Vista Security Claims Debunked

An anonymous reader writes "Apparently Microsoft still hasn't learned that counting vendor acknowledged vulnerabilities isn't a good way to establish the security of an OS. As an analysis of Microsoft's claims on Full Disclosure shows, we see that the methodology used was badly flawed. A bug in Firefox (not to mention emacs), counts as a flaw for Linux, while IE bugs get ignored on Vista's chart. Then we see that vulnerabilities aren't vulnerabilities when they're security-challenged features such as Vista's Teredo. Also, there's far too little consideration given to severity, given that it stoops to counting even extra access restrictions on a file in OSX to have something to show. In short, the original Microsoft analysis was good PR and poor research."

Comments

The Microsoft guy did a second report

[Utopia]

with the non-Core Linux components no longer listed because of based on the feedback.

This just debunks the first report.

Depending upon your definition of "security", yes.

[khasim]

Here's why: assume that windows was technologically backwards and couln't get on the internet. Would you then agree that Linux was less secure, because the possibility exists to hack it over the internet while that possibility does not exist for windows? No, that wouldn't be an appropriate assesment of security.

Actually, it would be appropriate.

If you can remove an avenue of attack, you have increased the security of your system.

Now, by removing it from the Internet you have also reduced the FUNCTIONALITY of your system.

So you end up with a less functional, more secure system.

Security is all about evaluating the possible threats and reducing their effectiveness.

Teredo gives Vista the ability to get to ipv6 from behind a NAT, so vista has the ability to access more things (in this one limited way). Thus it should not be counted as a vulnerability unless Linux has a way to do the same thing, in which case we can compare the security implications of Linux's method versus Vista's method.

No. If it is an avenue for attack, it is an avenue for attack.

If it is vulnerable, it is vulnerable.

We've been over this before with Firefox's avoidance of ActiveX. Sometimes, increasing your security simply means NOT including some functionality.

Don't accept abuse. MS apparently lied.

[Futurepower(R)]

MOD PARENT UP!

Quote from the Slashdot story: "In short, the original Microsoft analysis was good PR and poor research." It amazes me how easily people accept abuse, and give excuses for being abused. It was not "good PR". My best understanding is that Microsoft's analysis was an intentional lie.

My rule number one in dealing with Microsoft: Unless forced by circumstances, never upgrade to a new version of Windows until the second service pack is released. Let other people have the grief. The huge number of bugs in Windows XP before SP2 was very expensive for us. If I remember correctly, SP2 fixed more than 630 bugs, and some of the fixes were not documented. It is not only the vulnerabilities that are expensive.

Quote from the link in the Slashdot story: "Also, the entire networking stack was rewritten for Vista, and that means lots of new bugs are present. I have already spoken to other researchers who have not disclosed such flaws publicly. However, a good start for learning about some is the Symantec paper that analyzed Vista during the BETA phases and revealed numerous issues."

Microsoft has, in my opinion, a long, long history of not allowing their programmers to finish their jobs. There were even security vulnerabilities in the Microsoft Help protocols!

Armchair critique

[weinrich]

This report from Microsoft's Jeff R. Jones is ludicrous...

This isn't a debunking.

I feel Jeff really needs to perform another less exaggerated analysis.

It's an armchair critique of someone else's work.

[...] a good start for learning about [Vista flaws] is the Symantec paper that analyzed Vista during the BETA phases and revealed numerous issues.

A competitor (see Live OneCare) wrote an article about an early BETA of a new OS saying is had some issues? Shocking!

Even though OS X claims to be secure, researchers have obviously shown that Apple will have flaws too. This is nature of software, and it affects all code.

What are you saying here, Kristian? Bugs are inevitable, so we should just give Apple a free pass on their share of problems because, well, it affects all software?

Ok, that's enough of that.

I feel Kristian really needs to perform his own research and analysis, and draw his own conclusions.

PS: Don't mod this as flamebait until you read Kristian's entire post. Really.

Re:You don't need to see our identification.

[smitty97]

MOD PARENT DOWN!

1. I think we all know where the quote is from.
2. Except you.