing a logical fallacy in your post. You equate the fact that your Macs have never been compromised (that you know of) to the their actual security. This is an invalid equation.

      I could write a piece of software that had a 1000 known critical security vulnerabilities, but it might never get hacked. Does that then mean that my software is secure? Of course not.

      Factors that contribute to whether or not something gets compromised include the number of vulnerabilities in the code, but it's not limited to just that. Usage is a big factor. In the cause of my buggy piece of software, if I'm the only one who uses it, it's unlikely to be a target.

      Similarly, Mac OS X is used by far fewer people than XP. And, as of April, Vista was used by about 50% as many people as use Mac OS X. Change are, Vista is now used by more people than Mac OS X. So a direct comparison is now at least more valid.

      Macs have had far more known vulnerabilities than Vista, and even than XP in recent years. That's an objective fact. A fact that can't be changed by how much Steve Jobs coolaid you drink.
    4. Re:Why would you ever..... by Enrique1218 · · Score: 3, Insightful

      OSX has more vulnerabilities than XP or Vista. Where do you get that number? Please publish the links to at least 3 source of said number. I am just curious. This being slashdot and all. I am befuddled how so many haven't mastered citing a reference.

      --
      You don't have to be smart to use a Mac, you just have to be smart enough to buy one
  2. Simple Explanation by Aqua_boy17 · · Score: 3, Insightful
    From TFA:

    "it will be more interesting to look at vulnerability statistics once Vista becomes more popular than XP, and the target of more hackers."
    I for one am glad Microsoft releases fixes for XP problems in a more timely fashion than Vista. I would expect that when Vista deployments outnumber XP, the situation will reverse itself. So where's the story here?
    --
    What if the Hokey Pokey really is what it's all about?
  3. In Other Words by camperdave · · Score: 5, Insightful

    Jones says that's because "Windows Vista continues to show a trend of fewer total and fewer high-severity vulnerabilities at the six month mark compared to ... Windows XP,"

    So, they're not fixing the bugs because Vista is less buggy than XP? Whatever happened to fixing it because it was broken?

    --
    When our name is on the back of your car, we're behind you all the way!
  4. Does this count all the secret fixes? by argent · · Score: 3, Insightful

    Jones argued that Vista had a lower number of vulnerabilities than competitive operating system products such as Red Hat Enterprise Linux and Mac OS X.

    Microsoft has acknowledged that they include secret undocumented patches in hotfixes, patches that would count against their "score" if they were required to count them... open source software doesn't have the luxury of hiding their dirty laundry like that. And it's not just Linux that suffers from that "disadvantage", OS X has an awful lot of open-source components, and many of Apple's updates have been patches rolled in from them.

    Microsoft's gaming the system here. Statements like this should be granted no credibility.