Microsoft Talks Back To Google's Security Claims

Kilrah_il writes "Yesterday there was a piece about Google ditching Windows for internal use because of security concerns. Now Microsoft is fighting back, claiming its products are the most secure — more than Google's and Apple's. 'When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else. And it's not just the hackers; third-party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others.'"

Comments

Some Helpful Advise

[eldavojohn]

When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else.

Hint: Your worst nightmares do not have open jovial dialogues with you. And if they did communicate with you or offer you a score card or report, they would want you to feel as though you are completely safe -- totally unaware and unprepared for what you may face.

You've come a long way, Microsoft, but you have much much further to go. If you measure security by percentage increase in security then the evolution from Windows 95 to Windows 7 is nigh impassable. But that in no way means you're number one in the security scores. Run your marketing campaign with setting the "facts" straight but people like me know. With what little (journalistic) evidence you presented, there's no way I can build a conclusion that backs up your statement. And there's no way around that. It would better prepare you to look into the several thousand anecdotes found daily revealing the issues with Windows and Internet Explorer.

Re:Some Helpful Advise

[DavidR1991]

I love the weasel words that come out in these kinds of discussions. "Most" - what is "most"? One competitor? (Maybe, Apple?). Because it certainly does not include (on an OS level) Linux, BSDs etc. Heck I'd be surprised if you could say definitively that MS trumps Google (I certainly don't think that's the case)

Re:Some Helpful Advise

[Omega Hacker]

Even more interesting is that the "hacker" is comparing Microsoft to Adobe and Apple. Adobe is an *applications* vendor, which has no bearing on the OS security discussion. Apple has engineered a far more secure product from the ground up, being based roughly on OpenBSD et al, thus they have far fewer security holes in the first place. Not to mention he's talking about their internal processes, and not the results or the need for the process in the first place.

Re:Some Helpful Advise

[jbeach]

I personally would doubt they're even more secure than Apple. I can't recall the last time Macs around the world were taken out by some virus. Ditto for botnet infections.

Re:Some Helpful Advise

[h4rr4r]

Server rooms around the world disagree. As do smartphones, netbooks and all manner of embedded devices.

Re:Some Helpful Advise

[Gr8Apes]

Windows in the hands of a knowledgeable admin is just as secure as Linux or OSX in the hands of an equally knowledgeable admin.

Untrue. Even in knowledgeable hands, windows is still less secure than any *nix derivative in equal or lesser hands. Why? One reason is because of DLL code injection. Another is the completely clueless way MS architected the (in)security system.

Re:Some Helpful Advise

[man_of_mr_e]

He didn't say nobody gives a shit about apple. He said, nobody gives a shit about attacking apple's products (Mac's in particular).

Here's a hint. Say you are going to write a mean nasty program whos sole purpose is to make you money, and tons of it. Will you, a) target 5% of the computers in the world, or b) tartet 90% of the computers in the world?

I know which one I would do. And if you answer differently, then you either aren't being honest, or you have a very warped idea of how malware writers think these days. It's all about return on investment, and they are spending a LOT of money buying 0 day vulnerabilities and writing tons of code to exploit them, rootkits, etc.. it's not just kids in their parents basement trying to put penises on peoples screens anymore.

Nobody gives a shit about the "challenge" of the hack, if it doesn't make them lots of money.

Re:Some Helpful Advise

[dAzED1]

tired response is tired.

The money is on UNIX systems. That's where the large banks are running their transactions, where stock is being traded, where the military is running it's services, where engineering designs are stored, etc. omgponies you hacked grandpa's 10 year old computer, and added it to your botnet...just what did that get you, really? For just a few $k a month I could build an ec2 cluster that would destroy any botnet in sheer computing power...mostly because I wouldn't have to deal with crazy queing mechanisms, or nicing the tasks down enough to not be noticed by the user.

The reality is, more than anything this tired "people hack windows boxes because they can win more" response pretends to suggest, that UNIX is phenominally more secure on a basic, fundamental, architectural level than Windows. Out of the box, I can trust an app on a RHEL os. Out of the box, I can't even plug a windows machine in to a network without being behind a firewall. I've literally seen, with my own eyes, windows machines get compromised in less than 20 minutes of being online. Sure sure, sample sizes and all that...except, I've also managed hundreds of unix machines at a time without any concerns on them.

Re:Some Helpful Advise

[sg_oneill]

Posting from a mac here, so dont get me wrong. But apples market increase is not about macs, its about iphones ipods and now ipads. Macs are great things, aint no doubt about it, solid well engineered and damn reliable machines, but its still undoubtably a minority platform.

Re:Some Helpful Advise

[man_of_mr_e]

What a ridiculous line of reasoning. The money is in lots of different systems. Unix, Windows, but largely IBM Mainframes running OS's like MVS.

But what OS is used is irrelevant, because those systems are well protected by more than just the OS itself. Further, those systems have the power of the FBI, CIA, NSA and others behind them to track down anyone who might be capable of penetrating the impressive outer security to get to the OS itself. No (sane) hacker wants that reign of hurt to come down on them.

Then, even if you get access.. then what? You have to figure out how to get the money out. That's not an easy thing to do, since there are tons of safeguards in place to prevent money from just evaporating.

It's *MUCH* easier to compromise low-security desktop machines and take over someones checking account, transfering a few hundred or thousand dollars using the users own credentials to someplace offshore. Or, it's even easier if you get the user to do it themselves (ala fake anti-virus).

Your "reality" is not any kind of real "reality".

Wow, you hook a 10 year old operating system up to the internet without any kind of security, and it gets compromised in 20 minutes. Great. I guarantee you a 10 year old copy of Linux could get compromised just as easily if someone had merely had the motivation to write the code to do it.

And trust me, a 10 year old unpatched copy of Linux probably has 10,000 or more vulnerabilities that could be exploited to do so... if anyone cared to.

Re:Some Helpful Advise

[toadlife]

The Windows admin will be going to enormous effort to make everything "just work" without logging in as the NT equivalent of root,

An inexperienced Windows admin might. I haven't had that problem.

any reasonably young distro locks root login by default.

"locking" root (I assume you are talking about distros like Ubuntu) provides no extra security. root is not really locked, as root permissions are used every time sudo is invoked. Besides that, in the case of Ubuntu, the default settings for sudo - to cache the password fot a time after sudo is invoked allows any process running under a users credentials to capture root permissions as soon as that user invokes sudo - basically a built in - *designed in* - privilege escalation vulnerability.

Re:Some Helpful Advise

[drsmithy]

The money is on UNIX systems.

Which are professionally managed and monitored. Why would you target them, when you can target the (typically) very UNprofessionally managed and monitored client machines, which have access to everything that matters on those central systems.

Obligatory car analogy: would you try and steal the locked car kept in a brightly lit garage with a guard watching it 24x7, or would you try and steal the unlocked car parked in a dark back alley on the edge of town that's only driven a few times a week ?

The reality is, more than anything this tired "people hack windows boxes because they can win more" response pretends to suggest, that UNIX is phenominally more secure on a basic, fundamental, architectural level than Windows.

In what way ?

Out of the box, I can trust an app on a RHEL os.

What about the users ? Most security breaches come from users, not from software flaws or bugs.

Out of the box, I can't even plug a windows machine in to a network without being behind a firewall. I've literally seen, with my own eyes, windows machines get compromised in less than 20 minutes of being online. Sure sure, sample sizes and all that...except, I've also managed hundreds of unix machines at a time without any concerns on them.

Plug a comparably configured and aged RHEL machine, unprotected, on the 'net and it's going to get cracked as well.

Re:Some Helpful Advise

[penix1]

If you leave everything set to auto-login, then you are asking for trouble. Amazingly, many still seem to do this, even though they are often young enough to have never been brought up to the bad habits people acquired with DOS.

That really can't be blamed on the user. The blame rests squarely on both Microsoft who encouraged it with their "Home edition" and large scale computer distributors (HP in particular) where the default is auto-login. And not just any auto-login but administrator auto-login. It comes from the dumbing down of the OS to gain the dollars of the unwashed masses. We all know grandpa is too dumb or will get too frustrated having to enter passwords (much less really secure passwords).

Re:Some Helpful Advise

[s13g3]

Er... stupid 4chan meme is... lame and old and tired and, well... stupid.

Let's see, where to start... Ok, yes, large computing operations are all done on *nix. I manage THOUSANDS (note the plural) of *nix servers (and nearly as many Windows servers), and while I'm much less concerned about their default installs on a *nix, even those are just as capable of being compromised, especially depending on the distribution. And no, RHEL is not what I'd consider one of the more secure ones, unless you're also leaving SELINUX enabled, which robs the machine of a great deal of functionality and connectivity: put a default Plesk install on a *nix machine on a non-firewalled publicly addressable IP and watch how long it takes to get compromised - I can do it in under 3 minutes. You also probably have no idea just how many production *nix servers are hopelessly behind on kernel and other system updates, leaving them vulnerable to a dizzying array of compromises and exploits against everything from HTTP to SSH to webmin/usermin. Much like a Windows system, even *nix systems need some post-install configuration to ensure their safety, as well as continuing maintenance and updates, otherwise over time they become just as vulnerable as anything else, and there is no dearth of noob *nix admins who think that simply using a *nix makes them invincible and regular security maintenance unnecessary.

Also, yeah, let's see how long your "few $k a month" server(s) stands up to 10GB/s sustained DoS from Zeus or the remnants of Mariposa - unless it isn't connected to a switch that is in turn eventually connected to something else, in which case it's more or less useless for business. Botnets aren't used for computing power, and if they in fact were, I do believe you'd be rather chagrined by your above statement. There's a REASON that the various BOINC projects have been running so long, and not just because it's cheaper: it's because they crunch far more data in these distributed applications than they could do in their own server farms at any reasonable cost. Once again, this isn't the point.

Additionally, you missed the points raised by other posters above re: low-hanging fruit. You don't go after the better-administered (and a lot of Windows server admins use Windows because they have no admin skills at all), better secured servers, you go after the easy ones. Ones you can get a trojan on a 5 million Windows desktops and servers, stealing passwords and credit-card information from the former and using the latter to host the attack sites distributing your malware.

As man_of_mr_e said, especially if you live in a civilized country (which does not include China, Russia, N. Korea, Iran or Brazil, IMNSHO), then attacking a corporate system with the risk of the FBI etc. coming after you is not remotely worth it, especially when you can go after individuals who are unlikely to ever successfully initiate any sort of law enforcement action. "Grandpa's 10 year old computer" probably has his bank password on it, however.

Re:Some Helpful Advise

[toadlife]

That's a privilege escalation vulnerability. Those have existed in every OS since the the concept of privilege separation was first introduced. Like that one, many vulnerabilities (read: sshd) end up being present for several years before being discovered/disclosed.

Your original post inferred that Windows contained an inherent design flaw that always allowed dll code injection, which is bullshit.

Re:Some Helpful Advise

[man_of_mr_e]

You are confusing "vulnerable" with "exploited". I guarantee you that your system is vulnerable. There are several high profile apache vulnerabilities, for instance. I'll also bet you've applied security patches, which is not the same thing as taking a stock, unpatched system and connecting it directly.

I'll also bet you've enabled and propertly configured the firewall, something most people simply won't do.

Re:Some Helpful Advise

[man_of_mr_e]

The part you keep forgetting is that 100% of the mac market isn't anywhere near as lucritive as 10% of the Windows market. So having 100% of the mac market (even if you could get that) won't make you as much money as infecting 10% of windows boxes.. yep, you know where they're going to go.

Re:Some Helpful Advise

[man_of_mr_e]

Whether or not Windows is "low hanging fruit" or not is a matter of opinion, but the fact is.. it doesn't matter.

Even if windows were 100x more secure than any other OS, it would still have the majority of the malware. Guaranteed. Because it has the majority of the reward.

Hackers may be lazy by nature, but they will do whatever work is required to get the job done (and usually no more). So one cannot look at the amount of exploitation as an indication of the level of security, since one also has to look at the motivations of the attacker, and the ability of the target to provide what the attacker seeks.

Unix and Mac systems do not provide the level of reward that Windows systems do, and none of them have any serious consequences for failure.

Sure, ATM networks would be the holy grail, except the consequences of failure are very high, and there are lots of people willing to hunt you down if you screw up in attacking something like that.

Not so much with desktop PC's.

Re:Some Helpful Advise

[md65536]

But they have improved, and this should be both acknowledged and encouraged.

Sure, maybe in Linux vs. Mac vs. Windows forums such as slashdot. But pertaining to the original story, that of Google dumping Windows, Microsoft is being -1 off topic in talking about how much their grades have improved in remedial school. That's beside the point. It is not Google's responsibility to pat Microsoft on the back for making strides to catch up to where they should be. Good for Google, I say, to have the means to dump Windows for something that suits them better. Nothing encourages Microsoft to improve their products, more than losing market share. It's just too bad for them that they waited so long to start.

Re:Some Helpful Advise

[TiberiusMonkey]

Because if Macs were so easy to hack, as well as all being sat without anti-virus software, I'd pick the easy target for what is still a good 90 million user base. Not only that, but the perk points for writing the first real wide scale OSX virus would be worth it, alone. I'm only willing to listen to this "there are more Windows machines than OSX machines" argument for so long, OSX was released in 2002 and yet there is still nothing. Sure if there was one or two viruses out there I'd see your point, but nothing? No viruses at all?

Re:Some Helpful Advise

[Bert64]

That's entirely the point, on paper windows has a very impressive set of security features, but once you get down to trying to use them the cracks show...

The password hashing is trivially weak compared to what other systems have...
The authentication system is tied in to the hashing algorithm so it cant easily be changed without breaking things...
The authentication system is designed such that you never need to send the plain text password over the network, but you don't need the plain text password - you can just use the hash (google for hash spraying or the windows auth model is broken)...
Many of the group policy restrictions are implemented in userland applications and are easily bypassed...
Windows and its associated network protocols are extremely complex (greater complexity leads to greater chance of bugs) and in those network protocols there is often no clear demarcation between what functions can be accessed pre-auth and whats available post-auth... RDP for instance establishes a full gui session *before* you log in meaning any of those gui functions are open to attack by unauthenticated attackers...
File extensions are used to differentiate between types of file and wether a file can be executed or not, although windows does implement execute permissions through acls they usually allow execute by default. a remote web/ftp/whatever server can control the filename but not the permissions...
The complexity of the windows security system means that very few people try to use it fully, and those who do need to expend significant effort to get things working with it. Because so few people harden their systems in this way, very few applications are designed to run in such an environment and many simply don't.
Windows is generally not modular, so removing things you don't need is far more difficult than it should be, win2k8 has gone some way in this regard but its still a long way from the package managed modularity of linux.
Windows has a very messy filesystem layout, files are randomly lumped together in the windows and system32 dirs, unix has a far more sensible design which lets you do things like keep core parts of the system on read-only media.

Windows is an unholy over complicated mess, consisting of parts of a relatively well designed OS (NT), merged with parts of an extremely poorly designed OS (win9x) and various poorly designed subsystems on top...

Unix on the other hand keeps it simple, its easy to know exactly whats going on with a unix system, and the more you understand about a system the better you can monitor and harden it.

Re:Some Helpful Advise

[AlexiaDeath]

You are right about the low hanging fruit. There's a catch tho. A *nix system is never going to be a low hanging fruit, even if the admin is a dumb user. Why? Because it's not a monoculture. For the same reason its so hard to provide a Linux binary that will work for every version it also hard to devise an attack that would compromise a significant number of Linux machines because each of them is in some way different. Even if one install is old and unmaintained, there is no critical mass of systems like it.

Re:Some Helpful Advise

[zeropointburn]

Your last point is worth exploring further. If Linux systems comparable in age to XP are compared, there are in fact exploits in the wild. That would invalidate the argument that linux is too low in install-base to be targeted. What we see today is that with very few exceptions, 10-year-old linux systems aren't in use because they have been updated, patched, made more secure.
  If we assume that the 10yo RHEL and the unpatched XP boxes are equally secure, then over time RHEL gains security when compared to the XP machine due to more frequent fixes. It may lose ground (though not necessarily fall behind) at XP service pack releases, but over the lifespan of the systems the linux system is normally more secure than the windows system.
  Both systems require actions considered arcane by joe user when a difficult patch or upgrade comes along. For Windows, this is often because the necessary setting is buried beneath a mountain of dialogs, panels, and warnings (if the upgrade even does what it says it does). For Linux, this is often because the user must first obtain appropriate privilege, find the config file or script, and make specific text changes. It is confusing on both sides for the general user. For the more advanced user, Linux is far less irritating and insulting. It can be more work to get something working right sometimes, but it is often a lot less work to get back to that state after a serious problem.
  My requisite example would definitely be MS-SQL server 2005. With multiple instances, uninstalling one instance also uninstalls the tools necessary to remove other instances. A massively complicated series of steps involving registry edits, manual file deletion, special MS utilities, and a healthy dose of prayer (or chicken sacrifice) is necessary to get the box working again without a full reinstall. In fact, the repair process is far more complicated than backup > format > reinstall OS > reconfigure.

  I guess what I am saying is that most Linux systems are run by competent people, and that certainly does contribute to the platform's reputation for security. Even if you are not entirely competent, Linux can be made secure with a lot less effort than Windows and that also contributes. For Windows, though, the efforts made for security are often too little, too late, or too difficult. It is getting better, but it hasn't reached 'good' yet. How about a sandbox for suspicious executables? Let joe user drag his email attachment/activex control/shareware program to the sandbox (or let windows silently do it for him) and let it execute there, with no access to anything exploitable. If it is some harmless inane video, great. If it's a virus or if it tries anything stupid then the system quietly deletes it with no damage done. Sure it's more extreme than anything we would tolerate on linux, but how many hundreds of bank accounts and how many tens of thousands of windows reinstalls could that one feature save every day? (not to mention the bandwidth cost to Microsoft for the massive backlog of patches and updates after said reinstalls)

ROFL?

[snowboardin159]

can i be the first to just say... ROFL

Security?

[WahCheng]

Security is NOT about patching holes, a system must be designed from the ground up to be secure. Doze and it's predecessors were NEVER designed this way. Mind you, it's created one hell of an industry patching holes.

Re:Security?

[hedwards]

That's just the thing, investment is one thing, but what has been their return on investment in terms of security? Are they really getting their moneys worth out of it, or are they just throwing it down a hole like they've been doing on IE. It's not just the investment it's the stupid ideas that they've failed to kill, most notably activex and the tight integration into the OS.

Re:Security?

[MrEricSir]

They've added a lot of security. For example, when I debug an application on Windows 7, I have to click four dialog boxes instead of just one. If that isn't real security, I don't know what is.

Re:Security?

[Barny]

This is the total point, it shouldn't matter if your apps have holes in them or not (although "not" would be best), they should never have the kind of privileges that allow things to take over (do a little search for "smitfraud" and you will understand what I mean).

They seemed to be going top-down for a long time, when only now are they starting to realise that sandboxing (UAC) the user from the OS is a good idea, not the best, not 100%, but they are almost on the cusp of "getting it" at last :)

Re:Security?

[hedwards]

A shill's a shill. UAC in vista was more or less completely worthless because it was so intrusive that nearly everybody turned it off. Patch Tuesday is not the definition of prompt security updates. The permission system they use has gotten a lot better over the years, but it's absolutely inexcusable that Windows XP was allowed to ship without a proper security model. Yes, that's kind of an old OS, but it is still heavily used in the Windows world and it did ship at a time when proper security models dating back decades before indicated that running everything as admin was bad. Technically you didn't have to, it's just to get any work done at all you had to be.

Some of these things MS has fixed, but most of it is just whitewash. The internet was never something they planned for. And it took them a really long time to even consider stopping to just fix things properly. Sure they may spend more time and money on security than the competition, but is it being productive. The actual effect is what's important, not the amount of resources.

Re:Security?

[edelbrp]

True.

One argument that seems to come up over and over again when the topic of security comes up is that Windows is targeted because it's more popular. The fact is that modern networked equipment, from routers to printers to VoIP gateways, to gaming consoles, to cable modems, to smart phones, etc. run an OS with a network stack. Often many of these devices go for years without patches. I would argue that there are more non-Windows based networked computing devices than Windows PCs. I would also argue that hackers would love to sink their teeth into all those identical game consoles and other devices so they can skim CC #s and do the usual botnet activities of spam and DoS attacks.

Yet, it's rare that we hear of an exploit for those devices, while at the same time, it's so common to have a Windows computer get infected with something that it's almost considered a normal occurrence. From one point of view, it could be seen that Windows PCs have more general utility and therefore more security risks, particularly for attacks that rely on the user to do something to enable the attack. But, on the flip side, lots of identical appliances only need one attack vector to make them all susceptible and they are less likely to have the ability to phone home for security updates.

Microsoft's track record is horrible, and it's complicated by the fact that they not only make it a hassle to get updates, but there's often little incentive in the way of new features or assurance that it won't break something. Window's security problems may also stem from the history of the OS not putting a priority on networking and therefore, security (remember Bill saying the Internet was a fab and just a home-shoplifting-network?).

Re:Security?

[nmb3000]

Security is NOT about patching holes, a system must be designed from the ground up to be secure. Doze and it's predecessors were NEVER designed this way.

Is that why Ubuntu 8.04 prompts me to install some hundred or more security updates after installing it? No software is perfect and anyone who thinks that the only secure system is on that is "designed from the ground up to be secure" either A) has never worked on a large software project and/or B) doesn't have a clue what they're talking about.

What is so fundamentally more secure from a design perspective about the Linux kernel compared with the WinNT kernel? How about a distribution like Ubuntu compared with Windows XP/Vista/7? Since one was "designed from the ground up to be secure" I sure hope you can point out a few design choices specifically.

Since all software (even the Linux kernel and its ilk) have security holes, the ability and speed at which you discover the exploits and issue fixes for them is at least as important as the initial design and coding of the program. It's naive and obtuse to think any complex system will be perfect from the get-go.

Re:Security?

[Iyonesco]

Everything in Windows 7 takes four times as many clicks as in XP so that's simply consistent user interface design.

It's a shame that the one and only aspect of the Windows 7 interface that is consistent is somewhat of a negative one.

Re:Security?

[man_of_mr_e]

But.. but.. you don't know what you're talking about...

Security patches on Linux are evidence that Linux has such a secure system that patches can be found so easily. Security patches on Windows are evidence that Windows sucks.

Get with the program.

Re:Security?

[0123456]

So let me get this straight, UAC is both:
1) Too easy to ignore as you just have to click 'yes' every time
2) Too intrusive as it pops up whenever a program requires administrative privileges

Sure, don't bother to respond to what I post when you can just make stuff up instead.

At least as far as point 2 goes, mac os and many linux distros are "worse" as they not only prompt, but require your user name and password.

Like that.

Linux occasionally asks for my password or the root password (depending on the distribution) when I'm performing some kind of system maintenance. The only time it asks for a user name is when I log in.

Windows asks me to click yes to allow SuperFoobarScreensaver wants to access the program files directory; how the hell is anyone supposed to know whether it's trying to update a configuration file that the dumb developer stuck in the program files directory, or install spyware into IE? Worse, it happens so often running ordinary everyday software that pressing 'yes' becomes second nature.

Windows 7 has an OK kernel with a bazillion lines of crud on top in order to support old software that thinks it's running on a single-tasking DOS with no security. That is why Windows will take at least a decade to be anywhere near as secure as a real operating system, because it has to burn off the crud first.

The concept of Windows's UAC is fine, it just boils down to poor UI design.

Which is what I said.

Re:Security?

[Barny]

Sandboxed so far as user limits (as in linux) or even browser windows (like in chrome browser), yes it does have overheads, but really, isn't security worth a little extra CPU time since without all those anti-virus and anti-spyware apps running we can free up a whole lot of resources?

Re:Security?

[w0mprat]

Security is not a one time design effort. It's a ongoing process. The layout of interface is a one time design effort, because if you get that wrong it is a problem every single time your interface is used a flaw wastes a little of someones time, and it's hard to make changes without pissing off your user base.

Security is the opposite. Great design should not be your focus. It helps, but you cannot forsee everything.

Microsoft not only never planned for the internet but they failed to be a moving target also.

Focus and Investment

[Weaselmancer]

Nice zero content marketingspeak there:

"...third-party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others."

Focus and investment. Notice "results" aren't on that list.

As a side note, I'd also like to add that lately BP has had a huge focus and investment on cleaning up oil spills. More so than any other oil company. But still - nobody loves them this week. Wonder why?

Microsoft products are the most secure?

[morgan_greywolf]

Microsoft has come a long, long way in security, yes, that's true. But the most secure? No way. Not compared to systems designed around security from the ground up like OpenBSD or a security-hardened Linux distro with SELinux and the like. I really like the progress that Microsoft has made, and Windows 7 is much improved over previous Windows versions, but if I want a system that's truly secure, it's not a system I'm likely to pick.

Keep saying it and one day it might stick

[kaptink]

All I know is that for more than ten years I made good money removing malware from Windows boxes. In all fairness tho Windows 7 is a much better effort at a secure OS but saying that 'hackers' are making such comments is just not all that believable. Any serious geek will tell you the long sorded history of windows and all its memorable virii, malware and hacks is nothing to be proud of but I guess if you start telling people what you want them to think and keep at it one day it will stick. I think a few statistics should set the record straight.

Re:Keep saying it and one day it might stick

[Dynedain]

Where are the equivalent virii in 2010? I remember Code Red and Slammer and the really malicious code that was raping any system stupid enough to expose 135/137 and 445 to the world. I don't remember any malware of that league in recent memory.

That's because modern spyware is more focused on hijacking your machine to be part of distributed botnets. That means you don't want the user to realize the machine is compromised. As such, vandalism is less prominent in favor of the lucrative enterprise of selling access to the botnets.

Vista reinstall

[NetNed]

I did a reinstall on a Vista machine recently for a friend. 100+ windows critical updates later and it was done! Really, the install itself took a fraction of the time that all the updates took. I guess if security is measured in security updates, you win Microsoft. Now claim your paper hat that says "We Won!"

Re:Cisco

[ThePhilips]

That resonates with my own reading of the quote: all companies who are on the receiving end of M$' security investments praise the investor.

And obviously anti-virus companies would tell that Windows is better: without the swiss cheese OS they would be out of job.

Google is the competition..

[naelurec]

Google is Microsoft's #1 competition right? Of course Microsoft wants Google to continue to use Windows.. not using Windows puts Google at an even further advantage.. its not like Microsoft can drop using Windows for its internal systems.

Focus and investment != results

[Todd Knarr]

Certainly Microsoft's focus and investment surpasses everyone else's. That's because it needs to simply to tread water. The problem is that most of Microsoft's security problems aren't bugs, they're design features of their system.

There's a quote from a boss: "I don't want the industrious guy who'll keep busy doing things over and over. I want the lazy guy who'll do it once, right, so he doesn't need to keep doing it over."

Re:Both have problems

[hedwards]

Hmm, I must've missed MS beating out OpenBSD for security.

Re:Both have problems

[dclozier]

I always figured they hacked the prize they valued most and that's why Windows was on the bottom of the list.

Shut up, Microsoft, just shut up.

[bmo]

When you finally get rid of "hurr, this file is a program because it ends in .exe" and stripping executability from incoming files, then maybe you can start talking about security with the grown-ups.

But until then, go back to the kiddie-table with CP/M.

--
BMO

Re:Both have problems

[Jaysyn]

Here is a little hint for you. The dangerous hackers, the ones that are actually committing crimes in the wild, don't go to hacker competitions.

Oh please

[Tanman]

I'm sure that if you install linux from a distro that's 2-3 years old that updating all of that goes really quickly and smoothly.

Re:Both have problems

[Runaway1956]

No, now that you mention it - I know about 3000 kids using Windows, and one kid using OpenBSD. And, now that I think about it, at least 2500 WIndows users have nuked and reinstalled multiple times. That nerdy little BSD kid just keeps on going, and going, and going, and going. I think maybe she's getting some of the Energizer Bunny.

Re:Both have problems

[sortius_nod]

In a corporate environment this can happen. It's quite easy to get some tradesman's clothes and pretend you're there to service a computer. You might want to read The Art of Deception by Kevin Mitnick.

Re:Absolute vs. Relative.

[Shados]

Except you don't need antivirus/antispyware on Windows. The only people who need it are those who disable the security features right after a fresh install, and people leaning heavily toward illegal activities. Since Vista you really didn't need it.

You'll see how quickly a Linux box gets owned if I send grandma 100 free smilies with instructions about how to set exec permissions and how to sudo (similar to what you need to do to get "pwned" by an attachment in a default Win7 install).

10 years without anti-virus and anti-spyware with bi-yearly scan just to be sure I'm not crackpot, and no virus so far, and I'm not even careful...

But you'll say: "people get owned all the time on Windows!". Yeah, because when you setup Grandma's Linux box, you actually set it up for her, not just hit next next next finish and give her the admin password. I setup the Windows boxes for my family (in roughly the same amount of time I spend setting up Linux boxes), and they don't get viruses either :)

Main difference: Linux users use legitimate software, Windows users don't (even when the OSS equivalents exist for Windows) and pay the price.

Re:iPad

[mlts]

A closed device could make life much worse for privacy. How does one know that history and cookies are actually deleted, as opposed to saved off to a protected area? And of course, there are items like Flash/Java shared objects that are normally not deleted and on a closed system, there likely is no way a user can delete those. And there is always the ability to have an undocumented add-on which reports a unique ID to any Web server that asks for it.

Privacy on normal computers is an uphill battle, but at least if worst comes to worst, you can run your Web browser in a VM, or on Macs, do your web browsing as guest and log out periodically so all files are deleted. If a platform is closed, where one has to trust the Web browser to guard privacy, does it really do so? Cookies are not the only way to uniquely identify a machine.

I can see in the future this becoming a tool for "law enforcement" -- because most devices that are closed are tied by some sort of unique ID to some central place, it wouldn't be hard to push an update to a device to upload those "deleted" cookies and other data. The end user wouldn't know, and if he or she did, there would be nothing they could do other than trash the device. Or push a program out on a mass scale to look for certain items (say a MP3 file that was leaked), confirm it was on a number of devices, then file a large amount of lawsuits.

Re:Both have problems

[drsmithy]

Hmm, I must've missed MS beating out OpenBSD for security.

It's easy to be secure when you don't do anything.

Re:Both have problems

[drsmithy]

Am I to gather from this that the hackers are granted access to the machines? That isn't very realistic...

It's absolutely realistic. The vast majority of users are more than happy to do whatever it takes to see the dancing bunnies.