More Mac Vulnerabilities Than Windows In 2007?

eldavojohn writes "A ZDNet blog reports stats from Secunia showing OSX averaged 20.25 vulnerabilities per month while XP & Vista combined averaged 3.67/month. Is this report card's implication accurate, or is this a symptom of one company turning a blind eye while the other concentrates on timely bugfixes? 'While Windows Vista shows fewer flaws than Windows XP and has more mitigating factors against exploitation, the addition of Windows Defender and Sidebar added 4 highly critical flaws to Vista that weren't present in Windows XP. Sidebar accounted for three of those additional vulnerabilities and it's something I am glad I don't use. The lone Defender critical vulnerability that was supposed to defend Windows Vista was ironically the first critical vulnerability for Windows Vista.'"

Comments

/. Windows bashing makes me want to throw a chair

[Anonymous Coward]

They're just looking for excuses to downplay the results of the report.

Counting shows nothing

[Ed Avis]

How many times does it have to be repeated? Counting vulnerabilities is a stupid way to measure security. Counting vulnerabilities is a stupid way to measure security. Counting vulnerabilities is a stupid way to measure security.

Shouldn't Slashdot link to some more insightful analysis?

Re:Counting shows nothing

[Anonymous Coward]

Not only that, but the math used in TFA is wrong. The total number of XP + Vista bugs should sum to 54, for an average of 4.5/month, instead of the reported 3.67/month.

Re:Counting shows nothing

[slazzy]

This just goes to show, nothing,not even exploits run on Vista...

Re:Counting shows nothing

[dgatwood]

How did they total the vulnerabilities on different versions of Mac OS X? They need to combine them in the same way for comparison to be fair.

Even that isn't necessarily fair, though. If they combine them by summing, then vulnerabilities that appear in more than one version of Mac OS X would make Mac OS X look disproportionately bad simply because there have been many more versions of Mac OS X than Windows in the same period of time.

The only truly fair way to do these comparisons is to compare the number of vulnerabilities on each version of the OS separately. Any combining will skew the numbers one way or the other.

Re:Counting shows nothing

[ByOhTek]

Actually he explained it, and it isn't wrong.

Any exploit that occured in both XP and Vista was only counted once for the total, not twice.
Just as any exploit that occured in both OS X.4 and X.5 was counted once, not twice.

As long as he did the same thing on both operating system pairs, it's ok. Though he should have given a breakdown of the X.4 and X.5 bugcounts as well.

Re:Counting shows nothing

[Howitzer86]

The odds are so overwhelming that it should still matter to you.

Re:Counting shows nothing

[bunratty]

Even Secunia itself says not to use their statistics to compare the overall security of products against one another.

Re:Counting shows nothing

[ByOhTek]

lacking modpoints, and annoyed ath that being called troll, I'd just like to add my +1 funny.

Even as a person liking Windows (2000/XP anyway), I find that a riot.

Re:Counting shows nothing

[cyphercell]

you didn't read a single link in the parents post, did you?

Re:Counting shows nothing

[dgatwood]

Absolutely. Vulnerability counts are worthless. Here's the simplest example I can think of:

My friend and I both maintain a tool of some sort. We both get ten security vulnerability reports sent to us each year. I patch ten security bugs ten minutes after they are reported and my friend sits on the first ten bugs for a year, then the next year, we both fix ten vulnerabilities in the second year. However, for a user that keeps their system patched, I have an average of slightly over zero exposed vulnerabilities, while my friend's software exposes slightly over ten. According to the vulnerability count, however, I had 20 and my friend had 10.

Re:Counting shows nothing

[MrShaggy]

Are they counting vista as one big huge one??

Re:Counting shows nothing

[ByOhTek]

Another issue would be severity.

1) Your friends flaws only allowed an administrator of the systm, on the local system to accidentally delete (but not read or otherwise modify) secur data of the users.
2) Your flaws allowed anyone to connect to the machine remotely and read/write/modify all of the secure data on the server.

Which is worse? It's severity and time of exposure. MacOS X didn't have any extremely critical vulnerabilities, but Windows had four, MacOS X had a lot more highly critical, and slightly more moderately/less critical. This makes the vulnerability count look even less meainingful (if every level counts 100x more than the previous level in terms of overall risk, and the average fix time was the same, Windows would be more vulnerable than MacOS X, even with only 15% the bug count.)

Re:Counting shows nothing

[nschubach]

You forgot another aspect as well. What if your friend sits on the problems, but doesn't report then as vulnerabilities, but instead reports them as bugs.

Re:Counting shows nothing

[man_of_mr_e]

Counting vulnerabilities is a stupid way to measure security.

So why is it, then, that for so many years those against Microsoft and Windows used every vulnerability as a chance to proclaim how much Windows sucks? Isn't that counting vulnerabilities as well?

Re:Counting shows nothing

[mr_rattles]

True but the author also left out Windows Server but he did count the vulnerabilities in the server applications that come with Mac OS X. This was NOT an apples to apples comparison.

Re:Counting shows nothing

[someone300]

If you read some of the OS X vulnerabilities, you'll see that they're often in non-Apple software, such as CVE-2007-5476 (Highly Critical) which describes a "vulnerability in Adobe Flash Player 9.0.47.0 and earlier, when running on Opera before 9.24 on Mac OS X". The Microsoft vulnerabilities tend to be referring only to the Microsoft software

Also, the way they rate vulnerabilities seems to be different. Microsoft "Highly critical" vulnerabilities seem to all be remote arbitrary code, and "Less critical" can be remote DoS, whereas "Highly critical" on OS X seems to sometimes include DoS. Infact, CVE-2007-4702 (less critical) doesn't even seem to be a security vulnerability. I thought it was discussed and found that the application firewall on OS X functioned as documented (though potentially not as a user would expect). CVE-2007-3036 and CVE-2007-0023 seem to describe similar vulnerabilities, but they're rated less critical on Windows than OS X.

Re:Counting shows nothing

[Anonymous Coward]

Unless using it to bash Microsoft. Then it's always a-ok.

Re:Counting shows nothing

[theelectron]

This was NOT an apples to apples comparison.

No, I believe this was an Apples to Microsoft comparison.

Re:Counting shows nothing

[unPlugged-2.0]

Read the link?

You must be new here.

Re:Counting shows nothing

[Tony Hoyle]

If an exploit was running on vista slowing it down... ... how would you tell?

Re:Counting shows nothing

[crashelite]

he is right you cant really compare a closed os to a open source based os. for apple people can find bugs and report them. MS ppl can find them also but its a LOT harder. also MS does not really say what their fixes are fixing when apple says what it is patching.

Re:Counting shows nothing

[Ed Avis]

It depends what you mean by an 'exposed vulnerability'. There is often a mindset that until a vulnerability is publicly disclosed, it cannot be exploited, and so it is the act of disclosure that creates security risks, rather than the act of writing the buggy code in the first place. If you are counting 'exposed vulnerabilities' you need to count exposure time from the date the vulnerable code was released to the date it was withdrawn or patched - not just counting from some arbitrary public disclosure date. The bug existed long before the program's author found out about it.

Re:Counting shows nothing

[Ed Avis]

I can't speak on behalf of 'those against Microsoft', but while mindlessly adding up total numbers of disclosed vulnerabilities doesn't give a fair picture (for reasons explained in the links I posted), if you use your brain a bit you can still point to a particular vulnerability as evidence of bad software quality. You need to take into account how severe it is, how exploitable in the default configuration, how long it went unpatched, and so on. All important things to look at, but not reducible to a single number.

Re:Counting shows nothing

[Carthag]

An improved metric would be the duration between announcement and fix for each vulnerability, totaled in some fashion. It doesn't take into effect severity, though.

Re:Counting shows nothing

[Aram Fingal]

Right, security by obscurity doesn't work... unless you take it to the level of non-functionality.

Re:Counting shows nothing

[Gr8Apes]

st give me three points and I'll show you an elephant.

Re:Counting shows nothing

[heffrey]

Shouldn't Slashdot link to some more insightful analysis?

Then it wouldn't be Slashdot.

Re:Counting shows nothing

[jedidiah]

Nah... we use press releases of mass malware infections for that.

You really can't beat "it brought my company down" or "it destroyed my data" or "it crippled the internet".

Re:Counting shows nothing

[Stephan Schulz]

I checked out some of the bugs. A Windows bug was "unspecified bug in local procedure call may be used to execute arbitrary code" (one bug). For the Mac, it was "buffer overflow in handling of escape sequence \E\Q in PCRE library may allow crash (and possibly arbitrary code execution)" (one bug), "buffer overflow in handling of escape sequence \P\Q in PCRE library may allow crash (and possibly arbitrary code execution)" (second bug), ...

As long as the bugs are counted at very different resolutions, and as long as very different functionality is compared, the numbers are worthless.

Re:Counting shows nothing

[Anonymous Coward]

Actually it's easier to pull that joke on Linux.

Re:Counting shows nothing

[calebt3]

Is the "P" supposed to be missing from the end of your sig?

Re:Counting shows nothing

[dgatwood]

Right. Well, that's another example of the more general point I was alluding to, which is that the only vulnerabilities we know about are those that have either been disclosed by the company or disclosed by somebody who got pissed off waiting for the company to fix the bugs. The result is that vulnerability counts can be severely underreported, and you are at the mercy of the company's honesty and competence at deciding which bugs are security bugs when you try to determine how accurate your vulnerability numbers are.

Re:Counting shows nothing

[init100]

Multiply the time between vulnerability discovery and patch with a severity multiplier, and you may get a better metric.

Re:Counting shows nothing

[dgatwood]

I agree with you. From the day a security vulnerability ships the first time until the day it is patched, it is a risk. The risk certainly does increase significantly when the nature of the vulnerability is publicized, but if security experts are using fuzzing tools and stuff to find these bugs, you can bet your ass that people trying to compromise systems are doing the same sorts of things, and if a bug first gets caught by a white hat, you should count yourself damn lucky....

By "exposed", I meant "known to the company", i.e. that people using my friend's software during the second year averaged out to having slightly over ten unpatched vulnerabilities that were known to the company, while people using my software in this scenario averaged out to only having slightly over zero unpatched vulnerabilities that were known to the company. This assumes people patch quickly after a patch is released. I guess if you really get down to it, though, during the second year, assuming there were no additional vulnerabilities beyond those first twenty (which you really can only guess about), my software really averaged 5 vulnerabilities (since ten were fixed over the year, so on average there were probably five) while my friend's averaged 15 (since ten were fixed over the year, but ten additional ones remained unfixed at all times).

Re:Counting shows nothing

[dbIII]

Mac house vunerabilities - two screws lose on security screen on southeast first floor window.

MS house vunerability - missing front door.

From a simple count the MS house wins!

To be fair we're comparing the MS hobby range here with a swarm of applications of less than Friday afternoon quality to something where some effort has been put in. A more decent MS operating system (ie. win2k, 2003) well written apps and well written drivers help a lot and the comparison is not as dire. Even then abject stuidity like image viewers running arbitrary code embedded in images crops up due to poor management.

Re:Counting shows nothing

[ceoyoyo]

Or you could just look at the stat that really matters -- what is the probability that a normally used system will become infected over some time period?

Re:Counting shows nothing

[Anonymous Coward]

I checked several of vulnerabilities randomly from the Mac column and, surprise surprise, a number of them were vulnerabilities related to Java, equally affecting Windows and Linux if Sun Java virtual machine installed! However these bugs were not listed in Windows column. So very fair comparison.

The recipe to get shit loads of readers: randomly select security vulnerabilities and add them to column C instead of B.

At least one should read the description of the vulnerabilities before making any comparisons.

Re:Counting shows nothing

[Crayon Kid]

Which is worse? It's severity and time of exposure.

That's why a relevant view of these matters should be a graph that shows how much time vulnerabilities for an OS spent unpatched. Time spent unpatched on the X axis, amount of vulnerabilities as stacked blobs on the Y axis, color to indicate severity. Then we see whose graph (OS X or Windows) shows the longest and highest red hills.

And here's what you'd get that way: a security graph that actually means something.

Re:Counting shows nothing

[JohnBailey]

This just goes to show, nothing,not even exploits run on Vista... Ahh.. security through unusibility...

Re:Counting shows nothing

[SacredByte]

Using the number of patched vulnerabilities to compair programs is like compairing programmers based on the numeber of lines of code they write. This was already proved by Bill Atkinson at Apple. http://books.google.com/books?id=6ASeeTZbqCQC&pg=PA65&lpg=PA65&dq=apple+%22lines+of+code%22+%22revolution+in+the+valley%22&source=web&ots=9uh0jyyn6F&sig=8wWekH6iy1wSJATOR4_EVAfTQdM

Re:Counting shows nothing

[Anonymous Coward]

download some bugzilla or similar open source software. Run a sed script against it replacing all the sixes with nines and the nines with sixes [sed 's/6/9/d' *.c ahh fuck it reverse all the numbers ...] try to compile it (run it or whatever, who cares), post your first error to the mailing list, post your second error to the mailing list, post your third, ask for an algorithm, put it in microsoft code, get fired, support FOSS software patents, patent the algorithm you stole from the sucker, confess to your greedy bastard lawyer, sue microsoft. #??? PROFIT!

You see, you have to ask yourselves WWBGD? - What Would Bill Gates Do?

That's how you f*ckin' solve problems man.

Re:Counting shows nothing

[Ash Vince]

So does that make Windows ME the most secure OS ever?

Obscure the entire OS behind a blue screen and your done.

Re:Counting shows nothing

[Yvan256]

Your computer would actually start undoing what you did in the last hour?

Re:Counting shows nothing

[Anonymous Coward]

Funny how counting vulnerabilities was the favorite comparison made by the Linux camp for years when the numbers favored their favorite OS. Now that the numbers favor Microsoft, it's no longer a good way to compare. Same goes for performance benchmarks that once were used to show Linux's superiority, but now that they favor Microsoft, they're considered "artificial" and unrealistic. But hey, that's the kind of double standard we're used to from the Linux community.

BT has BB

Re:Counting shows nothing

[Ed Avis]

Was there ever a time when the count of vulnerabilities was higher for Windows than for a Linux distribution?

Re:Counting shows nothing

[Anonymous Coward]

Counting vulnerabilities is a stupid way to measure security Counting vulnerabilities acknowledged by the vendor is an even stupider way to measure security.

Macs cannot be critiqued

[athloi]

They are not Microsoft.

Therefore

They are beyond criticism.

Anything that is not Microsoft, and makes us feel like the hipper kids in the street, is automatically beyond criticism. We all wish we were the rich kids in Redmond, but since we're townies instead, we will speak ill of them any time we can. Macintosh is not from Redmond. True, they are greedy and wealthy. But they are not our enemy so they are us.

(See also Apple's identity problem.)

Re:Macs cannot be critiqued

[bealzabobs_youruncle]

There is quite a bit of false premise here, but I'll give this a shot. I don't use OS X or Linux to be special or different, but because they are better operting systems. I make a healthy living supporting MS products and have for years, I've used MS products when it made sense and dodged them when it doesn't (like now with Vista). For many people Windows has always been "good enough" but that doesn't appear true any longer (and applies to more than just the OS, Office 2007, IIS, the Zune, etc...). That doesn't make Apple or OS X beyond criticism, although as others in this topic will mention, counting vulnerabilities has never made sense for Windows or OS X/Linux/Unix/etc...

I know you put a lot of work into what you feel is a clever post, but all you did was come across as the exact kind of poster you are describing. And your link is really irrelevant as it was Apple supporters (mostly) who over-played the outsider status, not Apple itself. What kind of half-baked value system do you employ when you decide who is cool by what OS they use? An OS is a tool and you should use what fits your needs best. I'm a media junky and like to dabble in editing, that makes OS X my best choice. If I were still a PC gamer, you can bet I would use Windows. But that doesn't excuse the long history of Windows security issues, and an article that spins a a year where Windows finally has fewer vulnerabilities than another OS as proof of progress is really just proof how many people don't get it. The bigger question is how those vulnerabilities were handled, from point of discovery to solution, and that is where MS always breaks down.

Re:Macs cannot be critiqued

[Altus]

What kind of half-baked value system do you employ when you decide who is cool by what OS they use?

Yea man, everyone knows you decide who is cool by what kind of car they drive.

OS... please, thats not cool at all :-)

Re:Macs cannot be critiqued

[DwarfGoanna]

What's really funny about this sort of thing is how, not all that long ago*, Macs were anything but cool here on slashdot. Granted, the OS was flaky, but even talking up the neato hardware or rock solid interface would get you laughed out of here. It's been an amazing transformation to watch Mac derision turn into Mac backlash.

*okay, maybe I'm dating myself there.

Re:Macs cannot be critiqued

[99BottlesOfBeerInMyF]

The bigger question is how those vulnerabilities were handled, from point of discovery to solution, and that is where MS always breaks down.

I'd argue what really matters is how these vulnerabilities were discovered and what vulnerabilities have not been discovered, how these vulnerabilities have been reported and what vulnerabilities have not been reported, what the risk to normal users from vulnerabilities is, and (in the case of this article) which of these "vulnerabilities" are real and which are reserved numbers, only potential vulnerabilities, duplicates, and vulnerabilities that realistically cannot or will not ever be exploited.

In my opinion MS broke down when they did not perform the same level of code review, did not find as many potentially security related bugs, did not fix half the bugs they did find, and did not report either the bugs they found or even all the bugs they fixed. And then, or course, the speed with which those bugs they found, fixed, and announced were actually patched.

Re:Macs cannot be critiqued

[Anonymous Coward]

Shut up, Prozak, and stop pretending to know what you're talking about. It didn't work with music, and it doesn't work with technology. Maybe you should go write another screed about the evils of the Jews or something.

It's all academic.

[phoebusQ]

No artificial metric really matters in the security landscape.

In the end, what matters is the real-world security performance of these systems. Sure, it's not so easy to quantify and measure, but stories like this ZDNet fodder are just pageview generators, and nothing more.

Re:It's all academic.

[vertinox]

No artificial metric really matters in the security landscape.

One thousand exploits that allow someone to wipe a users home directory is nothing compared to single exploit that allows an unauthorized person to gain root access to the machine remotely.

Re:It's all academic.

[Anonymous Coward]

Hmm... no, actually, I don't think so. Yes, in fact I'm quite sure that 1,000 remote non-root exploits is pretty fucking shitty. I'd much rather clean up after just one rooting.

Re:It's all academic.

[Bert64]

If you get rooted, the only sane thing to do is a complete format and reinstall, since you can never be sure what malware will be hidden on the system.

Re:It's all academic.

[TheRaven64]

That depends a lot on the system. Most desktop and laptop computers are single user. An exploit that wipes out the user's home directory is absolutely no different from one that compromises the entire system; both allow the attacker access to the only files on the system that the user actually cares about. Operating systems and applications can be reinstalled in a few hours.

For servers, of course, it's different. If, say, a department server is compromised then a few hundred people might have their accounts compromised. If a single account on the server is compromised this is much less important.

An account compromise on Windows is typically equivalent to a system compromise, due to how the operating system is used. On OpenVMS, an account compromise is rarely likely to affect more than a small fraction of the users of the system, and so is much less important (unless you are the user whose account is compromised, of course).

Re:It's all academic.

[Anonymous Coward]

One thousand exploits that allow someone to wipe a users home directory is nothing compared to single exploit that allows an unauthorized person to gain root access to the machine remotely.

I wouldn't want to be the one to tell this to the thousand people who just lost all their documents...

We hear this idea on Slashdot all the time, but it ignores the fact that what's in my home directory is my work product. If I have to restore from backup, or recreate work I've already done, it doesn't matter at all to me if my home dir's been wiped or my machine has been rooted -- the resulting loss of productivity is the same.

Glad /. will be discussing this

[hrbrmstr]

but I'd hate for MacNN to get any ad revenue or new, regular visitors from the traffic this will generate.

I posted my retort on this just before the /. post : http://www.rudis.net/content/2007/12/18/macnn-editors-egg-nog-consumption-increases-disastrous-results

I wish non-security folks would stop reporting on security "stuff"... I can't wait for NPR, CNN and Fox to run with this "breaking news!" tonight or tomorrow.

Repeat something false often enough...

[pieterh]

Linux costs more than Windows.

Open standards are bad for the economy.

Software patents are good for the economy.

Microsoft is a nice company.

Windows Vista is more secure than Mac OS/X.

OOXML is better than ODF.

Buying votes is a good way to build new standards.

People remain with Windows because they like it.

Firefox is less secure than Internet Explorer.

They're not really people, anyway...

Re:Repeat something false often enough...

[justfred]

You mean like:

War is peace.
Freedom is slavery.
Ignorance is strength.
We have always been at war with Eastasia.

Seems like it's working out pretty well for the current (US) government.

Re:Repeat something false often enough...

[mr_mischief]

The US are a bunch of Facists.
The US was not previously at war with Iraq.
Iraq did not violate the terms of the ceasefire.
Saddam did not buy homes for families that sent teenage boys to blow themselves up on Israeli buses.

Yeah, repeat it often enough and people will believe it. I like how you quote 1984 for its geek cachet and then go on to repeat your particular hatred without justification.

Regardless of your feelings about the US in general, the US federal government in particular, or specifically the George W. Bush administration, if you're going to argue against a tactic (in this case empty repetition) don't turn around and use it in the same post. If you have a gripe, gripe. Don't just repeat your conclusion.

Re:Repeat something false often enough...

[mr_mischief]

I see. Someone makes a hypocritical post trashing a country, and that's not flamebait. Calling them on it is. I'll be sure to update my dictionary, because I'd always though it was the other way around.

Re:Repeat something false often enough...

[tigerhawkvok]

Even though /. is a haven of MS-bashin, some people do try the products first.

I use Vista by choice, and I have used OSX 10.3, 10.4, Solaris, Ubuntu, and openSUSE. If you're competant in the windows environment, you know how to do everything you can in the *nix environment in windows -- including a proper terminal shell (UNIX subsytem anyone? And I swear by EMACS for coding/scripting). Vista is flat-out better than OSX. Sorry to say it. The interface is better (though I wish they had a non-alpha implementation of multiple desktops). Explorer is more powerful than Finder. The searches are essentially equivalent. Widget implementation is poor on both systems.

I used an iPod for four years, and during that time, my family bought and used three generations of iPods. I upgraded to a Zune recently, and my family and friends all agree the interface and device as a whole is better than an iPod. That's real people, folks.

As to ODF vs. OOXML ... I don't really care. I htink OOXML files are slightly smaller, and since I rarely use the GUI (keyboard shortcuts for the win), some advanced functionality in MS Office and the ability to minimize the Ribbon and have a super-utilitarian interface makes it a far superior choice to OpenOffice. This is, of course, neglecting the horrible footprint and initial load times for OO

IE is mediocre. FF memory leaks. Opera for the win. I wish FF or Opera had native 64-bit though.

And finally, why do you give a damn if MS is a "good" company or not? Everyone is in it for themselves. Everyone. And so long as I am satisfied with their product, I don't care if its made by MS, Apple, or the Cookie Monster. Heh. Time to see how much karma-dinging I get for this.

Re:Repeat something false often enough...

[gnuman99]

GW administration is the "USA"? Holy crap, pull the wool from your eyes man! Or in your eyes the US will disappear when Bush leaves the presidency?!?! You claim this like Bush was some sort of embodiment of the USA. I'm glad that vast majority of US citizens and lawmakers do not agree with your point of you.

Your post was definitely flaimbait. There are people that do a lot worse than Hussein ever did (you know Saddam is a first name, like George, or should I just call US's president George from now on?). They did a lot worse yet are perfectly fine because,

    1. they have better military, and/or they have nukes, or
    2. they do not oppose US, or
    3. US doesn't need anything they have

For examples of areas that have leaders that did a lot worse than Hussein, the short list off the top of my head would be (for recent history): Somalia, Rwanda (genocide), Sudan (current genocide), Burma, DR. Congo, Burma, Uzbekistan, etc..

Hussein could have been a very good US asset in the area, even post 90s war. Bush should have made him into a puppet, but I guess they just don't understand the motivation of someone like Hussein. That is very sad considering they apparently have an "expert" in the Soviet politics in Rice - I guess that expert was on paper only.

Bush administration has so far ruined the US financially, economically and morally. The next administration will have a difficult time to get back up.

Hoes does this relate to the original flame of "Mac security worse than Windows" baffles me.

Re:Repeat something false often enough...

[Sancho]

Vista is flat-out better than OSX. That's flat-out opinion.

The interface is better Usually, when I hear this, what I really think a person means is, "The interface is more Windows-like." Most computer users learned about them on Windows--it was probably their first computer experience[1]. That's what familiar, and although Windows does change the interface quite regularly, it's always got quite a bit in common with the previous generation.

Generally speaking, I find the OS X interface to be simpler, which I like. It's easier to do more advanced things with the Windows graphical shell, but with a single OS X addon, it wins hands down in my book: Quicksilver.

Widget implementation is poor on both systems. Personally, I rather like OS X widgets. They're unobtrusive because they're only there when you want them (when you hit F12 or whatever hotkey you assign to display them.) When I used Vista, I just felt like the widgets were getting in my way. You can Show Desktop, but there's not as clear a delineation between the widgets and the background, and Show Desktop has always been pretty flaky for me (inconsistent in its behavior, sometimes failing to hide windows or oddities.)

IE is mediocre. FF memory leaks. Opera for the win. I wish FF or Opera had native 64-bit though. We're in total agreement, here. I just wish that Opera was more easily extensible, and that it had half of the development community for add-ons that Firefox has.

[1] Except for old farts who used something pre-DOS--my first experiences with computers were Commodore 64s and Apple IIe.

Re:Repeat something false often enough...

[mr_mischief]

Go ahead and call Bush "George". I don't care, and he likely doesn't either. In the Middle East, a famous person being called by his first name isn't an insult at all from what my friends who have served there tell me. That's cultural transferrance from people in the West. Please call GWB "Mr. President" when addressing him directly in person, though, as to respect the office. I would have paid Hussein the same honor when in his country while he was in power, but now he's dead.

The US was in Somalia, but Bill was getting blow jobs in the Oval Office and there was a movie called "Wag the Dog" implying that military involvement there was to take our minds off the scandal. That was a no-win situation.

The Russians are very tense over the US doing anything in Uzbekistan.

The US has even less support for doing anything in Sudan, Rwanda, Burma, or the DR Congo than we had to go into Iraq. Don't think that Sudan is militarly mightier than Iraq. Don't even suspect it, because it's simply not true.

Let me tell you what I think of Iraq, since you are asking me what I think about the situation. Iraq was not, as far as I can tell, directly nor indirectly tied to 9/11. They were in contact with Al Qaeda, but neither one trusted the other enough to even meet face to face, let alone work together. They did pay off families of suidice bombers in the "Palestinian resistence". They did evade, lie to, and interfere with the UN weapons inspectors. They did keep key WMD scientists employed and idle even while they weren't actively working on WMD projects. They repeatedly violated the no-fly zones. They had a history of gassing people internally and while at war with Iran. They invaded Kuwait over alleged slant drilling rather than going to the UN. They tortured their people and claimed 100% voter turnout and 100% votes for Saddam. The president's sons regularly raped women and girls then killed their families if there were any complaints. The US was at war with Iraq which ended in a ceasefire, and Saddam Hussein and his military for 11 years repeatedly violated the terms of that ceasefire. Which of the other countries you listed fit those criteria, most importantly the ceasefire?

Right now, GWB and his administration are the executive branch of the US federal government. That means that, other than nebulous private market pressures or the very specific Congressional action of a new declared war, they are all of the US that projects power outside US borders until the end of the current presidential term. Your "GWB is the whole US" question is a strawman. I never claimed that. This is specifically what I said, and it very clearly makes the distinctions you claim I did not make:

"Regardless of your feelings about the US in general, the US federal government in particular, or specifically the George W. Bush administration, if you're going to argue against a tactic (in this case empty repetition) don't turn around and use it in the same post. If you have a gripe, gripe. Don't just repeat your conclusion."

This thread relates to the method of discourse being used by Microsoft, satirized by George Orwell in 1984, pointed out by the parent of my original post, then utilized in the parent of my original post. That is, namely, that if you repeat a falsehood enough that people will begin to believe it based on the repitition.

I merely asked for some reason the parent was trashing the US government rather than a repitition about how bad the government is supposed to be. Apparently that's too much to ask of some Slashdot posters.

Re:Repeat something false often enough...

[bblount]

"IE is mediocre. FF memory leaks. Opera for the win. I wish FF or Opera had native 64-bit though."

I love Opera, especially 9.5. I can't wait for it to become stable!
Opera actually does have 64bit versions of Opera for Linux and FreeBSD (9.5 only though).

See here: http://www.opera.com/support/search/view/842/

Re:Repeat something false often enough...

[Anonymous Coward]

why the fck would someone need a 64bit browser. You want to have 2^48 pages in your memory cache ?

Re:Repeat something false often enough...

[SJ2000]

why the fck would someone need more then 640Kb of RAM? :)

Re:Repeat something false often enough...

[Anonymous Coward]

Yes- let's stay in the 32bit world forever! Yeah! 32bit-for-life.

Re:Repeat something false often enough...

[LKM]

The interface is better

Translation: I'm used to it, and I hate everything I'm not used to, no matter how good it is.

That's real people, folks.

As opposed to non-real people, such as us.

Re:Repeat something false often enough...

[tigerhawkvok]

As opposed to us, a bunch of nerdlings. Most people don't even know what Linux is, keep that in mind ... and of those that do, even the semi-computer-literate (as opposed to out-and-out computer nerds) don't like Linux at all.

Are we not done yet?

[junglee_iitk]

Who has counted the bugs and security holes that were fixed without prior disclosure? It is like counting footsteps of two dinosaurs from their fossils and then comparing them for their health.

flamebait

[ryujiwarui]

this whole article should be modded flamebait, counting vulnerabilities is a useless way to compare operating systems

Re:flamebait

[Anonymous Coward]

flamebait? that's exactly what it is.

these discussions about vista and mac and "SECURITY VULNERABILITIES" and "DRM" and all the other stupid shitty REPETITIVE articles on here is killing Slashdot.

Unpossible!

[Anonymous Coward]

Apple is the light, the truth and the way.

Not really objective

[UnknowingFool]

First, reporting on the number of flaws disclosed and fixed says nothing about the relative security of either platform. Both MS and Apple could be holding back on patches to their own software. Second, many of Apple's security patches address 3rd party open source software like Samba, Kerberos, etc, that are being patched when flaws are discovered.

Re:Not really objective

[blazerw]

I did RTFL, and for the fun of it decided to click on a few of the OS X vulnerabilities. The first 3 out of 4 I clicked on in December were for the Perl Compatible Regular Expression library. Each appeared to be a way of causing a crash, DOS, or remote execute when using patterns involving character classes. Why are these 3 unique vulnerabilities? My guess is because the vulnerabilities are dumps of the project's bug database.

Just my 5 second research into these results.

Re:Not really objective

[ToasterMonkey]

I saw Ruby on rails, openssl, and a lot of Java too. I understand the reasoning behind reporting it the way they do, but even though Java is installed in Mac OS X by default, the flaws should be reported separately if it affects java users on all platforms. Just doesn't make sense... if I don't use the software at all, does it justify the same severity rating? If I do, and it can be used on any platform, wouldn't it be everyone's problem?

Is there a report that shows reported vulnerabilities that ONLY affect each platform? You could of course link each platform to bundled software that also has known bugs, but lumping the total counts together is not only as meaningless as "reported vulnerabilities", but not even very interesting.

Re:Not really objective

[Anonymous Coward]

I would say that counting vurlurnabilities in 3rd party software do count if said 3rd party software is installed on the platform as you would recieve it from a retail purchase.

Do macs come with Samba, Kerberos, Flash, etc. installed out of the box? If so that makes the platform vurlurnable out of the box, and the vurlurnability should be counted.

Re:Not really objective

[TheRaven64]

I don't think it's that unfair to count Java vulnerabilities with OS X because the Java plugin is installed. If you use the default browser on OS X then you have the Flash and Java plugins running automatically. Any security vulnerability in either of these should count for OS X, just as every IE vulnerability should count for Windows.

Re:Not really objective

[ToasterMonkey]

That's true, hadn't considered the plugin.

Nonsense

[Cally]

I'm absolutely not an Apple fanboi but this is bollocks. Apple (who are indeed significantly slowerthan other distributors in releasing patches) ship an awful lot of Free software - application software that is - with OS X, whilst Microsoft generally only patch the core OS (and Office, if you go to https://microsoftupdate.com/ rather than https://windowsupdate.com/ .) Hmmm, one day I must get round to doing that chart tracking who, of the main distros shipping common code such as (say) Zlib, releases what patches, when. Some of the Linux distys are particularly lax on this front.

Re:Nonsense

[Joe U]

If it ships with the OS it should be patched by the OS company. If Apple shipped something with a flaw, Apple gets to patch it. Same for Microsoft.

Re:Nonsense

[99BottlesOfBeerInMyF]

If it ships with the OS it should be patched by the OS company. If Apple shipped something with a flaw, Apple gets to patch it. Same for Microsoft.

Agreed, although not all the "vulnerabilities" listed in this so-called study do ship from Apple, many are third-party applications that just run on OS X. Also, OS X includes a lot of cool tools with their OS, because they are free. 99.99% of the time, these tools are never used, let alone exposed to the outside world. For example, almost a third of the first 30 CVE's listed in this study apply to the same Perl, regular expression evaluator. Now how many users do you suppose turn on Apache and this module and make use of it on a Web page they're hosting from their home computer? I mean these tools are great for Web developers that want to test stuff on their workstation, but that is likely about all they are used for, in the very rare cases that they are used. That particular module accounts for 8 of the "vulnerabilities" in OS X listed.

It is fine to list these as vulnerabilities, but for a comparison to vulnerabilities in Windows, well they're pretty useless because of the use case as well as the dozens of other things wrong with this study. I mean, the OSS team developing this module lists each and every potential hole they an find on a public Website and it is counted by Secunia. Their list for MS includes only holes that have been discovered by the public and which MS has acknowledged. Since MS does not publish most of the bugs they find, none of those are counted against MS, including the ones they don't bother to fix (more than 50% according to an ex-MS developer I know).

Secunia knows this. Every respectable security expert knows this. The only problem is, random bloggers don't seem to know this, and write "articles" about it which get widespread readership, misinforming large numbers of people and leading them to make incorrect decisions that end up causing problems for everyone.

Re:Nonsense

[Midnight Thunder]

Agreed, although not all the "vulnerabilities" listed in this so-called study do ship from Apple, many are third-party applications that just run on OS X. Also, OS X includes a lot of cool tools with their OS, because they are free. 99.99% of the time, these tools are never used, let alone exposed to the outside world.

Certainly, but it providing these applications as core part of their OS, surely Apple is in charge of the QA. If certain parts of the OS depend on this, then they should do the necessary QA. When a flaw is discovered they have two options, either get the latest patch from the module developers, or if it is not available work with them to ensure that a fix is provided. A bundled, but separate application does not follow the same rules, as it is usually described as non-essential addon.

For me this is like a car manufacturer, which discovers that the tires have a design flaw, after it gets to the customer. Sure it might not be directly their fault, but they are responsible for ensuring the fix gets to the customer. It doesn't matter if it is their problem or their suppliers problem, what matters is it gets to the customer.

Re:Nonsense

[99BottlesOfBeerInMyF]

Certainly, but it providing these applications as core part of their OS, surely Apple is in charge of the QA.

They're not including it as a "core part" though, just as some free developer tools.

If certain parts of the OS depend on this, then they should do the necessary QA.

Umm, for the example I listed, the OS does not depend upon it at all. You can remove it with no problems at all and even among developers who know what this is, very few would use it especially exposed publicly. The only way I see this being exposed is if a Web developer was writing a really complex tool with a Web interface that needed users to input regular expressions for complex sorting of data, and they hosted a development copy on their workstation and then exposed the Web server so some people in a remote location with a malfunctioning VPN could try it out.

When a flaw is discovered they have two options, either get the latest patch from the module developers, or if it is not available work with them to ensure that a fix is provided.

They did get the fix from the vendor and patched it in the next update. The issue is: should a bug that is a potential hole in a free tool, which they happen to include and which will realistically never even be exposed let alone exploited, be considered with the same weight as a hole in a service actually running and exposed on Windows? What about a hole in IE, which MS includes, but whose vulnerabilities were not included in this "study' as counting against Windows?

For me this is like a car manufacturer, which discovers that the tires have a design flaw, after it gets to the customer. Sure it might not be directly their fault, but they are responsible for ensuring the fix gets to the customer. It doesn't matter if it is their problem or their suppliers problem, what matters is it gets to the customer.

Oh boy, a car analogy. How about if it was something a bit less critical than the tires, say some misspellings on a map that came in the emergency kit. Should that be listed and given the same of more weight than a leaky gas line in competing product? Should each misspelling count the same as a mechanical fault in the competitor's vehicle? There were 8 "Highly Critical" vulnerabilities counted against OS X because the OSS project that writes the module listed every bug in it as a potential security problem, despite the fact that there is no evidence anyone on OS X ever actually exposed that component to hackers, no exploit was ever found, and it is not even certain it is exploitable.

Would you care to bet there are thousands of analogous bugs in IIS components that MS has not bothered to fix, let alone report to the public?

Re:Nonsense

[Sancho]

The issue is: should a bug that is a potential hole in a free tool, which they happen to include and which will realistically never even be exposed let alone exploited, be considered with the same weight as a hole in a service actually running and exposed on Windows? What about a hole in IE, which MS includes, but whose vulnerabilities were not included in this "study' as counting against Windows? Absolutely not. A vulnerability in calc.exe does not have the same weight as a vulnerability in iexplore.exe. A hole in the Apache shipped with OS X does not have the same weight as a hole in Safari. And now we'll cross the OS boundary--a hole in Samba shipped with OS X does not have the same weight as a hole in Internet Explorer. In each case, one of the bugs is much more likely to be exploitable--and thus exploited, even if all of them lead to the same malicious code execution. That's why it's asinine to judge the security of an OS by the number of vulnerabilities (or worse, by the number of patches, as one patch may address multiple vulnerabilities.)

Re:Nonsense

[Joe U]

Agreed, although not all the "vulnerabilities" listed in this so-called study do ship from Apple, many are third-party applications that just run on OS X. Also, OS X includes a lot of cool tools with their OS, because they are free. 99.99% of the time, these tools are never used, let alone exposed to the outside world. For example, almost a third of the first 30 CVE's listed in this study apply to the same Perl, regular expression evaluator.

I maintain, if Apple, Microsoft or any other company bundles flawed utilities with their OS it is their responsibility to provide support in the event vulnerabilities are found. It doesn't have to be written by Apple or Microsoft, if it was on the OS CD/DVD (or other distribution medium), they are responsible.

Put it this way, if Microsoft released a free copy of 'root kit for windows by l33t d00d' with Windows Server 2008, don't you think they would be held responsible?

Re:Nonsense

[99BottlesOfBeerInMyF]

I maintain, if Apple, Microsoft or any other company bundles flawed utilities with their OS it is their responsibility to provide support in the event vulnerabilities are found.

No one is arguing about support. Apple is supporting these tools and patching them. The point is, since they aren't needed, or part of the OS, or used on 99.99% of systems and are not presenting a security risk on those systems, why are they being counted multiple times as high risk security flaws? In this "comparison" not even IE bugs are being counted against Windows, which is software also included, but in addition enabled by default and actually used by most users.

Re:Nonsense

[Anonymous Coward]

Good point.

I am tempted to say most people I know with Macs complain of spyware and viruses all the time. But Windows users rarely have such trouble, probably thanks to the "official microsoft" numbers of reported fixes. Thank god I resisted the temptation to switch to a Mac!

Re:Nonsense

[jayp00001]

99.99% of the time, these tools are never used, let alone exposed to the outside world.

Note that the same methodology can be applied to many IE/windows vulnerabilities but unless you give those types of issues a pass it's not valid to do the same to another OS.

Re:Nonsense

[99BottlesOfBeerInMyF]

Note that the same methodology can be applied to many IE/windows vulnerabilities but unless you give those types of issues a pass it's not valid to do the same to another OS.

Umm, IE vulnerabilities were not counted against Windows in this so-called study. And we're talking about a vulnerability that is a bit more rare than using IE to browse to a site specifically designed to exploit this. In order to be exploited by the Perl library you'd have to, set up your Mac to be a Web server and write a new Web application using the library and allow that Web application to take unverified content from Web users and hand it to the Perl library and have someone discover your Website, somehow know you're using that library, and craft a malicious string and even then it is not clear if it would really do anything since it is only a potential vulnerability that no one has ever tested to see if it could really be used. Yeah, I'm just shaking in my boots with regard to this "highly critical" vulnerability in OS X that was counted as seven separate holes. You never know when I'm going to accidentally write a Web application that parses user entered regular expressions and run it on my workstation.

Re:Nonsense

[jayp00001]

I didn't actualy review each and every vulnerability to see how each one manifests. As in the past it wouldn't shock me to find out that one of window critical vulnerabilities is something like you described. I agree that many "critical" vulnerabilities difficult to implement, my point was if you are going to sort thru the issues and see which ones are really critical and which ones aren't you have to do it to both OSes.

Re:Nonsense

[99BottlesOfBeerInMyF]

I didn't actualy review each and every vulnerability to see how each one manifests.

Neither did the author of this article, since from spot checking about 1/3 of the ones he lists are simply CVE numbers reserved for future use by someone.

As in the past it wouldn't shock me to find out that one of window critical vulnerabilities is something like you described.

I didn't see any such thing. In fact, I saw possible remote exploitations listed as "low risk" for Windows, while local DoS, were listed multiple times as "high" for OS X.

I agree that many "critical" vulnerabilities difficult to implement, my point was if you are going to sort thru the issues and see which ones are really critical and which ones aren't you have to do it to both OS's.

It is pretty obvious the author did no such thing. It seems he found a category for "Windows XP" and another for "Windows Vista", removed the dupes and published a number. Then he did a search for everything listing "OS X" as a potential platform, including applications that run on OS X and the server version of the OS and lumped them all together, including all the OSS projects that list OS X as a supported platform. He then tried to somehow equate these two numbers despite the fact that many of the vulnerabilities listed ship on neither OS, run on both Windows and OS X, but were only counted against OS X. This whole "article" is the worse kind of misinformed crap. He did exactly what the Website he downloaded the statistics from says is pointless and shouldn't be attempted with their data.

No one has time to look through all of these listings, but it is pretty clear that as provided, they are worthless and do not in any way reflect the same thing for each platform.

It's not size that counts...

[Tom]

Ah, the usual "X has more Y than Z, so it must be better" strawman. With all the usual flaws. Didn't we have this discussion at least 50 times already?

So let me see, we will have:

• The windos fanboys drooling "told you so"
  
• The Mac fanboys screaming "it ain't so"
  
• The math fanboys going on about how you should trust statistics unless you've forged them yourself
  
• The nitpicker faction revealing that they are comparing different kinds of bugs
  
• The wannabe-blackhatters outlining that these vulnerabilities were more vulnerable than those vulnerabilities and should count more
  
• The I-read-the-web-all-day group pointing out a contradicting article in some other magazine
  
• The tinfoil-hat wearers telling us that it's all bullshit anyways and the article is only meant to get us upset and create ad impressions
  
• The meta-commentators who point out that we've already been through all this and do we really need to re-hash this discussion again? :-)
  

Re:It's not size that counts...

[BarryJacobsen]

Ah, the usual "X has more Y than Z, so it must be better" strawman. With all the usual flaws. Didn't we have this discussion at least 50 times already?

So let me see, we will have:

• The windos fanboys drooling "told you so"
  
• The Mac fanboys screaming "it ain't so"
  
• The math fanboys going on about how you should trust statistics unless you've forged them yourself
  
• The nitpicker faction revealing that they are comparing different kinds of bugs
  
• The wannabe-blackhatters outlining that these vulnerabilities were more vulnerable than those vulnerabilities and should count more
  
• The I-read-the-web-all-day group pointing out a contradicting article in some other magazine
  
• The tinfoil-hat wearers telling us that it's all bullshit anyways and the article is only meant to get us upset and create ad impressions
  
• The meta-commentators who point out that we've already been through all this and do we really need to re-hash this discussion again? :-)
  

You seem to have forgotten two:

• The list makers who will show everyone (using a list) exactly what will appear in the comments.
• The annoying jerks who point out things the list makers missed.

Re:It's not size that counts...

[Anonymous Coward]

Isn't this the pattern for ALL slashdot comments?? I thought a memo had gone and out and this was the decided protocol to replaces the TPS report protocol??

Re:It's not size that counts...

[john83]

Didn't we have this discussion at least 50 times already? Yes. I'm going home. It's dinnertime where I'm from.

Re:It's not size that counts...

[Anonymous Coward]

One more:

- People who don't know how to make bullet points

Re:It's not size that counts...

[Anonymous Coward]

You made my day with this, I love how /. can make me burst into laughter in the middle of my work.

I hesitate to mention that you DID miss an important one:

The anonymous cowards who add nothing meaningful to the conversation and who take away mod points (good or bad) from those who do.

Re:It's not size that counts...

[stewbacca]

What about those of us with a bit of an education (more than a B.S. in Computer Science, for example) who recognize poor data analysis and biased conclusions that are void of any academic credibility or validity? Does that make me a Mac fanboy or something, or just an intelligent person?

Re:It's not size that counts...

[mr_mischief]

Frankly, it may make you a pompous egotist, but not a fanboi or unintelligent at all.

It doesn't take an Associate's in Underwater Basket Weaving to understand that the reporting is flawed, but you used it as an opportunity to discount the opinions of everyone who doesn't have a post-baccalaureate Computer Science degree.

Firstly, this has more to do with statistics than theoretical C.S. Secondly, it has to do more with logic and rhetoric than theoretical C.S. Thirdly, nobody on Slashdot cares that you, personally, have an M.S., M.A., or Ph.D. in Computer Science nor any reasonable way to confirm that's actually the case.

You have committed the opposite of an ad hominem attack on another person. You have attempted to invoke "proof by expert opinion" in a forum in which people tend to value a valid assertion over the user ID of the poster, and you have used yourself as the alleged expert. It might be useful to note your qualifications in addition to a reasoned response, but it just doesn't stand on its own that you're so well educated and say something is indeed so.

You should be proud of your advanced degree, and I hope it and your actual ability bring you much success. However, Slashdot isn't a job recruiting board, and blowing your horn to hear the sound isn't that useful here.

Re:It's not size that counts...

[Anonymous Coward]

Don't be so hard on your self... your comment wasn't annoying.
Oh and you forgot one more:

• Jokers who ridicule everyone else's comments and provide nothing useful to the debate

Ps When is Slashdot going to get Textile/Markdown comment formatting... sigh.

Re:It's not size that counts...

[m1ndrape]

and don't forget

oh noes....[insert favoraite or hated os] is dying

Re:It's not size that counts...

[stewbacca]

Uh, I wasn't speaking only behalf of myself, but for the thousands of intelligent slashdot users who are offended by the simplistic logic posted by so many people in this thread. It was, however, a subtle dig at all the fools on this board who feel enabled because they have a semester of computer science on their transcript yet do not possess the critical thinking skills required to understand this article is neither valid nor reliable (and thus unusable for research purposes. In other words, it's trash).

It was also a not so subtle dig at Computer Science, as that field tends to over-evaluate numbers and overlooks human factors on a consistent basis. (My advanced degree is in Computer Education, so I'm not totally exempt).

While I like your response, it isn't entirely accurate, because my post was sarcastic. If I didn't know what straw-man and appeal-for-authority meant, your post would be spot-on. But I do, and I posted as such on purpose out of sarcasm.

Finally, the main thing I wanted to bring across is that I'm sick and tired of slashdotters dropping the "fanboi" label just because some numbers actually support a belief once in a while. The mere mention of "fanboi" (in my book) makes all points in the post no longer valid. Dropping "fanboi" shows more bias than the person one is calling a "fanboi" in the first place. I wish I took more debate classes because I could figure out what the logical fallacy is called behind this concept.

Re:It's not size that counts...

[mr_mischief]

So we're on the same page, actually. I placed the 'may' in that first sentence very carefully.

My post was a purposely over-the-top response to your purposely over-the-top assertions. I'm sure you realize that a semester of CS is not necessary to spot the fallacies in the article, yet a PhD in CS is not sufficient to spot them. It's the critical thinking skills you mention that are most important, and some simple understanding of bug reports helps. I don't think a person really even needs to know how to create a diff file to understand how wrong the article is.

Technically, of course, a post which drops the "fanboi" label might still contain some logically valid points. It may, though doubtfully, start from a decent premise. The question, I think, is whether a post which sinks so low can be redeemed. I'm of the opinion that a post in which the author sinks to ad hominem attacks like derogatory labeling should be considered for their lowest level of discourse, and aren't worth searching for nuggets of wisdom even if any are to be found. (Yes, I realize that my previous post in the thread can be read that way, and it really is entirely worth passing over if the reader interprets it that way. It was, truthfully, tongue-in-cheek, but not so clearly translated into text as I see upon re-reading it and reading your response.) There are too many intelligently and rationally (even if sometimes subjectively) argued points on Slashdot to worry about the ones that aren't.

For what it's worth, I'm a CS dropout myself, due to illness. I never went back because I found I enjoyed working at the margins of the industry more enjoyable than studying to be a star theoretical programmer somewhere. I'm considering going back to school, but it probably wouldn't be for CS. What I really want to study, in case it's not apparent, is philosophy. It's not that I'd do much with the degree professionally, but it's what intrigues me.

Re:It's not size that counts...

[stewbacca]

There are too many intelligently and rationally (even if sometimes subjectively) argued points on Slashdot to worry about the ones that aren't.

Best post I've seen in a while...

Myths

[Anonymous Coward]

Things like this perpetuate the Mac/gay metaphor.

Why can the world accept Mac users for who we are? Stop spreading misinformation about the dangers of network intercourse!

The Real Problem

[drewmoney]

I'm not a Mac user at all, but I'm will to bet, there is a substantial number of pirated, unpatched copies of Windows out there that you can count each one as a vulnerability in itself.

Re:The Real Problem

[Bryansix]

The real problem is that Microsoft doesn't allow the pirated copies to be patched thereby supporting terrorism.

Re:The Real Problem

[drewmoney]

Yes, but not that full-blown up-to-date terrorism, just the old unpatched, behind-the-times kind. It seems the attacker has left himself vulnerable to attack himself.

Re:The Real Problem

[Extide]

Actually they got rid of that rule. XP SP2+ can be installed on the fabled FCKGW XP key as well as any other blacklisted one. (Unlike SP1)

Re:The Real Problem

[toddestan]

Furthermore, Automatic Updates works regardless and always has. You can't get the optional updates like the latest DirectX, Media Player, or .NET*, but you'll get all the security updates to keep the system patched.

*Interestingly enough, IE7 is not considered optional so all the pirate editions will get it through Automatic Updates.

Yawn

[JimDaGeek]

I own two Intel Macs, an iMac and a Macbook. I own two desktops that run XP and two desktops that run Linux.

I am personally tired of the stupid "insecure" talk. My iMac runs my servers with ports 80, 443, 22, 5900 open. I watch my logs and have not seen any bad stuff.

On the other hand, I once opened my XP boxes IIS server and saw a crap load of hits in the web logs trying to break it within 48 hours. Thankfully I was running IIS lockdown which really helps.

Comparing XP in 2007 to OS X 10.4 or 10.5 is just stupid. XP has been around for a long, long time. Do a fresh install of XP home SP0 and see how many security updates you need to download.

As a programmer with more than a decade of experience, I don't care about the number of releases for an OS. I care about the timely releases. From my experience, Apple and especially Linux will release a fix as soon as they have it. MS on the other hand seems to go through a PR machine.

Microsoft, I don't care if your product XYZ has a flaw, trust me as a programmer, there will always be flaws. Just release the damn info on the flaw and the URL to the fix. I don't think XP is "crap" because I have had to download more than a GB of updates since SP0. Really, I don't care. As a geek, I actually get excited about a new update from MS. I usually hope for new features, etc.

So, please MS, just publish and release the fixes. 95%+ of people out there don't care if you have 150 "vulnerabilities" or 20. We just want the fix. Give us our "fix" bro!

Re:Yawn

[IamTheRealMike]

I don't get it. You opened port 80 on different machines, and saw different traffic, none of which managed to exploit the web server.

I'm sceptical this tells us much about anything, beyond maybe the set up of your NAT/DMZ. Otherwise you should have received exactly the same traffic on both web servers. Bots don't check the OS before sending their exploitable GET requests.

Re:Yawn

[dezert_fox]

In other news, I am positive that there are no elephants in my house because of the elephant dust I sprinkled on the floor!

Your contention that your OS is secure because you don't see people attacking you is patently ridiculous. That only proves that you're not a prime target. It's just like presidential candidates claiming the PATRIOT act has prevented terrorism; we haven't been attacked so it must be working, right!? The primary security characteristic of a Mac is that it's a low market share OS, so it's not targeted as often.

Re:Yawn

[ILongForDarkness]

True you can't compare a new OS to an old OS. Vista to OS 10.4 or 10.5 should be reasonibly fair. As people have already said there is a bunch of open source stuff in the OS that Apple doesn't control, however, they chose to include it in their product so IMHO they own the bugs (if you don't like it then code your own functionality, or let the end user download it).

Microsoft has come up with the idea of "Patch Tuesday" to control the update process. While your systems might be vulnerable for an extra few days (30 at most in a worst case), you also gain better control over the scheduling of staff to test and deploy the patches. You don't have to go to their website every morning to see if something came out (or have some service that does, a la auto update or what ships with linux distros). Is it better? Well for the security paranoid, no. However, being an IT manager myself, I can appreciate a company trying to make things predicable as much as possible for me. If my site has autoupdate enabled, and things stop working the day after patch Tuesday, the first thing I'll do is roll back a box to the day before and see if things start working again. If so, push the roll back to everyone, then hit the test servers/workstations, and localize the patch problems, to the specific patch/app combo that is the issue. Much, much better than having random crap pushed at random times.

Re:Yawn

[RzUpAnmsCwrds]

I am personally tired of the stupid "insecure" talk. My iMac runs my servers with ports 80, 443, 22, 5900 open. I watch my logs and have not seen any bad stuff.

This kind of cavalier attitude is what gets people hacked. Clearly you aren't watching your logs very carefully (or you're blocking those ports externally with some kind of firewall), because anyone who runs an SSH server (which is presumably what you're doing on port 22) knows that you get TONS of dictionary attacks. Before I disabled password authentication (and switched to using key-based authentication exclusively), I would sometimes get 20-30MiB of logs, all failed PAM logins with common usernames and from a variety of hosts. Clearly I'm not alone either.

As a programmer with more than a decade of experience, I don't care about the number of releases for an OS. I care about the timely releases. From my experience, Apple and especially Linux will release a fix as soon as they have it.

From your experience? How do you even know when Apple has a fix? How do you know when the vulnerability has been reported? Are you basing this opinion on fact, or is it your "feel" that Apple is better than Microsoft about this?

Microsoft releases most patches during the Tuesday release cycle.

As someone who works in IT, I can tell you that we don't want patches released "as soon as they are ready". Patches need to be tested, and they need to be tested with other patches. You may not think that Apple patches cause issues, and usually they don't - but even one incompatibility could result in thousands of our users being down for hours or even days. 1000 employees being down costs us $1000000 per day. That's a damn big incentive to get it right.

With the Tuesday cycle, we can test ALL of the critical patches at once, together (about 2 weeks of both automated and manual testing). Then we can roll them ALL out to a pioneer group for a week, and see if any problems arise. If they don't, everyone gets the patch on the 4th week - and the process restarts. Our IT department has people dedicated to doing this cycle.

Guess what? We use the same Tuesday cycle for Mac and Linux patches. So what does Apple's "when it's ready" release process buy us? More time for the script kiddies to reverse-engineer the patch and exploit the vulnerability.

Comparing XP in 2007 to OS X 10.4 or 10.5 is just stupid

Agreed. Why don't we compare something like Windows Vista? Oh, wait, they did. Vista has fewer reported vulnerabilities than XP now, and far fewer than XP had in its first year of release. Not to mention far, far fewer than Mac OS X.

So, what does this mean? Do these numbers mean that Vista is more secure than Mac OS? No. The number of vulnerabilities is a poor measure for how secure an operating system is.

What it does mean, though, is that all is not well in Wonderland. Security is a process, and that process needs to be well-developed regardless of the software used. Mac OS X is not a silver bullet. Neither is Linux.

Re:Yawn

[db32]

In their world remote code execution seems like it should be considered a feature. I can't imagine why they would ship so many of their products with that feature and then patch to "fix" it.

Re:Yawn

[Anonymous Coward]

Mod parent up, my ssh logs have been bursting. I've changed ports because I got tired of watching "bob" trying to log in from China.

Re:Yawn

[chartreuse]

Your contention that your OS is secure because you don't see people attacking you is patently ridiculous. That only proves that you're not a prime target. It's just like presidential candidates claiming the PATRIOT act has prevented terrorism; we haven't been attacked so it must be working, right!? The primary security characteristic of a Mac is that it's a low market share OS, so it's not targeted as often. I think your first statement is largely true (though sadly misinformed as to what is patentable). But I run 10.4 and I get intrusion attempts all the time in my logs, so there's a counterexample. And besides, how would J Random Intruder know whether IP 145.65.24.x is running Windows, Linux, or OS X? True, there might be some telltale aspects to what the machine returns in response to a probe, but that doesn't seem to be deterring 66.230.200.228, 203.218.198.69, 61.75.4.188, or 69.108.102.11 (to pluck a few at random) from repeated intrusion attempts.

Re:Yawn

[p0tat03]

Security can be defined in many ways. A house secured like Fort Knox in the wrong neighbourhood will still be subject to break-ins and robberies, while a house with a simple security latch in a good neighbourhood doesn't have to worry about such things, despite being relatively insecure. Which house would I rather live in? I run a Mac, and given Apple's rising market share I'm counting the days until my intrusion-free status becomes a thing of the past, but I'm enjoying every moment until then. And perhaps I will move to Linux by then (Ubuntu is getting better, though their UI is still too ass-backwards in many places for me to really want to switch).

Re:Yawn

[Bert64]

I would greatly prefer if patches DIDNT include any new features.
They should only fix the vulnerability in question, and nothing else. Adding new features brings potentially new vulnerabilities, and could cause other problems which may delay or stop people deploying the patch.

Re:Yawn

[Bert64]

Scanning for weak passwords does not indicate a vulnerability in the OS...
SSH is the standard for remote administration of unix servers and networking equipment, the mere fact people are scanning for weak passwords shows they don't have many useable exploits these days. If they could scan for something that would give a quick root, they would. Brute forcing is time consuming, and often only yields nonroot accounts.

Re:Yawn

[ILongForDarkness]

I can have my own "patch Tuesday" every bloody week if I want. And you can live in the test lab for the entire month, because we all know you don't have any software to deploy/hardware to fix etc.

If you had proper testing procedures in place you'd know whether something would break or not and you wouldn't have to roll back. Not really an option in my case. I run a cancer centre's IT, we are linked to a hospital and they push the patches down (and have senior management rubber stamp the policy). At best, I can open a Sev 1 with them and tell them what broke and get them to remove it.

Also not a real option at all for a timely patching of systems. We have over 1100 software programs installed in the centre alone, and we are only ~1/5th the size of the hospital. Some of our users develop their own software (PhD's in physics) as well. There simply isn't time to see if each app works after a patch before deploying it, and the only real way for us to get access to the apps is to have it deployed. We have a standard image with windows and office on it, but other than that, some software requires different graphics cards, some requires you only have .Net 1 installed, while other apps need .Net 3 to work, some vendors will only let you run the app on a particular workstation model (FDA) etc. Our test lab would be the nearly the size of the hospital to have all the configurations out there.

The larger apps get tested before the push (PACS, scheduling, clinical assessment), but other than that the damage would be localized for the most part and/or relatively non-critical.

Re:Yawn

[Gr8Apes]

Guess what? We use the same Tuesday cycle for Mac and Linux patches. So what does Apple's "when it's ready" release process buy us? More time for the script kiddies to reverse-engineer the patch and exploit the vulnerability. Sounds like more whining than wanting to deal with a potentially important fix.

If it's important, you check it now, if it's not, it's pushed to the regular update. Considering the number of 0 day exploits on Windows vs Macs....

Re:Yawn

[Sancho]

I'm glad someone pointed this out.

Beyond that, you can't just trust logs. They are easily modified or wiped, if the attack was successful.

Re:Yawn

[Sancho]

So a RHN satellite isn't like a MS Update server? See, with RHEL, you get to patch the machines on your own schedule, and if there's an exploit, then I bloody well want to (and might even get permission to) patch it today. I can have my own "patch Tuesday" every bloody week if I want. It's a different idea of security. It goes like this: once the patch is released, it's trivial to reverse-engineer the changes to find the flaw. Once that happens, many more people will write exploits for it. By releasing patches on a fixed schedule, businesses can plan around that schedule so that they aren't blindsided with a major vulnerability that needs to be tested and deployed. A company which is concerned with security can plan, every Tuesday, to see which patches came out and evaluate whether or not they should be deployed. With an erratic schedule, one might delay patching because you've scheduled other, high-priority activities for that day, and that delay could lead to a compromise.

It's sound logic, honestly, but it's mostly only necessary since Windows is as cobbled together as it is. It's pretty rare that security updates in the Linux world break the operation of the machine. When I still used Windows (several years ago), it was pretty much expected.

Re:Yawn

[Sancho]

Preach on!

This is something that bugs me about lots of Open Source Software. Although some get it right by maintaining a security branch, far too many mix patches and new features in the same branch. It goes beyond just the possibility of introducing new bugs--it changes program functionality into something untested.

The best way of doing it (in my opinion) is to set your target features, code to that target, branch, and move on if you want more features. Fix security issues in the old branch so that I don't have to upgrade and get the new features. If you want to maintain a beta branch that fixes security issues while adding features, that's fine, but it should clearly be beta, and it'd be nice if the release cycle was reasonably consistent.

Re:Yawn

[Anonymous Coward]

Clearly you aren't watching your logs very carefully (or you're blocking those ports externally with some kind of firewall), because anyone who runs an SSH server (which is presumably what you're doing on port 22) knows that you get TONS of dictionary attacks. Before I disabled password authentication (and switched to using key-based authentication exclusively), I would sometimes get 20-30MiB of logs, all failed PAM logins with common usernames and from a variety of hosts. Clearly I'm not alone either.

Did I say what services I am running on those ports? Nope. Port 22, doesn't do SSH. I do port knocking for everything but 80.

From your experience? How do you even know when Apple has a fix? How do you know when the vulnerability has been reported? Are you basing this opinion on fact, or is it your "feel" that Apple is better than Microsoft about this?

Apple uses a lot of Open Source code in their OS. Their printing system for example. Keeping up with open source vulns. helps wrt Apple. You cannot say the same for MS.

With the Tuesday cycle, we can test ALL of the critical patches at once, together (about 2 weeks of both automated and manual testing). Then we can roll them ALL out to a pioneer group for a week, and see if any problems arise. If they don't, everyone gets the patch on the 4th week - and the process restarts. Our IT department has people dedicated to doing this cycle.

Yeah, I hear this all the time. After working at two fortune 500 companies, I can tell you that MS "critical" patches don't always work that way. Oh, and how great is it to wait a few weeks for a critical patch to be applied? One Tuesday a month?

Vista has fewer reported vulnerabilities than XP now

Keyword highlighted. I wish I was a big multi-billion company with a big PR department to make it seem like my latest flop is better. If Vista is really so "secure" and great, why are people switching from it?

Security is a process

Thanks! All this time I thought I could buy a box of "security" for $99.99. Quick, how to get mod points on /.? Say "Security is a process".

Re:Yawn

[Anonymous Coward]

Beyond that, you can't just trust logs. They are easily modified or wiped, if the attack was successful.

Well, unlike on the Windows machine, there were no attacks in the logs of his Mac.....hrhrhr.

Re:Yawn

[stewbacca]

Weak passwords are overrated. I use all lowercase letters that are merely a form of my name. I've never been hacked, and I ran NO password for over 5 years (how's THAT for cavalier?). Hack away, if you can. I'm running OS X.5.1. and I'd give you my IP address, but I'm a Mac user and I'm not supposed to know where to find that ;-)

Re:Yawn

[coryking]

Don't forget patch Tuesday isn't a hard and fast rule. If there is a nasty vulnerability with code already in the wild that exploits it, Microsoft obviously isn't just going to go soup nazi on your ass and say "no patch for you! come back on Tuesday!". They'll push out a critical fix as soon as they can and you better damn well deploy it across the organization.

If there is no (known) code in the wild that exploits a security vulnerability, it makes much more sense to push out the fix on a routine schedule (for all the reasons given in the parent post). Once they push out a patch, people will reverse engineer it and *write* code to exploit the vulnerability.

Re:Yawn

[coryking]

It's pretty rare that security updates in the Linux world break the operation of the machine. In my experience, this really, really, really depends on the distro and how they manage "third party packages". If your running Gentoo, security patches don't often get backported. Typically, the only way to fix a security issue is upgrading the software version and all it's dependencies.

Even on my beloved FreeBSD, the only part of the OS that gets backported security fixes is the core. Thankfully, the "core" of freebsd is much bigger than the linux core, which is only the kernel. Most of the ports dont get backports on FreeBSD either, but there are some very large exceptions to this, like apache, mysql, postgres, etc.

So yeah. I guess the only people who have really nailed this is debian or maybe redhat. I'd say the biggest difference between distros *is* how they manage backports.

Re:Yawn

[Ant P.]

Guess what? We use the same Tuesday cycle for Mac and Linux patches. So what does Apple's "when it's ready" release process buy us? More time for the script kiddies to reverse-engineer the patch and exploit the vulnerability. Do you sit there crying when Microsoft releases out-of-band patches for 0-day holes too? Because they do.

Re:Yawn

[mjwx]

So why is this Apple's or RedHat's or Novell's or Canonical's or whosever problem?

He elaborated this, patches need to be tested to make sure they work together and don't screw stuff up. It's easier to do this if all patches are released on schedule with the exception of high priority patches.

No, security is a response, and that response needs to be rapid and effective

No security is not a response it is a process, proper security is a preventative measure. A response it what happens when your security fails. Security is to predict threats and counter them before they happen not after and poor patch management is a security threat.

An appropriate response to a particular security hole might be to limit network connections

Once again here you go, this action should not be a response, this action should be a preventative measure. Default Deny is a preventative security measure, the process goes - if I am not using this port, block it.

I'm an "as someone who works in IT" too. Go figure.

I am someone who deals with IT security every day and if I'm responding to something it means my security measures were ineffective and need to be re-examined.

I win.

Actually, You Lose. If you were running my IT security I'd say we all lose.

Re:Yawn

[weicco]

an artificial MS-like schedule on security

It is far from artificial. It was the industry which demanded it and MS implemented it.

I'm an "as someone who works in IT" too

Obviously you shouldn't.

Re:Yawn

[Bert64]

Your password isn't as weak as "root" "test" or "password"... So long as there is lower hanging fruit you'll be just fine. The more user/password combinations someone tries the longer their scanning takes. So the kiddies will select their wordlist based on the lowest time expended to acquire access to a system.

Re:Yawn

[Bert64]

Well, open source tends to offer the best of both worlds in this respect.
If you want a supported version that will only have security patches and no feature upgrades, several linux distributions operate in this way, such as debian stable and centos.
Of course you are still free to install the updated feature versions of packages too, if you wish.

Microsoft give you no choice, there is typically only a single patch for a given hole which may or may not introduce new untested features or change functionality, or even fix other undisclosed vulnerabilities (leaving you wondering why the hell a patch for X is modifying Y).

Re:Yawn

[qinjuehang]

What currency do you mean? If its USD, you might mave an extra zero. Unless everyone earn $20,000 a month?

Re:Yawn

[Anonymous Coward]

While your systems might be vulnerable for an extra few days (30 at most in a worst case)...

Except when they skip a Patch Tuesday like they did at least once this past year. Then you're left for over two months with a gaping hole in the OS.

Re:Yawn

[666999]

Guess what? We use the same Tuesday cycle for Mac and Linux patches. So what does Apple's "when it's ready" release process buy us? More time for the script kiddies to reverse-engineer the patch and exploit the vulnerability.

That doesn't really sound all that brilliant, to tell you the truth. Waiting a whole month to install a security patch/update is something that I think should never happen in a place of business.

Perhaps the testing schedule could be sped up somehow?

Testing updates at our office is done in a matter of hours, not weeks. I'm not saying this is going to work with businesses with thousands of machines, but for our sub-hundred setup it works quite well.

Depends on the severity

[Roger W Moore]

The simple number of vulnerabilities is not a good metric of security. I seem to remember that one of the Windows ones last year was one where displaying a picture in a web browser, ANY web browser, could compromise your machine. I don't remember seeing close to that severe for a Mac.

In fact you could make the argument the other way around: the reason there are so few fixes with Windows is because the problems are so big and far reaching that it takes a lot longer to patch them. This conclusion is also probably wrong but is just as valid as the one in the original post.

Re:Depends on the severity

[Anonymous Coward]

I seem to remember that one of the Windows ones last year was one where displaying a picture in a web browser, ANY web browser, could compromise your machine. I don't remember seeing close to that severe for a Mac.

What about the iPhone exploit where viewing a TIFF image in Safari resulted in arbitrary code execution? I bet Mac OS X was affected too...

heh?

[rice_burners_suck]

Let's assume that the software engineers working at all companies are equally qualified. On average, that will probably turn out to be true. Assuming that all programmers are equally qualified, let's assume, only for the sake of argument, that all software is released with a similar quantity of security flaws; say, X amount of flaws per Y amount of code. Now ask yourself this: Does having lots of fixes released on a constant basis imply something about the security of the company's product? Or does it imply something that is totally unrelated to software, which speaks not of the software's initial security status, but of the company's policy towards servicing flaws as they're found? I think that ultimately, all software will contain some level of bugs; the company's policy towards fixing them is what determines security.

Flaming Article

[kaoshin]

I invented my own OS, which I call F.U. (Frackin Unix). My OS has only one bug (Bug #1 - Operating System Not found). Clearly my OS is more superior than any competitors due to its extremely low number of bug reports.

Re:Flaming Article

[Anonymous Coward]

That's a feature. Not a bug.

Re:Flaming Article

[Mister Whirly]

Likewise I am still waiting for the first OS/2 exploit. Crossing my fingers it will be soon. Then on to infect my TRS-80, and my old Atari 800.

Re:Flaming Article

[sankyuu]

> My OS has only one bug (Bug #1 - Operating System Not found).

Access violation -- index out of bounds

They just keep coming :)

Re:Flaming Article

[Viceroy Potatohead]

I think you are fudging your numbers. Clearly, you are BIOSed.

Re:Flaming Article

[n3tcat]

I think I found that bug in WinME this one time also...

Reissue only counts once?

[TheSkyIsPurple]

He shows CVE-2007-3896 only in July, but it was reissued in November as well... why wasn't that counted in November?

The July patch closed that CVE, and the November patched more of it... It should count both times, since they said it was closed.

I'd be interested to analyze them all next to each other, but not interested enough to actually dig into it myself =-)

What's the point?

[thousandinone]

Vista was a lost cause from the get-go, and OSX is still largely a 'niche' operating system. Is comparing the number of exploits in either truly noteworthy?

Reminds me of the Firefox & IE Topic

[jessiej]

There was a discussion about firefox and explorer security that this topic reminded me of.

Patching is good... duh

[Foofoobar]

So when people acknowledge bugs and fix them, the windows crowd bashes them?? So we should all be like Microsoft and just say that something isn't a bug until something critical happens and THEN issue a patch? Or wait until consumers are so pissed about it that it requires the company to issue a patch?

Frankly, I would LIKE a product to ship flawless but realize I dont live in a fantasy world so prefer them to fix their flaws in a timely fashion as they find them and am happy that the Mac, Linux and BSD communities respond in such a fashion.

Re:Steve Jobs and Security

[Anonymous Coward]

You must be a virgin.

Obligatory

[Malevolent Tester]

But Microsoft are a CONVICTED MONOPOLY!111!11

Cool

[Anonymous Coward]

Yeah, I just checked -- your logs don't show any bad stuff coming through the Macs. Still, I was surprised by what I got just by typing "Oracle Password" into Spotlight.

Sounds like a population problem to me...

[Anonymous Coward]

If you're looking at vulnerabilities on new installations, in particular. In that case, you'd be comparing the thousands of licenses sold for OS X this year to the dozens of licenses for Vista that were purchased voluntarily this year.

Well....

[gandhi_2]

Even a blind squirrel gets a nut now and then. (:

Re:Well....

[Doonga2007]

It seems the nut was poisonous... http://it.slashdot.org/article.pl?sid=07/12/18/1847233

In other news..

[Selfbain]

Bush is the best President in history because he has fixed fewer problems.

Re:In other news..

[IdeaMan]

Help me out here, is that supposed to be modded funny or insightful?

Re:In other news..

[Hillgiant]

Yes.

Security advisories

[courteaudotbiz]

I receive daily many security advisories about patches, updates and vulnerabilities discovered in most IT spheres. If I was to count flaws on every products, I would say that Linux and Unix products are the poorest products regarding vulnerabilities. Obviously it's not the case!

It is far more critical to have a Microsoft Windows flaw than a Mac or a Linux flaw, since the product is more widespread, so more likely to be actively and successfully exploited. Dumbly counting the numbers is a strange way to say that a product is more secure. Do I have to remember anybody that most viruses and spywares are .EXE files???

Wonder why...

[labmixz]

Ya... doesn't take a genius to figure out, the more something is widely used by the public the more flaws/security holes will be discovered. Mac's are much better than Windows in handling security, however it's kind of a new brainer when Mac's haven't been so much in the "public" eye for years to not hear much about security flaws, yet when the public is now jumping on the bandwagon... more people are going to discover more things and this will peak the malicious interests... so big fat... "DUH"...

Re:Steve Jobs and Security

[Selfbain]

If it appears in a movie, it must be true.

Re:Steve Jobs and Security

[falcon5768]

you realize that was a movie right? Even moreso you realize it was a FICTIONALIZED TAKE on Jobs and Gates, in the same vein that Titanic was true?

Right?

And people wonder why our country is going to hell....

Several problems

[jd]

First, most announcement services won't/can't announce until the vendor approves. If Microsoft doesn't approve any announcements, then they will always be "perfect" by counting announced flaws. Second, the exploitability of a flaw matters. A hundred flaws that could never actually leave a system vulnerable in practice would obviously be superior to even one single flaw that leaves a system wide open to attack. Third, not all announcement services will cover all reported flaws. There are too many OS' and too many bugs being discovered to report everything. As a result, there is bound to be some degree of cherry-picking. It's not to say anything bad about any given service, it's just a consequence of the volumes involved. Lastly, there is the quality of the bugfixes. I can't remember the last time anyone actually recommended the first Microsoft service pack for an OS, although that's by no means unique to them.

In the end, it is impossible to analyze the security of software by means of analyzing second-hand or third-hand reports, and extremely difficult to do so by means of black-box testing by means of probably incomplete documentation. However, I cannot seriously imagine Apple or Microsoft conducting a thorough security audit and software analysis. For that matter, I don't believe either could afford to do so. Microsoft may be rich, but Vista is big and the kind of skills required to conduct a comprehensive audit wouldn't come cheap, certainly not in the volume needed to conduct such an audit fast enough to get the results before software changes invalidated said audit.

(Having said that, given that the world economy is so utterly dependent on the reliability of the IT infrastructure these days, there is also the question of how long it will be before it is uneconomic at a global level for there not to be such an audit. If an audit would cost a trillion dollars over the course of a year, then it only requires the total direct and indirect cost to business and government over the entire globe from such flaws to be a trillion and one dollars over the course of a year for it to be worth it almost instantly. However, the costs of flaws will always add up with interest but a single audit might easily be sufficient for the lifetime of an OS, if it's good enough. Given a long enough shelf-life and a high enough interest rate, how unreliable can we afford to have any software these days?)

Only 3.67 a month?

[LuminaireX]

I don't know which Windows Update you're counting, but I download 10 (on average) every month.

Re:Only 3.67 a month?

[adisakp]

I realize that AutoUpdates installs something nearly daily from Microsoft but how many of those OS "updates" are the weekly MS Genuine Advantage, MS Malicious Software Removal Tool, MS 'Windows Update' Update, MS Windows Defender Definitions (new almost daily), etc -- none of which actually fix any bugs.

Microsoft SDL is making a difference

[mrkitty]

bash microsoft all you want however their new SDL is really making a difference in securing their products. of course they will continue to have issues it won't remove all the issues, however it has reduced their bug count big time. Take IIS 5/6/7 as a great example of how their process is making a difference. Bash away MS bashing zealots.

Re:Microsoft SDL is making a difference

[VGPowerlord]

Wow, Microsoft uses SDL in their products?

Does this mean we'll be seeing IIS on Linux or OSX soon?

Re:Microsoft SDL is making a difference

[mrkitty]

Glad you know how to use google. If you scroll down a little bit it clearly states on the microsoft URL 'Security Development Lifecycle'.

Re:Microsoft SDL is making a difference

[VGPowerlord]

I didn't use Google to look up SDL, I knew about it long before that. It was present in the Unreal Tournament server distribution back when I ran a private UT server something like 6-8 years ago.

Broken study?

[IamTheRealMike]

I clicked through a bunch of the vulnerabilities, and a lot of them are marked as reserved for future use. What's up with that? I think whatever script the dude used to compile this table, didn't work - either that or I don't understand the CVE process being used, because I don't see any indication of which systems are affected by them.

Anyway. Such a study is ultimately pointless, we already know that MacOS X and Windows are both seriously insecure. A single vulnerability in the tangled morass of code making up modern web browsers is typically enough to compromise the entire machine (Vista being an exception to this). A single vulnerability in *any* app which talks over the network is usually enough to get your code onto the machine, and from there you have free reign to do more or less whatever you want. Requiring root is no panacea, you don't need root to do the things modern malware wants to do anyway. As that's the entire OS X desktop security system right there, we can surmise that the primary advantage it has security-wise is just obscurity. (yeah, i know 10.5 is supposed to have MAC for some basic daemons etc .... wake me up when it is properly and widely applied to desktop apps).

What a joke!

[99BottlesOfBeerInMyF]

So I took a look at a few sample vulnerabilities and it leaves me Flabbergasted. The person who wrote this article and composed the data should be beaten. The ones listed as OS X vulnerabilities are primarily holes in software that runs on OS X, much of which does not even ship with OS X by default. A lot of it is holes in various Web server modules, some of which do ship with OS X, but are disabled by default. Some of them are NOT EVEN VULNERABILITIES... like CVE-2007-3876 which is a number reserved for use by an organization for the next time they report a vulnerability, but they haven't assigned it to anything yet. Whole ranges of numbers listed are like that. I mean did the author even click on the links he's providing? I tried, I was more than twenty items into the list of "highly critical OS X vulnerabilities" before I found one that actually affected a default install of OS X, and it was a potential denial of service for SSL Web sites if you have a machine in the middle. Of the first 30, 12 were reserved for future use and not real vulnerabilities, 7 were holes in the same Perl library, and 5 were holes in tcpdump. Only one was a real, hole that could be exploited on a default install without additional software being added, or it being reconfigured as Web server or something.

Another question is, for the real vulnerabilities to the OS's, how do they decide what the danger level is for a vulnerability? For example, one low rated one for WinXP (CVE-2007-2228) was a possible remote exploit, whereas a Highly cCritical one for OS X (CVE-2007-0267) was a denial of service on a machine, requiring a local user account. Does this make any sense to anyone?

I'm all for pointing out security problems in OS X and other OS's and doing comparisons of relative security, but this is just a sad joke. Please, can we at least get articles by someone with the tiniest bit of a clue instead of the number game from someone who might be able to count, but apparently can't be bothered to read his subject matter.

Re:What a joke!

[Jason Levine]

The quote on the bottom of the page seems oddly appropriate.

Weinberg's Principle: An expert is a person who avoids the small errors while sweeping on to the grand fallacy.

Re:What a joke!

[moshennik]

I was actually going to comment about the same.. i do have a few additional comments. - Some of the listed issues don't even apply to MacOS when you look into description.. just start from the top * CVE-2007-1218 * CVE-2007-1661 and at least 10 out of 20 or so that i checked. Others have several references to the same issue. A number is for third party products (openssl, etc). However packaged MSFT products are not included.. as far as i can see there are 123 advisories for IE 6.x http://secunia.com/product/11/?task=statistics_2007 Lies, damn lies, and statistics..

Re:What a joke!

[pavera]

The very first one on the list for Dec is a whole in Adobe Flash Player, and on the page it lists an MS security advisory for the bug which says windows is vulnerable, AND its still not included in the count for MS bugs... Joke indeed

Maybe I can't count...

[stonertom]

How many times does it have to be repeated? Counting vulnerabilities is a stupid way to measure security. Aside from this TFA says: Windows 44 / MacOS 243. When I looked on Secunia it says 30 for Windows and 26 for MacOS. When I looked at some of the mentioned reports LOADS are "reserved" (I'll list some at the end). If counting is worthless how good is counting incorrectly?

CVE-2007-5850 H
CVE-2007-5851 H
CVE-2007-5853 H
CVE-2007-5854 H
CVE-2007-5855 H
CVE-2007-5856 H
CVE-2007-5857 H
CVE-2007-5859 H
CVE-2007-5860 H
CVE-2007-5861 H
CVE-2007-5863 H
CVE-2007-6077 H

I know that OS X is more secure

[AccUser]

I know that OS X is more secure, because I use it every day, and I can rely on it. I am a Mac fan boy, but only because Windows continued to let me down.

Re:I know that OS X is more secure

[Jackie_Chan_Fan]

i used osx recently on a final cut edit station and my head blew up. Its an ok OS, but theres a lot of stupid in there :)

Re:I know that OS X is more secure

[Bert64]

Your not used to it, you've not used OSX enough to get used to it.
People don't like change, and will prefer what they're most comfortable with. Very few people will even spend enough time with something else to get used to it and realise it's benefits.
It takes a lot for people to change, they have to see significant value in doing so before they will try, but once they get used to something else they will stick with it (unless it's found to be significantly worse). The longer they use it, the greater the chance of sticking with it.

I'm most comfortable with unix, before that i used an amiga. I liked the amiga a lot, and i was very used to it and very efficient at working with it's os, however i saw significant advantages in switching to unix (no new amiga hardware was being made, third party software support was dwindling, a lot of the third party software was overpriced and inferior to windows/mac/unix equivalents which were often free, any poorly written app could bring down the whole os - even the overpriced apps)...
After the initial learning curve of linux (redhat 4 or so) i got used to it, broke my amigaos habits, became used to the advantages of unix and learnt of many new ones i wasn't aware of at the time.
I also quite like macosx, because of it's similarities to unix but i could never get to grips with earlier versions.
I've never been able to get on with windows either, the window manager doesnt suit me at all, and the commandline is weak (aside from being different from what im used to)

Re:I know that OS X is more secure

[Anonymous Coward]

Yes, but more people use Windows every day. So by your logic, more people believe Windows to be more secure, since they use it every day and rely on it.

Re:I know that OS X is more secure

[Jackie_Chan_Fan]

i definitely was not used to it but there were things i found frustrating like final cut crashing more than any windows program i've ever used :)

I got used to it as i used it, but not really enough to make an informed decision. I admit that. I do like Macs but i had my fill that day :)

Re:I know that OS X is more secure

[Bert64]

Hmm, never used final cut myself...
None of the mac apps i use tend to crash on me, tho i would quickly switch to different apps if they did.

OSX has more open source

[gilesjuk]

OSX has lots of open source commands and daemons. It will be subject to more patches.

The fact there are more security holes being patches can also indicate there's more pro-active review.

Two Words

[Swift2001]

George Ou.

Ya but.

[Halmos]

I haven't used virus/"vulnerability" software on my Mac since OS 7. Still don't in OS X Leopard. All's well.

Re:Ya but.

[Anonymous Coward]

Well, yeah, but that doesn't mean you're secure. I don't bother with anti-malware software on my PC either -- I figure that if there are going to be unsavory people loading my PC with a whole bunch of crap that slows it down and makes it less reliable and then helping themselves from my bank account, it may as well be criminals as Symantec.

Re:Ya but.

[Anonymous Coward]

I recently enabled the firewall in Leopard and this kind of things start to show up;

Dec 19 21:13:51 iPhonetunes Firewall[38]: Stealth Mode connection attempt to TCP 192.168.1.74:52630 from 209.225.0.101:80

Any idea?

cheers
Robin

Are there Vista exploits in the wild

[Yergle143]

Comrades, I am a mac/ubuntu user who sort of tunes out Microsoft OS. So I don't really know this: In terms of practical security, is Vista a success? In other words as a haven for: the zombie army of spambots, viral/worm propagation, malicious spyware has Vista fixed the problem compared to XP? Forget theoretical exploits, has the tide turned? (Or does user ignorance negate any advances?) ---537

Re:Are there Vista exploits in the wild

[OXOTHNK]

I'm so frustrated with Vista that I've been debating coming over to Macs/Mac OS now (even though it would put me into debt) ever since I got my new laptop (Tohisba Satellite series).

I find that Vista's "security" features are no more than irritating pop-ups, which people tune out after a while, since so many come up. As far as I can tell, they basically just make you sign off on all of your stupid decision three times as much as they used to - so that when something happens, the user is fully responsible.

Vista gives my machine - which has ample processing power - terrible processing speed problems. Its Big-Brother-esque elements, which I won't even get into, are straight-up frightening. It's Office application compatability issues are PATHETIC. The new "Word" is a mockery to educated consumers worldwide. It's like, they added some totally trivial bells and whistles, like the stupid sidebar (see the RSS reader offering for the definition of "stupid"), and a couple of window-to-window Windows Exlporer features, and pumped it out in haste. Basically, on the front end of things, Vista is the worst thing that's ever happened to me (I work from home, and have had terrible issues with work due to Vista vs. XP issues). On the back end, I'm actually frightened by some of the things I've read. Frightened, if not horrified.

Stick with Linux. A friend of mine, who runs "Free Geek Vancouver" (Google it), introduced me to Ubuntu a few weeks ago, when I was having Vista issues. Not only did it get onto my computer and tell me that there was nothing wrong with my computer - just Vista - it told me that my computer had a battery recall, which I never would have found out about otherwise. Again, Vista is the worst thing ever to happen to me. It's a joke, that isn't funny.

Sure, Bill Gates is crusading for good, and seems to have good values, but many of his employees should be shot over this disgrace called Vista.

Re:Are there Vista exploits in the wild

[coryking]

It will be an interesting 2008, that is for sure. Vista is the first Microsoft OS that will not have ordinary users running as root. If spyware or botnet software wants to sink into Vista, it either has to go through a UAC dialog first, or do it the old fashioned way through a root exploit.

Idiots will always click through UAC dialogs unthinkingly (or worse dumb geeks will turn UAC off completely and run as root like on XP). UAC pops up only when you expect it to, the button or icon will have a shield on it. UAC should never pop up out of the blue, which would happen with a evil program trying to do bad things. I suspect even the greatest of idiot will think twice before hitting okay on a random UAC dialog.

The interesting question is how many privilege escalation exploits will be found on Vista? How long will it take to get those patched? How wide will any botnet program spread using the exploit?

The other interesting thing to track is if there will be a decline in botnet size equal to the rise in Vista installs.

Good times ahead!

Re:Are there Vista exploits in the wild

[Tony Hoyle]

There's no reason whay a botnet needs admin privileges.. if you can open an outgoing connection on port 25 you can send mail for example.

btw. 'UAC only pops up when you expect it to'. Yeah... and I've got a bridge to sell you :p SP1 reduces some of the more stupid popups so the statement is nearly true, but it still surprises you at regular intervals.

(there's also a vulnerability in SP1 - its domain prefix code is broken, so if you have a server in 'foo.com' called 'fred' and you type 'ping fred' it tries 'fred.com' first rather than 'fred.foo.com'. Do that with ssh/email/anything critical and you just gave away your password to the owner of fred.com).

Re:Are there Vista exploits in the wild

[coryking]

Sure they can talk out port 25 all they like, but your virus scanner is running as root. One of the first things a good botnet program does is disable the virus detection software. They can't do that anymore.

Botnets might be able to sniff your files, but they can't sniff your keyboard without running as root.

Yeah... and I've got a bridge to sell you :p SP1 reduces some of the more stupid popups so the statement is nearly true It does have it's share of seemingly stupid popups, better to be stupid and to frequent than lax and never. For example, a normal user shouldn't be mucking with directories outside his home directory (program files), so it should pop a UAC up. A lot of the others are from stupid software trying to mess with said directories as a normal user. I think the trick is a more elegant way to elevate yourself while in file explorer (and friggen make notepad.exe aware of UAC!). The hard part is if Microsoft makes it easy for you, it becomes easy to exploit by evil software. Anything you can do, a script can do.

Bottom line is yeah, botnets can live on a Vista box, but their life just got way, way harder. Maybe you should say "botnets can live on Vista, but probably for a short amount of time before getting discovered and cleaned up". Or something...

It will be interesting to see how botnets evolve to deal with Vista. What kinds of evil things can they do on a limited user account? Can they get your IE/Firefox passwords? Dunno. Can they sniff packets sent out by the user they are running under? Dunno, but I doubt it. Can they sniff my trillian chatlogs? Hell yeah. Can they sniff my saved IMAP password in outlook? Dunno.

Exciting and yet scary.

Re:Are there Vista exploits in the wild

[Anonymous Coward]

Life got harder for botnets? I think not. You forget that normal people get trained to click on popups, UAC or otherwise. You can blame this on poorly written third-party software if you want to, or the users or what have you, but the fact remains that if they have the ability to grant admin access they will.

And odds are good that they will be doing something that causes a UAC popup. Do you even know how botnets work? On our network at least (~8,000 systems) the issue usually isn't failure to patch, or even failure to run AV. The failure is in common sense, what not to click on, what pages to visit. And the bad guys keep getting more inventive. Poisoning google results to get malware sites high in the results, for example.

Re:Are there Vista exploits in the wild

[coryking]

Do you even know how botnets work I know how they work. But some of the tricks they used to rely on aren't as easy in Vista. There will still be idiots who click through UAC's to see "myporn.exe" no matter what. But the fact that "myporn.exe" used to run without *any* kind of warning to the user is what I think the big deal is.

I believe the number of "I run any executable" people is way higher than the number of "I click through scary operating system messages" people. If 1,000 people run myporn.exe, but only 10% of them click through the UAC and get botted, that is a huge improvement over XP! On XP, all 1,000 myporn.exe users got the bot, but only 100 of the myporn.exe users on Vista got the bot. See where I'm going? You still have 100 people running the myporn.exe bot, but it is way better than the 1,000 you could have had.

The question becomes, is my 10% guess high or low?

Re:Are there Vista exploits in the wild

[Bert64]

UAC dialogs are annoying, people will just hit yes without even reading them.
Create a website that tries to install something on a user's machine, make it something totally mundane that just phones home and increments a counter, but make sure the website requires a confirmation dialog first, that tells the user something like "Do you want to install a rootkit on your machine yes/no".
You want to see how many people actually just hit yes and install that? More amusingly that may even be a legal way to install a rootkit, because the user has consented to it.

UAC is intrusive enough that users will get annoyed and either turn it off, or just blindly hit yes...
Similarly, people will get annoyed enough with their badly written apps not working that they just run as a privileged user (i assume unpriv accounts are separate and in addition to uac, i haven't used vista much).
People's solution to forgetting their password, is to turn the password requirement off... They will simply bypass any security that gets in their way. The same is true for firewalls and other "security software", when joe user wants to run his p2p program or play a game and the firewall gets in the way, off it goes.
I remember hearing from someone proudly talking about how much faster his windows box was after he performed some "performance optimization"... He'd turned off the firewall (no more popups when programs try to access the network, his p2p program now ran a lot faster too) and turned off the antivirus (sped everything up).

You need to be secure by default, and have that security not impact the user's daily life. Users are used to an easy life, without needing passwords or such (thanks to windows) so now they're seen as an onerous annoyance. And now windows has gone too far in the other direction, it's security is now more annoying than what unix had originally.
Had people's first and/or only experience of computing been as a nonroot user on a unix system, people would have much different expectations.

Re:Are there Vista exploits in the wild

[stewbacca]

You've pointed out one of the main reasons MacOS is far superior to Vista. I don't ever want to be bothered by a stupid pop-up window, yet Windows takes every chance it can to do so. Even if it is a legit warning, there are so many times where it isn't, that it becomes the proverbial boy-crying-wolf. It isn't long until even the smartest of users will start disregarding the messages. You make it sound like anything bad that happens to a computer is the stupid user's fault for getting fed up with a hundred warnings a day, of which one might be credible. Funny, I get none of these warnings in OSX, yet I haven't had a single security incident since day one of 10.0.0.

Re:Are there Vista exploits in the wild

[stewbacca]

Sell your Toshiba on eBay (for a loss), then buy a MacBook. If you don't like it, sell your MacBook on eBay (for nearly what you paid for it). That's ONE thing that has kept me on a Mac for the past 20 years.

Re:Are there Vista exploits in the wild

[coryking]

i haven't used vista much It shows ;-) You should play with it a bit more. The admin group on vista is kinda-maybe-sorta like what the wheel group is on a BSDish unix system. You aren't running as root, but you are in a group that can su to it if you want. The admin group on XP had you quite literally running as root. Local users on Vista need somebody in the wheel group to use their credentials to get past a UAC dialog. I forget what it was on XP, but I dont think you could ever run elevated without logging out and in as an admin first (which is why nobody ever ran as a limited user :-)

I still agree with you; on vista, social engineering will become the best root exploit. The good thing is it is hard to fake a UAC dialog and the only way something other than a user can confirm one is via a root exploit. Like you, I can imagine these download sites telling the user "just ignore the UAC that pops up, you can trust us...". As you see already, there are plenty of idiots running around disabling UAC on their computer. (I hope to god they aren't disabling on computers they do not personally own - that is so irresponsible I don't know what to say).

The first big virus that hits vista will result in media all across the globe telling people "dont randomly click through UAC dialogs you idiots!". I remember the slammer or whatever and our local news would always tell you "never run untrusted programs on your computer" at the end of the newscast. Same thing will happen with Vista.

Wanna really make Vista secure? Make it a requirement to sign your binary with a legit code certificate. Refuse to run it at all unless it is signed. I'll bet money we see that in the next couple versions of windows. The question is how do we sign *legitimate, trusted* open source apps? I suspect we'll figure it out.

Re:Are there Vista exploits in the wild

[coryking]

Name a single UAC dialog that wasn't for a good reason. Just one.

Most UAC problems are either the fault of the software vendor being an idiot, or the result of poor UAC integration (I'm looking at you notepad and all the common file dialog boxes, why can't I get a UAC dialog instead of a "permission denied" message?).

You could also say that Vista and windows has a weaker architecture that requires more things to be locked up as root. Most OSX programs are installed on the users desktop or in their extended home directory, right? In that case, you don't need to be elevated to muck around with the application as the files are all owned by you. I dont know if that is a good thing or a bad thing really. It is just different.

Re:Are there Vista exploits in the wild

[coryking]

Oooo... dont forget that almost all new thinkpads have thumbprint readers. Imagine if thumbprint readers became widespread and were on the side of your LCD, or on your keyboard? Imagine if you had to give your fingerprint to click through a UAC dialog?

Something about myporn.exe and fingerprint readers though... I dunno :-)

Re:Are there Vista exploits in the wild

[stewbacca]

How about when I hit the "print" button for my computer that is connected to a printer right down the hall?

Most UAC problems are either the fault of the software vendor being an idiot, or the result of poor UAC integration

Does that even matter? All the user sees is a hundred UAC messages a day that make no sense. Poor UAC integration would be leaving it turned on.

Re:Are there Vista exploits in the wild

[coryking]

So have I been trolled yet?

Your printer sounds fucked up. That is not an example of a legitimate UAC dialog. Nor is that Vista's problem. Talk to your idiot sysadmin or talk to the idiots who wrote the printer driver.

If you are getting UAC dialogs to print, you've got bigger problems with your computer than Vista. I always wonder if these "100 UAC a day" people have spyware that was happily running on the XP box they just got done upgrading from?

Re:Are there Vista exploits in the wild

[Bert64]

And so swiping your thumb will become as instinctive to users as clicking yes, ok or next.
And serious criminals wanting to break into a machine will simply cut off your thumb, i hate the idea of biometric authentication. At least with a password they need to keep you alive to extract your password from you. Very few people are willing to lose body parts to protect their data.

Re:Are there Vista exploits in the wild

[Bert64]

Any code signing system will harm users more than it helps them.
It will create a cartel, preventing free development of applications, how much will this hinder people who simply want to program in their back bedroom?
Only companies with sufficient money will be able to release software, this is microsoft's wet dream because it will shut out open source developers.

Malware is big business, so companies profiting from malware will simply buy certificates for their rootkits. And because the whole system would revolve around money, anyone could bribe their way into a position of trust.

And not to mention the chance that the signing authority could be hacked, resulting in all kinds of malware being signed.

Microsoft knows code signing would do little or nothing to improve security, they are pushing it as a way to exclude independent developers. Other companies they can buy, but open source they can't do much about.

Re:Are there Vista exploits in the wild

[stewbacca]

LOL. I'm printing your post and taking it to my idiot sysadmins. Considering I work for a large software company that is CMMI Level 5 certified, a Microsoft Certified Partner, and ISO 9001:2000 compliant, they'll get a good laugh at your post. You sound like "that guy" who is eager to help anyone/everyone fix their windows PC only to dork it up even more.

Re:Are there Vista exploits in the wild

[coryking]

Whatever dude. Printers don't trigger UAC dialogs. IHBT.

Re:Are there Vista exploits in the wild

[soulhuntre]

Fire your idiot admins. Seriously. Then tell us what company you work for so we can make sure to never trust them with any important data.

You woudl have to be some sort of idio-admin-savant to get UAC prompts in the situation you described.

Re:Are there Vista exploits in the wild

[stewbacca]

So you are saying that network settings NEVER trigger UAC dialogues? No wonder you refuse to believe that UAC is an annoying, useless, poorly thought out waste of time. You don't believe the hundreds of claims on slashdot that we are innundated by UAC dialogues because you don't WANT to believe it. You even go as far as blaming everying under the sun EXCEPT Vista, which is strange, because BEFORE Vista, there were no annoying UAC dialogues.

Re:Are there Vista exploits in the wild

[stewbacca]

Yep. Keep blaming the admins. They are the ones who obviously wanted to make sure that the 300+ developers, engineers and tech writers aren't able to print any work over a network printer. Funny how those same idiots were able to get it to work fine from our XP boxes (and from our Linux VMs as well).

Re:Are there Vista exploits in the wild

[soulhuntre]

I'm sure it's not what they wanted - they're just incompetent.

The reality is that thousands of corporate networks hosting hundreds of thousands of users manage to print over a network in Vista without UAC issues. Hell, I have 11 clients that do it myself. Nothing special had to happen... just add the printer and you're done.

So you're either lying or your admins suck.

Re:Are there Vista exploits in the wild

[stewbacca]

Typical slashdot mentality...of COURSE it's the stupid administrators' fault. Just because YOU haven't had problems with network printing and UAC controls doesn't mean other's haven't. You asked for "one" example and I gave it to you. Of course, you don't want to believe it, because it doesn't fit your argument.

Re:Are there Vista exploits in the wild

[stewbacca]

http://www.google.com/search?hl=en&q=UAC+network+printer

Just in case you still think I'm making it all up... Seems like there are plenty people having the same issue with UAC and network printers.

Re:Are there Vista exploits in the wild

[soulhuntre]

Actually, I didn't ask you for an example... that was someone else. You might want to read these things.

Re:Are there Vista exploits in the wild

[coryking]

This is a dead thread but...

Malware is big business, so companies profiting from malware will simply buy certificates for their rootkits. True.dat.

The cert authority can revoke the certificate though right? probably not until it expires, right?

Either way, it is an expensive hurdle for script kiddie botnets to leap over. A blessed botnet.exe suddenly becomes something only organized crime can acquire (that is, unless the cert authority is hacked by the script kiddie botnet owner :-)

they are pushing it as a way to exclude independent developers That is one way to interpret it. I dont agree they are out to deliberately screw developers, even if that is the result. I think they are doing it to bring some kind of accountability to the table.

I suspect we'll see some non-profit organization provide code certificates to trusted applications. I'd also assert that you have no business distributing software to random people if you cannot afford the certificate. That is a big assertion though, and I dont entirely belive it myself. I'm thinking contractors (like myself) and custom applications for "mom and pop" break my bold assertion. I will assert shareware apps you download from "download.com" should all be signed, period. Regardless, we are in a very grey area on how to define what should be signed and shouldn't, aren't we :-)

So the question becomes, do certificates provide *any* measurable win? I'd say yes. I'd also say your objections are valid as well. Does the win outweigh the cost? I dont know.

Re:Are there Vista exploits in the wild

[stewbacca]

You, as in first person plural, as in you Vista apologists.

Re:Are there Vista exploits in the wild

[soulhuntre]

Since the problem you describe is a local one caused by the incompetence of your IT staff, I doubt any of "us" need to apologize for it at all :) However, in the interests of good faith I will...

I'm sorry your admins suck.

Re:Are there Vista exploits in the wild

[stewbacca]

So now my admins are responsible for the hundreds of google search results that result from people having problems with newtwork printing and UAC??? I suppose my admins are responsible for all the stupid default behavior of UAC too, because they are too incompetent to go in and remove stupid UAC features like not being able to rename Start Menu items, or not being able to rename files across the network that I am the author of? I could go on, but we only use Vista as a test platform, and I "only" get about 10 or so UACs a day on it. Not bad, I guess, considering I only use Vista about 10% of the time. Maybe if I upped my usage to 90-100% I'd get to the normal 100 UACs a day I referenced earlier.

Re:Are there Vista exploits in the wild

[OXOTHNK]

I'm SO close stewbacca...it's the price that deters me. I know that you pay for what you get, but holy crap is there ever a monetary divide between the two. I'm no rich man. I use Meemo instead of a Crackberry for mobile e-mail. I make soups with my extra vegetables, and I'll be eating Turkey stock well into June after this holiday season. That said, I may -unavoidably - have to take a hit for my poor choice in this case.

Re:Are there Vista exploits in the wild

[stewbacca]

I think /. has been all over this before. At the end of the day, there really is only +/- $200-$300 difference between Macbooks and equally configured PC clones. Turkey stock is tasty, btw.

Re:Are there Vista exploits in the wild

[OXOTHNK]

Hell yes Turkey stock's tasty! I guess I should have said - relatively speaking - considering that I'm a student, for me there's a price and time cost that's been holding me back. I agree that /. has covered this subject, if not beaten it within an inch of its life. Cheers,

Re:Are there Vista exploits in the wild

[Macthorpe]

I clicked your Google link.

The articles all describe a scenario that you have to click through a UAC prompt ONCE to add a network printer, and if it's turned off you won't be able to add it. It is a bug, yes, but it's in the process of being fixed.

That's certainly not "I have to click a UAC prompt every time I print something." In your case something actually is seriously wrong.

Re:Are there Vista exploits in the wild

[stewbacca]

It's still "one" example, though. Look, I'm done with this conversation, since apologists will never accept anything that goes against their POV. I know what I know, and it seems millions of others are sharing the same frustrations as me when it comes to uber-chatty UAC dialogues. You have to ask if the supposed security benefit is worth the interruption of users' work flow or not. In my case, it ISN'T. But then again, I'm not some paranoid conspiracy theorist that would rather lockdown my computer to the point that it is nearly unusable either.

Re:Are there Vista exploits in the wild

[Macthorpe]

Look, I'm done with this conversation, since apologists will never accept anything that goes against their POV. You've yet to even provide a shred of proof that what you say is happening even exists save Google links that show a completely different issue. I'm pretty sure you were 'done' before you started typing your first response.

Front Loaded

[CruddyBuddy]

This is ridiculous.

The Windows security problem count is front loaded by several years.

A similar argument can be made that there are more Mac security flaws this last year than Windows 95.

Instead of counting the number of security flaws over the last year, what happens to the number if the count is over that last two years. Three years. (You get the idea.)

"inherently insecure"

[Toreo asesino]

So I put the question to the crowd then...

Is Windows inherently more insecure than OSX for example?

True, you can say "security holes fixed != number of security holes", but then to even be equal on the score cards, Windows, as entire eco-system (Vista + XP) would still need 5 times more the number of vulnerabilities.

I put it to you my techie friends, Windows security isn't so bad after all and has evolved from non-existent to at least on the same footing with it's rivals (that's to say, I agree that I don't think this study can conclude much at all ultimately).

Re:"inherently insecure"

[Bert64]

Can't speak for vista, but XP is definitely far less secure in it's standard setup.

XP encourages users to run as admin, whereas OSX forces you to run as an unprivileged user.
Most of the system services on XP run under a privileged account, whereas OSX sandboxes more of them...
XP ships with considerably more network-listening services by default than OSX does, and it's often not obvious (and definately beyond the capabilities of an average home user) how to turn them off.

That's not to say you can't harden it, but the fact is most home users won't ever do that. Anything designed to be used by technically illiterate people needs to be secure out of the box.

Obvious

[the100rabh]

If it is not usable...It wont have any flaws

No point in comparing 'vulnerabilities'...

[subl33t]

... until there is a self-replicating Mac virus in the wild.

Re:No point in comparing 'vulnerabilities'...

[Anonymous Coward]

But what does it do after it's replicated to both macintosh computers?

Re:No point in comparing 'vulnerabilities'...

[subl33t]

HAHA, wish I could mod this up!

It's just Secunia again. Proceed with the ignoring

[Onan]

Ever since they showed up a few years ago, Secunia seems to have been nothing but a pro-Windows, anti-everything-else trolling group. They've published countless "studies" claiming that Windows is more secure than god, every one of which involves some extremely skewed definitions of what constitutes a vulnerability and how one classifies its severity.

Some glorious day, perhaps slashdot will learn to ignore this variety of trolling (I'm looking at you, Cringely and Dvorak.). But until then, we'll all just need to ignore them individually.

Secunia advises against what he did

[General Lee's Peking]

It was pointed out in one of the responses that the writer of the article did exactly what Secunia advised people not to do. From Secunia's Mac OS X vulnerability report:

The statistics provided should NOT be used to compare the overall security of products against one another.

So it seems there are three reasonable conclusions to draw here. The first is that the author is incompetent and should be disregarded. The second is that the author is dishonest and manipulative and should be disregarded. The third is both the first and the second.

Re:Secunia advises against what he did

[magus_melchior]

(slight OT) Actually, since you didn't present an exclusive or scenario, two conclusions would've been just fine, and both are likely correct.

But then, we humans love nonexistent false dilemmas...

Ballmer?

[Anonymous Coward]

Ballmer, is that you?

third party open source software

[pikine]

Mac OS X contains many third-party open source software packages. The bugs are found through source code auditing. These bugs may or may not become exploitable depends on how the code is used.

Just take a quick look at the bugs list. Most of them are found in third-party code like PCRE library. These are labeled "highly critical" without a demonstrable proof that it can be exploited. The software using PCRE is vulnerable to malformed regular expression strings, but I've never seen any software accepting arbitrary regular expression strings from another machine. (A web browser interprets JavaScript code from another machine, which may contain regular expressions, but JavaScript regular expression definitely isn't Perl compatible, so that's not PCRE.) Those same bugs also affect Linux. If you use Cygwin on Windows, these bugs also affect you, so they can be Windows bugs too.

On the other hand, since we can't audit proprietary Windows code, we only find bugs that are actually exploitable, in contrast to the open source bugs that are only potentially exploitable. Therefore, the severity of Windows bugs are vastly underrated compared to open source bugs. And there are more potentially exploitable bugs in Windows that we don't find, which aren't being counted.

That said, if you rely on bug counts and decide that Windows is more secure for you, I'd call you crazy.

Finally, why would Adobe Flash player bugs be counted as a Mac OS X bug?

Re:third party open source software

[gujo-odori]

In addition to your well-taken points, I'd like to add that TFA also does not seem to designate between remotely exploitable flaws and ones that are only locally exploitable. A flaw that is only locally exploitable, even if it can give the attacker a full root shell if used, is of much less importance than one that can zombie a machine remotely.

I also give some weight to the "greater diligence in patching" argument. This diligence may or may not be Apple's. In many cases, these patches probably originated with the upstream maintainers of open-source software included with OS X and were subsequently tested and released by Apple, and the original vulnerabilities may have been found by the upstreams, or by third-parties auditing the code. This is a strength, not a weakness. The fact that 243 flaws in OS X have been patched this year, compared to 44 in XP and Vista, doesn't mean there aren't something like that number of flaws in Windows. It just means we don't know how many there are, but it's probably some number a lot larger than 44.

That said, it's entirely possible that the statistics are pretty accurate. XP is very mature and there aren't (or so we would hope) to many more serious bugs left to be found in it. Vista is still young and not all that common yet because it hasn't exactly been selling like hotcakes, so it hasn't yet been flogged as hard or or as long as XP has.

Finally, OS X includes a lot more "stuff" than Vista and XP. Much of what would be counted as a totally separate product under the Microsoft system, such as a development environment, etc., are either standard with OS X or easily installed from either ports or the OS X disc. It's kind of like comparing vulnerabilities in a Linux distro to vulnerabilities in Windows. Look at how much stuff is in, say, Debian, compared to how much stuff is in Windows. How do you normalize the patch numbers so that they are really meaningful and relevant. I think there's a lot of "Apples (heheh) Vs. Oranges" in the comparison.

Re:third party open source software

[coryking]

A flaw that is only locally exploitable, even if it can give the attacker a full root shell if used, is of much less importance than one that can zombie a machine remotely. To say local exploits are of much less importance than remote ones is the absolute biggest lie I ever read here on slashdot!

True, local exploits might not be as important on a server that doesn't have anybody on it, but on the desktop where everybody is local, they are a HUGE HUGE issue. They are even more of a problem than remote exploits because most home users run inside a NAT and usually dont get hit directly with portscans.

All it takes to make a remote exploit out of a local exploit is one email with "mouse-on-the-screen.exe" or a single download of "happy-cat-chases-your-cursor-around-the-screen.exe".

Please don't ever spread the lie that local exploits aren't important!

Re:third party open source software

[gujo-odori]

I can't let that pass without challenge.

On the desktop where *nobody is local but me* a local exploit is far less of a threat than a remote exploit. That even though I use Firefox with Noscript at tighter-than-default security settings. A local exploit is still less of a problem because you first need a local shell to even attempt it.

All of my systems are behind a NATting firewall and run local firewalls in addition. They don't listen on any ports. They have no users but me. My data is all encrypted on disk. I scan *everything* and have no Windows systems. Good luck with that local access. Let me no how it works out.

For desktop Mac users, which is who this is about (and Linux users, too, by extension), exploits that require local access aren't much of a problem. Of course, on a locked-down desktop, remote sploits aren't much of a problem either.

Re:News Flash: nothing has changed

[wish bot]

I'm going to post this here because Slashdot's been full of MS shills for the past couple of weeks, and you're conveniently close to the top of this thread.

Security through obscurity will never beat actual security.

Well, here's my token sound bite too...

The proof's in the pudding.

MIcrosoft is the party guilty of underreporting vulnerabilities, including undocumented patches in updates - how much more obscure can you get?! On the other hand show me a significant linux virus or OS X exploit being used in the wild. Well? Where are they? Waiting.....

Re:News Flash: nothing has changed

[Anonymous Coward]

ssshhh....

dont forget linux is more attractive to target for "cool" things like IRC daemons, XDCC bots and whatever. What else has a compiler and a great remote interface (the shell)? Windows are great for a botnet, but nothing else really.

Once you toss PHP into the mix, Linux is a very insecure operating system. I'll take FreeBSD any day. Much more professional development team, better documentation, very stable (as in config management stable) and ports rule.

Of course, I have to post anonymously because if you say anything bad about linux, you'll get modded into the ground no matter how right you are.

Re:Counting vulnerabilties shows nothing

[kholburn]

They weren't counting vulnerabilities, they were counting successful attacks. When you count successful attacks windows still loses really big time. Vulnerabilities, meh.

Re:Steve Jobs and Security

[VGPowerlord]

You seem to be confusing Pirates of Silicon Valley with Triumph of the Nerds, which is an actual documentary.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:News Flash: nothing has changed

[Renig]

NO! The proof is not in the pudding. That makes no fucking sense. The proof of the pudding is in the eating!

Re:Repeat something false often enough...Only on /

[Anonymous Coward]

...can it go from Microsoft Vista to George Bush, Iraq etc. in a few posts

      Repeating the groupthink here is way beyond any sort of organized bias, its now inbred into geekdom and a new dna test will soon emerge that will identify the gene that defines those who are born to believe the following-

-prefers mac or linus to windows regardless of obvious merits of all
-believes that no one can own intellectual property, in spite of deriving income or
  some benefit from some intellectual property in some way, even if it was "way back when"
  and will download to the hearts content and whine when property owners exercise their rights
-its the oil companies, GWB and Global Warming that is preventing widepsread linux adoption
-republicans stole the election from al gore while bill gates supplied the code to hack the
  vote

This place should really be the Obama Campaign Headquarters being that is has become the token left wing blogspot for geeks...zzzzz

I can Has Insightful Analysis

[Anonymous Coward]

Macs R Stoopeed. Microsoft Wynndoze is moore Bettah!

Re:News Flash: nothing has changed

[gnuman99]

One of IE bugs (currently exploited 0-day bug),
  http://secunia.com/advisories/28036/
is not very pretty.

For example of Mozilla bugs,
    http://secunia.com/product/12434/
vs. IE,
    http://secunia.com/product/12366/

Of course, how the fsck how is 3rd party software the fault of the OS, I have no idea. IE is bundled, but can be disabled to browsing web sites (2003 server edition disables it). Most of the software is quite safe these days, but it still depends on how you use it. Exploits triggered by things like web browsers are the worst, but at least Vista addresses that issue by running IE in "lower than regular user account", not sure if that would protect vs. the IE bug in first link.

Summary: stop trolling for one side or another. If you get hacked it doesn't matter if you run Windows or Linux or BeOS.

Re:News Flash: nothing has changed

[noamsml]

Linux [any]?

You're honestly comparing one OS that comes with only a minimal featureset to a plethora of OSs, each of which comes with a full repository of applications?

Come on.

Stop bashing windows

[Reigo Reinmets]

Umm... I've been using Vista for 6 months now, and i have to admit, it ain't perfect - not by a long shot.
It's full of annoying bugs, stupid ideas etc, But unsecure? Far from it(Assuming the user has at least a bit of a common sense and logical thinking).

I've been using my Vista without any anti-virus anti-spyware etc stuff all the time without problems.
Now, i do scan my machine from time to time throughly, but i don't keep the software constantly monitoring etc.

Basically, the way i see it, Vista is at least as secure as any other OS out there,
assuming the user doesn't download and run any strange niceboobs.jpg.exe files(The same goes to linux with shell scripts for example(assuming chmod +x)).

Anyway, what i really wanted to point out is, Vista is crap, it's resource hungry and annoying sometimes but it sure as hell ain't that unsecure as most of you seem to think.
This ain't 2003 anymore and it ain't XP without service packs.

Re:News Flash: nothing has changed

[Znork]

Mmm. Troll (but as there are real 'studies' that make the same error, I'll point it out). Your links say this at the top of the pages:

View Topics > Underlying OS > Linux (Any)

View Topics > Category > OS (Microsoft)

You're comparing security issues in applications that run on linux with security issues in Windows itself.

Re:News Flash: nothing has changed

[Anonymous Coward]

If you don't eat your meat, you can't have any pudding. How can you eat your pudding if you don't eat your meat?

Vista

[Leet0]

Plus 5 leet0 points! for because it R teh funney! no seriously, that's hilarious.

Re:News Flash: nothing has changed

[yakumo.unr]

Your last comments rather redundant though isn't it.

Obviously whatever OS you run once you're hacked, you're hacked but the whole point is that if an OS has more vulnerabilities then it's more likely to happen in the first place.

Re:News Flash: nothing has changed

[mhall119]

Well technically Apollo 11 had more things go wrong than did Apollo 1, but guess which one I would have rather been on?

Re:News Flash: nothing has changed

[jedidiah]

> I'll take FreeBSD any day. Much more professional development team, better documentation,
> very stable (as in config management stable) and ports rule. ...right up until the point someone decides to run PHP apps. [snicker]

Re:News Flash: nothing has changed

[Bert64]

In that respect, any unix is more attractive including bsd.
But your right, many old school hackers will exclusively target unix machines because they are simply more useful from their perspective. People typically only target windows machines to run a particular program (their bot) which has a fixed set of built in capabilities. Gaining access to a shell gives someone far more scope, and makes it much easier to deploy new malicious code.
You will rarely get an attacker interactively connecting to a hacked windows system to do something, but this is common with compromised unix systems. When a windows box is compromised, it's typically by an automated process which will install a bot and move on to the next host. Automated attacks are less common on unix, partly also because of the increased diversity of unix systems.

So what we have learned...

[TheNetAvenger]

From the Mac-Fans...
- If a bank leaves the vault open and doesn't lock the front door, but only has 10 banks located randomly around the country, it is still the best and most secure bank, especially if they have pretty iMarble on the floors.

From the OSS-Fans...
- OS X sucks as much as Vista and everyone is evil.

From the Win-Fans...
- Holy Shit, we thought our crap sucked more than this.

Re:So what we have learned...

[IntergalacticWalrus]

From the people who actually know something about computer security...
- Concluding that a given piece of software is more secure because it has less reported vulnerabilities is a logical fallacy. If anything it effectively shows the opposite, because less known vulnerabilities can indicate that the software was not sufficiently audited, or that its author denies the existence of those vulnerabilities. But then again those factors can not be effectively proven, so in the end it is still a worthless measure of security.

Anyone who claims otherwise is either stupid, grossly misinformed, or a corporate shill.

Re:So what we have learned...

[TheNetAvenger]

From the people who actually know something about computer security

You 'so' have no idea who I am, or you would just have shit yourself realizing who you responded to with this crap retort.

Your argument was somewhat true several years ago. This is the age of communications and the Internet. Your argument is pursing a tangent because it makes assumptions...

Assumptions like Software and OSes don't automatically report breaches, report back findings of trojans, etc.

Windows is the PRIME example of how your argument fails, as Windows Error reporting in XP has identified TONS of vulnerbilities, attempted exploits, etc. Adding in Defender and Vista's enhanced experience reporting, if a trojan, or spyware or exploit is found or used it is usually in Microsoft's hands long before it has a chance to hit the wild.

Not only have "LESS" vulnerabilities been reported in Windows in the past year, it has also had LESS exploited systems in its history, with a perfect Zero exploits if the user's systems have been patched. This is in the league of OS X, and is not a 1 in a million chance of finding a computer running OS X, this is 90% of the computers on the internet.

If you want to poke at OSes that have had MORE vulnerabilities, AND Exploits, you can look no further than Linux or even the sacred cow BSD. Go look up the records and data breaches over the past year at many government and Universities where data was sitting on secure BSD or Linux servers and 'magically' was taken...

Even the freaking Berkley University themselves had their servers hacked in the past year.

Why haven't you heard about these stories? Well apparently you are not someone in the security 'know'... Go look them up.

These headlines also usually don't make it to SlashDot, remember this is the Faux News of the internet, even though the site's original concept had more honorable intentions of bringing light to the OSS news world, the intential bias of bringing news to OSS has turned into attack tactics of everything that doesn't fit the nice neat OSS ideal, even if it means smacking Linus or other strong OSS advocates around to do so.

PS: My original post was a joke, get a life or sense of humor...

faith in humanity

[logicassasin]

"Assuming the user has at least a bit of a common sense and logical thinking"

You assume entirely too much.

It would be obvious

[calebt3]

You would start getting 1 fps, rather than 2. That's a very visible difference.

Re:News Flash: nothing has changed

[init100]

Once you toss PHP into the mix, Linux is a very insecure operating system. I'll take FreeBSD any day.

Can you explain why Linux becomes a very insecure operating system with the addition of PHP, while FreeBSD with PHP is still a secure operating system (which is implied in your post)?

Re:News Flash: nothing has changed

[init100]

You must be new here. :)

This is a very old tactic by Microsoft supporters to make Windows look much more secure than Linux.

Build with bricks not wood

[ChrisA90278]

I think we are comparing Apples to Oranges here. (Sorry could not resist) But it is true Apple counts ever small nt pick fix to every program. For example the recent Mac OS update listed about two dozen fixes. Microsoft lumps this kind of stuff all together and counts it as one fix. The other thing is "Who cares" what mattersis the final result: No one, or "hardly anyone" runs anti-virus or anti-spyware software on a Mac. It is simply not required. The fire wall is open by default too. It is not needed. So given the fact that most Macs have the firewall disabled and no anti-whatever can anyone point to even one Mac that have problems. I'm sure some did but the problem is very rare. On the other hand even with firewalls and anti-virus programs widely used we do hear now and then about eople having problems with Windows PCs. I would have thought that Microsoft as a company would be embarrassed that an anti-virus industry even exists. The fact that it does speaks volumes about Windows. People say it s only because Windows is the majority OS, so it is targeted. Hell no. Could you imagine the "bragging rights" a hacker could get if he was able to write a Mac OS virus that would spread in the wild? Believe me this is the Holly Grail and there is strong motivation. Use this analogy, do termites eat wood houses because most are made with wood and they leave brick houses alone because there are so few of them "so why bother?" No, the engineers who wrote Mac OS X, Solaris, BSD and Linux simply used bricks and avoided the whole termite problem. They built and OS that viruses can't live in.

Re:Build with bricks not wood

[Grail]

Virus protection software is required on any machine on which you might be sending attachments received from other people. For example, if you use Microsoft Office for Mac and receive a Word document for review, you could be a carrier for a macro virus if you were to forward the document on to someone else for them to rubberstamp it.

Twisted, bizarre example I know, but I'm sure there's someone in the world for whom this is not an alien workflow.

Re:News Flash: nothing has changed

[timmarhy]

slammer is still out there as are numerous apache hacks.

and you want to rag on MS for their patching efforts, apple are even worse and flat out refuse to patch some things till service pack time.

Re:News Flash: nothing has changed

[Anonymous Coward]

Wait a minute, slammer was an MS SQL worm! MS as in Microsoft, it doesn't run on any other O/S so that hurts your argument.

BC

Re:News Flash: nothing has changed

[nanowired]

the irony of this all, is that your post is only true on opposite day.

Now I understand....

[TW Atwater]

...why the botnets are almost 100% Mac OS X machines and why they get all the viruses. Windows is just so much more secure.

Re:Now I understand....

[KillerBob]

...why the botnets are almost 100% Mac OS X machines and why they get all the viruses. Windows is just so much more secure

Only takes one vulnerability. Couple that with a market penetration that at one point approached 95% of desktops (and is still well over 75%), Macs simply aren't a decent target. There aren't enough of them out there to make writing viruses for them profitable, though proof of concept have already been demonstrated. Likewise for Linux.

I'm not saying that security through obscurity is the only thing keeping OS/X and Linux machines safe, but it's a major factor. Another major factor is the knowledge level of the users... and lemme let you in on a secret: if you know what you're doing it's entirely possible to secure a Windows box. I have had one or two in my house since the days of Windows 1.0, and have been on high speed Internet since 1995. My notebook is the one right now, my desktop on Linux. Despite that, I've *never* had a virus. Idiot users are what makes an OS insecure, and secret #2: they exist on OS/X and Linux platforms, too.

lots of linux exploits in the wild...

[sentientbrendan]

>I'm going to post this here because Slashdot's been full of MS shills for the past
>couple of weeks
What do you mean by "MS shill"? Do you actually mean you believe that Microsoft actually pays people to post on Slashdot, or is that just an all purpose term for people that disagree with you? If I vote for someone other than you will you also call me an "MS shill"?

Maybe MS shills are a secret conspiracy set up by "the man" to "keep you down". That sounds like the best bet to me.

>On the other hand show me a significant linux virus or OS X exploit being used in the wild.
>Well? Where are they? Waiting.....

Please do not spread misinformation. It may be legitimate to choose linux over windows on a security basis, depending on what security concerns you have specifically, but it is simply untrue that linux is somehow magically immune to security threats. Both linux and osx have viruses and exploits which have been used "in the wild".

Just a little above this article is a slashdot article about a squirellmail exploit...

As for viruses for linux and osx, there are some out there. However, the reason they aren't as widespread as windows viruses is widely known... the amount of linux and osx machines on the network isn't dense enough. You can't spread a virus effectively if the affected species is really small and spread out. If you email 100 people at random with an email with a linux virus attached, it may not be received by a single linux user, thus that propagation mechanism just doesn't work. This is impossible with a windows virus.

Re:lots of linux exploits in the wild...

[Crayon Kid]

Both linux and osx have viruses and exploits which have been used "in the wild".

Could that have something to do with the fact that "Linux" means tens of thousands of different applications? In fact, how exactly is a SquirrelMail a Linux security threat? Why not a Windows security threat? Doesn't it run on Windows too? It's a web app.

Please make a difference between security threats targeted at GNU/Linux itself (the kernel and GNU tools) and something targeted at a 3rd-party app which may very well run on other OS as well.

As for viruses for linux and osx, there are some out there. However, the reason they aren't as widespread as windows viruses is widely known... the amount of linux and osx machines on the network isn't dense enough.

Are you actually dumb as a rock or just trolling? How can you say there aren't enough Linux machines out there? What do you think most of servers of all kinds run on? Don't you think that a virus or worm would have a lot more to gain by breaking into servers than personal desktop computers?

If you email 100 people at random with an email with a linux virus attached, it may not be received by a single linux user, thus that propagation mechanism just doesn't work. This is impossible with a windows virus.

That settles it, you ARE as dumb as a rock. You seem to really believe that somehow Linux apps are staying out of harm's way by sheer luck and hiding behind the poor Windows computers. Has it ever crossed your brain that perhaps Linux apps are designed with security first in mind? Such as, I dunno, NOT ALLOWING BLOODY EMAIL ATTACHMENTS TO BE EXECUTED?

Re:lots of linux exploits in the wild...

[Anonymous Coward]

What do you mean by "MS shill"? Do you actually mean you believe that Microsoft actually pays people to post on Slashdot [...]?

Wow. I didn't realise there were still people hiding under rocks who'd never heard of guerilla marketing.

Re:lots of linux exploits in the wild...

[stephanruby]

As for viruses for linux and osx, there are some out there. However, the reason they aren't as widespread as windows viruses is widely known...

Making your statement sound more patronizing doesn't mean that more of us will accept it. What you're articulating is the official stance taken by Microsoft, yes. Does this mean it's a fact? That remains to be seen.

...the amount of linux and osx machines on the network isn't dense enough. You can't spread a virus effectively if the affected species is really small and spread out. If you email 100 people at random with an email with a linux virus attached, it may not be received by a single linux user, thus that propagation mechanism just doesn't work. This is impossible with a windows virus.

An alternate theory that's also very "widely known" is that Microsoft may be more insecure because it tries to be more remote-control-ware. The theory goes that if a company over-rides the control that a person has over his/her machine, even if it's for good reasons like protecting content through DRM or selling more products by serving ActiveX ads through your email, that this company is inherently designing a more insecure system for its users.

After all, this isn't as far fetched as it sounds. The construction of a backdoor for very good reasons is an alluring proposition for any organization, but this approach has drawbacks. The clipper chip, for instance, was designed by the US government to make us all safer, when in fact it would only have made us less safe -- because it meant that once broken -- any bad guy could have used that backdoor (and we can all thank our lucky stars that this supposedly unbreakable system was broken long before it went into mass production).

Re:lots of linux exploits in the wild...

[gordo3000]

how many viruses do you know of that have brought down windows servers? I've worked with windows and linux servers and they are both rock solid and basically impenetrable. Servers may be the nicer target, but windows or linux, they are incredibly hard to attack. you seem to mistake the point that the points he raises are perfectly applicable to the DESKTOP market. and he is right. I've watched mac users try and run executables... they just happen to be built for windows so they are safe(that's called obscurity, not superior engineering).

I've never had my windows machine try to magically execute an attachment. I've never had my mac or linux boxes try to either. But ALL THREE will try to execute an attachment that I double click on and tell it to. It just happens that I have to watch carefully for windows because it's the only system with the install base to actually allow a virus to propagate.

Just so you know, I do not do any type of OS programming so for me, it's how the system performs, not some obscure knowledge of OS design that makes me choose which is more reliable. Linux and Macs may be engineered better, but I doubt it. They seem to just come with more options turned off that I have to go turn on rather than the other way around. This may mean better security for a newb, but there isn't much of a reason for me to care one way or the other.

Re:lots of linux exploits in the wild...

[monsted]

What do you think most of servers of all kinds run on? FreeBSD?

Re:lots of linux exploits in the wild...

[Wingsy]

I think you may need to revisit the definition of a virus and a trojan.

Re:lots of linux exploits in the wild...

[gordo3000]

not really, I use virus to apply to all malware(except spyware) that you can get.

when you are talking about spreading a virus via email, you are almost universally(now adays) talking about a trojan, but that is irrelevant to whether or not the population of users outside of windows is ever high enough to allow such a virus/trojan to spread.

Re:lots of linux exploits in the wild...

[LKM]

As for viruses for [...] osx

Link please.

Re:lots of linux exploits in the wild...

[intheshelter]

"I've watched mac users try and run executables... they just happen to be built for windows so they are safe(that's called obscurity, not superior engineering)."

No, that has NOTHING to do with obscurity, nor security. If the USER actively runs an app then that strikes me as ignorance on the users part, or a Trojan with a well crafted hook to entice the user. No OS can protect against that kind of attack unless it disallows any 3rd party apps or disables the ability of all apps to write to the hard disk. Both solutions make the OS worthless so it's a balancing act.

"I have to watch carefully for windows because it's the only system with the install base to actually allow a virus to propagate."

You obviously don't have the first clue what you're talking about. Security through obscurity is a MYTH.

Re:lots of linux exploits in the wild...

[dutin]

There have been multiple worms for SQL Server and IIS. I remember looking at my Apache logs and seeing these going. HAHA! I run apache. Not to say Apache hasn't had worms, but the flaw was fixed very fast and in the open. Remember when Windows Update servers were infected? Who knows how many holes are in IIS still that just haven't been found and how many were fixed quietly and thus never reported. Better security for a "newb" is better security for everyone. As for "rock solid" windows servers, this must be a new thing, I remember the days of weekly maintenance reboots.

Re:lots of linux exploits in the wild...

[John Betonschaar]

not really, I use virus to apply to all malware(except spyware) that you can get.
when you are talking about spreading a virus via email, you are almost universally(now adays) talking about a trojan, but that is irrelevant to whether or not the population of users outside of windows is ever high enough to allow such a virus/trojan to spread. Then you show me a trojan for OSX that can hose my system without specifically asking for a password, which normally only happens when I want to install system software (which is about once every few months or so, when a security update is released). Then compare that to the ease-of-infection on an XP system, or a Vista system that has UAC disabled because it annoys the hell out of people.

You really should try to make a distinction between trojans and virsuses, you know. I can write an almost 100% fail-safe linux trojan in about 2 seconds:

#!/bin/sh
sudo rm -rf /

Does that mean linux is just as unsafe as Windows? I don't think so, because no user in his/her right mind would consider typing in their user password for some obscure binary or shell script they from an unknown source. That's completely different from the windows world, in XP clicking a link in your MSN client can be enough, clicking an email attachment, whatever, because so many people run with admin privileges. So XP and everything before that can be considered unsafe just because of the fact that using it on a day-to-day basis means running as admin for 99% of people. For Vista things are a little harder, but since it asks for your password so often, people get lazy and just fall back to their Windows-conditioned 'ok, ok, ok' habits.

Re:lots of linux exploits in the wild...

[tehcyder]

What do you mean by "MS shill"? Do you actually mean you believe that Microsoft actually pays people to post on Slashdot

Scarily, the GP probably does genuinely believe that.

Re:lots of linux exploits in the wild...

[Crayon Kid]

But ALL THREE will try to execute an attachment that I double click on and tell it to.

You're probably confused by what it means to "execute" an attachment. There's one thing to treat it as executable code and launch it as a program (which many Windows programs will do, sometimes automatically). And it's quite another to launch the associated application and pass the file to it.

I have yet to see a Linux email program that will actually allow an attachment to be treated as executable code and run. Therefore I call bullshit (or ignorance) on your claim.

Re:lots of linux exploits in the wild...

[knavel]

Then you show me a trojan for OSX that can hose my system without specifically asking for a password rm -rf ~/*

Re:lots of linux exploits in the wild...

[QuietObserver]

That won't hose the system, it will only hose the current user's account, so you're wrong; even if the user in question is the only user on the system, the system itself won't be permanently damaged.

Re:lots of linux exploits in the wild...

[knavel]

Good point, but the example used in the post I was replying to (for linux) wouldn't work either. Sudo still asks for a password in default configurations.

Re:lots of linux exploits in the wild...

[toadlife]

There have been multiple worms for SQL Server and IIS. Multiple, as in...two? Since the slammer incident there have been no critical vulnerabilities discovered for SQL 2000, and there have never been ANY vulnerabilities discovered for SQL 2005. The last worm for SQL or IIS was several years ago. The fact that they are still propogating means little.

I get tons of hits on my various sshd logs every day from hacked linux boxes running apache. Following your logic, that means linux and apache are insecure.

Remember when Windows Update servers were infected? No, I don't. Care to refresh everyone's memory here by linking to a source so I can read about it?

Who knows how many holes are in IIS still that just haven't been found and how many were fixed quietly and thus never reported. If there were a ton of unknown holes in IIS, IIS servers would be getting hacked left and right and everyone would know it, but they are not.

Re:lots of linux exploits in the wild...

[flewp]

not really, whether or not the population of users outside of windows is ever high enough to allow such a virus/trojan to spread. I've seen plenty of sober people pass along viruses/trojans.

Try the veal, tip your waitress, etc, etc.

Re:/. Windows bashing makes me want to throw a cha

[softdevs]

NO no! I doubt...I think its Windows. Java Programming

What does your OS come with???

[theolein]

Although I support OSX, WinXP (Vista as little as possible) and Linux at work, I mainly use WinXP at work and am fairly happy with it. I don't have mountains of crappy little systray thingies in there and keep the OS slimmed down to a minimum. At I have three Macs, with OSX 10.4 and 10.5. One of the reasons why I like Macs is because the Macs with such an enormous amount of software. I have music editors, video editors, DVD editors, photo editors, at least two web servers (apache and tomcat), document viewers (PDF and whatever else), Music juke boxes, a complete developers kit of software IDEs, numerous languages (bash, perl, php, python, ruby, java, objc, c, applescript) and the full complement of Unix tools.

While Windows has a fair amount of stuff in it (and apart from WMP, the quality is often somewhat disheartening, I must say - *Movie Maker* seems to be a typical Microsoft throw away application) and the amount and quality is improving, OSX simply has far far more. A lot of that stuff is 3rd party code, such as perl, tcpdump etc (these two feature prominently in the latest security patch) for which Apple is not really responsible, except, of course, for security updates to them as they become available.

Thus, I would say that a good portion of the Apple patches are to underlying Unix tools.

That doesn't of course excuse Apple or make Apple magically more secure than Windows, but it does show a decent sense of security responsibility. That said, even Microsoft is much better in the last year or so at providing security updates to its system. They have also deactivated things like the gaping holes in automatic macro execution in Outlook and Office in general, and even IE7 is no longer the bug magnet that IE6 used to be. BUT, Windows, by design, still has some flaws that are simply not present on other systems. The worst of the lot is ActiveX. The fact that Windows Update runs in the browser with an ActiveX control having direct access to your machine is something that simply should not be allowed to happen. Taking over a Mac remotely is not something that you often hear about.

I suspect however, that Vista, with its massive overkill in the security department, will mostly be better in terms of security as years go by. It's just a pity that Microsoft's implementation of sudo (UAC) as opposed to Apple's only using it for truly sensitive tasks makes users become desensitised to security.

Re:Counting vulnerabilties shows nothing

[man_of_mr_e]

Umm. no. I'm talking about:

Headline: Microsoft releases 3 patches on patch tuesday

Reaction: ZOMG!!! This just goes to show how much Windows sucks!!! Use Linux or Firefox or Thunderbird or MacOS!!!!

Re:News Flash: nothing has changed

[Anonymous Coward]

The culture around FreeBSD is more mature and they take things like local privilege vunralibilties more seriously. I lost interestest in Linux right about the time they decided the send the kernel versioning scheme straight to hell. When you roll out kernel level security fixes with new features, that is plain old amature.

PHP might leak like a sieve, but at least on FreeBSD I'm fairly sure when the next poorly written PHP app cannot run some damn injected script and get root. PHP apps are nutorious for leaking like a sieve, letting anybody run any damn code locally. On Linux, I can pretty much promise that the minute you run code you can get root somehow. PHP is a great scripting host for anybody looking to run local code on your server.

Basically, the linux kernel and the surrounding userland tools give me the creeps. I dont trust any of them at all - I remember back a few years ago, the man page (or was it the info page... another rant there) for "sudo" had a good long rant about how it was evil to have a "wheel" group. Look it up... it was there! Definitely not what I'd call "enterprise grade".

FreeBSD (and OpenBSD/NetBSD) are about the closest you can come to an enterprise grade operating system that isn't sponsored or sold by a corporation. It is a shame more vendors like dell didn't support freebsd on their servers. Linux is just amature hour.

Re:/. Windows bashing makes me want to throw a cha

[Anonymous Coward]

Maybe it's only noticed because Apple fixes the bugs quickly?
Besides, which OS would be able to walk around on the internet without virus protection?

I am glad

[Anonymous Coward]

I am glad I have switched to Vista. Good bye Mac OS X.

Of Course They are Shills

[His Shadow]

The vulnerability count only prove that some people are very, very stupid. No amount of vulnerability counting will counter the fact that there are over 150000 various viruses, trojans and assorted other infections for Windows, with multiple vectors. The amount of viruses on OSX? None. Zero. Zip. Nada. And one Trojan. That makes a difference of what? 150000 to one? Anyone pretending that these counts mean a damn thing are shills or stupid. It's not that complex. You can count have all the automotive recalls among various manufacturers you want, but if only one manufacturers autos blow up on a daily basis, it doesn't matter shit how many recalls the other guy issues.

Re:I just finished penetration testing your mom ..

[alsrsc]

If you say so... [ymess.ro]

Accurate vs. Useful

[RAMMS EIN]

The report may be accurate, but all that really tells us is that Vista had more _disclosed_ vulnerabilities than OS X. While such a large difference (a factor 5!) is certainly cause for raising eyebrows, the concrete implications of these figures are far from clear. In particular, it says nothing at all about the relative security of the systems. Of course, people will use them that way.

IF all the vulnerabilities are counted...

[qinjuehang]

How would you know how many vulnerabilities there actually are? It is impossible to exactly count them in Windows, or OS X. For example, Red Hat Desktop Workstation v5 has 70 vulnerabilities, while Windows Vista has 24, according to Secunia. That would contradict what most people think, but it is probably because Redhat is open source, while Windows is not. In this case, we are comparing two closed source operating systems, so the number of security vulnerabilities probably depended more on the testing each went through than the operating systems here.

SECURITY BY OBSCURITY is "the MacOS X advantage"

[Anonymous Coward]

Security by OBSCURITY (less users, thus, less of an attack surface area exists for potential interlopers) is what MacOS X enjoys. From the point of view of those who are out to make monies illegally via exploits online, attacking Windows (the MOST USED OS PLATFORM THERE IS, mind you) makes a hell of a lot more sense to do. If MacOS X (or Linux, or BSD, etc. et al) were the MOST used (especially on noobz/new folks to computing's systems)? The tables WOULD be turned, & for obvious reasons (in the eyes of attackers of personal computers/hackers/crackers).

Re:News Flash: nothing has changed

[Anonymous Coward]

Seriously, I have to say that despite the fact that the parent and grandparent posts are obviously flame bait, it's absolutely hilarious how the Mac community, the Linux community, and the overall anti-Microsoft community come out with their FUD and spin blazing any time anything indicates that perhaps Microsoft is doing good at something. You talk about how much more secure IIS 6 has been than Apache and people start working up these huge conspiracy theories about how Microsoft is hiding bugs and how Microsoft's bugs are all MORE vulnerable and MORE important so we should count them two or three times! Nevermind the fact that the other vendor has decided to describe their vulnerability as critical. Maybe they should invent "not-so-critical" and "zomg-critical" so that your biased classification of bugs would have more of a foundation than simply something you subjectively decided on your own. And yet through out all of this crying about security reports daring to rule in Microsoft's favor, none of the spin spewed by Mac and Linux lovers has any of the proof or evidence that is always demanded from statements made favoring Microsoft. Linux people are allowed to spew FUD all day and all night and have it accepted as gospel, especially if they support their contrived arguments by appealing to the authority of some other, more important Linux fanboy. Mac people are no different.

How about some current, factual evidence demonstrating that any of the crying and hot air being spewed below has some basis in reality? Secunia discloses their methodology, and they base it on factual information from reliable sources. Their research is favoring Microsoft. Can we have some actual research from the Mac or Linux community disproving anything that Secunia's research is showing? Is there anything documented that backs up the claims that Mac OS X and/or Linux has been more secure than Windows XP or Vista over the past year? Or is it all suppositions and FUD? Is it too much to ask that there be some kind of proof beyond forums full of fanbois? All I'm hearing is "Microsoft is hiding bugs", "Everyone knows (Linux|Macs) are more secure", "Vista sucks! Microsoft sucks!", and "uh oh, yet another Microsoft shill".

It's real easy to call someone a shill (ad hominem) and appeal to the authority of pro-Linux or pro-Mac e-magazine articles (which don't provide sources or any kind of empirical evidence to back up their assertions, making them as valuable as forum posts, except they're formatted nicer). How about you guys live up to the standards you've been demanding of Microsoft's PR department for years? Put your research where your mouth is.

Oh, and since I'm going to be called a MS shill by some idiot, let me ask another question. What happened to all of the Linux vs Microsoft server benchmarking? Linux guys were really hot on that for a long time. Then I recall Microsoft challenging Red Hat to a benchmark, which they declined. I haven't seen any Linux kiddies publishing benchmarks showing Apache is faster than IIS in a long time. I haven't seen benchmarks showing that Linux is faster than Windows Server in a long time. This used to be a favorite past-time of the Linux camp. What happened? Does epoll (2002) and/or aio (2002?) not keep up with I/O Completion Ports (1994)?

WTB more information from Mac and Linux camps to back up their name-calling towards people who dare speak in favor of Microsoft, and their unfounded claims of superior security and performance.

BT has BB

Re:News Flash: nothing has changed

[CSMatt]

What are these "service packs" of Apple's that you speak of?

Re:/. Windows bashing makes me want to throw a cha

[Anonymous Coward]

Sadly, I totally agree...a very large portion of articles posted here that have any negative connotation on Windows are often missing key facts and are played in the article description more than pac man.

My default rule is, if it is on /. and is Pro or anti Windows, do your own research.

It's just tarded that we have to take /. Windows articles with a grain of salt when it could be EASILY changed by some filtering done by the editors.

hacker blame Vista

[edjusted]

"How am I supposed to find Vista vunerabilities when I'm busy rebooting every 5 minutes?"

Title stated as question attempt to mask trolling?

[Switche]

I hope everyone took the time to read the article, and to find other articles on the same data, or the data itself. Unfortunately, once again, I find myself having difficulty seeing past a slashdotter's inability to simply report information without introducing controversy on his own terms or relaying the bais of a bad journalist.

The only content of this post that wasn't quoted was in the form of the question "Is this report card's implication accurate, or is this a symptom of one company turning a blind eye [1]while the other concentrates on timely bugfixes," which is actually not a question.

One side of this supposed question, "Is this report card's implication accurate," suggests the data is flawed. OK, we can consider that good, yet obvious question, but I hope they back it up (they did not). The other side begins by accusing "one company" as "turning a blind eye (to problems)." This side of the question has already validated the first part of this supposed question, because this claim, if true, would invalidate any study that relies on such a company such as this to report security flaws without silently fixing them. I wonder which company they mean? The second part of the "question" continues, glorifying the "timely bugfixes" of the "other" company. Which company is which, here, slashdotter? You might as well come out and clearly accuse who you accuse so we can see how baised and unfounded those claims are without backup, no matter what name you put on these companies. Adding question marks at the end of a sentence doesn't always make it a question, but does sometimes help in evoking a lean in support toward a statement hidden inside a valid question, as the slashdotter did here. Also, notice the "[1]" citation's placement (on the "timely bugfixes" company's side). Citations/footnotes (unfortunately) add an immediate, and in this case, false sense of validity to information they're placed on. A reader could be misled to believe what the slashdotter wrote as a statement of fact if they did not notice this was simply linking to the article they read, in which case it belongs at the beginning of this "question." However, the entire statement portion of the question, including claims toward both of these ambiguous companies, is subjective, coming completely from the mind of the slashdotter, with no support to them, so validates no usage of any citation at all.

The slashdotter goes on to quote the author's statements against Windows Vista. The author failed to provide any details of Mac OS vulnerabilities, instead showcasing Apple's generosity in paying hackers to "hack" a Macbook, then give them a bunch of money and a free Macbook (thanks Apple! *ding!*). Herein lies both the author and the slashdotter's bais. I can't fault the slashdotter for reporting what they read, and not being objective about it, but this is clearly flame fodder to post like they have.

This slashdotter seems to have already made up his mind, but I hope you would read the article, and try to gather some more information from other sources. Citing some more sources that analyze the same data, or back up the seemingly baised statements made in the post, would have been helpful.

Re:SECURITY BY OBSCURITY is "the MacOS X advantage

[stewbacca]

So for every 150000 PCs there is only 1 Mac? Your obscurity argument doesn't hold water. Mac OSX has plenty of marketshare to have at least a blip on the hacker radar. Unless, of course, you are suggesting that a computer system that has roughly 100 million machines online isn't worth anyone's time? Certainly there are enough anti-Mac bigots out there who would love to just hack a Mac one time, just to say they could?

The plural of anecdote...

[argent]

The plural of anecdote is not proof.

For example, I have been using Windows 2000 without antivirus software for several years, and I have not had a virus on it even when I was using it on networks that had active network worms that were known to attack Windows 2000.

By your logic this means that Windows 2000 is at least as secure as any other OS out there.

What this means, actually, is that I actively track security lists and make sure that I am not using components of Windows that are known to have security flaws in ways that expose them to unknown data sources. For example, the only thing I used IE for is Windows Update, and I disable things like the messenger service, and so on.

This was also the policy I enforced as a network administrator, and that was more effective in keeping my part of the network secure than the official policy for our company... which included antivirus, but also required IE and required many known-insecure services be enabled.

IF the user is aware of the components that need to be avoided, Windows can be used safely.

But in the default configuration, Windows is wide open. Even Vista is still using inherently unsafe components, and using unproven internal firewalls and sandboxes to keep the computer as a whole secure even if one component is compromised. This is a potentially useful technique, but it should be a backup rather than a required part of the security model.

Apple is not innocent either. They have copied part of Microsoft's browser and desktop integration, albeit not the most dangerous part... but they have had several vulnerabilities that could have been completely avoided by NOT using the same LaunchServices database for both internal helper applications (such as those used Finder) and sandboxed ones (the ones that could be used by Safari), and by NOT treating files with known extensions as "safe" to open.

But compared to ActiveX?

Re:News Flash: nothing has changed

[blast3r]

flagged as troll and flaimbait. I responded directly to the person's post. I hate seeing people post things here acting like they know what they are talking about so i responded accordingly. a troll surfs around to find things to say just to get things stirred up. this was not a troll event! but to be honest, i could care less. ;)

Re:News Flash: NOT QUITE TRUE

[Anonymous Coward]

"IE is bundled, but can be disabled to browsing web sites (2003 server edition disables it)." - by gnuman99 (746007) on Tuesday December 18, @03:51PM (#21743732) Some "FYI":

In Windows XP (not sure if it was SP #1, OR SP #2 that implements it though) you have IE in a "safe mode" also, very much like the one for IE6/IE7 in Windows Server 2003 outta the box stock, prior to any service packs it offered or came out later with.

It's a shortcut of IE7 that uses the -extoff switch on IE's commandline.

It's almost "hidden away", because it is stuffed into the Start -> All Programs -> Accessories -> System Tools folder... but, it IS there.

APK

P.S.=> I am not sure if this commandline switch works with IE6 & below, but I know it does with IE7, & yes... on XP as well as Windows Server 2003... apk

Re:SECURITY BY OBSCURITY is "the MacOS X advantage

[Anonymous Coward]

"So for every 150000 PCs there is only 1 Mac? Your obscurity argument doesn't hold water. Mac OSX has plenty of marketshare to have at least a blip on the hacker radar." - by stewbacca (1033764) on Wednesday December 19, @03:57PM (#21756254) Go tell a spyware maker that, ok?

I don't think you understand the motives of the people creating these things nowadays... std./traditional viruses are NOT what is prevalent out there today (I know, I have to remove them from @ least 4-5 systems a day, & I see what I see for years now doing it).

The creators of SPYWARE (the more prevalent threat out there today) are out to either:

1.) Get your bank account info.

2.) Get your credit card info.

3.) Use your machine to attack other machines

4.) Send spam mails

(& who KNOWS what else... the point being, write your malware to get the most "surface area possible" so it can corral the MOST machines it can to use them for said enumrated purposes above (& especially for the points noted above for what is MOST USED in the way of OS' out there today, Windows)).

His explanation holds plenty of water.

This is NOT about "bragging rights" bullshit: These people, like the RBM (Russian Business Network) are about making money, OR, selling off TONS of "botnetted" zombied systems for attack dogs for rent.

ALSO: DO YOU PAY ATTENTION TO SECURITY NEWS OUT THERE (& specifically, what methods get used in 99% of the attacks (roughly but consistently))?

Well, if not?

Most of the threats are javascript related, IFRames related, & lately Adobe Flash/Shockwave (heck, even adobe reader did) + Quicktime related as well (bad activeX controls also, such as RealPlayrer had VERY recently).

Are the browsers on other systems that use those addons for scripting impervious to said attacks, especially in their webbrowsers that call upon them for page rendering? No.

Windows is just "out there" more, & thus, the one to target, for the purposes enumerated above.

Re:I know that OS X is more secure TRY THIS!

[Anonymous Coward]

" I am a Mac fan boy, but only because Windows continued to let me down." - by AccUser (191555) on Tuesday December 18, @02:13PM (#21742070) Homepage Read, AND APPLY, what is listed here on a Windows 2000/XP/Server 2003 & even VISTA setup:

http://forums.tweaktown.com/showthread.php?s=95da64f88f66f615773c4e77ac12ca87&t=25596

& let Windows "let you down", no more, in terms of security...

Just by following a tool (CIS Tool) that guides you thru MOST of it, & then some more tips that page advises you on in 12 relatively simple steps & rules to use, you won't get "burned" by nearly as much malware of any kind IF any @ all anymore.

(Yes, sometimes you sacrifice some "glitzy" animations & such online, but big deal - better than paying for a spyware/virus/trojan/malware removal).

APK

P.S.=> I've been running the SAME setup since 2002 on 1 system here using the setup noted above on Windows Server 2003 & another system also using it here (not sharing files between them, just online via my LinkSys router), & no virus/trojan/malware/spyware etc. et al on EITHER of them... how? By simply applying what is noted above, & not being stupid... apk