Slashdot Mirror
Microsoft Says Vista Has the Fewest Flaws
ancientribe writes "Microsoft issued a year-one security report on its Windows Vista operating system today, and it turns out Vista logged less than half the vulnerabilities than Windows XP did in its first year. According to the new Microsoft report, Vista also had fewer vulnerabilities in its first year than other OSes — including Red Hat rhel4ws, Ubuntu 6.06 LTS, and Apple Mac OS X 10.4 — did in their first years."
It has the fewest flaws found because it has the fewest amount of people looking for them.
It's important to recognize that you can't possibly measure which OS has the fewest flaws absolutely. You can only measure which OS has the fewest flaws reported (or discovered). Since the number of flaws reported is proportional to the number of people using the OS, and no one is using Vista, it's natural that it'd have the fewest reported flaws. :)
The Mongrel Dogs Who Teach
Is this via support calls or just little modal dialog boxes that people are tired of clicking "send" on? Or are they filtering out things they've already encountered in XP? Statistics are a great aid to the common lie.
Do not mock my vision of impractical footwear
It has the fewest flaws found because it has the fewest amount of people admitting to them
Parent has it exactly right. This is likely another statistical half-truth. Tell us % of users reporting flaws and let's compare that to XP's first year.
For the last time, you just can't add up the number of vulnerabilities in separate products from different authors and expect to glean any meaningful information from numerology thereon. This is especially true when contrasting one closed-source product from a vendor with questionable security reporting practices (say, Windows), and an open-source product where every single flaw of any level of significance is public knowledge (say, Ubuntu Linux).
I'm tired of seeing such claims about vulnerability tallies parroted in Slashdot summaries without the least bit of skepticism regarding their relevance. This sort of thing has already been debunked a million times over on this site. Come on, editors, a little quality control would be nice...
Could the reason there are fewer exploits in the first year of Vista (Verses XP) be due to the fact that it has a reluctant adoption rate bu users and the OS exploiters are likely focusing their efforts on current Operating Systems that are more stable, known, and in higher use.
Give it time...
Besides, now that Microsoft has set 2009 for the new "Windows 7" release target date, it seems that Vista may be the new short-lived 'Windows Me'.
I think that is a silly measure of bugginess. Not only does the number of flaws reported being less reflect lower usage of Vista, it also likely says the the reporting system is difficult to work with. If anything, I think the fact that the non-Windows systems have a higher number of flaws reported indicates that they have easier-to-use bug reporting systems. The correct way to measure statistics on things like this is either to have a third party subject them to a standardized battery of tests (indicating actual security levels) or to measure the ratio of bugs fixed to total bugs reported (indicating the development team's ability to correct reported flaws quickly).
Tomato wedge sperm darts that are Republican.
So ... assuming RHEL4 has a much smaller installed base than Vista (let alone XP), what does this say about the security of enterprise Linux? What does it say about the worth of "quick" security metrics like patches in first release year?
There are no karma whores, only moderation johns
And how many installs are on new machines, where the buyer had no choice? How many of those forced installs have been wiped out by now and replaced by XP, 2K or Linux?
Good, inexpensive web hosting
How many of those were kernel patches, and how many were related to other applications?
Ignore this signature. By order.
Reminds me of a quote - "Statistics are like humans. Torture them enough and you can make them admit anything you want".
I'm much more funny, interesting and insightful than the moderators think
I'm sure most people do. However, it's still hard to find new laptops without a pre-installed OS. Also, I know there are people buying computers with iCandy installed and replacing it with XP; I'm going to be doing exactly that for a friend later this week.
Good, inexpensive web hosting
I think the GP wasn't talking about the kernels. Linux distros simply distribute much much more software than comes with your average proprietary OS.
Most will issue a security advisory when there's a bug in apache, mysql, postgres, sqlite or all of these types of things. Microsoft doesn't issue an advisory about a bug in Oracle. On Linux, the distros take responsibility for a much much wider range of software than Microsoft does on their platforms.
I touch computers in naughty places
Might be a rewrite but chances are you either had the same people rewriting it, or at the very least the same mindset/corporate culture/etc. rewriting it, so it probably didn't end up all that different (based on results this looks pretty likely).
Don't change the subject, he didn't say better. And as far as a defense, it's not, it's an explanation. When microsoft ships with several different database packages, several different browsers, several different desktop environments, several different office suites, a crapload of various network tools, applications, etc... that a typical linux distro ships with, and manages to pull off less bugs, then they can use such comparisons to prove something. Until then, it's like comparing the number of problems found in a storage shed to a skyscraper, and using that comparison to try to argue that the shed is better since it had less reported problems.
Patriot - A fan of expanding government power and spending while not wanting to pay higher taxes.
Us Mac users never believed in this line of logic. Right?
Right, who cares about VISTA? Why bother if you're a hacker; it's not even a challenge to hurt MSFT anymore; they've done it themselves, in spades.
Where are you drivers in linux? Where do you download them? Why you don't, they are IN THE KERNEL!
So Linux "The kernel" does a lot more then MS does with its core OS because MS still asks you to download a ton of drivers. This is part of their strategy, it allows them to shift blame to the driver instead of their OS. If you really got a problem with MS software and actually have some support (check your MS license, you pay for the software, there is no support) then your first job will be to convince them the bug lies with them and not some combo of drivers that you had to install.
That is why these MS reports are so silly, you really can't compare the two "distro's". MS Vista does far less then a Linux based distro like Ubuntu BUT they don't have a bare kernel they distribute but even if it did it does far less then the linux kernel.
So what are you comparing?
Also not that security bugs in Vista affect EVERY vista user because all the installs are the same. A linux distro bug in PHP affects only those who use PHP on their linux distro. MS funded research has in the past made lists of security bugs in linux where they counted the same bug multiple times for each distro it was in. That is kinda like saying "Just look at our competitors cars, they made 1 million of them and 1000 of them had the same fault. Meanwhile our 1 model has just one fault, the brakes don't work. We are BEST!"
MS, FUD at its best.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Fewest vulnerabilities doesn't mean it has the fewest flaws... Freezing, poor driver support, poor program support, these things are flaws, yet have nothing to do with security vulnerabilities. I love vista, i've run it since the betas and run a legal copy of ultimate that i paid for with my own money, and i've been able to generally make stuff work, but having to use workarounds to make stuff work is a flaw, in my opinion, and having good security is nice, but not if a bunch of stuff i've used for years doesn't work. I want to be an MS fanboy but i can't. I use vista at home because i can deal with it's shit, but i buy a new computer at the office, i make sure it has XP, because reliability is king at work. Lack of a reliability is too big of a deal to leave it out of the category of "flaws"... -Taylor
Worldwide Military budgets: $2100 billion. Worldwide Space Exploration budgets: $38 billion. Really, world? Really?
Again, a ridiculous comparison based on reported security holes...
Microsoft are in the best position to find holes in vista, having the source code. They have no incentive to report them, and will just fix them silently. OSX is in the same boat but to a lesser degree, and with ubuntu/redhat all the issues will make it into the public domain. The only vista issues which make it public, are ones discovered by third parties, which are probably less than the number found internally because internal developers have access to the source, access to the original devs and a more intimate knowledge of the inner workings.
Then you have to consider functionality, vista comes with one web fairly old web browser, one mail client, a rudimentary text editor, a single-protocol im client, a trivial drawing program, a simple media player with a small number of codecs and a few very simple games... Ubuntu/RHEL come with multi protocol im clients, a full office suite, a larger number of slightly less simple games, a larger and more capable set of networking tools, scanner software, fully capable drawing software, a much larger set of hardware drivers bundled by default, and lots more besides...
It's like trying to compare the rudimentary "peoples cars" produced in the former USSR, with only rudimentary features and a largely hidden safety record, to the luxury cars being produced in the west around the same time... Try comparing a Zaporozhet to something like an E-type Jaguar.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
And also, how many of these were patches for applications that vista doesn't ship with an equivalent of?
And how many of these patched flaws were discovered by the developers of those applications? Which in RH's case means the issue is published, but in MS's case would not be published.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
The kernel itself is simpler, the difference is drivers...
Windows doesnt include many drivers, most are sourced from third parties.
It also doesn't include many optional components, anything optional tends to come from third parties too.
Linux ships with a large set of hardware drivers in the kernel, although they can be turned off.. Windows comes with things like video support that can't be removed, and which needs third party drivers to work properly.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
And how many were patched silently without being publicly disclosed?
Will microsoft be willing to disclose their internal changelogs (if they even exist) detailing exactly what changes were made to code and why? Vista SP1 looks to be huge, how many vulnerabilities known only to microsoft are going to silently get fixed without ever being disclosed to the public?
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
That's what I think this is all about. Microsoft can publish whatever number they want as the number of "vulnerabilities" to make itself out as the "good guy" while distributions of Linux put it all on the pavement so everyone can see what has been fixed or will be soon.
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
From what i understand their stance on this is that anything that is catched by UAC is not considered a security issue. Its not a local privielege escalation, Microsoft just blame the user who pressed OK. The security isnt better, its just the difficult decisions that has been lumped into the users.
This is ofcourse bad in the long run as most Windows Vista machines will get malware and become bots just as easily as Windows XP while Linux becomes more and more secure through the constant patching of all the apps.
HTTP/1.1 400
no it doesn't as if you change windowsupdate.microsoft.com to anything else windows bypasses it and goes straight for the proper site.
this is both good and bad. good in that you can always be assured of quailty updates from msft, but bad in that you msft can't follow proper security procedures to secure hosts files.
i thought once I was found, but it was only a dream.
At the risk of pointing out the obvious, if Microsoft abandoned backward compatibility, they'd lose most corporate users and many home users as well. You don't need an MBA to see why that is not a promising idea.
About the best they can do is what they did with NT. Jack the whole unwholsome mess up, and insert a new frame and engine under it. They did that with NT without all that much success. (Windows 95 runs about as well with far fewer resources if you don't mind a crash every few weeks). I suppose they can try again, but I doubt the results will be any better.
Maybe the idea would be more appealing if there were a "clean" design out there that was actually any better than NT, Unix, OsX. But I don't think there is. AFAICS, for several decades, OS design has consisted of shuffling the subsystems of a 1960s mainframe into slightly different configurations and slapping a shell on it. It's not that I can do better. I can't. Maybe NT, Linux, Vista really are the best we can do. That's a depressing thought.
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
I would think that one major difference is that Linux is public. We admit to our security problems and they're counted. Exactly how many Vista security problems that Microsoft discovers are made public?
... Microsoft gets to hide behind obscurity. These problems will come out eventually. Personally, I have much more confidence in code that's been exposed to "many eyes" and Coverity. Let's get real and talk about the number of flaws that Coverity exposes in the Linux kernel vs. the Vista kernel. Anyone who relies on a brand new kernel to be secure will get what they deserve as the flaws become exposed.
Another case of apples and oranges is open vs. closed source. The bug count for Linux includes many security issues that are uncovered through analysis of source code
Now, let's talk about real issues like the number of viruses that affect Vista and then let's compare the number of zombies that Microsoft has created. If MS made cars, or any other tangible product, they'd be out of business due to all the class action lawsuits about unsuitability.
I'd go on, but why bother, MS is *always* so full of shit it's not worth the time it takes to post this.
Leave it to Microsoft. Vista has the fewest amount of flaws only because all the bullshit crashes, lockups, application instability and ambiguous error messages are FEATURES, not flaws.
Maybe there is some BSD code buried in FTP.exe or some user mode stuff but so what? Even if a few functions in kernel mode are from BSD, so what actually? And why is it hypocrisy BTW? Microsoft have spoken out against the GPL, but they have never done so against BSD.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
They did that with NT without all that much success. (Windows 95 runs about as well with far fewer resources if you don't mind a crash every few weeks).
It doesn't, on 9x try making the taskbar a couple of rows high and opening browser windows until it's full with small icons, you will notice things start falling over. Now try doing the same on a NT based version, no problem. Also 9x has absoloutely no concept of user permissions, every user is essentially god.
The real problem that MS is still trying to find a way out of is that most win32 programmers wrote apps that assumed no security because they were developing on a platform that had no security.
P.S. if you really want to stop windows systems getting messed up without stopping apps working windows steadystate rocks.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
So now they actually have the gall to say that (P)OS Vista has fewer declared faults or to quote the article 'complied the number of vulnerability disclosures and security updates", what a pack of lying, deceitful, misleading ass hats.
There not even pretending to be honest, public vulnerability disclosures and security updates, versus the number of faults that have actually been found, and have not been fixed and those people who found them have been threatened with legal and financial sanctions if they disclose them.
So reading between the lines M$ security and legal have been far more effective in preventing public disclosure of windows security vulnerabilities and their failure to fix then they have in the past.
Chaos - everything, everywhere, everywhen
Statistics lie for whoever pays them.
There are many more interesting numbers than such a simple count. For example, as a user, I don't care at all for the number of fixed bugs, I care a lot more about the number of unfixed bugs.
And that's just the tip of the iceberg.
Assorted stuff I do sometimes: Lemuria.org
Power users will be annoyed with UAC right from the start. It's okay if it asked only for deep system changes, but printing to a network printer? I'd like to see a poll of how many people still have UAC enabled.
Vista needs some serious horsepower whether you have the eyecandy enabled or not. The eye candy causes a big increase, but I had to upgrade my machine's 1GB of RAM to reach a reasonable level of performance even with Aero turned off, in order to run any intensive apps like Eclipse or Photoshop.
Just you wait until you buy that fancy new Blu-ray drive only to discover that Windows refuses to output DRM'd HD video to your monitor because it has no HDCP support. Vista has DRM that reaches deep into the subsystem, and when companies begin to take advantage of those features (by flagging Windows Media files appropriately), I bet you'll be surprised at what Vista refuses to let you do.
I use Vista at work because my laptop came with it, and if I could start over again I'd wipe it and go with XP. The wireless behavior is terrible, NetBIOS-based file shares are still spotty, the file explorer refuses to remember my preferences, files sometimes end up mysteriously undeleteable, and the new Minesweeper sucks. Windows 2000 people were against XP when it came out, but most folks came around and XP is now one of Microsoft's most solid operating systems. Vista is receiving much more flak than XP ever did, and while it might end up improving in the end, the negative press has left a pretty big scar.
If Microsoft's claims were backed up by independent 3rd party analysis I'd agree with you. But their "we're awesome cuz our Mom say so" statistics are immediately suspect and extremely likely, given the source, to be bullshit.