Microsoft Talks Back To Google's Security Claims

Kilrah_il writes "Yesterday there was a piece about Google ditching Windows for internal use because of security concerns. Now Microsoft is fighting back, claiming its products are the most secure — more than Google's and Apple's. 'When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else. And it's not just the hackers; third-party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others.'"

Comments

Some Helpful Advise

[eldavojohn]

When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else.

Hint: Your worst nightmares do not have open jovial dialogues with you. And if they did communicate with you or offer you a score card or report, they would want you to feel as though you are completely safe -- totally unaware and unprepared for what you may face.

You've come a long way, Microsoft, but you have much much further to go. If you measure security by percentage increase in security then the evolution from Windows 95 to Windows 7 is nigh impassable. But that in no way means you're number one in the security scores. Run your marketing campaign with setting the "facts" straight but people like me know. With what little (journalistic) evidence you presented, there's no way I can build a conclusion that backs up your statement. And there's no way around that. It would better prepare you to look into the several thousand anecdotes found daily revealing the issues with Windows and Internet Explorer.

Re:Some Helpful Advise

[onionman]

Microsoft's products are completely secure!! Completely! You don't even need to bother with any more security "research". In fact, I've even seen Bruce Schneier running Windows on his laptop, so it's completely safe!!

Re:Some Helpful Advise

[FuckingNickName]

That's a story about using your kid's unmanaged Windows PC for the first time to manage your finances.

MS security record is far less than impressive, but that's an awesome case of PEBCAK.

[OT]Oh god, I need to sleep but I keep getting given things to do. My fault for wasting half the afternoon on /..[/OT]

Re:Some Helpful Advise

[negRo_slim]

No one argues they are fool proof the point is merely that Microsoft ships a more secure product than most of it's competitors.

Re:Some Helpful Advise

[DavidR1991]

I love the weasel words that come out in these kinds of discussions. "Most" - what is "most"? One competitor? (Maybe, Apple?). Because it certainly does not include (on an OS level) Linux, BSDs etc. Heck I'd be surprised if you could say definitively that MS trumps Google (I certainly don't think that's the case)

Re:Some Helpful Advise

[Omega Hacker]

Even more interesting is that the "hacker" is comparing Microsoft to Adobe and Apple. Adobe is an *applications* vendor, which has no bearing on the OS security discussion. Apple has engineered a far more secure product from the ground up, being based roughly on OpenBSD et al, thus they have far fewer security holes in the first place. Not to mention he's talking about their internal processes, and not the results or the need for the process in the first place.

Re:Some Helpful Advise

[ma1wrbu5tr]

But, they are making great strides.
Just a few months ago, they completely secured thousands of PCs, making them "unhackable" (and unbootable, LOL).
https://patrickwbarnes.com/blog/2010/02/microsoft-update-kb977165-triggering-widespread-bsod/
When Microsoft can properly secure the OS at the kernel level, then I'll start taking those statements a little more seriously.

Re:Some Helpful Advise

[Romancer]

Microsoft ships a more secure product than most of it's competitors.

Name one.

Then back it up with more than a general feeling and you've got a point to make. Otherwise your comments are useless.

Re:Some Helpful Advise

[jbeach]

I personally would doubt they're even more secure than Apple. I can't recall the last time Macs around the world were taken out by some virus. Ditto for botnet infections.

Re:Some Helpful Advise

[Anonymous Coward]

I have owned several Microsoft mice and not has ever been compromised!

Re:Some Helpful Advise

[blair1q]

Hint: Your worst nightmares do not have open jovial dialogues with you.

No, but they do use irc, usenet, etc., etc., and Microsoft may or may not know how to use those things as well.

Re:Some Helpful Advise

[mysidia]

Because more investment in security does not mean your product is more secure.

You can throw a hell of a lot of money at trying to secure something, and fail utterly, because your design and imposed requirements, inherently lead you down the path to an insecure system.

For example: mandatory compatibility with a known insecure framework, and 'compatibility' includes a lot of esoteric bugs that programs came to rely on over the years.

Re:Some Helpful Advise

[h4rr4r]

Server rooms around the world disagree. As do smartphones, netbooks and all manner of embedded devices.

Re:Some Helpful Advise

[micheas]

I seem to remember the person that won the P0wn20wn contest stating that there are several security enhancements with regards to the memory stack that are not present in OSX but are in FreeBSD, Linux, and Vista.

But this may be things like the windows login being provably secure, but the firewire driver allowing you to end run the login screen.

Windows has security features that on paper make it look like it could be a very secure system, the problem is that once you have locked it down to use all the security features, you probably have to write your own applications, as most off the shelf windows software does not run in that type of environment.

Re:Some Helpful Advise

[RyuuzakiTetsuya]

Adobe is an *applications* vendor, which has no bearing on the OS security discussion.

If Adobe's applications render another OS vulnerable, that OS is to blame too.

The onus of insecure applications isn't just on the software vendors, it's also of the OS vendors.

Re:Some Helpful Advise

[MrShaggy]

I think that the same argument can be made about my ex,

Re:Some Helpful Advise

[glebovitz]

Do you seriously believe that? Do you really have your head that firmly up your ass, that you don't have a clue what is going on in the world? Apple has surpassed Microsoft as the largest Technology corporation in terms of market cap. I doubt that can happen if Apple is really so irrelevant that no body gives a shit about Macs.

How about no one, but a bunch of us hackers gives a shit about Linux on the desktop. If they did, then maybe my Dell laptop would have a working touch pad, and would be able to sleep more than once without crashing.

And yes I am participating in the effort to fix these issues.

Re:Some Helpful Advise

[Gr8Apes]

Windows in the hands of a knowledgeable admin is just as secure as Linux or OSX in the hands of an equally knowledgeable admin.

Untrue. Even in knowledgeable hands, windows is still less secure than any *nix derivative in equal or lesser hands. Why? One reason is because of DLL code injection. Another is the completely clueless way MS architected the (in)security system.

Re:Some Helpful Advise

[man_of_mr_e]

He didn't say nobody gives a shit about apple. He said, nobody gives a shit about attacking apple's products (Mac's in particular).

Here's a hint. Say you are going to write a mean nasty program whos sole purpose is to make you money, and tons of it. Will you, a) target 5% of the computers in the world, or b) tartet 90% of the computers in the world?

I know which one I would do. And if you answer differently, then you either aren't being honest, or you have a very warped idea of how malware writers think these days. It's all about return on investment, and they are spending a LOT of money buying 0 day vulnerabilities and writing tons of code to exploit them, rootkits, etc.. it's not just kids in their parents basement trying to put penises on peoples screens anymore.

Nobody gives a shit about the "challenge" of the hack, if it doesn't make them lots of money.

Re:Some Helpful Advise

[dangitman]

Adobe is an *applications* vendor,

What's your point? Microsoft and Apple are also application vendors, and applications are often the route used to exploit the OS.

Re:Some Helpful Advise

[Runaway1956]

"Here's a hint. Say you are going to write a mean nasty program whos sole purpose is to make you money, and tons of it. "

Alright, who leaked Bill Gate's business plan?

Re:Some Helpful Advise

[man_of_mr_e]

Linux and FreeBSD boxes get hacked all the time. One can claim it's because people use weak passwords or use the same password on their box as they do on every site on the internet, and there are probably a lot of those boxes that compromised that way, but a lot are also do flaws in software installed on Linux boxes. Spend some time going through sites like Zone-H and you'll see that Linux sites get successfully attaced as much, if not more so than Windows servers (the numbers change from day to day).

You're living in a dream world if you think Linux security is any better or worse than anyone elses. Most Linux boxes have 1000x more software installed on them, and each software package is a potential security flaw waiting to happen. Most of those can only compromise the account it runs on, but attackers are getting smart and creating blended attackes that include multiple vulnerabilities, including local root vulnerabilites that get executed via a user-level remote attack.

But really, the only people who attack Linux boxes are those looking to either brag, or those looking for fat pipe DDoS zombies. Malware authors, who target stupid users who will pay $50 to the fake virus writers are going to target the vast majority of systems.. ie windows.

Re:Some Helpful Advise

[Thinboy00]

Windows in the hands of a knowledgeable admin is just as secure as Linux or OSX in the hands of an equally knowledgeable admin.

That's debatable, but I'm not going to debate it.

The Windows admin will be going to enormous effort to make everything "just work" without logging in as the NT equivalent of root, while the Linux admin won't have to worry about that at all since any reasonably young distro locks root login by default. Why go to all that effort?

Re:Some Helpful Advise

[Runaway1956]

"Windows in the hands of a knowledgeable admin" is much more secure than Windows in the hands of a fool.

The rest of your assertion has absolutely no basis in logic, or in fact.

Re:Some Helpful Advise

[SQLz]

But...Linux far out numbers windows in the server room. Running a server on windows is like taking your head and slamming in a doorway 100 times, its painful.

Re:Some Helpful Advise

[Thinboy00]

Adobe is an *applications* vendor, which has no bearing on the OS security discussion.

Flash probably has the worst security of anything used as often as it is, with possible exceptions of various stupid things Microsoft has done over the years (e.g. IE6).

Re:Some Helpful Advise

[dAzED1]

tired response is tired.

The money is on UNIX systems. That's where the large banks are running their transactions, where stock is being traded, where the military is running it's services, where engineering designs are stored, etc. omgponies you hacked grandpa's 10 year old computer, and added it to your botnet...just what did that get you, really? For just a few $k a month I could build an ec2 cluster that would destroy any botnet in sheer computing power...mostly because I wouldn't have to deal with crazy queing mechanisms, or nicing the tasks down enough to not be noticed by the user.

The reality is, more than anything this tired "people hack windows boxes because they can win more" response pretends to suggest, that UNIX is phenominally more secure on a basic, fundamental, architectural level than Windows. Out of the box, I can trust an app on a RHEL os. Out of the box, I can't even plug a windows machine in to a network without being behind a firewall. I've literally seen, with my own eyes, windows machines get compromised in less than 20 minutes of being online. Sure sure, sample sizes and all that...except, I've also managed hundreds of unix machines at a time without any concerns on them.

Re:Some Helpful Advise

[X0563511]

Running a server on windows is like taking your head and slamming in a doorway 100 times, its painful.

Not only painful, but the risk of brain damage is higher too!

Re:Some Helpful Advise

[Gr8Apes]

You are incorrect. Code injection into a system DLL is possible as a regular user. Firewalls have nothing to do with this, nor does AV. All you have to do is run a piece of malicious code as the lowest level user and you're owned.

MS is as insecure as it comes, despite all their marketing hooplah.

Re:Some Helpful Advise

[Wovel]

Good point. Microsoft spends significantly more than Apple on R&D and look what that has bought them.

They did appear to have enough influence on some wannabe hacker conference to redefine what "owning a machine" is to make Apple look as bad as them.

Re:Some Helpful Advise

[Lars T.]

http://www.itwire.com/your-it-news/home-it/23941-mac-hacked-in-under-10-seconds-at-pwn2own

"Windows users need not feel smug, apparently Safari and IE8 on a machine running Windows 7 also fell soon after the winner."

Re:Some Helpful Advise

[Pikoro]

Could it be because apple doesn't pay dividends to it's shareholders? All that money coming in and none going out to the owners will inflate your market capital pretty darned easily...

Re:Some Helpful Advise

[ScrewMaster]

You've come a long way, Microsoft, but you have much much further to go.

A pound of Swiss cheese by any other name is still a pound of Swiss cheese.

Re:Some Helpful Advise

[dangitman]

Apple is not vendor... It would like to think it is but consider the following ..

Are you fucking stupid? I was talking about applications, not hardware. Apple makes dozens of applications. It would be pointless to list them all.

Microsoft is different than this, in which case it's software is either bought from somewhere else and rewritten, or its built from scratch. Therefore they are a real vendor. Their hardware is pretty much the same as Apples though, rebranded and in some cases from the same factory.

Uh, when did Microsoft start selling PCs?

Re:Some Helpful Advise

[Millennium]

You've come a long way, Microsoft, but you have much much further to go. If you measure security by percentage increase in security then the evolution from Windows 95 to Windows 7 is nigh impassable.

This. It is important to acknowledge the gains that Microsoft has made, but it is equally important to acknowledge just how far behind they were, and that they have not yet caught up. Their attitudes have improved by leaps and bounds, but they are not yet where they need to be. And they might never be, at least for as long as they cling to compatibility with certain fundamentally-flawed models they used in the past rather than making clean breaks. They certainly make much more work for themselves.

But they have improved, and this should be both acknowledged and encouraged. They should not, however, be allowed to rest on their laurels or make claims that are simply untrue.

Re:Some Helpful Advise

[sg_oneill]

Posting from a mac here, so dont get me wrong. But apples market increase is not about macs, its about iphones ipods and now ipads. Macs are great things, aint no doubt about it, solid well engineered and damn reliable machines, but its still undoubtably a minority platform.

Re:Some Helpful Advise

[Anonymous Coward]

Now we are comparing UNIX boxes that run financial institutions to Windows XP boxes run by 14 year old girls who's primary concern in life is weather or not facebook.com loads?

Hilarious.

UNIX systems in Banking institutions are run by competent people and sit on network secured by competent people. It's much easier and less risky to take control of 100,000 Windows machines run by people with zero knowledge of security and next to zero chance of figuring out they are infected than infiltrate a corporate network owned by a bank and run by a professional. Some bank machine getting hacked is going to attract a ton of of law enforcement attention whereas 100,000 Windows boxes being owned is going to attract nothing.

Re:Some Helpful Advise

[man_of_mr_e]

What a ridiculous line of reasoning. The money is in lots of different systems. Unix, Windows, but largely IBM Mainframes running OS's like MVS.

But what OS is used is irrelevant, because those systems are well protected by more than just the OS itself. Further, those systems have the power of the FBI, CIA, NSA and others behind them to track down anyone who might be capable of penetrating the impressive outer security to get to the OS itself. No (sane) hacker wants that reign of hurt to come down on them.

Then, even if you get access.. then what? You have to figure out how to get the money out. That's not an easy thing to do, since there are tons of safeguards in place to prevent money from just evaporating.

It's *MUCH* easier to compromise low-security desktop machines and take over someones checking account, transfering a few hundred or thousand dollars using the users own credentials to someplace offshore. Or, it's even easier if you get the user to do it themselves (ala fake anti-virus).

Your "reality" is not any kind of real "reality".

Wow, you hook a 10 year old operating system up to the internet without any kind of security, and it gets compromised in 20 minutes. Great. I guarantee you a 10 year old copy of Linux could get compromised just as easily if someone had merely had the motivation to write the code to do it.

And trust me, a 10 year old unpatched copy of Linux probably has 10,000 or more vulnerabilities that could be exploited to do so... if anyone cared to.

Re:Some Helpful Advise

[dAzED1]

if anyone cared to

Yeah, you're right. No one wants to, that's why I see scans and hack attempts in the thousands per second against the machines I have exposed to the internet.

Tired response is tired. Get a new one - it never really convinced anyone even 15 years ago, and it still doesn't now.

Re:Some Helpful Advise

[toadlife]

The Windows admin will be going to enormous effort to make everything "just work" without logging in as the NT equivalent of root,

An inexperienced Windows admin might. I haven't had that problem.

any reasonably young distro locks root login by default.

"locking" root (I assume you are talking about distros like Ubuntu) provides no extra security. root is not really locked, as root permissions are used every time sudo is invoked. Besides that, in the case of Ubuntu, the default settings for sudo - to cache the password fot a time after sudo is invoked allows any process running under a users credentials to capture root permissions as soon as that user invokes sudo - basically a built in - *designed in* - privilege escalation vulnerability.

Re:Some Helpful Advise

[Anonymous Coward]

Except your ec2 cluster would be taken out very quickly by any one who wants to stop you. The botnet is distributed and can do it's work from many places and can a lot of times not be traced back to the user.

And, are the banks, or military, or engineering design company (By the way I do not believe most companies like this do all of their systems through UNIX), going to be able to find the problem and nullify it compared to the grandfather? So why target the people who have more people who are capable of finding and destroying the kit? They can target mass amounts of computers most of which have no security, have not been updated in forever and contain people dumb enough to click on links in their emails.

Mac's & UNIX - Not the numbers required in the general population to make for suitable attack vectors.

Re:Some Helpful Advise

[dAzED1]

the point is that the value isn't by building a bigger botnet, it's by getting prime targets. If it takes you 10,000 times more effort to get on the large banking system than it does to break on to a windows7 box someone uses at home...so what, it's likely going to be that much more valuable. Even with massive, massive numbers of compromised systems, botnets aren't a money-making venture. Getting that random keylogger to get access to someone's bank account is FAR, FAR more difficult than shooting a spam email to 100,000 people just asking them for the info - you'll get it from a few of them. No need to actually break on to a box for that sort of thing, you just break the person. The OS is thus irrelevant.

Linux isn't less of a target, it's *more* of one. There is less success hacking it not because people don't want to hack it, but instead...wait for it...because it's more secure. I could go over the reasons why in detail, but if you haven't figured it out for yourself after all these years, then...hey, fanboi away.

Re:Some Helpful Advise

[cyphercell]

Oh, BS. It's perfectly reasonable to assume that a base windows install, if kept up to date, is about as secure from remote attacks as OpenBSD atleast once or twice a year. It's the first thing you do after a base install that really messes things up.

Given what you've said, you might argue that Windows Mandatory Integrity Control is fundamentally broken, but that's different, since most Mandatory Access Control configurations aren't going to be setup 100% anyways.

Basically, I'm assuming Google's ultimate response is that if you have 5-6 package managers running on your system it's still going to take extra effort to keep them from getting owned even if nobody turns off the updates.

Re:Some Helpful Advise

[BrokenHalo]

For most practical purposes (i.e. against all but the most sophisticated of crackers) I doubt if there's much to choose between OS X (which I gather is largely based on BSD) and Linux. Login facility depends entirely on the level of authentication you set. (Obviously this latter applies to Windows too.) If you leave everything set to auto-login, then you are asking for trouble. Amazingly, many still seem to do this, even though they are often young enough to have never been brought up to the bad habits people acquired with DOS.

Re:Some Helpful Advise

[s13g3]

Note to parent: "market share" is not everything. Especially when you consider Apple's market share is based not solely on OS or computer sales (which is more or less the case with other companies like HP and Dell who pretty much only sell hardware, or MS does not sell hardware at all [to speak of... I doubt the Xbox360 was counted in that study]), but also includes iPhones, iPods and iPads.

The vast majority of desktop computers are still PC's - Macs in data centers are basically non-existent except for a few specialized or one-off applications: the closest thing to a Mac in any of the data centers I've ever worked in is the hackintosh I'm currently writing this on.

Having one's head up one's own ass is bad enough, but talking out of your own isn't any better.

Obviously the claims made in TFA are damn-near custom designed to invite outraged flames based sheerly on how ludicrously incorrect they are, but that doesn't mean we should be modding Apple fanboys as Insightful just for doing what fanboys do and gushing about their favorite company at every opportunity and then flaming anyone who deigns to jump on their bandwagon.

Re:Some Helpful Advise

[lena_10326]

He said, nobody gives a shit about attacking apple's products (Mac's in particular)

Let's accept that as true. The result would be zero competition in the Mac trojan marketplace. Also consider that the lack of competition combined with a large population will make a marketplace very attractive for trojan entrepreneurs. As competitors enter the marketplace, margins will diminish until equilibrium is met. This contradicts your claim. One logical conclusion is the Mac is considerably more difficult to exploit compared to a Windows system so that presents itself as a barrier to entry with the Mac population. It's the barrier to entry that can explain why there are so few trojans on the Mac.

Re:Some Helpful Advise

[drsmithy]

The money is on UNIX systems.

Which are professionally managed and monitored. Why would you target them, when you can target the (typically) very UNprofessionally managed and monitored client machines, which have access to everything that matters on those central systems.

Obligatory car analogy: would you try and steal the locked car kept in a brightly lit garage with a guard watching it 24x7, or would you try and steal the unlocked car parked in a dark back alley on the edge of town that's only driven a few times a week ?

The reality is, more than anything this tired "people hack windows boxes because they can win more" response pretends to suggest, that UNIX is phenominally more secure on a basic, fundamental, architectural level than Windows.

In what way ?

Out of the box, I can trust an app on a RHEL os.

What about the users ? Most security breaches come from users, not from software flaws or bugs.

Out of the box, I can't even plug a windows machine in to a network without being behind a firewall. I've literally seen, with my own eyes, windows machines get compromised in less than 20 minutes of being online. Sure sure, sample sizes and all that...except, I've also managed hundreds of unix machines at a time without any concerns on them.

Plug a comparably configured and aged RHEL machine, unprotected, on the 'net and it's going to get cracked as well.

Re:Some Helpful Advise

[drsmithy]

But...Linux far out numbers windows in the server room.

Evidence ?

Re:Some Helpful Advise

[Gr8Apes]

If you look at Apple sales you'll see that iPhones only sell double Mac sales, and cost less than half on average. iPods have maxed out at 50Million a year, and cost far less than 1/5 of the average Mac. So from a revenue standpoint, Macs are still very relevant. Also from a pure numbers and sales standpoint, macs are relevant and bugging MS

Re:Some Helpful Advise

[kiddygrinder]

5% is still like 90 million computers, most of which without av software

Re:Some Helpful Advise

[drsmithy]

Even more interesting is that the "hacker" is comparing Microsoft to Adobe and Apple. Adobe is an *applications* vendor, which has no bearing on the OS security discussion.

Most "exploits" don't happen because of failings in "OS security".

Apple has engineered a far more secure product from the ground up, [...]

OSX wasn't "engineered by Apple" from the ground up. They bought NeXSTEP, replaced its display system and GUI, and called it MacOS.

Re:Some Helpful Advise

[Dionysus]

If you leave everything set to auto-login, then you are asking for trouble. Amazingly, many still seem to do this, even though they are often young enough to have never been brought up to the bad habits people acquired with DOS.

Oh no, the computer that I have at home automatically logs me in. Fear, ruins. Any hacker can read all my financial statements and see all my pr0n by just turning on the computer.

Well, first they must disable the alarms in my apartment otherwise someone will notice that they are here. But then they can just turn on the computer and see everything on my system.
Well, then they need to get into my apartment through a locked door (without triggering the alarm). But then they can just turn on the computer and see everything on my system.
Well, to get to my apartment, they need to get into the locked building. and up five floors. But then they can just turn on the computer and see everything on my system. ....

Re:Some Helpful Advise

[s13g3]

DING! Please mod parent +1. Malware writers go after the low-hanging fruit that is easy to exploit whenever possible, since they're lazy good-for-nothing bastards to begin with. That said, if you're lazy and profit-motivated, even if OSX was easier to hack (and I'll grant all day long that OSX is much harder to remote compromise than Windows on a number of levels), the fact remains that regardless of any market share claims, there are VASTLY more computers world-wide running Windows than OSX, period. Don't argue it, you can't; if you're so inclined, here's some proof for you.

Why would anyone waste their time on less than 7% of the total number of computers available to compromise, especially when doing so is rather more difficult? Much easier to go after the much less secure ~85% of the market that will net considerably more value in return for each hour of coding or attacking.

Parent is wrong about one thing though: there are *some* of us left who do indeed care about the challenge of the hack, but most of us have gone grey-hat at worst because we've found there is pride and joy in doing good work, as well as plenty of legal monetary compensation for those of us who are actually good at what we do. Sadly though, as above, the kiddies aren't inflicting others with penis ascii and annoying screen-savers: the kiddies are running botnets to DDoS anyone with the temerity to tell them how juvenile they are on IRC, or using trojans to steal credit card info, and the adults who lack either ethics or real skills are buying up exploits and databases and using them for large-scale fraud and espionage. Especially in China, where programmers trained in US colleges then denied citizenship are sent back home to a country where the only job available to them is a government sponsored black-hat outfit. Still, there *are* a few of the "good guys" and "propellerheads" left like Schneier, et al, who take great joy in the art of the hack and then have the ethical fiber to share their knowledge with the world, rather than hoard it to use against others for personal gain.

Re:Some Helpful Advise

[CAIMLAS]

Microsoft's threat is that there is so very much out there targeting their OS; I don't care which is "more secure" innately: it doesn't matter, ultimately, unless someone is actually trying to take you out.

Yes, we all know that the p2o competitions see Apple's products getting taken out first. So what? Trivial amounts of data are contained there (and their numbers are far fewer) compared to the Windows machines out there. In the real world, it's like giving a person the option of going after a pot of gold behind a dozen footballers or a $10 bill behind a 5 year old: only those with few aspirations will tackle the child.

Meanwhile for Microsoft, it seems like the available Windows rootkits are getting significantly more capable. They're harder to notice, harder to locate and harder to remove - sometimes even infecting into the system disk's HPA.

While it might be relatively easy to avoid a slow moving canon set next to you, avoiding a 5" hole through your chest, a hail of game darts will, eventually, leave their mark. That's the situation Microsoft faces.

Personally, I don't feel like protecting someone from thousands of darts. I'd rather them try their own luck against the canon.

Re:Some Helpful Advise

[NotInTheBox]

Well, it did help that Apple replaced its own senior staff with people from NeXT... even as high as the CEO, then iCEO, Jobs. Structurally it seems more like if NeXT had bought Apple, then the reverse.

Re:Some Helpful Advise

[RyuuzakiTetsuya]

Disable Apache, Samba, FTP, SSH, etc. on that 10 year old linux install.

Now attempt to exploit it.

Disable IIS, File/Print Sharing, remote desktop, et al, and you're still going to have a Windows machine that has open ports facing the internet.

Re:Some Helpful Advise

[CAIMLAS]

I can't speak for 10 years, but I know of a Linux server which has not only been online since May 30th, 2002, but has been running uninterrupted since then. Yes, it's had a couple reboots, of course. It's been running mail, web, and a handful of other services, publicly exposed.

Again, let me reiterate: it's an 8-year-old public facing Linux server. There's nothing uncommon about it - it's actually about as common as you can get with Linux from that era, being RedHat 7.3. The Apache binaries were compiled on April 9th, 2002 and the kernel was compiled on the 18th of the same month.

Re:Some Helpful Advise

[Gr8Apes]

Code injection into a system DLL is possible as a regular user.

Repeatedly saying something doesn't make it true.

Please provide a source for your claim. If you can't, you should apologize for posting bullshit and retract your statement.

Fine: Quickest thing I could find

Re:Some Helpful Advise

[penix1]

If you leave everything set to auto-login, then you are asking for trouble. Amazingly, many still seem to do this, even though they are often young enough to have never been brought up to the bad habits people acquired with DOS.

That really can't be blamed on the user. The blame rests squarely on both Microsoft who encouraged it with their "Home edition" and large scale computer distributors (HP in particular) where the default is auto-login. And not just any auto-login but administrator auto-login. It comes from the dumbing down of the OS to gain the dollars of the unwashed masses. We all know grandpa is too dumb or will get too frustrated having to enter passwords (much less really secure passwords).

Re:Some Helpful Advise

[s13g3]

Er... stupid 4chan meme is... lame and old and tired and, well... stupid.

Let's see, where to start... Ok, yes, large computing operations are all done on *nix. I manage THOUSANDS (note the plural) of *nix servers (and nearly as many Windows servers), and while I'm much less concerned about their default installs on a *nix, even those are just as capable of being compromised, especially depending on the distribution. And no, RHEL is not what I'd consider one of the more secure ones, unless you're also leaving SELINUX enabled, which robs the machine of a great deal of functionality and connectivity: put a default Plesk install on a *nix machine on a non-firewalled publicly addressable IP and watch how long it takes to get compromised - I can do it in under 3 minutes. You also probably have no idea just how many production *nix servers are hopelessly behind on kernel and other system updates, leaving them vulnerable to a dizzying array of compromises and exploits against everything from HTTP to SSH to webmin/usermin. Much like a Windows system, even *nix systems need some post-install configuration to ensure their safety, as well as continuing maintenance and updates, otherwise over time they become just as vulnerable as anything else, and there is no dearth of noob *nix admins who think that simply using a *nix makes them invincible and regular security maintenance unnecessary.

Also, yeah, let's see how long your "few $k a month" server(s) stands up to 10GB/s sustained DoS from Zeus or the remnants of Mariposa - unless it isn't connected to a switch that is in turn eventually connected to something else, in which case it's more or less useless for business. Botnets aren't used for computing power, and if they in fact were, I do believe you'd be rather chagrined by your above statement. There's a REASON that the various BOINC projects have been running so long, and not just because it's cheaper: it's because they crunch far more data in these distributed applications than they could do in their own server farms at any reasonable cost. Once again, this isn't the point.

Additionally, you missed the points raised by other posters above re: low-hanging fruit. You don't go after the better-administered (and a lot of Windows server admins use Windows because they have no admin skills at all), better secured servers, you go after the easy ones. Ones you can get a trojan on a 5 million Windows desktops and servers, stealing passwords and credit-card information from the former and using the latter to host the attack sites distributing your malware.

As man_of_mr_e said, especially if you live in a civilized country (which does not include China, Russia, N. Korea, Iran or Brazil, IMNSHO), then attacking a corporate system with the risk of the FBI etc. coming after you is not remotely worth it, especially when you can go after individuals who are unlikely to ever successfully initiate any sort of law enforcement action. "Grandpa's 10 year old computer" probably has his bank password on it, however.

Re:Some Helpful Advise

[CAIMLAS]

Yet, an iPad costs more than the average PC, and an iMac (the low-end Apple computer) well over twice the cost of PC hardware comparable to the low-end powerMac.

How much of those sales is pure profit to Apple? Compare that with Microsoft, which gets something like $25-35 per desktop (including corporate machines, which are CALed). You'd need something close to the actual numbers of sales to make income equity.

No wonder Apple has impressive market numbers.

Re:Some Helpful Advise

[toadlife]

That's a privilege escalation vulnerability. Those have existed in every OS since the the concept of privilege separation was first introduced. Like that one, many vulnerabilities (read: sshd) end up being present for several years before being discovered/disclosed.

Your original post inferred that Windows contained an inherent design flaw that always allowed dll code injection, which is bullshit.

Re:Some Helpful Advise

[anechoic]

not 'weather' but 'whether'

Re:Some Helpful Advise

[man_of_mr_e]

You are confusing "vulnerable" with "exploited". I guarantee you that your system is vulnerable. There are several high profile apache vulnerabilities, for instance. I'll also bet you've applied security patches, which is not the same thing as taking a stock, unpatched system and connecting it directly.

I'll also bet you've enabled and propertly configured the firewall, something most people simply won't do.

Re:Some Helpful Advise

[man_of_mr_e]

First, how many of those scans are targeted at windows boxes? How many of them are just generic brute force login attempts?

Other than those, how many Linux specific scans do you see?

Re:Some Helpful Advise

[man_of_mr_e]

The part you keep forgetting is that 100% of the mac market isn't anywhere near as lucritive as 10% of the Windows market. So having 100% of the mac market (even if you could get that) won't make you as much money as infecting 10% of windows boxes.. yep, you know where they're going to go.

Re:Some Helpful Advise

[man_of_mr_e]

Because original, not service packed Windows XP or 2000 are the only versions of Windows that's susceptible to attack right out of the box within 20 minutes.

No, Vista and 7 do not have the ability to be compromised by themselves, out of the box.

Re:Some Helpful Advise

[man_of_mr_e]

Yes. And? Tell me, if you could target 900 million users or 90 million, with the same amount of work, which would you do? Why would you expect the same amount of work to get 10% of the reward?

Re:Some Helpful Advise

[man_of_mr_e]

Whether or not Windows is "low hanging fruit" or not is a matter of opinion, but the fact is.. it doesn't matter.

Even if windows were 100x more secure than any other OS, it would still have the majority of the malware. Guaranteed. Because it has the majority of the reward.

Hackers may be lazy by nature, but they will do whatever work is required to get the job done (and usually no more). So one cannot look at the amount of exploitation as an indication of the level of security, since one also has to look at the motivations of the attacker, and the ability of the target to provide what the attacker seeks.

Unix and Mac systems do not provide the level of reward that Windows systems do, and none of them have any serious consequences for failure.

Sure, ATM networks would be the holy grail, except the consequences of failure are very high, and there are lots of people willing to hunt you down if you screw up in attacking something like that.

Not so much with desktop PC's.

Re:Some Helpful Advise

[man_of_mr_e]

One need only look at the number of high profile vulnerabilities that have been found in the last 10 years.. OpenSSH has had several, for instance.

Re:Some Helpful Advise

[dAzED1]

the suggestion that stealing 100,000 pennies over the course of a couple years is somehow bragging rights compared to the person who robs a couple banks and gets far more...is silly. botnets have already been proven to have little commercial value, and are barely anything more than "I hacked X number of people" trophies for the creators. Attempts by the botnet creators to actually use them in useful ways have always ended in failure...sure, DDoS a single site. Wow, that's useful...except, that only works with sites that are old-school, that aren't serving data from redundant CDNs from globally distributed server farms. The "cloud" has trumped botnets in any meaningful way, and can be had with far, far less effort.

The value is not on windows desktops. They're barely worth the hassle. The only reason they're targets isn't because they're so prolific, but because they're so easy.

Re:Some Helpful Advise

[md65536]

But they have improved, and this should be both acknowledged and encouraged.

Sure, maybe in Linux vs. Mac vs. Windows forums such as slashdot. But pertaining to the original story, that of Google dumping Windows, Microsoft is being -1 off topic in talking about how much their grades have improved in remedial school. That's beside the point. It is not Google's responsibility to pat Microsoft on the back for making strides to catch up to where they should be. Good for Google, I say, to have the means to dump Windows for something that suits them better. Nothing encourages Microsoft to improve their products, more than losing market share. It's just too bad for them that they waited so long to start.

Re:Some Helpful Advise

[dAzED1]

awesome...you corrected your AC post as a non-AC.

Re:Some Helpful Advise

[dAzED1]

Er... stupid 4chan meme is... lame and old and tired and, well... stupid.

I honestly don't know what the fark you are talking about.

Also, yeah, let's see how long your "few $k a month" server(s) stands up to 10GB/s sustained DoS from Zeus or the remnants of Mariposa

Wow. Well, you um...quoted part of that sentence, and either ignored or didn't understand the rest. Let's repeat it, shall we?

"For just a few $k a month I could build an ec2 cluster that would destroy any botnet in sheer computing power"

Unless you're a person merely after epeen, then botnets are outdated. If you're actually trying to do something useful with a horde of computers, then that's another matter. I have lots of ec2 instances that cost me 3.1 pennies...that's $0.031....per hour to run. That's with 1.7G of ram, and I don't even remember how much disk space (I discard what it comes with and use ebs, so meh). So let me repeat - for just a few $k I could build a globally distributed ec2 cluster running out of dozens of different data centers, and serving content from globally distributed CDNs. Your grandpa XP box botnet will indeed have a hard time not only doing something useful, but even taking down such a beast. That said, I don't need to get crazy with any such clusters, because...well, I'm not trying to compete with large botnets :) But for the effort required to create and manage one, I could do better in the cloud. It's why botnets are dying.

Additionally, you missed the points raised by other posters above re: low-hanging fruit.

Farking bloody hell I did not. I deliberately and distinctly said I disagree with that notion. The fruit is hanging lower not because it's more prolific, but because it's easier. Social hacking is OS-agnostic, and is more rewarding than going after grandpa's info brute-force, because...well, who the hell knows where he put that bank info, but if you can send out 500,000 spam emails saying people need to send in their bank info or they'll lose their accounts...and only 10 of them reply...it just cost you almost nothing to get that money. Far less effort than actually trying to break on to 500,000 boxes and rifle through their files.

Windows is hacked via script-kiddies that use old, easy, exploits. It's hacked via silly exploits that make your computer do silly things. And almost all the time, the net result is your computer is farked up, and you need to clean it. Generally, considering the automated nature of the hacking, they haven't done anything useful yet if you figure it out relatively soon.

And not a damn bit of that has anything to do with the fact that unix was built as a multi-user server environment, with no regard for clippie, games, or etc - while Windows was built as a single-user desktop environment, with no regards to ssh, stuff other people want to do on the machine, etc. They're just different systems, meant for different things. MS can try to dress up their latest thing as some new monster, but really...they should just be pointing out that their OS is far more user-friendly and intuitive to the general public than unix is, but that such comes with a cost. The old adage goes pick 2: cheap, fast, good. Windows chose cheap and fast. Maybe the great innovator Gates shouldn't have been so dismissive of the Internet for so long, and he wouldn't still be playing catch-up.

Re:Some Helpful Advise

[morbingoodkid]

We are trying to compare apples with oranges here. It all depends on how you define security. I for example consider virus and worm propagation (and most of the Unix world) as major security flaws. Windows users consider it part of their life. I consider it a security flaw if a user can without my permission access my files. In the windows world it standard practice. It the difference between having a lock door. In the Linux(Unix) world a security flaw is the same as somebody gained entry into your house without your permission. In the windows world the door is open and a security flaw is when somebody removes the bolted down table that does not fit through the door in one piece. It is not the same thing. So just taking 2 criteria (the most common attack vectors). 1. Human knowledge and awareness of security issues. 2. Ability to execute unauthorized software and the damage that software can do to your system. Which operating system comes out on the top.

Re:Some Helpful Advise

[Calinous]

Windows outnumbers Linux in the server room - Linux outnumbers Windows in the data center.
      The server room would be where the business infrastructure is - Active Directory, Exchange, MS SQL, IIS for internal projects and so on.

Re:Some Helpful Advise

[RivieraKid]

What a ridiculous line of reasoning. The money is in lots of different systems. Unix, Windows, but largely IBM Mainframes running OS's like MVS.

Now that's where you're either wrong, or just plain didn't understand what dAzED1 was saying.

Yes, the front office systems are a mix of Windows, Unix, and mainframe - but that's not where the "money" is. Those systems are just the management interface to the back-office systems where the real money (such that it is) actually is. Those back-office systems are largely Unix, typically Solaris, and given the nature of the banking industry, they'll be SPARC based.

As for the back-office systems, the mission-critical systems that handle all the trades and foreign exchange? Well, actually, it's not unusual for those to actually be 10 year old systems running 10 year old software, on a 10 year old OS. It's not unusual to run those on Solaris 8, with extended paid support from Sun/Oracle.

The reason such old systems are still in use? It's the same reason that until relatively recently vacuum tubes were still in use by the military - the characteristics are known, and the system works. You don't want to risk your billions of dollars a day of trades by using a new, untested system.

Having said that, you are totally right about the multi-layered security and how you get a better return/risk ratio from compromising a huge number of desktops for a small payout each than one bank system for a huge payout..

Re:Some Helpful Advise

[TiberiusMonkey]

I've literally seen, with my own eyes, windows machines get compromised in less than 20 minutes of being online. Sure sure, sample sizes and all that...except, I've also managed hundreds of unix machines at a time without any concerns on them.

And yet Microsoft still doesn't get why people won't trust their products. I also get the feeling that most of the people defending the security of Vista onwards, tend to be in their 20s and didn't have to deal with Microsoft in the 80s and 90s. It always comes down to this for me, YES Microsoft are doing better, but isn't it about damn time that they did better? It's taken them THIS long.

Re:Some Helpful Advise

[minus9]

Internet facing web server:

# w
8:58am up 112 days

# cat /etc/redhat-release
Red Hat Linux release 6.2 (Zoot)

Released March 2000. What do I win?

The FBI, CIA, and NSA haven't been looking after it for me as far as I know.

Re:Some Helpful Advise

[KDR_11k]

The mere presence of Bruce Schneier in the area is enough to harden Windows against any attacks. Except attacks performed by Bruce Schneier, of course.

Re:Some Helpful Advise

[RyuuzakiTetsuya]

Great, copy and paste breaks because you turned off RFC.

What now?

Re:Some Helpful Advise

[TiberiusMonkey]

Because if Macs were so easy to hack, as well as all being sat without anti-virus software, I'd pick the easy target for what is still a good 90 million user base. Not only that, but the perk points for writing the first real wide scale OSX virus would be worth it, alone. I'm only willing to listen to this "there are more Windows machines than OSX machines" argument for so long, OSX was released in 2002 and yet there is still nothing. Sure if there was one or two viruses out there I'd see your point, but nothing? No viruses at all?

Re:Some Helpful Advise

[Xest]

No hacker in their right mind is going to go after the banks. Many of these authors live in countries like Russia, and the Russians could barely give a shit about people in their country stealing $1000 dollars from Grandpa Sam's Paypal account in the US and paying it into his Russian account. If he goes after a bank instead then that's going to force an international response by the likes of the FBI and NSA, even if he hacks the bank where does the money go? you can't just sneak a million dollars out the local ATM.

But then there's the other side of it, botnets for hire, DDOS on request- in this case hackers rent out their botnets for use in taking down sites, acting as distributed password cracking networks and so forth, they get paid a fortune for this by criminal gangs, and as the gangs already have plenty of untraceable laundered money hanging around, getting paid without being traceable isn't a problem.

So simply put, you have no idea what you're on about. There's no money in hacking banks, because there's no way to do it without incurring the wrath of the world's finest in the security services and because getting out large lump sums in an untraceable manner is pretty much nigh on impossible. In contrast siphoning out small amounts in large numbers is much easier to get away with, but particularly easy to get away with is just renting out a network of machines.

But finally what's also important is the human element, grandpa Sam may well just connect his machine directly to the internet, and use a stupidly weak password like 'sam', he might actively disable security features through fiddling because he doesn't know what he's actually doing. In contrast, banks have security professionals doing security, they don't do anything so stupid. What it doesn't mean is that Windows is inherently any less secure though, unless of course you make it so.

Re:Some Helpful Advise

[Xest]

It used to be true some years ago, in the Windows 95/98 era if the system application interacted with the user's desktop. One prominent example at the time was anti-virus software, that ran on a privileged account, but displayed itself to the user in the system tray.

You're absolutely right nowadays though, this was resolved in Windows 2000 onwards, so hasn't been a problem for over a decade.

Re:Some Helpful Advise

[Bert64]

That's entirely the point, on paper windows has a very impressive set of security features, but once you get down to trying to use them the cracks show...

The password hashing is trivially weak compared to what other systems have...
The authentication system is tied in to the hashing algorithm so it cant easily be changed without breaking things...
The authentication system is designed such that you never need to send the plain text password over the network, but you don't need the plain text password - you can just use the hash (google for hash spraying or the windows auth model is broken)...
Many of the group policy restrictions are implemented in userland applications and are easily bypassed...
Windows and its associated network protocols are extremely complex (greater complexity leads to greater chance of bugs) and in those network protocols there is often no clear demarcation between what functions can be accessed pre-auth and whats available post-auth... RDP for instance establishes a full gui session *before* you log in meaning any of those gui functions are open to attack by unauthenticated attackers...
File extensions are used to differentiate between types of file and wether a file can be executed or not, although windows does implement execute permissions through acls they usually allow execute by default. a remote web/ftp/whatever server can control the filename but not the permissions...
The complexity of the windows security system means that very few people try to use it fully, and those who do need to expend significant effort to get things working with it. Because so few people harden their systems in this way, very few applications are designed to run in such an environment and many simply don't.
Windows is generally not modular, so removing things you don't need is far more difficult than it should be, win2k8 has gone some way in this regard but its still a long way from the package managed modularity of linux.
Windows has a very messy filesystem layout, files are randomly lumped together in the windows and system32 dirs, unix has a far more sensible design which lets you do things like keep core parts of the system on read-only media.

Windows is an unholy over complicated mess, consisting of parts of a relatively well designed OS (NT), merged with parts of an extremely poorly designed OS (win9x) and various poorly designed subsystems on top...

Unix on the other hand keeps it simple, its easy to know exactly whats going on with a unix system, and the more you understand about a system the better you can monitor and harden it.

Re:Some Helpful Advise

[Bert64]

And then people take these bad habits to work, where that computer is now in an open plan office that many people have access to...

Re:Some Helpful Advise

[XnR'rn]

Oh, right. On Linux, you just recompile your soft against security enhanced libraries et al. You have the source for most apps, and large percentage of it has patches that allow it to run in locked down environment.
Still, for some things you'll have to write your own patches, I guess quite a bit of FOSS also won't run 'off the shelf' for such an environment (but does it have to? Such environments are more common in *nix, and most anything that is supposed to run on very secure boxes does).
Still, if you do have something that noone else to execute in such an environment, you have much easier time doing that. In contrast on windows, you have to contact the developers of the software in question and hope the patches it will be in next release (yeah, right).

Re:Some Helpful Advise

[Anonymous Coward]

Correction, they are run by supposedly competent people... These banks also have windows boxes which again are supposedly run by competent people...

Having had experience performing penetration tests against various financial institutions, whenever we've been given an ethernet socket and free reign to attack the network we have had success compromising the windows domain (yes they always run an active directory domain which makes life so much easier when trying to compromise things)... Our record with compromising unix (or z/os os/400 and vms) systems is a lot weaker...
Gone are the days of redhat 4, modern unix systems are pretty solid out of the box and it is quite rare we would be able to compromise one directly.. Many of the unix boxes we see are default installs, but default unix installs don't have a lot of remote exploits these days. Many of the windows systems we see have had some attempts to harden them, and yet we still get in.. The easiest way to get into unix machines these days is actually to compromise the windows workstation of one of the admins and monitor his keystrokes until he logs in.

I have never encountered a corporate network (including financial institutions) where a single ethernet socket on their corporate lan wasn't all that's necessary to compromise every windows system on the network, and from there compromising everything else through keylogging...

I've also never encountered a corporate network where these actions were noticed, all of these companies rely on automated tools such as a/v to detect compromise, and its trivial to bypass these. I can do a 1 week pentest where the staff are fully aware that i'm attacking their network and will be diligently monitoring and at the end of the week they will have seen nothing, and will be extremely surprised to see a list of all their passwords.

Re:Some Helpful Advise

[Bert64]

Yes they do:

http://www.securityfocus.com/bid/36299/discuss

Re:Some Helpful Advise

[lena_10326]

With that logic small independent video game companies should not exist, because they serve a minuscule population compared to the big name companies. Since their expenses are smaller, their profit requirements (and expectations) are lower.

Also, it only takes 1 trojan developer to go rogue and write a trojan for a platform largely ignored by the big players. A lone developer reaping 5% of an untouched market will profit far more than working for the mob going after 95% portion of the market loaded with cut-throat competitors.

Re:Some Helpful Advise

[stonertom]

The firewire thing is not really a fair problem to pick, any OS with DMA could be vulnerable.

Re:Some Helpful Advise

[somersault]

Vista and 7 do not have the ability to be compromised by themselves, out of the box

That's just as dumb as saying that Linux is 100% secure. There must be some exploits in Vista/7 out of the box - ie no patches - and there will still be unpatched exploits waiting to be discovered.

Re:Some Helpful Advise

[amn108]

As far as I know, that is not possible. Please provide examples of doing exactly that, thank you.

Re:Some Helpful Advise

[AVryhof]

Most attacks. You'd be in big trouble if Chuck Norris decided he wanted to roundhouse kick your notebook.

Re:Some Helpful Advise

[mjwx]

tired response is tired.

Uninformed response is uninformed.

The easy money is not on Unix, it's on Windows. So Vladmir Q MalwareWriter wants to build a botnet to sell to spam or DDOS services, is he going to pick 1% of the worlds most powerful but well protected computers or 90% of computers where at least 60% of that market doesn't care about security in any meaningful way.

Yes, the big money is on UNIX, banks, stock exchanges and so forth but these orgs have dedicated security teams monitoring the systems 24/7. Like the GP said, do a quick cost/benefit analysis here, there is less money on Windows but it's dozens of orders of magnitude cheaper and easier to get. Ultimately, if you are doing something clandestine on someone elses equipment you do not want this noticed by the people using that equipment. How long would a trojan remain undetected in a bank?

The reality is, more than anything this tired "people hack windows boxes because they can win more" response pretends to suggest, that UNIX is phenominally more secure on a basic, fundamental, architectural level than Windows. Out of the box

But it is. Out of the box, Ubuntu (arguably, one of the weakest distro's in terms of *nix security) is miles ahead of Windows and Mac OSX (both still permit blank passwords).

Here's the rub, it is not easy to configure *nix to be less secure then Windows but it can be done. Mac OSX has almost done it (saved by the virtue that OSX does enforce separate user permissions). Windows and OS X are very difficult to secure properly unlike Linux and other *nixes. OS X makes it even more difficult because Apple insist on propagating a false sense of security around Macs (you cant get viruses, OS X is 100% safe). Security through obscurity, Mac's can get viruses and trojans the same way 90% of windows boxes get viruses and trojans, the user installs them and giving the user a false sense of security will only exacerbate this. If OSX gains a significant market share we will see OS X viruses becoming as abundant as Windows viruses because the biggest weakness for any system remains in the end user.

Re:Some Helpful Advise

[LizardKing]

They bought NeXSTEP, replaced its display system and GUI, and called it MacOS.

While they did replace Display Postscript with the more PDF-like Quartz, Apple didn't replace the GUI - they just changed the look and feel from the almost monochrome one of NextStep and OpenStep. The early developer and "Server" releases of OS X kept the NextStep look and feel, while Apple concentrated on updating the Unix core using code from NetBSD and FreeBSD.

Re:Some Helpful Advise

[Spad]

Really? What are you running, NT4?

Re:Some Helpful Advise

[amn108]

http://www.pretentiousname.com/misc/win7_uac_whitelist2.html

Re:Some Helpful Advise

[delinear]

I've been saying the same for years. Also, banks? Why lock all the money in safes overnight, the weight of the money itself is deterrent to anyone stealing it. Leave the safe doors open and we'll promise not to steal anything (okay, this joke worked much better back in the days when banks actually had any money...)

Re:Some Helpful Advise

[TheRaven64]

If the kernel and Apache are really that old, then Apache has at least one arbitrary code execution vulnerability and the kernel has at least two privilege escalation vulnerabilities. My memory is slightly fuzzy when it comes to Linux kernel versions, so the kernel might have a remote exploit of its own.

If it hasn't been compromised, it's because no one cares enough to bother. Given that it has known security holes that will grant an attacker the ability to execute code in kernel space, I wonder how you are able to tell that it has not been compromised - nothing that you do from userspace will tell you if there is a rootkit installed.

Re:Some Helpful Advise

[delinear]

If there's something on those work computers worth securing, it's pretty lax to leave the security up to the whims of the individuals using them rather than forcing shut down/log in (or locking the stations after X minutes of idle time) and/or instigating physical security measures to ensure unaothorised users don't get near them. Any company allowing people to bring their bad habits into a data sensitive office deserves the slap of having its data compromised.

Re:Some Helpful Advise

[TheRaven64]

One can claim it's because people use weak passwords or use the same password on their box as they do on every site on the internet

I can believe this. Checking my sshguard logs, I'm getting a lot of packets dropped from machines that have already been blocked for attempting to brute force ssh. I get a couple more attackers added every day, and the timeout is only a few minutes initially. Mostly they try accounts like 'git' that don't exist. Occasionally they try root (apparently there are people stupid enough to allow remote root login). If you're not running sshguard or similar (which isn't the default on any system that I've used), it just takes one weak password and the attacker has local access, one privilege escalation vulnerability and the machine is theirs.

But really, the only people who attack Linux boxes are those looking to either brag, or those looking for fat pipe DDoS zombies

Or those hoping to distribute Windows malware via the server. If you compromise a server that people trust, it's a lot easier to compromise the client.

Re:Some Helpful Advise

[TheRaven64]

Are you sure? There was a vulnerability published in Microsoft USB keyboards (and those of several other manufacturers) about a year ago. It was possible to reprogram the controller - you only had about 256 bytes of RAM to play with, but that's enough to record a short password and play it back. I'm not sure what you'd do with a compromised mouse, maybe make people miss in FPS games. Making them click on the 'okay' box when UAC pops up saying 'some malware is trying to do something evil, do you want to let it?' might be possible if you knew the screen size (move a large distance so you're trapped in the corner, move a fixed distance back, send click).

Re:Some Helpful Advise

[FictionPimp]

Here's some anecdotal evidence. The data center here has exactly 3 windows servers. I'm not sure of the exact number of servers running linux because I stopped counting at 20.

Re:Some Helpful Advise

[ThatsNotPudding]

Then again, that 5% have proved they have large amounts of cash to blow on overpriced products, so maybe they are a worthy target.

Re:Some Helpful Advise

[FictionPimp]

Except for in many cases you can't just patch windows like you can with say a debain server.

I've got no problems patching a debian server. I'd even feel comfortable patching it without a test system. However, every time I want to patch our windows servers I have to make sure to test first because many times microsoft pushes a 'patch' which is really an entirely new version of the software that breaks anything that relied the old version. More then a handful of times we have been unable to patch our windows desktops and servers because software we relied on simply would not work after the patch. This forced us to live with security vulnerabilities while we waited for a 3rd party group to get their ass in gear.

Re:Some Helpful Advise

[zaphirplane]

It's too late if the hacker is from another country, those American organizations can't help you.
e.g. google china hack ( by the way a lot of other companies were affected ) how did those American organisations help undo or ensure it does not happen again ?

If your company isn't american then you have even less assistance then that.

Sure they can help you find out how it happened but the damage is done!

Re:Some Helpful Advise

[X10]

When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else.

That's because "anyone else"'s products are secure in the first place. They don't have to be made secure.

Re:Some Helpful Advise

[gbjbaanb]

n fact, I've even seen Bruce Schneier running Windows on his laptop, so it's completely safe!!

You're making the schoolboy mistake of thinking that your laptop is safe too. Its safe because its Bruce Schneier's laptop its running on. Viruses take one look at the hostname and die instantly.

Re:Some Helpful Advise

[CyborgWarrior]

I like to call this the Wal-Mart approach to hacking. Don't go big... go wide. A ton of small targets have a greater ROI than a select few large products, and also have much less risk involved. And as anyone can see from Wal-Mart's value... it works!

Re:Some Helpful Advise

[Ash Vince]

If you leave everything set to auto-login, then you are asking for trouble.

I set all my machines to autologin if they primarily use local storage. Without disk encryption there is always the possibility that anyone who gains local access can just image the hard disk. I generally lock my PC's down to disallow all remote access so why bother logging in when anyone who sees the login screen is already sat down at my desk anyway. The only PC I used to keep on a login basis was my old linux box that also used ReiserFS to encrypt the entire home partition.

Logging in is only any form of protection if you have secure network storage that users do not have physical access to or if you use the password as an encryption key to access a local disk.

Re:Some Helpful Advise

[SiaFhir]

I've never had an issue with my touch pad in Linux, and while I've had issues with Linux sleeping before, I've had only one issue with sleeping in Ubuntu Lucid. It wasn't a crash, but rather the laptop screen was dimmed (my second monitor was fine). Needed to restart to fix that. That happened the first time after I installed Lucid, and hasn't happened since. But maybe it's because I have a Compaq and not a Dell?

Re:Some Helpful Advise

[AlexiaDeath]

You are right about the low hanging fruit. There's a catch tho. A *nix system is never going to be a low hanging fruit, even if the admin is a dumb user. Why? Because it's not a monoculture. For the same reason its so hard to provide a Linux binary that will work for every version it also hard to devise an attack that would compromise a significant number of Linux machines because each of them is in some way different. Even if one install is old and unmaintained, there is no critical mass of systems like it.

Re:Some Helpful Advise

[mrjb]

You'll see that Linux sites get successfully attaced as much, if not more so than Windows servers [...]Zone-H

Yo MS fanboy. Have you even bothered visiting that site yourself? That site isn't about OS security but about website security. Just because those websites were defaced, that doesn't mean the operating system was compromised. You know, attacks in the "arbitrary code execution due to a buffer overflow" category, allowing people to take over the machine entirely to do their bidding (usually spam botnets)?

Also, your argument stating that the "vast majority of systems" is Windows so it is targeted more does not hold for the web, where Apache still reigns supreme over IIS and yet gets compromised less, regardless.

Re:Some Helpful Advise

[sumdumgai123]

Your Zone-H argument is comparing apples to oranges. The Zone-H page you link to shows web page defacements. Web sites can be insecure on whatever OS they are running. They don't even rely on the underlying OS. You can take a website with poor security and run it on the most secure OS in the world and it can be defaced. That doesn't say anything about the security of the OS! Just because you can deface a web page does not mean the OS is vulnerable. None of the data you point to has any relevance to this discussion.
You don't know how secure any OS is until you have written kernel level modules for that OS. I have for both Windows and Linux and Windows security is a joke.

Re:Some Helpful Advise

[FewClues]

No one argues they are fool proof the point is merely that Microsoft ships a more secure product than most of it's competitors.

And you know this how? You have what proof? OH WAIT... Microsoft said so and they would never try to deceive anyone. Please ignore those lawyers behind the curtain.

Re:Some Helpful Advise

[Pax681]

LOL.. ok i'll bite.. it's not really their laptops and desktops driving their sales at all

it's itunes,ipod and such that is driving their sales.

will be interesting to see whgat the antitrust case about the itunes lockin does to this though.

however if you want to live your little life in that little walled garden of apple then fill yer boots.. help yerself.

i'd rather use my debian machine, windows machine(gaming) and my maemo OS N900 nokia and on all three of them i can install what i wish not what Mr Jobs marketing plan tells me i can and cannot do.

and yes in terms of what this thread is about apples numbers on desktops are insignificant and OSX Server.. gimme a break.

apple.. yeah nice designs but that still doesn't hide the ugliness of their lockin plan my man

Re:Some Helpful Advise

[snadrus]

No one runs that because upgrades are free & easy with Linux.
Ubuntu Linux installs and runs with no open ports by default (and has for years). So a 10 year old Ubuntu online has no vulnerabilities you can use to remotely attack it (until Firefox or other software runs).

Re:Some Helpful Advise

[Windowser]

Internet facing web server
# uptime
12:11:11 up 1027 days, 23:05,

# cat /etc/redhat-release Fedora Core release 6 (Zod)
B.t.w. I see thousands of breakin attempts a day, they can keep trying, I sleep well :)

Re:Some Helpful Advise

[TheLink]

It's not just Microsoft. OSX defaults to autologin too:

http://ist.mit.edu/services/software/macosx/security
http://www.rit.edu/its/services/desktop_support/mac/xdisableautomaticlogin.html

OSX is NOT more secure from a technical POV.

But it is more secure the way a house with no locks in a small village is more secure than a locked apartment in a big bad city.

Heh Apple even do silly stuff like: http://www.fuzzydice.net/?tag=macintosh-osx-linux-telnet-auto-login

Re:Some Helpful Advise

[DJRumpy]

A minor point with this. First, simply putting in more security features doesn't make a product more secure. It is only as strong as it's weakest link. Third party apps that fail in this area as well as the user in between are a huge exposure. Although MS has improved here, far too many apps regularly require root to install, maintain, or to even use. Such instances should be the exception an I don't feel that's the case with Windows.

From what I recall of recent hacking contests, the OS's were all relatively secure from purely remote attacks. They failed when the user could be directed to outside sites after the initial hacking rules were relaxed. It is entirely possible to be strong in one area an weak in another.

The problem with Windows is that every new user is still an admin by default with 'no' warnings as to the risk, and prompts for the admin password are stll way too common. Prompts for such access in a common day on a Mac are not. It is an immediate red flag.

The UI is also important. For instance, you see an actual lock indicator on a Mac for EVERY control panel option that required admin credentials. Simply typing in a password doesn't unlock everything with admin credentials. It just seems more logical to partition the admin instance in this fashion and to require action via the gui or command line rather than allowing an 'admin' to change anything without any prompt or warning.

Re:Some Helpful Advise

[falckon]

I could run a script to count the number of SSH login attempts I get daily but I can guarantee you it's in the 1000s. Windows is not the only system that gets targeted. In this case I assume they're trying to get in with weak passwords, but if there was some security vulnerability I bet they would use that instead.

Re:Some Helpful Advise

[cshark]

But...Linux far out numbers windows in the server room. Running a server on windows is like taking your head and slamming in a doorway 100 times, its painful.

Linux outnumbers windows on every platform except the commodity PC.

Running Windows in a server room is no picnic.

It's exploited more often, and more successfully than Linux. The attacks, in my observation have also been more deadly. Maybe Linux hackers need to get off their lazy asses, and write some malware that's worthy of it's name! Yeah, that's it. Why not come up with a way to take down a Linux box as thoroughly as they can their windows counterparts? I mean, if what I'm hearing here is correct... it's childsplay, right?

Look, you can give me benchmarks, and tell me that Linux is as bad as Windows all day. Until I see it , first hand (and I would have by now)... I'm not going to believe you.

Re:Some Helpful Advise

[amn108]

All versions of Windows 7 are affected. Wake up and smell it.

Re:Some Helpful Advise

[DrgnDancer]

A bit off topic and purely out of curiosity, what distro do you use? I recently bought a new desktop gaming rig, which removed the need for Windows on my Laptop. Since most of my work is with Linux I decided to make the laptop Linux only. Most of the office machines are Red Hat, so Fedora seemed like the easiest bet. I got everything installed and wasn't very happy with the results. No wireless (of course), touch pad acted really finicky, no Nvidia graphic drivers (again, kind of obviously). Nothing was awful, it was all stuff I'd kind of expected, and all stuff I could fix, but for some reason it all annoyed me.

I decided I'd deal with all the etcetera the next day after work. By some odd feat of chance I read the next day that Unbuntu had released 10.4. I've played with Ubuntu a few times, but never thought it was really worth the hype. It wasn't a bad distro, just nothing special that I could see. On a whim, though, I grabbed 10.4. Another reinstall wouldn't be any less fun than what awaited me in Fedoraland.

I have to say I'm pleasantly surprised. Everything works. First thing that greeted me on login was a note that the systems had installed default video drivers, but if I wanted it could grab the closed source drivers from Nvidia and set them up for me. My wireless was working (This was a shock. I used USB wireless on this laptop, never gotten around to replacing the dead internal card) so I entered the network key and clicked "yes" for the video card thing. Bam, installed. The touchpad was acting normal *and* the button to turn it off and on worked. The system informed me that my battery was failing and I should replace it (I knew this, but I'd never had an OS let me know). Then the big shock... All the media and volume touch pad buttons over the keyboard worked too. Sleep also behaves as I would expect.

All in all I was kind of shocked. Everything worked like it was supposed to instantly on boot up, or gave me an easy to use wizard to fix it (and the fix worked like it was supposed to). Like I said, I don't necessarily need this kind of dead simple setup,but I was mighty pleased to get it. This may have been the first time in my life that I put Linux on a stock laptop and it all just worked. Not to say that a distro change will fix your problems, but I'm awful glad I switched.

Re:Some Helpful Advise

[SparkEE]

Doesn't the caching only apply to the single process ? It's not like you can have some background task running waiting for a sudo, or am mistaken there?

Re:Some Helpful Advise

[yankeessuck]

Mod up! I've used pretty much every Microsoft OS since DOS 3.x and many of their development and enterprise products. Clearly things have gotten tremendously better over that time but I long ago stopped trusting them after decades of dealing with mediocre products, Linux FUD attacks and DOJ investigation shenanigans. There's really nothing they can do now to reverse that.

Re:Some Helpful Advise

[man_of_mr_e]

I've worked in three different bank datacenters, all of them used MVS, none of them had a single Solaris box. I'm not sure where you get your information.

Re:Some Helpful Advise

[man_of_mr_e]

You missed the part "Windows File Sharing Must be enabled", which it's not by default.

Re:Some Helpful Advise

[man_of_mr_e]

The part you're not taking into account is that small independent video game developers are reasonable people. Malware writers are driven by greed, what else would drive you to not only do something illegal, morally repugnant, and likely to damage lots and lots of people?

If they were just looking for money, they would be doing something illegal rather than create a cool piece of software that people like. And if they were just interested in money, they would be targeting the largest platform.

Again, you have to look at the motivations of people. It's all about the money, and when you're doing something illegal, even if it has almost no chance of being caught, you want the biggest bang for your buck or hour or whatever you put into it.

Re:Some Helpful Advise

[man_of_mr_e]

While I won't say it's impossible, I was referring to what is currently known. Vista and 7 do not have any open ports to the internet by default, so that will make things more difficult.

Re:Some Helpful Advise

[man_of_mr_e]

Or those hoping to distribute Windows malware via the server. If you compromise a server that people trust, it's a lot easier to compromise the client.

I hadn't considered that one. You're right.

Re:Some Helpful Advise

[man_of_mr_e]

What information do you have that Apache is compromised less?

Website defacements are just the easiest way to track successful hack attempts. There are lots that can't be easily tracked. And OS security is a lot more than just buffer overflows. It includes the software that ships with it. OpenBSD knows this, and they make sure all the software they ship with it is highly secure by default.

Re:Some Helpful Advise

[RivieraKid]

Well, before starting my own IT and Enterprise storage consultancy company last November, I just spent 2 years in global storage engineering for a global investment bank - one of the few investment banks that actually remained profitable during the recent market crash.

Trust me, they didn't have a single mainframe in their estate.

Prior to that, I worked at (then the #2, now the #1) global news/financial data agency for two years. Prior to that, I was in professional services at the world leading enterprise storage vendor, with many internationally trading banks as clients.

Enterprise SAN is the only way you're going to get the levels of redundancy, resilience, and accountability necessary to satisfy people like the SEC.

In total, I've probably worked in six or seven bank data centres.

In my experience at least, the ratio of banks that have mainframes exclusively in the back-end money-making flow is about 50/50 at best. Every single one of them has Solaris (or possibly AIX) and Oracle as a core component of their back-office money making operation.

I'm not trying to get into a pissing contest, and you have a perfectly valid point of view, it's just not the only way, and not even necessarily the majority way.

Re:Some Helpful Advise

[hrimhari]

I, for one, fail to understand why people wield the "there's no virus for MAC/Linux" as a proof that it's secure except for intentionally or unintentionally playing with straws.

Unless you mean that you as a user are more secure because you are not part of the targeted majority and not because your system is secure.

If you want to talk about the security of MAC/Linux, talk about how difficult it is to break into it, not how many people have done it, because before doing they have to try and to try they have to want to.

Re:Some Helpful Advise

[drsmithy]

the suggestion that stealing 100,000 pennies over the course of a couple years is somehow bragging rights compared to the person who robs a couple banks and gets far more...is silly.

Of course it is, but that's not the comparison. The comparison is someone who steals a little bit from a lot of people to someone who tries and fails to steal a lot from a few people.

The value is not on windows desktops. They're barely worth the hassle. The only reason they're targets isn't because they're so prolific, but because they're so easy.

The point is that they're easy because of the user demographic. Most security breaches happen due to user error, not software flaw or failure.

Again, I'll make the car analogy. If you were going to steal a car, would you target the locked vehicle sitting in a well-lit display room with a 24x7 guard, or would you go for the vehicle left unlocked with the keys in it in a back alley on the outskirts of town ?

Re:Some Helpful Advise

[drsmithy]

While they did replace Display Postscript with the more PDF-like Quartz, Apple didn't replace the GUI - they just changed the look and feel from the almost monochrome one of NextStep and OpenStep.

Huh ? What do you think a GUI is if not "look and feel" ?

Re:Some Helpful Advise

[hrimhari]

I take my imaginary hat off and bow at you, sir. Excellent statement. Please pretend that this is a +1 Insightful.

Re:Some Helpful Advise

[pugugly]

Admittedly, Sudo allows root access in (to the user) the same way vista/seven UAC allows access.

Now look at how often you actually *need* sudo access versus the number of times UAC pops up in windows seven on a default install.

At the end of the day Windows UAC still comes up on a regular basis. Sudo? Your average user (My Mom for example) will only see it to install or update software. I use it more, but only when I'm doing specific items that require it.

Yeah, this is symptomatic of underlying issues in the Windows security model - too much stuff, even today, requires access levels it should not need. I'm not at all sure I 'blame' Microsoft for this per se - there are historical reasons for the issues and for why they are difficult to resolve, and historical reasons for Unix/Linux having grown up without them, none of which have to do with the creators of Unix being inherently smarter - at best one could wish that Microsoft had taken the opportunity to look ahead and realize they were eventually going to have to deal with the same issues that Unix had the mixed pleasures of dealing with far earlier in its lifecycle.

Has Windows gotten *better*? Yes, but ignoring that the bar being vaulted is a low bar does not render Windows a Security Olympian.

Pug

Re:Some Helpful Advise

[man_of_mr_e]

It's not "easy" for any computer to get on botnets, it requires a great deal of work and research. If you're a virus writer, looking for a big payday, and you can make $1 million targeting macs, or $5 Million targeting PC's.. will say "Oh, $1 million is enough for me"? No. Virus writers are GREEDY, which is why they are doing it in the first place.

I'm not claiming Macs or anything else is easier to hack than windows. However, there are more people hacking windows than there are Macs, and those people share information, so it becomes a hacking ecosystem. Not only do you have 90% of the computers, but you also have nearly 100% of the hacking community sharing information (or probably, selling information).

These things don't happen as a lone programmer who discovers a flaw and decides to exploit it. It's a huge ecosystem of people who do this.

Re:Some Helpful Advise

[ckaminski]

Though that may be true, thanks to many things, including the power of OSX and the simplicity of design, it's making inroads in places it's never made before. I've almost convinced my dad to switch to a Mac portable instead of a PC. Almost. It would have been nigh-impossible 5 years ago.

I own a Mac Mini, and I've been a professed mac hater since I first started using the PC in 1988. I'm surviving with Ubuntu 10.4 until I save the money for a MacBook Pro.

Re:Some Helpful Advise

[ckaminski]

I've often thought it was a bad design decision that Microsoft never opened Windows Update up to ISVs.

Even if they didn't do hosting, being able to submit a signed key, and a URL for files, and maybe hash values, and tie that into Windows Update would be awesome. Then I only have one application trying to do updates (Windows Update), and then all the crap in my systray wouldn't need to be there, and Adobe and Mozilla could stop checking every other run... grrrr.

So much of what Microsoft does is good, but they never go the extra mile to be great. It's like they're happy with mediocrity as long as they have 100% marketshare.

Re:Some Helpful Advise

[ckaminski]

The type of attack you specify has never been possible in the NT world, with the exception of "LocalSystem" accounts, which are denied access to the network. Which means, you could have a service in administrator context, that could write to a user context, but not vice versa.

Re:Some Helpful Advise

[geekoid]

"Nobody gives a shit about the "challenge" of the hack, if it doesn't make them lots of money."

Wrong.
While there are people who basically take exploits and mostly them to the own ends, the people who are the best would become much more famous. Also, you could build up a hell of a reputation and bank on that.

You logic is flawed. It's based on the premise that Architecture, design, implementation and management are equal for both products. That are not.

A lot of people care about the challenge of the "hack". Universities are full of people that care about that.

FYI it's not a lot of money. It's a few thousand dollars at best.

Re:Some Helpful Advise

[geekoid]

He is right. If you can crack UNIX systems you can get the big dollars. Simple selling the information would get you a lot. Let the actually breaking in be done my governments or corporations.

Oh yes, the industrial espionage market is worth billions.

"And trust me, a 10 year old unpatched copy of Linux probably has 10,000 or more vulnerabilities that could be exploited to do so... if anyone cared to."

no. Show me 10 vulnerabilities in Linux version circa 2000.

Re:Some Helpful Advise

[Zen Hash]

From what I remember, Windows 95/98 did not have privilege separation. Please correct me if I'm wrong.

Re:Some Helpful Advise

[geekoid]

Industrial espionage.
That's why.

If I can sell the locked car in a brightly lit garage for enough money, that's the target.

Yes, many security breech come from users. HOWEVER a properly design system makes that hard to do by it's very design.

Monday I got an error trying to mount a hard drive in WIn7. The error said "You must have administrator permission to access these files" Continue?

That right, a hard drive from a different system I didn't have rights to access and win7 just gave me a nice box and then let me continue.

"Plug a comparably configured and aged RHEL machine, "

something I've intentionally done many times. I have yet to be compromised.

Windows security is horrid. It's design is poor, it's implementation weak, and you are a fool to use it on wide scale server systems.

Fro a user stand point, I like Win 7. I think it's their best OS to date.

Re:Some Helpful Advise

[geekoid]

You're missing the point.

UNIX systems are vulnerable out of the box, they're not nearly as weak as windows out of the box. Your not to terribly good at your job, are you?

The plus side of Unix is they can be lock down far more then Windows can.

I have a default linux install open to the wild right now, let see you crack it.

" in a civilized country (which does not include China, Russia, N. Korea, Iran or Brazil, IMNSHO),
"
Uncivilized people is what all security tries to stop. For christ sake, those are the very places you want to stop. They are where corporate espionage would go to conduct 'cyber' espionage.

Then this:
"hen attacking a corporate system with the risk of the FBI etc. coming after you is not remotely worth it,

because the existence of law enforcement stops crime? WTF?

Basically you have said the if you discount uncivilized places, and accept that no one commits a crime if there is law enforcement, you argument is valid.
If you worked for me I would be fast tracking you out the door.

Re:Some Helpful Advise

[jbeach]

If not proof, I think it's quite fair to at least cite it as evidence.

I am not personally a computer security expert. However, I am a pretty experienced user. I have heard of many, many many exploits run against Windows for over 15 years. I have not heard of anywhere near the same amount of exploits run against Macs.

In addition, I've listened to both friends and strangers who *are* experts in computer security. They all vastly prefer *nix. But, while most of them don't like Macs for other reasons - mainly adding up to it being an intentionally closed ecosystem - they never complain about it's security.

I am pretty sure that if you polled a group of Linux or similar non-biased security experts, they would agree that Macs tend to be more secure from entry than Windows-based machines in real-world practice.

Re:Some Helpful Advise

[jbeach]

I should add, they never complain about Mac's security **in comparison to Windows**. They will of course always find it lacking in comparison to *nix.

Re:Some Helpful Advise

[kiddygrinder]

to be honest i'd probably target the ones that weren't expecting it, hopefully i'd get a bigger percentage of 90 million than i would of 900 million

Re:Some Helpful Advise

[drsmithy]

Industrial espionage.
That's why.

Targeted attacks are so far out of scope of a discussion about typical windows malware it's not even funny.

If I can sell the locked car in a brightly lit garage for enough money, that's the target.

Really ? Even if you can make half as much stealing a dozen other cars with orders of magnitude less risk ?

Yes, many security breech come from users. HOWEVER a properly design system makes that hard to do by it's very design.

How ? What design features are you referring to ?

Monday I got an error trying to mount a hard drive in WIn7. The error said "You must have administrator permission to access these files" Continue?
That right, a hard drive from a different system I didn't have rights to access and win7 just gave me a nice box and then let me continue.

You mean as opposed to doing the same thing on a typical UNIX box where you wouldn't have even been prompted ?

something I've intentionally done many times. I have yet to be compromised.

Really ? You're plugging in a RHEL box dating from 2001, without a firewall, and with a comparable set of default services enabled, and not getting a single hit ?

Windows security is horrid. It's design is poor, it's implementation weak, and you are a fool to use it on wide scale server systems.

Pleasure highlight the "poor design" and "weak implementation" more specifically.

Re:Some Helpful Advise

[drsmithy]

That's no more a "vulnerability" than an SUID binary. Turn the UAC level back one from the default and it isn't even possible.

Re:Some Helpful Advise

[drsmithy]

More then a handful of times we have been unable to patch our windows desktops and servers because software we relied on simply would not work after the patch.

Can yuo give some examples of the patches and the software they broke ?

Re:Some Helpful Advise

[fwarren]

Security is all or nothing. If you are not balls to the wall about it,why bother?

I have worked in an environment where you would be fired after 3 warnings for being more than 5 feet from your computer with the desktop unlocked, or writing down a password.

There are three types of environments out there.
1. Hardened, to the max, secure passwords, can't repeat, changed on a very regular basis, are not allowed to install or run any software not approved by IT. IT does sweeps, port scans, looks at logs, audits, etc. People are fired for ANY infraction.
2. Where they realize they don't want to bother with security, they use a standard password for any app that requires a password and they can't turn the feature off.
3. Places that think any level of security below how example 1 does it is "good enough", when in reality they are only as secure as example 2.

If I can't set up the most stringent rules and have the authority to see someone fired who breaks a rule, I want to disable as much security as possible.

I can not be accountable if someone comes in at 6:30 in the morning, sits down at your desk, reads the password off the post it note at your desk and proceeds to poison the data in all the excel spreadsheets. If ANYONE can get your password, I can't be expected to secure information you have the right to change. And no amount of Security Theater will change that.

Lies I have to tell at work.
1. Nope, I am not using that bandwith to do personal downloads.
2. Yup, our systems are secured with passwords and I can tell who is making deletes and edits.
3. Yup, we self audit ever 6 months but we could always pass a BSA audit.

Re:Some Helpful Advise

[HamNCheese]

Last I checked, Linux boxes weren't being owned via browser exploits left and right.

Re:Some Helpful Advise

[HamNCheese]

Server rooms around the world disagree. As do smartphones, netbooks and all manner of embedded devices.

"Server Rooms" - as in on-site corporate intranets. The one run by the on-site IT goons - Exchange server, Domain Controller, etc.

I think the term you were looking for is "Data Centers" - the majority of which are mostly *nix.

As for "Embedded Devices" and "Smartphones" - please. Microsoft proudly owns the #5 spot in one of those, and isn't even on the radar for the other.

Re:Some Helpful Advise

[amn108]

We hereby appoint you to convince the 95% of Windows 7 users to do exactly that.

Re:Some Helpful Advise

[cyphercell]

I've got a few, I won't name names, but on my desktop systems it's around 0%-5%, on those systems I try to keep them from updating. The setups are pretty particular so I think it's better to just run the updates and fix the few machines that break, on a desktop that is. On server s-he's probably had a few over a couple years.

The worst is actually trying to make an effort to keeping everything on a windows system up to date.

Anyways, you shouldn't be making changes directly to production, I don't care what system you're running. Saying I have Debian and Debian is secure will not cut it.

Re:Some Helpful Advise

[cyphercell]

Yea, it sounds good, but it limits the bug testing. Suddenly, your beta testers are testing the latest adobe update as well as service pack 3.

Re:Some Helpful Advise

[man_of_mr_e]

Because nobody cares about the 1% of desktop Linux users. There have been plenty of vulnerabilities in Firefox and other Linux browsers to allow it, should someone have wanted to.

Yes, such vulnerabilities can only compromise the users account (as if that wasn't enough!), but user level compromise can do a lot (including be a spam zombie), but it can be combined with well known local root vulnerabilities to rootkit a box as well (hint, where do you think the term "rootkit" came from?). Sure, some boxes may be patched right away, but a lot aren't.. many users ignore local root vulnerabilities, especially if it means a reboot.

Further, it usually takes anywhere from 2-4 weeks from a vulnerability being publicly known (not the same thing as discovered, since linux developers embargo many bugs and don't release the information until a patch is ready.. which can take weeks or months in many situations). So lots of boxes are vulnerable to known vulnerabilities until it appears in their distro's automatic update system.

Desktop Linux has plenty of vulnerability. Few people seem to care enough to exploit it, though.

Re:Some Helpful Advise

[Gr8Apes]

The CALs are at least $35 each last time I looked at the pricing, by themselves in the corporate world (Exchange and NT/Whatever the standard is). There are others that add on to that. MS also gets some cash for the OS itself, and they don't pay for support on OEM OS licenses.

And the "low-end" Mac is the Mac Mini. iMac is mid-level.

Re:Some Helpful Advise

[Gr8Apes]

it's itunes,ipod and such that is driving their sales.

iTunes? Really? Have they hit 2B songs sold yet? At what? Just over $1 a song, which is revenue only, not profit?

iPods? We just stated that they sold 5X iPods compared to Macs. What's the average price of each again?

In terms of revenue alone it looks like iTunes is way down the scale compared to iPods, iPhones, iPads, and Macs.

i'd rather use my debian machine, windows machine(gaming) and my maemo OS N900 nokia and on all three of them i can install what i wish not what Mr Jobs marketing plan tells me i can and cannot do.

I also have windows installed on my MBP, although I now only run it in a VM. Haven't tried installing Linux in anything other than a VM.

and yes in terms of what this thread is about apples numbers on desktops are insignificant and OSX Server.. gimme a break.

Worldwide, somewhere around 250M or so PCs will be sold this year, around 10M of which will be Macs.

That is less than 5%, it's true. I couldn't get relative numbers just for the US, N. America or Europe. (We won't mention anything speculative like longevity differences between the two and what the effect is on the install base)

Who said anything about OSX Server?

apple.. yeah nice designs but that still doesn't hide the ugliness of their lockin plan my man

They don't work very hard at it. For example, I own an iPod, but no iTunes account.

Re:Some Helpful Advise

[zeropointburn]

Your last point is worth exploring further. If Linux systems comparable in age to XP are compared, there are in fact exploits in the wild. That would invalidate the argument that linux is too low in install-base to be targeted. What we see today is that with very few exceptions, 10-year-old linux systems aren't in use because they have been updated, patched, made more secure.
  If we assume that the 10yo RHEL and the unpatched XP boxes are equally secure, then over time RHEL gains security when compared to the XP machine due to more frequent fixes. It may lose ground (though not necessarily fall behind) at XP service pack releases, but over the lifespan of the systems the linux system is normally more secure than the windows system.
  Both systems require actions considered arcane by joe user when a difficult patch or upgrade comes along. For Windows, this is often because the necessary setting is buried beneath a mountain of dialogs, panels, and warnings (if the upgrade even does what it says it does). For Linux, this is often because the user must first obtain appropriate privilege, find the config file or script, and make specific text changes. It is confusing on both sides for the general user. For the more advanced user, Linux is far less irritating and insulting. It can be more work to get something working right sometimes, but it is often a lot less work to get back to that state after a serious problem.
  My requisite example would definitely be MS-SQL server 2005. With multiple instances, uninstalling one instance also uninstalls the tools necessary to remove other instances. A massively complicated series of steps involving registry edits, manual file deletion, special MS utilities, and a healthy dose of prayer (or chicken sacrifice) is necessary to get the box working again without a full reinstall. In fact, the repair process is far more complicated than backup > format > reinstall OS > reconfigure.

  I guess what I am saying is that most Linux systems are run by competent people, and that certainly does contribute to the platform's reputation for security. Even if you are not entirely competent, Linux can be made secure with a lot less effort than Windows and that also contributes. For Windows, though, the efforts made for security are often too little, too late, or too difficult. It is getting better, but it hasn't reached 'good' yet. How about a sandbox for suspicious executables? Let joe user drag his email attachment/activex control/shareware program to the sandbox (or let windows silently do it for him) and let it execute there, with no access to anything exploitable. If it is some harmless inane video, great. If it's a virus or if it tries anything stupid then the system quietly deletes it with no damage done. Sure it's more extreme than anything we would tolerate on linux, but how many hundreds of bank accounts and how many tens of thousands of windows reinstalls could that one feature save every day? (not to mention the bandwidth cost to Microsoft for the massive backlog of patches and updates after said reinstalls)

Re:Some Helpful Advise

[penix1]

Oh, I agree. Again though, it comes from trying to dumb down the OS for the unwashed masses.

Re:Some Helpful Advise

[BrokenHalo]

Heh Apple even do silly stuff like: http://www.fuzzydice.net/?tag=macintosh-osx-linux-telnet-auto-login

Never noticed that. :) But there again, I haven't allowed telnet to run on any server of mine in nearly 15 years...

ROFL?

[snowboardin159]

can i be the first to just say... ROFL

Re:ROFL?

[ma1wrbu5tr]

I would have beat you to it, but I had to clean Mt. Dew off my keyboard, desk, and both of my monitors after I sprayed it everywhere upon reading the article.

Re:ROFL?

[__aasqbs9791]

I think Steve Jobs isn't the only one with a RDF these days.

Security?

[WahCheng]

Security is NOT about patching holes, a system must be designed from the ground up to be secure. Doze and it's predecessors were NEVER designed this way. Mind you, it's created one hell of an industry patching holes.

Re:Security?

[hedwards]

That's just the thing, investment is one thing, but what has been their return on investment in terms of security? Are they really getting their moneys worth out of it, or are they just throwing it down a hole like they've been doing on IE. It's not just the investment it's the stupid ideas that they've failed to kill, most notably activex and the tight integration into the OS.

Re:Security?

[MrEricSir]

They've added a lot of security. For example, when I debug an application on Windows 7, I have to click four dialog boxes instead of just one. If that isn't real security, I don't know what is.

Re:Security?

[Barny]

This is the total point, it shouldn't matter if your apps have holes in them or not (although "not" would be best), they should never have the kind of privileges that allow things to take over (do a little search for "smitfraud" and you will understand what I mean).

They seemed to be going top-down for a long time, when only now are they starting to realise that sandboxing (UAC) the user from the OS is a good idea, not the best, not 100%, but they are almost on the cusp of "getting it" at last :)

Re:Security?

[hedwards]

A shill's a shill. UAC in vista was more or less completely worthless because it was so intrusive that nearly everybody turned it off. Patch Tuesday is not the definition of prompt security updates. The permission system they use has gotten a lot better over the years, but it's absolutely inexcusable that Windows XP was allowed to ship without a proper security model. Yes, that's kind of an old OS, but it is still heavily used in the Windows world and it did ship at a time when proper security models dating back decades before indicated that running everything as admin was bad. Technically you didn't have to, it's just to get any work done at all you had to be.

Some of these things MS has fixed, but most of it is just whitewash. The internet was never something they planned for. And it took them a really long time to even consider stopping to just fix things properly. Sure they may spend more time and money on security than the competition, but is it being productive. The actual effect is what's important, not the amount of resources.

Re:Security?

[WrongSizeGlass]

They've added a lot of security. For example, when I debug an application on Windows 7, I have to click four dialog boxes instead of just one. If that isn't real security, I don't know what is.

Well, four is greater than one. A car has four wheels and a unicycle only has one. A car is more secure than a unicycle. In fact, in a collision between a car and a unicycle the passenger(s) in the car will always be safer - even if the car isn't moving. Based on the preceding car analogy I can confidently declare Windows 7 is more secure than a unicycle.

Re:Security?

[edelbrp]

True.

One argument that seems to come up over and over again when the topic of security comes up is that Windows is targeted because it's more popular. The fact is that modern networked equipment, from routers to printers to VoIP gateways, to gaming consoles, to cable modems, to smart phones, etc. run an OS with a network stack. Often many of these devices go for years without patches. I would argue that there are more non-Windows based networked computing devices than Windows PCs. I would also argue that hackers would love to sink their teeth into all those identical game consoles and other devices so they can skim CC #s and do the usual botnet activities of spam and DoS attacks.

Yet, it's rare that we hear of an exploit for those devices, while at the same time, it's so common to have a Windows computer get infected with something that it's almost considered a normal occurrence. From one point of view, it could be seen that Windows PCs have more general utility and therefore more security risks, particularly for attacks that rely on the user to do something to enable the attack. But, on the flip side, lots of identical appliances only need one attack vector to make them all susceptible and they are less likely to have the ability to phone home for security updates.

Microsoft's track record is horrible, and it's complicated by the fact that they not only make it a hassle to get updates, but there's often little incentive in the way of new features or assurance that it won't break something. Window's security problems may also stem from the history of the OS not putting a priority on networking and therefore, security (remember Bill saying the Internet was a fab and just a home-shoplifting-network?).

Re:Security?

[Yvanhoe]

I would believe that Microsoft spends more on security than any other software company. Problem is, they take security as a separate issue from software design. I mean, without Microsoft, the whole antivirus field would not even exist. Of course they are spending more than anyone. They also are making other people waste money on security more than anyone

Re:Security?

[buchner.johannes]

The response from Microsoft is half-hearted at best. They don't even bother to claim that their systems are most secure, look at the post on how it emphasizes only the efforts into building secure systems, not the results. Sisyphos also put a lot of effort into his work.

The blog post also doesn't claim that Macs are less secure than Windows OS: They just reference articles that say Malware is coming to Macs now too.

The referenced study only shows one graph (Malware detection in IE8), so it is weak evidence of a whole picture.

They can play this game until someone finally comes up with a neutral, objective standard for measuring security -- such as impact-weighted bug report counts for example. Both the security industry and Microsoft will have to do better.

Re:Security?

[blair1q]

Nor was Mac.

Nor was Unix (file permissions are not a software-security system).

Not even Linux is pure.

Re:Security?

[ascari]

OK fine, but what if Ballmer says: "Hackers, hackers hackers! Hackers, hackers hackers! Hackers, hackers hackers! Hackers, hackers hackers!" That ought to do it, don't you think?

Re:Security?

[blair1q]

UAC in vista was more or less completely worthless because it was so intrusive that nearly everybody turned it off.

Only people who didn't read the directions turned it all the way off.

I turned it down so that it only pops up if I'm about to install something. Now it only pops up if I'm about to install something. Oboy, click this box to install; yeah, I meant to install that, thank you for checking. Like that's a big hassle. In general, because of the improved installation system, it's still a lot fewer clicks than it used to be.

Re:Security?

[nmb3000]

Security is NOT about patching holes, a system must be designed from the ground up to be secure. Doze and it's predecessors were NEVER designed this way.

Is that why Ubuntu 8.04 prompts me to install some hundred or more security updates after installing it? No software is perfect and anyone who thinks that the only secure system is on that is "designed from the ground up to be secure" either A) has never worked on a large software project and/or B) doesn't have a clue what they're talking about.

What is so fundamentally more secure from a design perspective about the Linux kernel compared with the WinNT kernel? How about a distribution like Ubuntu compared with Windows XP/Vista/7? Since one was "designed from the ground up to be secure" I sure hope you can point out a few design choices specifically.

Since all software (even the Linux kernel and its ilk) have security holes, the ability and speed at which you discover the exploits and issue fixes for them is at least as important as the initial design and coding of the program. It's naive and obtuse to think any complex system will be perfect from the get-go.

Re:Security?

[mysidia]

If designers have built a massive, insecure system, on an insecure foundation, the expenses involved in attempting to shore up the foundation and work around security issues are inherently higher.

Designers didn't have security in mind originally, so (technically) they should re-visit every design decision you made in every aspect of the OS, everything that interacts with the user, everything that interacts with software, every data structure, every API, every remote procedure call, the core design of every algorithm, including the remote procedure call system itself.

That's a lot more expensive and requires a lot more resources, than a system that was originally designed with security as a major consideration.

And when 'making it actually secure' requires a major design change, implementing the design change will be much more expensive, then fixing minor problems.

Also, when design change requires incompatibility, to achieve some semblence of security , you have a problem with no good solution.

I believe MS' answer in these situations has been to gloss over it, try to hide it, or fudge a patch claiming they've fixed it (just by covering over one exploitable scenario that results from it).

Re:Security?

[Iyonesco]

Everything in Windows 7 takes four times as many clicks as in XP so that's simply consistent user interface design.

It's a shame that the one and only aspect of the Windows 7 interface that is consistent is somewhat of a negative one.

Re:Security?

[0123456]

Only people who didn't read the directions turned it all the way off.

The rest always click 'Yes', because they have no idea what it means.

UAC was a good idea, but it's an appalling implementation; it tells you little that's useful about what the program is trying to do and half the time the window comes up minimised so the application just appears to have hung.

Re:Security?

[atmurray]

So let me get this straight, UAC is both: 1) Too easy to ignore as you just have to click 'yes' every time 2) Too intrusive as it pops up whenever a program requires administrative privileges So you want your cake and to eat it too do you? At least as far as point 2 goes, mac os and many linux distros are "worse" as they not only prompt, but require your user name and password. For me the problem never was about UAC, it was the fact that the UI design of things like the control panel required users to go in and out of the Administrative sandbox too often. This creates too many UAC prompts which frustrates the user. Mac OS at least (and some stuff in linux) has the notion of temporarily unlocking things like System Preferences so you can make many changes with only one prompt. The concept of Windows's UAC is fine, it just boils down to poor UI design. Disclaimer: These days I use a mac for my day to day machine and various ubuntu boxes for remote number crunching that I do.

Re:Security?

[dangitman]

This is the total point, it shouldn't matter if your apps have holes in them or not (although "not" would be best), they should never have the kind of privileges that allow things to take over (do a little search for "smitfraud" and you will understand what I mean).

That's a pretty idealistic outlook. In order to have powerful applications, they usually need to have some kind of low-level access, otherwise you are limiting the potential of what the applications can do.

If complete "sandboxing" were accomplished, you'd have developers, programmers and slashdot nerds whining about "closed systems" or "walled gardens" or whatever the latest buzzword is.

Re:Security?

[Daengbo]

That does not exist, by design software has flaws - human design of million lines.

The last line of your Hailu has too many syllables. Here. LMFTFY:

That does not exist,

by design software has flaws -

million line design.

If you're going to use a Slashdot meme, you've got to be more careful to conform.

You're welcome.

Re:Security?

[shutdown -p now]

it's absolutely inexcusable that Windows XP was allowed to ship without a proper security model.

So go ahead, explain what exactly is inproper in Windows XP security model, preferably in comparison to "proper security models dating back decades".

As for UAC, it's exactly the same as gksudo. Funny how no-one says the latter is worthless, though...

Re:Security?

[man_of_mr_e]

The vast majority of those devices do nothing to earn a malware writer money. They can't (easily) be used as spam zombies because nearly everyones email systems now reject mail from such systems. They can be used as DDoS hosts, but you really want systems with fatter pipes for that, although there's something to be said about death from a billion mosquito bites.

No, the real money in malware is in getting credit card numbers, fake anti-virus, and other sources.. all of which compromising routers and other devices won't get much of. You need a real computer with a real user, and you need to keylog because once it's over the wire it's largely encrypted.

There is some value in compromising those devices. But nowhere near the kind of value that most malware authors are looking for these days.

Re:Security?

[man_of_mr_e]

They don't have to claim they're the most secure, they need only claim they're more secure than Googles.

Re:Security?

[man_of_mr_e]

But.. but.. you don't know what you're talking about...

Security patches on Linux are evidence that Linux has such a secure system that patches can be found so easily. Security patches on Windows are evidence that Windows sucks.

Get with the program.

Re:Security?

[corbettw]

If that isn't real security, I don't know what is.

Never has a truer statement been uttered.

Re:Security?

[MBaldelli]

Patch Tuesday is not the definition of prompt security updates.

And... Prompting security and feature updates daily like a firehose is? There comes a point when weekly and even monthly scheduling of updates is actually more acceptable both to the end user as well as the IT people that have to ensure the latest patch doesn't suddenly break something vital for enterprise operations, than firehosing them with daily fixes, patches, feature upgrades, etc.

Although truth be told, I often see Critical patches being pushed to the end and enterprise users outside of the famed monthly "Patch Tuesday" push to the herd. Perhaps you forget about those? Or are you like the herd and simply accept them to be installed and your system restarted while you're sleeping?

Re:Security?

[0123456]

So let me get this straight, UAC is both:
1) Too easy to ignore as you just have to click 'yes' every time
2) Too intrusive as it pops up whenever a program requires administrative privileges

Sure, don't bother to respond to what I post when you can just make stuff up instead.

At least as far as point 2 goes, mac os and many linux distros are "worse" as they not only prompt, but require your user name and password.

Like that.

Linux occasionally asks for my password or the root password (depending on the distribution) when I'm performing some kind of system maintenance. The only time it asks for a user name is when I log in.

Windows asks me to click yes to allow SuperFoobarScreensaver wants to access the program files directory; how the hell is anyone supposed to know whether it's trying to update a configuration file that the dumb developer stuck in the program files directory, or install spyware into IE? Worse, it happens so often running ordinary everyday software that pressing 'yes' becomes second nature.

Windows 7 has an OK kernel with a bazillion lines of crud on top in order to support old software that thinks it's running on a single-tasking DOS with no security. That is why Windows will take at least a decade to be anywhere near as secure as a real operating system, because it has to burn off the crud first.

The concept of Windows's UAC is fine, it just boils down to poor UI design.

Which is what I said.

Re:Security?

[D Ninja]

They're hoping hackers get tired before they finish breaking into your computer.

"Do you want to hack this computer?" - [Yes]
"Are you sure?" - [Yes]
"Are you really really really really sure?" - [Yes]
"Seriously?" - [FTLOG, YES]

Re:Security?

[Barny]

Sandboxed so far as user limits (as in linux) or even browser windows (like in chrome browser), yes it does have overheads, but really, isn't security worth a little extra CPU time since without all those anti-virus and anti-spyware apps running we can free up a whole lot of resources?

Re:Security?

[shutdown -p now]

A security model ain't worth crap when so many applications won't run if you're not an administrator.

That's not a problem with security model. It's a problem with applications. Most of them don't have to be designed to, say, write to "C:\Program Files" - indeed, most can be trivially changed to avoid this - but they still do, because developers are lazy, and because you could do that in Win9x. This has nothing to do with XP as an OS at all.

Probably because you're talking crap. People don't complain about gksudo because they hardly ever see it, and generally only do so when performing some kind of operation that absolutely requires admin priviledges; UAC comes up routinely when you run ordinary every day pre-Vista software and with some that's not even that old.

Again, "UAC coming up routinely" is not part of the OS security model. It's a problem with badly coded legacy applications.

Note, I'm not arguing that it's not a problem. It definitely is, which is why e.g. to get "Certified for Vista/7" sticker you have to write apps properly - so Microsoft pushes software developers to fix this in their apps. However, your original comment says:

Windows XP was allowed to ship without a proper security model.

and my point is that none of your examples demonstrate any flaws with security model of Windows XP per se.

Re:Security?

[TubeSteak]

Only people who didn't read the directions turned it all the way off.

http://technet.microsoft.com/en-us/library/cc709691(WS.10).aspx#BKMK_S3
Advanced configuration options for UAC are not available in Windows Vista Starter, Windows Vista Home Basic, or Windows Vista Home Premium.

Most people buying computers end up with Home Basic or Home Premium.
They don't have the option of moderating the level of annoyance that is UAC.

Re:Security?

[dangitman]

yes it does have overheads, but really, isn't security worth a little extra CPU time since without all those anti-virus and anti-spyware apps running we can free up a whole lot of resources?

We're not talking "a little extra CPU time," we're talking about applications not able to do what applications do.

For example, if you want total security, then you can't allow an application to accept data input and connect to the internet at the same time. After all, if an application connects to the internet, and allows you to input data, there is a massive security hole - it could be sending your data to malicious parties.

Re:Security?

[w0mprat]

Security is not a one time design effort. It's a ongoing process. The layout of interface is a one time design effort, because if you get that wrong it is a problem every single time your interface is used a flaw wastes a little of someones time, and it's hard to make changes without pissing off your user base.

Security is the opposite. Great design should not be your focus. It helps, but you cannot forsee everything.

Microsoft not only never planned for the internet but they failed to be a moving target also.

Re:Security?

[Ash-Fox]

So go ahead, explain what exactly is inproper in Windows XP security model, preferably in comparison to "proper security models dating back decades".

I'm not the original poster, but some things I was doing in Ubuntu before Vista was even out. I have no idea when these things came into existence, but I believe these concepts already existed previously in other systems. All daemons with the exception of x.org were running under their own restricted user name accounts that were locked down enough to not touch the rest of the system while Windows runs daemons under various accounts including SYSTEM, LOCAL SERVICE, NETWORK SERVICE which all have varying degrees of access to the rest of the system which is how many Windows worms are capable of accessing the rest of the system.

As for UAC, it's exactly the same as gksudo.

I don't see how, gksudo is not wrapped around applications waiting for them to perform some operation that requires extra permissions and then prompting about it. It requires you run the command in question as the given user if you wish to do so. Unlike UAC however, these commands are usually simplified in some way such as you will see it prompting to run '/usr/bin/updatedb' as gksudo rather than application want to do action "{0f15391e-105f-4b05-91e3-48b73c60ae63}". Even for power users, stuff like "{0f15391e-105f-4b05-91e3-48b73c60ae63}" makes no sense. Does that mean it's going to install adware in IE? Does that mean it's just going to read/write some configuration settings? No idea. At least with gksudo you could see exactly what script/command it was executing and investigate.

gksudo also is not vulnerable to window messaging APIs like UAC is, where by you can craft various specially crafted applications to push buttons and such (hint: just get the application to toggle compatibility flags to get around windows 7's fixes against that) which defeats the whole purpose of Microsoft locking down console 0, but alas...

I can think of other things employed such as intrusion detection and elimination done on Linux via things like apparmor and selinux. Windows' closest functionality to that is group policy settings and unfortunately it is no where near as capable.

I hope this was sufficient enough to answer your question.

Re:Security?

[MrEricSir]

Right, because if there's one thing Microsoft is known for, it's a consistent UI.

Re:Security?

[shutdown -p now]

All daemons with the exception of x.org were running under their own restricted user name accounts that were locked down enough to not touch the rest of the system while Windows runs daemons under various accounts including SYSTEM, LOCAL SERVICE, NETWORK SERVICE which all have varying degrees of access to the rest of the system which is how many Windows worms are capable of accessing the rest of the system.

It's perfectly possible to run services under other accounts, so it's not a security model problem.

This is more of an issue with default configuration, which no-one really bothers to change. I agree that it is still a problem, by the way, though there have been some changes in that department in MS products - e.g. SQL Server installer will try to force you to create a separate user account for its services.

I don't see how, gksudo is not wrapped around applications waiting for them to perform some operation that requires extra permissions and then prompting about it. It requires you run the command in question as the given user if you wish to do so.

That is precisely how UAC works, actually. A process cannot elevate itself via an UAC prompt. It can only spawn a new, elevated process. Furthermore, this can only be done explicitly - an app written without knowledge of UAC will not cause an elevation prompt to pop up by doing something it's not allowed to do. It'll just get an error code from the API call that it made which will amount to "permission denied".

Unlike UAC however, these commands are usually simplified in some way such as you will see it prompting to run '/usr/bin/updatedb' as gksudo rather than application want to do action "{0f15391e-105f-4b05-91e3-48b73c60ae63}". Even for power users, stuff like "{0f15391e-105f-4b05-91e3-48b73c60ae63}" makes no sense. Does that mean it's going to install adware in IE? Does that mean it's just going to read/write some configuration settings? No idea. At least with gksudo you could see exactly what script/command it was executing and investigate.

A well-behaved application will just provide descriptive text to UAC.

A malicious application can generate a temporary script with contents that contains the actual nasty stuff, but with a convincingly sounding name that is good enough to fool a casual user.

gksudo also is not vulnerable to window messaging APIs like UAC is, where by you can craft various specially crafted applications to push buttons and such (hint: just get the application to toggle compatibility flags to get around windows 7's fixes against that) which defeats the whole purpose of Microsoft locking down console 0, but alas...

Erm, that's the whole point of running UAC prompts on a separate desktop - no application can "push buttons and such" on it.

Your reference to some compatibility flags that, if I understand you correctly, let one work around that is interesting, but I'm not aware of such a thing. Can you provide references?

I can think of other things employed such as intrusion detection and elimination done on Linux via things like apparmor and selinux.

It's a good point, but how many desktop Linux distros run AppArmor or SELinux in practice (and I mean not just out of the box, but rather not disabled or dumbed down to the point of being useless immediately after install)?

And what about OS X?

Re:Security?

[Jackie_Chan_Fan]

I dont know anyone that turned of UAC in vista or 7.

I dont mind UAC at all.

Re:Security?

[drsmithy]

Security is NOT about patching holes, a system must be designed from the ground up to be secure. Doze and it's predecessors were NEVER designed this way.

Which part of Windows NT was not designed from the ground up to be secure ?

Re:Security?

[drsmithy]

how the hell is anyone supposed to know whether it's trying to update a configuration file that the dumb developer stuck in the program files directory, or install spyware into IE?

How are they supposed to know if a sudo prompt in Linux or OSX is legitimate ?

Re:Security?

[drsmithy]

The permission system they use has gotten a lot better over the years, but it's absolutely inexcusable that Windows XP was allowed to ship without a proper security model.

Windows XP absolutely had a "security model", just like every version of Windows NT before and after it.

You don't know what you're talking about (or you're misusing terminology to the point of uselessness).

Re:Security?

[CAIMLAS]

A car is more secure than a unicycle.

I dunno, man.

Have you ever heard of someone having their unicycle broken into? Yeah, neither have I.

Re:Security?

[Ash-Fox]

It's perfectly possible to run services under other accounts, so it's not a security model problem.

Yes, it is possible, but it doesn't by default and that is one of the main reasons why worms were able to infect the rest of the Windows system. Additionally, you may find that Windows IPC does not work correctly between different user accounts, so you end up in situations where daemons that should only have access to certain things, have access to more things as other daemons need to run under the same account to operate correctly.

When it comes to the "out of the box" argument, I am reminded of OpenBSD, where I end up finding users running with some of the most insecure systems out there because the default and only account created on setup is the root account, the default configuration of daemons being completely disconnected with common security practices used in other OSes - Sure, you can configure it and OpenBSD has the potential but it's horrible to see how many people simply don't.

A process cannot elevate itself via an UAC prompt.

It can with the windows messaging API to which Microsoft has still not solved.

A well-behaved application will just provide descriptive text to UAC.

So, you're essentially saying that Microsoft Windows' control panel and configuration dialogs are not well behaved? Because those are classic examples of doing that. A very classic example of this is, modifying windows update settings.

A malicious application can generate a temporary script with contents that contains the actual nasty stuff, but with a convincingly sounding name that is good enough to fool a casual user.

The point is, for a more experienced/computer literate, whatever you want to call it, won't be fooled. Especially when the script or executable is not stored in /usr/bin or /usr/sbin, it calls for caution. When it comes to Windows, well.. I guess you could say everyone gets the same experience.

Erm, that's the whole point of running UAC prompts on a separate desktop - no application can "push buttons and such" on it.

Oh I agree, it is the whole point, but the whole problem is that it's broken.

Then I have to deal with issues like making an application that requires compatibility mode work while compatibility mode is blocked in the OS.

Your reference to some compatibility flags that, if I understand you correctly, let one work around that is interesting, but I'm not aware of such a thing. Can you provide references?

I'll provide you information to get you started, I can't provide my own research here due to the fact I don't have ownership of it (private company owns full rights to it). You need to know about the window messaging APIs, a good chunk of information on how to 'miss-use' it on previous versions of windows an be found on:
http://www.hacking-lab.com/export/sites/default/cases/7005-windows-security-privilege-escalation-shatter-attack/shatter.pdf

Exploiting it under Windows 7 is rather simple, provided you included a compatibility flag on your executable for a previous version of windows, you will have the ability to manipulate anything on console 0 as you essentially are broken out of the virtual desktop virtualization when in compatibility mode. You can then perform UAC actions, look for the UAC window handle. You will need to then remove the window restrictions from the window handle the same way as shown in the shatter exploit to deliver any large amount of shell code necessary, you can use Message.WParam to override various wmdproc settings.

Now here is the fun part, you can inject your own shell code into the window just like in

Re:Security?

[shutdown -p now]

Exploiting it under Windows 7 is rather simple, provided you included a compatibility flag on your executable for a previous version of windows, you will have the ability to manipulate anything on console 0 as you essentially are broken out of the virtual desktop virtualization when in compatibility mode.

What flag do you mean, precisely?

Now here is the fun part, you can inject your own shell code into the window just like in the classical shatter attack and essentially execute any code under UAC itself.

Isn't UAC prompt window itself privileged? You cannot send window messages from a less privileged process to a window owned by a more privileged process since Vista, so the classic WM code injection attack doesn't work for such scenarios anymore.

Re:Security?

[drsmithy]

The fact is that modern networked equipment, from routers to printers to VoIP gateways, to gaming consoles, to cable modems, to smart phones, etc. run an OS with a network stack.

And most importantly UNlike Windows they can - and frequently are - designed in such a way that they only run a very small subset of trusted, verifiable, code.

It's not hard to make a system secure when it doesn't do much, and especially when it doesn't have to be capable of doing arbitrary things.

It's basically impossible to secure an unmanaged, general purpose computer where an ignorant end user has ultimate control over what runs on it.

Re:Security?

[erroneus]

I think you have been living in the Windows reality distortion field too long. An application doesn't need "low level access" in order to do useful or even powerful things. To write a 3D modelling app, you don't need a kernel module to gain direct access to memory -- you just need good, proper, APIs such as OpenGL. User-mode drivers have proven to be quite useful in *NIX... take for example "fuse" file systems and the like. How nice would it be in Windows to be able to mount a CD/DVD ISO image or some other [virtual] file system without having to have administrator rights to accomplish this? *NIX can accomplish this rather trivially and securely. Don't need root, just need membership in a group with those focused privileges. (For example, a tty or dialout group that grants a member access to particular serial port/communications devices on the system.)

Windows is pretty much "need administrator access" for everything. There is "power user" access levels but it's usually quite useless. The Windows security model is great in some ways, but falls short in so many others.

Now as for what you just said, "for total security, [a program should not] accept data and also connect to the internet at the same time" I can't imagine how else one would run a web browser or even telnet. Having source code to verify what a program is likely doing answers that concern pretty well. Most of us know that we can't completely trust Microsoft Windows for the very reason you just mentioned -- we don't know for sure what it is doing. Is there REALLY a "genuine advantage"?

Re:Security?

[Malc]

Even though you're saying otherwise, you're actually blaming the users for the lack of security, not the OS. XP's security model is fine... encouraging users to create superuser accounts by default was not, but still, that's ultimately a user mistake. Trying to get users to work the other way in Vista didn't work out so well on the UAC front, but again, it's a user error (negligence?) to disable it. You can run everything as root on UNIX systems if you want, and would make those systems easier to use too.

Re:Security?

[Barny]

As the other replier points out, this isn't a major problem, chrome manages effective sand-boxing of a browser instance without locking the user out.

What the browser SHOULD NOT be able to do is access any part of the OS file-system in "read/write" mode... ever, it should be able to access a users browser settings and a temp folder (its own temp folder, not the WHOLE temp folder, for that matter) and of course its own executables and run-times in read only. Need to install a plugin? That should be handled by a separate process, or ask for permission, aka "SUDO" (hello? UAC? this is your job).

As windows is, too many programs have access to too much of the user data and OS in general, hell Microsoft pussied out on UAC because their program writers suck so much they can't get the hang of what little sand-boxing that accomplished (try installing an XP authored program under vista).

Re:Security?

[morbingoodkid]

Actually the last time I checked it's actually less secure. One of the more interesting issues with windows is. Because of the high number of pop up boxes in Windows most users don't actually read it and just press 'OK' as matter of course. Even in the DOS days we wrote programs that would ask the user to continue and delete or format the hard drive and most of the times they said go ahead. We used it more as a joke but goes to show that Dialog boxes is not the answer. Dialog boxes needs to be used sparingly so that if something does pop up the user needs to question what is happening. This is a major flaw in Windows that will most likely not be fixed.

Re:Security?

[JasterBobaMereel]

The kernel is no more and no less secure ... it is the rest of the Operating system that makes it secure ...

Linux/Unix apps have always assumed they have no access and cannot access outside the user directory, and generally do not have access

Windows apps are slowly following this but slowly ....

The difference is that most security problems with Linux that are patched are minor, only a problem if your system is insecure in other ways, a rather large number of similar security problems with Windows break the system wide open even on a securely setup system ...

The other difference is that a known fault in Linux tends to be patched quickly, on Windows it only gets patched if someone outside Microsoft knows about it and tells people .... otherwise it is buried

Re:Security?

[shutdown -p now]

To be a windows Logo app the *had* to write to C:\Program Files\

This definitely hasn't been true for XP logo, at the very least. If you can back your claim - for any version of Windows from NT up - with a reference, please do. Otherwise I'll consider it unsubstantiated FUD.

They had to keep everything in the Registry

This isn't insecure, if you properly separate date into HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER.

Re:Security?

[Barny]

WALL OF TEXT INC, WARNING

Self replying, but to hell with it, I am home from work now and more time to type :)

The best method I could think of to accomplish a secured walled garden would be to have a permission set for each application, which is added to the OS on install (would require a full SUDO to add an app). This would outline to the OS just what an app can and can't do, and combined with the users own set of permissions we could take the lowest of the two and run with that as the default. Lets have a web browser (because its a reasonably complicated yet simple at heart app):

User has read/write on their whole home directory and all registry settings associated with it. They have read access on any parts of the OS that they need to have the core parts of it run.

User says "install firefox", a window comes up, saying "firefox.msi" (yeah, windows as an example, if it can work for windows it will be a piece of piss to implement for other OSes) is attempting to install "Firefox", you have a drop-down (like the current time remaining drop down in windows) to show all what directories it wants read and write access to, and you want a big read message if it wants write access to its app directory or read access to any OTHER apps directory.

You of course read all that info (being at least a halfway smart user) and decide to trust the app and click allow (throw a captcha on this, its not like you will be doing it every day).

Your app is now installed, it wanted read access to the c:\program files (x86) directory, it wanted a secured temp folder (read/write), it wanted some of its own registry space for read/write (settings, layout, etc) and it wants read/write access to your bookmarks. You allowed all this, it may not get it all though :)

You run firefox, yay, you get a cookie for choosing a non IE browser, it starts up and is happy, you start browsing, first on the menu is youtube, it wants FLASH! (pre-html5 fight of course) so a popup comes up saying "flash.msi" wants to install, it will want read privs on its own directory (will be installed within the firefox directory, so will have a red warning here, which you will read because it is red) and decide its ok.

Guess what, if something nasty like smitfraud tears your browser a new arsehole, it can't infect your PC at large or even your user account because it is just plain not allowed (assuming the security system is perfect, knowing Microsoft implementations of security, I doubt it), and could easily be removed by telling your system "reset write areas for this app to new", and then start looking around your backups (a smart backup system could really just go "highest permission within users" and just backup anything writeable regularly, everything else is just code).

The beauty of this is the user could (if you wanted to set it up) add extra restrictions to this during the app install, so say your like me and add a new plugin once a century and a new bookmark about twice as often, you might want to limit access to the bookmarks folder (this would add an extra user accounts permissions for that app only, effectively a 3rd permission, not the global apps ones or the users full ones, remember, lowest permission takes precedence) to read only, thereby requiring a minor permission elevation (not a full SUDO, just to change from "lowest precedence" to "highest precedence" but still limited by user permissions.

Suddenly we can do a lot more as a user without tipping alarms off, but allow a lot less as a virus/exploit. Just downloaded something and want to know what it is? RUN IT. Any executable run from outside an installed apps directory will be able to have a temp directory as read/write and read on itself. If you get an "install app" dialogue, you can evaluate if it is the latest game demo or if it wants to rape your computer with big red read/write requests all over the file system.

Yes it would likely need further refining to have work for all apps, but maybe its time some apps were changed as to how they deal with directories.

The first thing we need to do is get rid of these damn drive letters though.

Ok, wall of text is over, back to regular /.

Re:Security?

[10101001 10101001]

Security is NOT about patching holes, a system must be designed from the ground up to be secure. Doze and it's predecessors were NEVER designed this way.

Is that why Ubuntu 8.04 prompts me to install some hundred or more security updates after installing it?

Nice strawman you've got there. So Linux is insecure too. Yea, that really shows how secure Windows is.

No software is perfect and anyone who thinks that the only secure system is on that is "designed from the ground up to be secure" either A) has never worked on a large software project and/or B) doesn't have a clue what they're talking about.

Arguing "no software is perfect" is an argument more about defects in implementation than the actual fundamental design. It's the difference between making a straw house sturdy enough to withstand a hurricane by regularly slapping it with cement vs having to epoxy a brick house to reduce the weathering damage. As for an actual design, one can look into something like Coyotos.

What is so fundamentally more secure from a design perspective about the Linux kernel compared with the WinNT kernel? How about a distribution like Ubuntu compared with Windows XP/Vista/7? Since one was "designed from the ground up to be secure" I sure hope you can point out a few design choices specifically.

You can't. They're both crap. Move on.

Since all software (even the Linux kernel and its ilk) have security holes, the ability and speed at which you discover the exploits and issue fixes for them is at least as important as the initial design and coding of the program. It's naive and obtuse to think any complex system will be perfect from the get-go.

No doubt. But the inverse of that, to expect all software to have vulnerabilities at all times and for most of them to be massively critical is equally naive and obtuse. Further, good coding practices can eliminate or at least mitigate many types of possible security vulnerabilities when implementing a secure design. Instead, both Windows and Linux (and obvious Mac OS X) are created from the pragmatic desire to build a system quickly, not just at the OS but at the application level. In short, there's more desire to spend less time and energy now with prolonged efforts to fix bugs over time than to built software right once, the first time, with only minimal patching needed in the future.

Such is visible in the firmware of many appliances which, oddly enough, don't randomly misbehave in the fashion you seem to believe should be expected in everything with software. When human life and limb, and the ensuing litigation costs, start to figure into the equation a lot of testing is done even when software is designed to fail safe. And when such software malfunctions or the design doesn't fail safe, the manufacturers are condemned, not merely patted on their shoulder with a "we understand, writing complex software is hard".

In short, own up the truth. PC software is shit because you and I are unwilling to wait for good software to be written and are willing to accept the consequences, including the need for patching. The only thing left is which software has to be patched more often, how much more (if any) pain it is to patch one system over another, how much that induces more pragmatic risk, and finally how that pragmatic risk actually starts to effect you directly or indirectly. Once you acknowledge that, you're left to acknowledge that arguments over relative security are pointless. The real issue is the pragmatic damage and the pragmatic risk.

Re:Security?

[pinkushun]

Exactly! Doze was originally designed for a single-user environment in mind, where *nix'es had multiple users, that is only one aspect where differences in design causes security holes.

Re:Security?

[TheRaven64]

Only people who didn't read the directions turned it all the way off.

If your end-user security system requires end users to read the instructions, you've already failed.

Re:Security?

[TheRaven64]

Unfortunately, the problem with the NT security model (which is very close to the VMS security model, and VMS remains significantly more secure than any *NIX variant) is that it had to coexist with Windows 3.x and Windows 9x applications, which were designed for a system that had no security model. They expected to be able to write anywhere in the filesystem, open any port, and generally do whatever they wanted. Until Vista, Microsoft looked at the trade between usability and security, and picked usability. With Vista, they picked security and everyone complained.

Writing secure software is easy. Writing secure usable software is hard.

Re:Security?

[TheRaven64]

On OS X, there is a system call that you can use to prevent the debugger from attaching at all. Of course, there's nothing stopping you from restarting the process with the debugger attached and then tweaking the program counter to skip over the system call...

Re:Security?

[TheRaven64]

The wowexec service.

Re:Security?

[BigThor00]

Can you tell me one single product that has been secure from the beginning? Unfortunately we are not all perfect and that includes programmers and all scenarios can not be anticipated by a small team in comparison to the number of users and exploiters out there. Come to reality and realize that the story is... Microsoft is doing the best they can, and they continue to do better.

Re:Security?

[Cro Magnon]

NT had a security model, but nobody ever used it. Microsoft defaulted to a single-user admin account, and most developers wrote their software based on that. Vista was the first MS OS that had any decent security out of the box.

Re:Security?

[yttrstein]

Indeed. It is absolutely true that Microsoft has among the most active security engineering and architecture departments in the world. But the implication is actually (as it almost always is) precisely the opposite of Microsoft's spin.

Re:Security?

[grasshoppa]

Because the prompts make more sense? Windows programs are often needing write access they have no business needing to write to. Is that MS's fault? Not directly, but their piss poor track record of development has led most developers to use the program files directory as a writeable location.

Linux has had this security model since forever, so developers don't expect to be able to write dynamic data to any system folders.

In Vista I was prompted every time I wanted to run certain applications. This trains users to simply click "accept" to get what they want done. Not secure. In linux, when I'm prompted I know it's because I need to be aware of something. The prompts are more realistic.

Re:Security?

[grasshoppa]

...ladies and gentlemen of this supposed jury, I have one final thing I want you to consider. Ladies and gentlemen, this is Chewbacca. Chewbacca is a Wookiee from the planet Kashyyyk. But Chewbacca lives on the planet Endor. Now think about it; that does not make sense!

Why would a Wookiee, an eight-foot tall Wookiee, want to live on Endor, with a bunch of two-foot tall Ewoks? That does not make sense! But more important, you have to ask yourself: What does this have to do with this case? Nothing. Ladies and gentlemen, it has nothing to do with this case! It does not make sense! Look at me. I'm a lawyer defending a major record company, and I'm talkin' about Chewbacca! Does that make sense? Ladies and gentlemen, I am not making any sense! None of this makes sense! And so you have to remember, when you're in that jury room deliberatin' and conjugatin' the Emancipation Proclamation, does it make sense? No! Ladies and gentlemen of this supposed jury, it does not make sense! If Chewbacca lives on Endor, you must acquit! The defense rests.

Re:Security?

[AlexiaDeath]

On ubuntu, Ive never seen sudo prompt unless I do something first, that warrants such request like trying to install something. Never have I seen it in casual use. This is not the case with UAC because the whole security model specially on the file system level is a mess. You need admin privileges for things that shouldn't need them.

Re:Security?

[arose]

They can be used as DDoS hosts, but you really want systems with fatter pipes for that

Yet no one seems to look down upon turning the Windows machine connected to the same router into a bot. How come?

Re:Security?

[Selfbain]

My port scanner doesn't find anything when I try and scan a unicycle.

Re:Security?

[SnarfQuest]

I don't think so. My unicycle doesn't get stolen 30 seconds after I get on it.

Re:Security?

[snadrus]

Distro design: Unlike Windows, Ubuntu by default...
- has no open ports.
- doesn't auto-connect to open Wireless networks.
- patches old libs instead of antiviirus reliance.
- limits administrative actions to a recent retype of the password.
- never comes with high-risk software like IE.
- doesn't run closed-source binaries of unknown origin (hacker for the cheapest price) as root.
- runs software sandboxed to the user and unable to make system modifications

Hope that gets you a starting point.

Re:Security?

[zeroshade]

And when the user REALLY wants to watch that Cat play the piano, he will blindly click "Allow" to every window and dialog in his path to get to it. =)

Re:Security?

[drsmithy]

This is not the case with UAC because the whole security model specially on the file system level is a mess. You need admin privileges for things that shouldn't need them.

For example ?

Re:Security?

[blair1q]

it happens so often running ordinary everyday software that pressing 'yes' becomes second nature.

Clearly, you have the setting set way too high.

I see it a couple of times a month. But then, I don't go downloading everything with a Download button, either.

Re:Security?

[blair1q]

I don't think that's correct. I have both Ultimate and Home Premium, and I've configured them to behave the same (though one asks for password confirmation and the other just has a button).

Re:Security?

[blair1q]

"man su...oh rats..."

Re:Security?

[drsmithy]

Because the prompts make more sense? Windows programs are often needing write access they have no business needing to write to. Is that MS's fault? Not directly, but their piss poor track record of development has led most developers to use the program files directory as a writeable location.

The last time Microsoft could be reasonably blamed for this is about 1998.

Linux has had this security model since forever, so developers don't expect to be able to write dynamic data to any system folders.

Even DOS-based Windows has had per-user datastores since about 1997.

In Vista I was prompted every time I wanted to run certain applications. This trains users to simply click "accept" to get what they want done. Not secure. In linux, when I'm prompted I know it's because I need to be aware of something. The prompts are more realistic.

The prompts appear for exactly the same good reasons in Vista. There's nothing the OS can do to prevent applications unreasonably requiring elevated privileges (as in Linux).

Re:Security?

[Barny]

If a user does that, then they pay me $149AU to fix the fuckin thing :)

Re:Security?

[Barny]

Heres a funny one, customer gets smitfraud on their pc, brings it to me, I tell them "cheapest fix is backup and reinstall, they agree, we do the job, they take it home Friday night, its back first thing Monday with smitfraud on it again, they swear black and blue they have not even used it, we check browser cache, only one site hit, isohunt, turns out their daughter loves her tv shows to the tune of nearly $300AU in total, parent is not amused :)

Cisco

[abigor]

Well, I can tell you right now that a lot of Cisco's engineers use Macs, and server-side it's Linux. That said, I imagine Cisco management, marketing, etc. are mostly Windows-based.

Re:Cisco

[ThePhilips]

That resonates with my own reading of the quote: all companies who are on the receiving end of M$' security investments praise the investor.

And obviously anti-virus companies would tell that Windows is better: without the swiss cheese OS they would be out of job.

Re:Cisco

[woboyle]

Not to mention that Cisco's most secure IOS operating system is an OEM version of QNX. No Windoze there...

Re:Cisco

[h4rr4r]

And all their ASA devices run linux.

Re:Cisco

[mysidia]

Er... interesting.. so what business do marketing people have picking an opinion for the company to have about the technical (security) merits of an OS, then?

Re:Cisco

[lar3ry]

At Cisco, I've found that MacBook Pros are the new "hot" laptop for engineers (320 GB, Snow Leopard, 4 GB RAM, instant on/off, etc. versus dog-slow Lenovos with smaller disks, smaller RAM, etc.). And I'm seeing more and more iMacs on engineers' desks.

To be fair, a lot of those Macs have VMWare Fusion (for those things that absolutely require Windows), but I think the overall goal for the company is to get everything running on Cisco's own hardened version of Linux. It won't happen overnight, but the seeds have already been planted.

On the other hand, Cisco doesn't really bad-mouth Windows. It sees Microsoft as a strategic partner.

Re:Cisco

[dueyfinster]

No surprise really, as Cisco IOS has more in common with *Nix families than it does DOS/Windows,

Microsoft?

[Anonymous Coward]

Secure products?

Crap.... woke up in the wrong universe again.. I hate when that happens.

Re:Microsoft?

[Anonymous Coward]

Thank you for explaining what the hell is going on today. I was beginning to think of going out and buying the latest version of Tin Foil Hat, because I seem to have displaced mine. But waking up in the wrong universe again explains everything!

Re:Microsoft?

[t0rb3n]

If there's nothing wrong with me, maybe there is something wrong with the universe!
<3

Re:Microsoft?

[alexandreracine]

hey.... where do you want to go today?

Awwwwwww, crap!

[LifesABeach]

I just sprayed coffee all over my keyboard. I guess Bill is going to try stand-up comedy now? He's got a great prop, "Clippy"

Re:Awwwwwww, crap!

[Barny]

Damn you, now i sprayed my tea all over my keyboard with the image of Steve doing a ventriloquist act with a puppet of clippy :) (since bill doesn't work there any more)

Re:Awwwwwww, crap!

[dangitman]

I guess Bill is going to try stand-up comedy now?

Did you miss the news that he has already done ads with Jerry Seinfeld? Or that comic "Bill's last day at Microsoft" video? His 1983 Teen Beat magazine spread?

Or the fact that Bill Gates no longer runs Microsoft and Steve Ballmer is the current CEO?

Re:Awwwwwww, crap!

[symbolset]

Bill is still Chairman of the Board and reportedly an advisor on key development projects. If you draw a salary you can't be said to "not work there any more".

That guy doesn't understand what irony means

[DavidR1991]

In a rough sense, irony means a contradiction. In which case, can someone please explain how this:

"There is some irony here that is hard to overlook. For starters, check out this story from Mashable a few months ago where it was reported that Yale University had halted their move to Gmail (and their move to Google’s Google Apps for Education package) citing both security and privacy concerns."

makes sense as a comparison, let alone counts as irony/ironic? What the hell is ironic here?

The fact Google is moving away from MS citing security concerns, and something else citing Google security concerns is not any kind of a contradiction as far as I can see.

Re:That guy doesn't understand what irony means

[spazdor]

Come to think of it, maybe Yale backed out of the Gmail deal because Google staff were running Windows.

Re:That guy doesn't understand what irony means

[iNaya]

If it were true that Google Apps package was the most secure, and Yale refused to use Google Apps due to security concerns, THAT would be ironic.

Because it would mean, by trying to increase their security, they have reduced their security.

If they were using MS Office instead of Google Apps, because of security issues then, assuming that G Apps is more secure, then yes, that is ironic.

For instance, I find it ironic that my ex school blocked Google Chrome because of security issues, yet runs IE 6.

Of course if it were MS Office that were more secure, then the ironic thing would be us saying that it was ironic...

Focus and Investment

[Weaselmancer]

Nice zero content marketingspeak there:

"...third-party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others."

Focus and investment. Notice "results" aren't on that list.

As a side note, I'd also like to add that lately BP has had a huge focus and investment on cleaning up oil spills. More so than any other oil company. But still - nobody loves them this week. Wonder why?

Re:Focus and Investment

[newdsfornerds]

I salute you, my fellow spelling enforcer. "Rediculous" is one of my pet peeves. And yeah, screw Microsoft right in the neck.

Re:Focus and Investment

[grcumb]

Nice zero content marketingspeak there:

"...third-party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others."

Focus and investment. Notice "results" aren't on that list.

SECURITY ANALYST: WTF? You invest billions and billions of dollars trying to fix your software, and this is the best you can do? Christ on a kebab, man! Do your developers even know how to tie their own shoelaces? What do they do, sit their slack-jawed at their desks all day, watching the grass die on their Farmville plots and pissing their pants because they can't even remember where the toilet is?

MS MARKETING PERSON: sotto voce Hmmm, billions spent... developers unable to leave desks... Ah!
[WRITING] "industry leaders tell us regularly that our focus and investment continues to surpass others."

Re:Focus and Investment

[pinkushun]

Well said Sir! I would have been more crude, along the lines of it being "competitive ass-kissing"!

We heard this before...

[toxygen01]

... using windows reduces TCO and improves performance...
http://www.microsoft.com/windowsserver/compare/linux/windows-server-tco.mspx
what is it going to be next? opensource bring bad karma and incantation upon us?

Microsoft products are the most secure?

[morgan_greywolf]

Microsoft has come a long, long way in security, yes, that's true. But the most secure? No way. Not compared to systems designed around security from the ground up like OpenBSD or a security-hardened Linux distro with SELinux and the like. I really like the progress that Microsoft has made, and Windows 7 is much improved over previous Windows versions, but if I want a system that's truly secure, it's not a system I'm likely to pick.

Re:Microsoft products are the most secure?

[jrl]

OpenBSD is still DAC. Not really directly comparable to SE Linux (MAC).

Read this for an idea of an OS designed with security in mind.
http://www.commoncriteriaportal.org/files/epfiles/solaris10ext-sec-e.pdf

Hi, I'm a hacker...

[thestudio_bob]

Hi, I'm a hacker and Windows 7 was my idea.

Re:Hi, I'm a hacker...

[Anonymous Coward]

When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else.

Let's parse that sentence...

At least two hackers have admitted that Microsoft is doing a better job of making their products more secure than anyone else is.

Translation: Microsoft does a better job of securing Microsoft products than third parties do.

So what Microsoft is really saying here is that some hackers believe that third party security products targeted at Microsoft products aren't as good as Microsoft's in-house security solutions. Way to sidestep the issue.

Re:Hi, I'm a hacker...

[future assassin]

Best one line response I've read on /. in a long time. Someone please make a video with this line in it and post it on youtube or something.

Re:Hi, I'm a hacker...

[newdsfornerds]

LOL!

Re:Hi, I'm a hacker...

[morgan_greywolf]

So what Microsoft is really saying here is that some hackers believe that third party security products targeted at Microsoft products aren't as good as Microsoft's in-house security solutions.

Yeah. Duh. Microsoft is a $200 billion company with an incentive to invest in improving the security of their own closed-source OS. Of course they're going to to do better than a 3rd-party company like McAfee or Symantec.

But that still doesn't mean they're doing better than other systems with security designed-in from day 1.

Re:Hi, I'm a hacker...

[codepunk]

Ha Ha, now that is some funny shit.

Re:Hi, I'm a hacker...

[Runaway1956]

I agree with the mods - definitely funny!

But, seriously, I've found that Win7 with Microsoft Security Essentials really is a pretty sweet deal. Especially if some common sense security measures are used - like Firefox with No-script and AdBlock plus. Don't open emails, don't open attachments - the normal common sense stuff.

I visited some of the nastier drive-by sites during my Win7 tests, and got away from them unscathed. Not bad, really. The worst thing that happened was a browser hijack - but the hijack failed to install the toolbar because Administrator wouldn't enter his password.

But, even so, I won't be lulled into believing that Win7 is truly secure. I only agree that Microsoft can do a better job at security than all the security vendors. The problem in the past has been motivating Microsoft to DO SO!!

Both have problems

[kvillaca]

I don't like MS, though the truth is that with this last Windows, they are really more secure than others SO's, if you guys pay attention in the hacker championship, that one the gives a prize for the fastest hacker that invade one system, the fast invasion happens into Mac OS X, then Linux and Windows for last. Of course as Windows has more platforms spread than any other OS, it's the target number one. However, I don't like the Google politics, because even the browser with or without privacy enable, they always will receive some data from you. If exist one big brother world wide, Google is this one, and don't thing that it will get better, because will not.

Re:Both have problems

[hedwards]

Hmm, I must've missed MS beating out OpenBSD for security.

Re:Both have problems

[dclozier]

I always figured they hacked the prize they valued most and that's why Windows was on the bottom of the list.

Re:Both have problems

[bryan1945]

The latest results I could find was from 2006. Do you have a link to a new competition?

Re:Both have problems

[butalearner]

I don't like MS, though the truth is that with this last Windows, they are really more secure than others SO's, if you guys pay attention in the hacker championship, that one the gives a prize for the fastest hacker that invade one system, the fast invasion happens into Mac OS X, then Linux and Windows for last.

Oh, you mean Pwn2Own? 2010? Nope, Linux not tested. 2009? Nope, not tested. 2008? Can't be, the Sony Vaio running Ubuntu was never cracked.

Anybody got results from 2007 or earlier? I can't find them.

Re:Both have problems

[Kitkoan]

I always figured they hacked the prize they valued most and that's why Windows was on the bottom of the list.

Wrong. They always hacked the Mac because Apple is way easier to hack then Microsoft

From the links article:

This came in via e-mail: Many pundits have made a lot of the fact that the Mac was the first to be exploited in the Pwn2Own contest. Was the choice of the Mac as the first target because the hardware/operating system combo was more desirable as a prize than the commodity Windows laptops of the other competitors? Or was it just because Macintosh exploits occur with much less frequency than Windows exploits and would therefore be more newsworthy?

So until this year, applications on Apple were way easier to exploit than Windows. This is because Apple had weak ASLR and no DEP while Windows had full ASLR and DEP. This year, Snow Leopard has DEP, so its no longer trivial to exploit. In fact, I have lots of bugs in Safari that I easily could have exploited on Leopard but will be very difficult on Snow Leopard. So it used to be that that it was much worse, but now its mostly comparable (although still slightly behind)

And this is from Pwn2Own 2010.

Re:Both have problems

[blair1q]

Know a lot of kids using OpenBSD?

Re:Both have problems

[chrono13]

Exactly which hacker championship are you referring to? Pwn2Own, the contest where they win the machine and $10,000? If so, you will want to look at the results again. Mac and Windows have consistently fallen, while Linux has remained the only OS standing.

Re:Both have problems

[Jaysyn]

Here is a little hint for you. The dangerous hackers, the ones that are actually committing crimes in the wild, don't go to hacker competitions.

Re:Both have problems

[MightyYar]

Am I to gather from this that the hackers are granted access to the machines? That isn't very realistic... I don't have hackers coming into my house while I'm at work trying to own my computers - they are limited to trying to bust through on the network, or infesting a site that I browse.

Re:Both have problems

[shutdown -p now]

OpenBSD is more secure than most anything else out of the box.

A brick is also more secure than most anything else out of the box.

Now, OpenBSD is somewhat more useful out of the box than a brick, but not by much. When you actually try to make it useful - by installing software not in base system on it - its security quickly diminishes to the same levels as most other Unix-likes.

Re:Both have problems

[man_of_mr_e]

OpenBSD only stays secure if you only use OpenBSD blessed apps.. ie, from their repository. If you start installing stuff you download off the net, then all bets are off.

Re:Both have problems

[shutdown -p now]

No, they aren't granted physical access. But they are allowed to set up a web server serving arbitrary content, for example, and then direct the person (who isn't one of them) using the laptop to open an URL on that website in the browser. I.e. it does not require the user to be entirely passive.

Re:Both have problems

[Runaway1956]

No, now that you mention it - I know about 3000 kids using Windows, and one kid using OpenBSD. And, now that I think about it, at least 2500 WIndows users have nuked and reinstalled multiple times. That nerdy little BSD kid just keeps on going, and going, and going, and going. I think maybe she's getting some of the Energizer Bunny.

Re:Both have problems

[sortius_nod]

In a corporate environment this can happen. It's quite easy to get some tradesman's clothes and pretend you're there to service a computer. You might want to read The Art of Deception by Kevin Mitnick.

Re:Both have problems

[Runaway1956]

"I don't have hackers coming into my house while I'm at work trying to own my computers - " at least that you're aware of.

Of course, given physical access, I can get anything I want from almost any computer, so your point still stands. ;^)

Re:Both have problems

[Anonymous Coward]

No, we just use the results of hacker competitions.

Re:Both have problems

[symbolset]

So what you're saying is that for the last two years Pwn2Own has been some sort of security Special Olympics? That's actually very interesting.

Did they ever have a BSD?

Re:Both have problems

[drsmithy]

Hmm, I must've missed MS beating out OpenBSD for security.

It's easy to be secure when you don't do anything.

Re:Both have problems

[drsmithy]

Am I to gather from this that the hackers are granted access to the machines? That isn't very realistic...

It's absolutely realistic. The vast majority of users are more than happy to do whatever it takes to see the dancing bunnies.

Re:Both have problems

[Dionysus]

I know about 3000 people driving Toyota, and one guy driving BMW. And, now that I think about it, at least 2500 Toyota users have had the car into service multiple times. That mechanic with the BMW just keeps his car going, and going, and going, and going. I think maybe he's getting some of the Energizer Bunny

Re:Both have problems

[JonJ]

That nerdy little BSD kid just keeps on going, and going, and going, and going. I think maybe she's getting some of the Energizer Bunny.

Okey, I'm calling your bullshit.

Re:Both have problems

[Paradigma11]

Here is a little hint for you. The dangerous hackers, the ones that are actually committing crimes in the wild, don't go to hacker competitions.

Yes, but the ones that are clever and interested enough, but earn enough money not to bother to go illegal, do.

Re:Both have problems

[mjwx]

I always figured they hacked the prize they valued most and that's why Windows was on the bottom of the list.

Then why is Windows always second to go in the last three Pwn20wn competitions.

I've alway figured it was easier to find a new exploit for a system that no one targets.

Re:Both have problems

[TheRaven64]

If you compile your own code on OpenBSD you still get:

• Linker warnings if you use any unsafe string functions.
• Stack protection by default, protecting you from stack-smashing attacks.
• W^X protection (even on x86 with no page-level NX bit), protecting you from many categories of arbitrary-code execution attacks.
• Address space randomisation, protecting you from return-to-libc attacks.
• Guard pages around large heap allocations, protecting you from a lot of heap buffer overflows.

All of these work without any user intervention, by default, on all running programs. Part of the OpenBSD developers' philosophy is that all code is buggy, and the system should do everything that it can to minimise the security impact of running buggy code.

Another part is that no one uses optional security measures. Windows NT has had fine-grained ACLs on all kernel objects from the start, yet people tend to leave Windows permissions wide open because they're hard. Even now, Fedora and Ubuntu documentation often says 'disable SELinux' for various things to work. It doesn't matter how secure SELinux or UAC is, if the end user disables it.

Re:Both have problems

[Runaway1956]

Lemme guess, Jon - you don't like girls, and you think computer engineering and programming should be closed boy's clubs, right? Crap, I'm an old dude who remembers when there really WERE closed boy's clubs, in construction, transportation, computing, the military and more. Personally, I welcome women to the real world. If my boss is going to chew my ass out, or push me for more production, I'd MUCH rather stare at her chest, than your ugly mug during the ass-chewing!!

Re:Both have problems

[MightyYar]

Right, but with physical access to a machine, it matters very little what OS you are using.

Re:Both have problems

[intheshelter]

Jeez, you don't really understand what is happening, do you? The breach happens in the order you listed because:

1. Apple is a high profile target. Hacking them gets your name printed everywhere.
2. Since you own it if you hack it, people compete to win the Mac first (who wants to compete to own a cheap ass commodity box)
3. Linux is the next highest profile target. Not as glitzy as the Mac, but hacking Linux still gets you some respect.
4. Hacking Windows is like dating your sister. Sure, you did it, but it's not anything you can really gloat about.

Re:Both have problems

[JonJ]

Lemme guess, Jon - you don't like girls, and you think computer engineering and programming should be closed boy's clubs, right?

Wow, you really suck at this. No, this is in no way representative for what I think. What I do like though, is take cheap shots at people to get an easy +1 Funny, and if some oversensitive jerkwad gets his panties up in a bunch, that's just a bonus.
It's a joke, laugh. Don't take everything so damn serious.
And if you believe that there are 50/50 females/males in *BSD land(if you exclude OS X), then I've got an island to sell you.
Oh, and by the way, I'm not old enough to remember when it was en exclusive boy's club. So kindly fuck off.

Re:Both have problems

[Runaway1956]

I'll fuck off - just as soon as you get off my lawn you young whippersnapper!

Keep saying it and one day it might stick

[kaptink]

All I know is that for more than ten years I made good money removing malware from Windows boxes. In all fairness tho Windows 7 is a much better effort at a secure OS but saying that 'hackers' are making such comments is just not all that believable. Any serious geek will tell you the long sorded history of windows and all its memorable virii, malware and hacks is nothing to be proud of but I guess if you start telling people what you want them to think and keep at it one day it will stick. I think a few statistics should set the record straight.

Re:Keep saying it and one day it might stick

[dave562]

Any serious geek will tell you the long sorded history of windows and all its memorable virii, malware and hacks...

Where are the equivalent virii in 2010? I remember Code Red and Slammer and the really malicious code that was raping any system stupid enough to expose 135/137 and 445 to the world. I don't remember any malware of that league in recent memory. The worst malware these days seems to be the AntiVirus 2010 and its related ilk. The malware itself is insidious and requires a pave and rebuild "just to be sure". The infection vector is the same old, same old mess of compromised websites and browser exploits. So in that regard Microsoft is getting better. Their software isn't getting owned two minutes after being connected to the internet. Like others have mentioned, they still have a long way to go.

I will believe that Microsoft has figured out secure software once they properly sandbox their browser and manage to prevent malicious code from breaking out of it to compromise the system. There is not any reason why visiting a webpage, either deliberately or through a redirect, should result in a compromised system.

Re:Keep saying it and one day it might stick

[Dynedain]

Where are the equivalent virii in 2010? I remember Code Red and Slammer and the really malicious code that was raping any system stupid enough to expose 135/137 and 445 to the world. I don't remember any malware of that league in recent memory.

That's because modern spyware is more focused on hijacking your machine to be part of distributed botnets. That means you don't want the user to realize the machine is compromised. As such, vandalism is less prominent in favor of the lucrative enterprise of selling access to the botnets.

Re:Keep saying it and one day it might stick

[dave562]

You are right that the focus has changed. The infection vector has also changed. The old vectors don't work, or if they do the access to them has been mitigated on the client by the software firewall, and on the network permimeter by hardware firewalls. The operating system has been hardened to the point that most of the exploits are targetting applications. That is an improvement. Once they figure out how to properly sandbox the applications, the entire system will become more stable. Whether or not Microsoft is really up to the task is debatable.

Re:Keep saying it and one day it might stick

[RobbieCrash]

Does the article state "Windows has always been the most secure everything, and we don't need to fix anything, we're awesome and hack proof?"

I believe it states, and I'm paraphrasing here, "We're doing more to help idiot users protect themselves than Apple is." Which is true.

Article after article has pointed out that Apple's security through obscurity model makes an unpatched Mac much less secure than an unpatched Windows box.

In five years, everyone will be talking about how vulnerable Macs are, and how you can't run an OSX box without just as much shit as you have to put on a Windows machine in order to be secure.

Re:Keep saying it and one day it might stick

[spazdor]

Where are the equivalent virii in 2010?

Storm.

Re:Keep saying it and one day it might stick

[dwinks616]

Virii? Perhaps you should read http://en.wikipedia.org/wiki/Plural_form_of_words_ending_in_-us There is no such word. Virii doesn't exist in English, nor does/did it exist in Latin.

Weasel words...

[Ynot_82]

If indeed "hackers admit [you're] doing a better job making [your] products more secure than anyone else"
then that just means your product is less secure in the first place, and you have to do more work to patch the holes

Other OS's need not put so much effort in on a release-by-release basis
the basic security of Unix was the there 35-40 years ago, and remains largely the same

Extra security features (SELinix, AppArmor, non-root-X, etc.) come along every so often
but agreed, no-one puts the sheer level of effort into security (largely in vain) as MS

Security claims

[DaMattster]

Uh, yeah .... whatever. I'd say security has improved, albeit by a decent margin but it has a long way to go. I won't be convinced until Microsoft, Apple, and the Penguin can go toe to toe with OpenBSD. I have heard of would-be intruders performing OS fingerprinting, finding an OpenBSD machine, and moving on as if it is not even worth their time to try. If you need to protect a network, set up OpenBSD as your bastion host and you can rest easier at night.

Uh huh

[starfishsystems]

Right. That's why there's no longer any market for third-party virus checking on the Windows platform.

And all those idiotic corporate restrictions on email attachments can go, too. That'll be a great relief, because right now I can't even attach a zipfile without Outlook complaining about it.

And those flashes of screen content that appear when I reconnect to a locked Remote Terminal session, those are just in my imagination. No information exposure there, any more. Good, cause that was really stupid. Wait, I'd better check. Nope, still there.

And those irritating and needless messages requesting permission after I've launched an Active Directory management window, those are gone too, right? Because now the system has finally caught up to the X Window System technology available back in 1993?

Oh, no. Actually, I just checked, and it hasn't.

Wow, Microsoft. I am impressed. You actually drank the kool-aid to prove that it was harmless. Except that it's not.

Re:Uh huh

[Sponge Bath]

...idiotic corporate restrictions on email attachments

Amen! I've started having emails silently dropped by customer's email systems for having links in the email to driver downloads requested by the customer! The customer is usually unaware of the changing rules on incoming emails, so I get to troubleshoot it for them when they complain about a lack of response. I now break up any URL into a base on one line and a file on another line, but who knows how long that will work. In conclusion, I close my rant with "kill all spammers".

Re:Uh huh

[tsm_sf]

Oh god. I just flashed back to a project where my client wanted to send opted-in emails to customers with AOL addresses...

You know the cleaning woman character on Family Guy? The one who answers everything with "ehhh...no...."

Vista reinstall

[NetNed]

I did a reinstall on a Vista machine recently for a friend. 100+ windows critical updates later and it was done! Really, the install itself took a fraction of the time that all the updates took. I guess if security is measured in security updates, you win Microsoft. Now claim your paper hat that says "We Won!"

Re:Vista reinstall

[b4dc0d3r]

I'm pretty sure the way to do a Windows reinstall at this point is to download the current service pack (sp2 depending on your definition of "recently") first. Do the OS re-install, apply the service pack, connect it to the network (you kept it off so far, right?) and then you only have 50 critical updates or so. And you didn't download the SP on the to-be-reinstalled computer did you?

Re:Vista reinstall

[NetNed]

Yeah it would have been nice if that's the way it worked. I tried to apply the service packs thinking it would skip all updates before, but no, it still did updates from dates before the release of the service packs. Believe me I was shocked. Like win 2000, download the first 4 service packs, then do all the ones after. Not Vista.

iPad

[Anonymous Coward]

The iPad actually seems to be a perfect device for doing Banking. Mac/Windows or Linux - I am always scared when opening a browser and browsing to my bank's website. Who knows when and what got installed on the machine - even open source stuff sometimes has had malware (I forgot the name of the one where the author just emailed everyone's passwords to his mail account.)

Locked down device like the iPad is godsend - never install any apps and just use it for browsing and email. Feels much secure. (One only needs to worry about Apple - hopefully the disgruntled Foxconn employees don't go installing bad stuff on the iPads.)

You can hate me now - a) for bringing up the iPad and b) for being paranoid.

Re:iPad

[MichaelSmith]

On linux I can open a shell and go

rm -rf ~/.mozilla

Can I do that on an ipad?

Re:iPad

[MikeFM]

If you really want to. I dunno what it'll gain you. You can burn charcoal bricks in your bathtub for heat too but typically it's not a good idea just because it does something.

Funny how the Linux wannabes make the same pointless arguments about why their OS is better that Windows users did when we started pushing Linux. Something is different and doesn't have random program X so it sucks. Kids I was using a Linux desktop when you were in diapers and Unix before that so don't even try to sell me on your crap desktop environment. If anything the Linux desktop has been wandering in the desert all this time with no real idea where it is going.

Re:iPad

[larry bagina]

You can also stick a cactus up your ass. Doesn't mean other people are interested.

Re:iPad

[spazdor]

And if it ever ceases to be factory condition, that just means it's time to buy the next model up?

Re:iPad

[MichaelSmith]

My point is that a closed device will only provide specific workarounds for specific problems like "delete history" and "delete cookies" while an open device provides more options for privacy such as low level file deletion and chroot jails, so the open device should be more secure.

I have a guest account on my linux laptop for situations where I need to lend it to other people. I am not aware of such a facility on the ipad.

Re:iPad

[mlts]

A closed device could make life much worse for privacy. How does one know that history and cookies are actually deleted, as opposed to saved off to a protected area? And of course, there are items like Flash/Java shared objects that are normally not deleted and on a closed system, there likely is no way a user can delete those. And there is always the ability to have an undocumented add-on which reports a unique ID to any Web server that asks for it.

Privacy on normal computers is an uphill battle, but at least if worst comes to worst, you can run your Web browser in a VM, or on Macs, do your web browsing as guest and log out periodically so all files are deleted. If a platform is closed, where one has to trust the Web browser to guard privacy, does it really do so? Cookies are not the only way to uniquely identify a machine.

I can see in the future this becoming a tool for "law enforcement" -- because most devices that are closed are tied by some sort of unique ID to some central place, it wouldn't be hard to push an update to a device to upload those "deleted" cookies and other data. The end user wouldn't know, and if he or she did, there would be nothing they could do other than trash the device. Or push a program out on a mass scale to look for certain items (say a MP3 file that was leaked), confirm it was on a number of devices, then file a large amount of lawsuits.

Waitaminit, which Steve?

[zooblethorpe]

I had the wrong Steve in mind, making for a very different "Hi, I'm a Mac" commercial...

Cheers,

Google is the competition..

[naelurec]

Google is Microsoft's #1 competition right? Of course Microsoft wants Google to continue to use Windows.. not using Windows puts Google at an even further advantage.. its not like Microsoft can drop using Windows for its internal systems.

Re:Google is the competition..

[Rockoon]

Google is Microsoft's #1 competition right?

ummm... eh? While its true that they compete in some spaces, the idea that Google is Microsoft's #1 competitor is absurd. Microsoft is primarily in the software business. Google is primarily in the advertisement business.

Microsoft's main revenue stream is in selling MS Office to, well, offices. Google isnt competing there at all. Offices are not dumping MS Office for Googles cloud apps.. they are much more likely to dump MS Office for OpenOffice, but they arent really even doing that to any great degree either.

Microsoft's second largest revenue stream is on selling Windows. Google has ChromeOS, but that doesnt have any legs yet... none at all... and Android is in a war with iPhoneOS, not Windows.

I am picking up what you are putting down. Microsoft would certainly benefit if Google was out of the picture, but they are not really competitors in any real sense. Googles main competitors are in China.

Re:Google is the competition..

[Tomy]

As a corporation, Microsoft needs to increase revenue, yet they are saturated in the OS and Office markets. They look to Google profits and want to be Google's competitor.

So Microsoft probably views themselves as Google's biggest competitor, whereas Google perceives them as a has-been.

Microsoft needs desperately to be relevant in the Internet age. Yet their fanatical adherence to maintaining their monopolies restrict them from entering other markets.

Textbook case of 'The Innovator's Dilemma':

http://www.amazon.com/Innovators-Dilemma-Revolutionary-Business-Essentials/dp/0060521996

Focus and investment != results

[Todd Knarr]

Certainly Microsoft's focus and investment surpasses everyone else's. That's because it needs to simply to tread water. The problem is that most of Microsoft's security problems aren't bugs, they're design features of their system.

There's a quote from a boss: "I don't want the industrious guy who'll keep busy doing things over and over. I want the lazy guy who'll do it once, right, so he doesn't need to keep doing it over."

Windows may be most secure...

[EmagGeek]

... but from whom? The people on the Internet? Or, the people sitting behind the keyboard?

Sometimes I feel like it's the latter...

Damned by faint praise

[HangingChad]

When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else.

Yeah, that's why the Google breach in China was traced to Windows exploits, because hackers always go after the strongest link in the chain.

I'd be the first one to admit Microsoft has come a long way on security. Vista and Windows 7 are better but you still won't catch me surfing the net with Windows or using it to access my bank account online or for anything that requires higher security. Windows gets to see Windows Update and updates for the few Windows only applications I run. That's it.

Microsoft Security Improvements

[DerKlempner]

...making our products more secure than anyone else...
...our focus and investment continues to surpass others...

It's easy to be the best at these things when you're playing catch-up to everyone else.

Microsoft products are the most secure lawnmowers

[davecb]

Poor chaps, they can only make a "c2" grade in the old orange-book (U.S.Department of Defense) grading by removing the networking, while a mainline Linux distro hits b1 (courtesy of the CIA).

--dave

Ahhh /.

[RobbieCrash]

Again we refuse to admit that MS has done anything right, because they still have problems. Improvement doesn't matter, because they're not perfect yet.

Not like OSX, or Linux. No sir. Neither of those products have any security holes. It doesn't matter that OSX is the first system to fall in any form of hacking contest, or that there have been at least 15 articles on /. in the last 6 months talking about how piss poor OSX's security model is. Nope, Microsoft isn't perfect, therefore they have not fixed anything.

Re:Ahhh /.

[inode_buddha]

As the old saying goes, "Those who fail to understand UNIX are doomed to re-invent it -- poorly." Attributed to Ken Thomson. And it seems to me that is exactly what MS has done over the last 15 years.

Re:Ahhh /.

[Anonymous Coward]

But we aren't claiming that OSX or Linux are the best. Microsoft have stated that Windows has the best security. Your argument: fail.

Re:Ahhh /.

[Anonymous Coward]

Are you just a twat, or did you honestly miss all the comments from /.'s who said that "MS has made some vast improvements, but.."?

No, you!

[russlar]

Microsoft might as well have said "oh yeah? well, your mom!"

Yeah, claim to be more secure than Apple is a joke

[jbeach]

Someone else can prove me wrong here, but I've never known a Mac to be susceptible to botnet infection, as only one example.

Re:Complete that thought

[GourdCaptain]

I love how one of the things they are doing to improve security is "We highly recommend our customers enable Automatic Update to ensure they are protected from attacks." Okay, you improve the security in the product by recommending people use it safely. I'm impressed. Then again, they also claim that Parental Controls make it safer... The heck? This is about an enterprise company, not a family computer!

What does that mean?

[blair1q]

Does it mean it's harder for a hacker to create a malware that will infect my machine, or that I am less likely to get malware?

Because I have no doubt the former is true. Because Microsoft is a fat target with a billion users, it has had tens of thousands of exploits thrown at it and has had to beef up its standards to fend off similar attacks.

But I have no doubt the latter is false. Because Microsoft is a fat target with a billion users, it is still the target of choice for the vast majority of exploits.

However, any other OS that claims I won't get hacked while using its system is utterly full of shit. Apple is egregiously baiting hackers by constantly reminding them that the reason they haven't had to improve security is that they've been targeted less often. Which means hackers can turn and apply low-grade exploits that haven't worked on a Windows box in years, and expect a hit.

As for Linux, the black-hats can just put their exploit in the distro and let us install it as a feature.

Seriously, all of these lamers can quit pretending they have a clue how to write secure software.

WTF?

[8127972]

"When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else. And it's not just the hackers; third party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others."

Hackers said that Microsoft is better at making their products more secure than anybody else? What about Charlie Miller the Pwn2Own winner who said pretty much the exact opposite? I guess he doesn't count.

Re:WTF?

[nude_noot]

Hackers said that Microsoft is better at making their products more secure than anybody else? What about Charlie Miller the Pwn2Own winner who said pretty much the exact opposite? I guess he doesn't count.

Are you stupid or just intentionally trying to mislead people?

If you actually read the interview that you linked to, you'd know he basically said that Microsoft has put the most effort into securing their systems. Admittedly, they had the most to work on, but that still doesn't make your statement true.

How about this quote from the interview?
"Between Mac and PC, I'd say that Macs are less secure for the reasons we've discussed here (lack of anti-exploitation technologies)"

Re:Complete that thought

[blair1q]

No, they say it because it's true.

But having to work harder at security and spend more on it doesn't mean you have it yet. It just means you have a bigger castle so you need a longer moat.

Apple is catching up

[AHuxley]

They now have real malware with pretty pictures.
The end user still has to install the software, but its a move in the right direction.
How many more years until Apple desktop malware has the classic surf and own functionality?
http://blog.intego.com/2010/06/01/intego-security-alert-osxopinionspy-spyware-installed-by-freely-distributed-mac-applications/
As for MS, they had how many years to secure a single users OS.
They finally started launching PR about it and seem to finally have packed some buzz word tech into the backend.
Great, but the damage was done, is been done and will be done until MS spends the cash to write a real OS.
They have the smart people, can reuse ideas from other OS ect.
Why is MS still so open around the world? They are not poor, distracted, have security clearances, top US university support... MS has all it needs.
Greed and easy market share all over the world got MS to the top, but is the OS really worth anything anymore in a networked world until totally reworked?

Re:Apple is catching up

[cdrguru]

A new, completely incompatible operating system today has pretty much zero chance of gathering even 0.1% of the current market unless it has something really big going for it.

Why would application developers (both internal corporate ones and ISVs) target a new operating system?

Today the most prevalent operating system is Windows, but OS X (mobile variety) is catching up. Right now if Apple were even the least bit interested in ISV software development they would likely be able to displace Microsoft in a few years. Unfortunately Apple is so disinterested in the ISV marketplace and intent on screwing over developers this is very unlikely to happen.

Today when building a platform-agnostic application there are three real possible targets:

1. Windows
2. OS X
3. Linux

Adding something new to that mix - regardless of who might do it - is going to be a tough sell. It would be insane for Microsoft to do this at this point because abandoning application compatibility would pretty much destroy their existing market as well as the new one being a flop. Apple was able to get away with it (twice!) only because the users are going to pretty much do whatever Apple tells them they have to. Microsoft foisted a somewhat incompatible operating system (Vista) on the world, and even with probably 90% of the applications working on it that 10% has meant a lot of people are sticking with XP still today.

The interesting thing will be to see what Google comes up with for their non-OS OS with virtually none of the services an OS provides. Who will target it for applications, and more to the point, why? Security will likely be very good - if there are no applications in a real executable sense, then it is really hard to have security problems. Same with disk storage - if there isn't any, you can't have persistent behaviors local to the machine itself.

Re:Yeah, claim to be more secure than Apple is a j

[MrLint]

User installs X, X is malicious, != insecure OS.

Now if you want to compare to the versions of windows that the default account is hot admin all the time, and can silently install SW by clicking on a web link.. well there ya go.

Keep in mind this none of this has anything to do with userland malware.

Shut up, Microsoft, just shut up.

[bmo]

When you finally get rid of "hurr, this file is a program because it ends in .exe" and stripping executability from incoming files, then maybe you can start talking about security with the grown-ups.

But until then, go back to the kiddie-table with CP/M.

--
BMO

MicroSoft announces new 'Obscurity' Protocol

[theNAM666]

Redmond, Wash., 2 June 2010. MicroSoft Corp. Security Directory Kluenlos Nove today announced that MicroSoft had innovated a new, unassailable security method known as Obscurity. "It's so secret, I can't tell you anything about it, but I assure you it works, and of course it works better than Mac or Linux methods," said Kluenlos.

Focus and investment? How about *results*?!?!

[Anonymous Coward]

Nobody gives a shit about your "focus and investment", only your lack of RESULTS, you shit-for-brains marketingdroid.

"Even hackers admit..."

[Dystopian Rebel]

even hackers admit we're doing a better job making our products more secure than anyone else

Hmmm, Symantec, McAfee, Kaspersky and 34 others all appear to be working harder than Microsoft to make Microsoft products more secure.

TheProbabilityOfKeyloggerGivenRunningWindows

[rrr00bb]

If the probability of getting something bad like a keylogger given that you are running Windows is much higher than for any other OS, then any theories about why this is true will not protect you. Nothing else matters beyond this (numeric) fact. I have a friend that gets his Windows system re-hacked a couple times a year, and he has never had a problem on his Macbook. I don't care why anymore. It's an interesting argument when talking about attacks against a pre-determined individual perhaps, but a badly setup linux setup is apparently "safer" than a super-secure Windows setup when you go by the only thing that matters: NUMBERS.

Absolute vs. Relative.

[GNUALMAFUERTE]

When we speak about GNU/Linux functionality, nobody takes relative values into account. They only take into account the absolute final result. Example, nobody takes into account the great hardware compatibility considering 99% of all drivers were written by the community after reverse engineering the hardware and/or other OSes privative drivers. People (including microsoft) only mention that GNU/Linux doesn't support all features of X hardware, and windows does, and therefore it's better.
Same thing for apps, marketshare, etc. They only say "More people have windows, it supports more apps, whatever, period. ".

So, why should we take into account relative values when talking about windows?

I don't care if they are trying hard, or if they have more marketshare, or about any other factor. The ONLY operating system that requires antivirus, antispyware, and other crap is windows. It is also the only operating system that is consistently, publicly and massively cracked around the world all the time. There are several botnets around the net that are the source of most spam, and this botnets consist of windows machines only.

So, in absolute terms, the most secure OS is OpenBSD. The most insecure is Windows.

Re:Absolute vs. Relative.

[Tordre]

Guess what if they make a operating system where you would not need antivirus two things will happen,
A> Users would not believe them
B> Antivirus companies would file an anti-trust suit.

Re:Absolute vs. Relative.

[Shados]

Except you don't need antivirus/antispyware on Windows. The only people who need it are those who disable the security features right after a fresh install, and people leaning heavily toward illegal activities. Since Vista you really didn't need it.

You'll see how quickly a Linux box gets owned if I send grandma 100 free smilies with instructions about how to set exec permissions and how to sudo (similar to what you need to do to get "pwned" by an attachment in a default Win7 install).

10 years without anti-virus and anti-spyware with bi-yearly scan just to be sure I'm not crackpot, and no virus so far, and I'm not even careful...

But you'll say: "people get owned all the time on Windows!". Yeah, because when you setup Grandma's Linux box, you actually set it up for her, not just hit next next next finish and give her the admin password. I setup the Windows boxes for my family (in roughly the same amount of time I spend setting up Linux boxes), and they don't get viruses either :)

Main difference: Linux users use legitimate software, Windows users don't (even when the OSS equivalents exist for Windows) and pay the price.

Re:Absolute vs. Relative.

[GNUALMAFUERTE]

How secure something is in itself doesn't have anything to do with how often it gets attacked.

If you leave a box out there in the woods with a million dollars inside where nobody can find it, the box is totally insecure, and yet nobody will get the money. If you instead put the money in a state of the art vault, the vault is more secure than the box, and yet more likely to get stolen.

On the other hand, I don't know where this whole "windows is more attacked than Unix" crap comes from.

Unix OSes have been around for 4 decades. They were big in servers before any other OS still in existence today was even created. Most of the important developments of the last 40 years happened in a Unix-like box. Still today, Unix is WAY bigger than windows in servers. 3 to 1. Windows doesn't really get attacked. It attacks itself. That is, malware propagates automatically. That's all it takes to get a windows box, a shitty self-propagvting script. Unix boxes, on the other hand, get shitload of targeted attacks all the time. The reason: There is valuable, important stuff going on in Unix servers, way more valuable than in porn-filled windows desktops. I administrate several GNU/Linux and OpenBSD servers. I am port-scanned tons of times every day. I run Honeypots on well known services like OpenSSH, and the real services somewhere else. I see tons of attempts every day, everything from crappy dictionary attacks to Apache exploits. I administrate many servers that move a quite important amount of minutes through Asterisk. You wouldn't believe how many SIP exploits are tried everyday in all of my servers. Everything from bruteforce with shitty dictionaries on SIP accounts, to more sophisticated dirscans, to several attempts at cracking SIP's digest auth.

So, windows gets owned by scripts written by 10 year olds, while Unix holds well against pro crackers that make a living off stealing everything from VOIP minutes to CC #s. Of course, a competent sysadmin helps a lot, but I've seen machines that have gone years unattended and still weren't touched. Last year I got a call from a customer that was having some issues with their PBX. They had a Slackware 10.1 machine running Asterisk 1.2 that I installed almost 6 fucking years ago. Then we lost contact. They never had a single issue. They contacted me last year because they wanted to add a full E1 to replace the 4 analogue lines plus a SIP truck that were feeding calls into that PBX. The machine was on the public internet the whole time, and wasn't updated a single time. It had an uptime of over 500 days. Try that with a windows machine any time.

Re:Absolute vs. Relative.

[yyxx]

How secure something is in itself doesn't have anything to do with how often it gets attacked.

But I don't care about how secure it is "in itself", I care about how secure it is sitting on my desktop and doing my work.

Re:Absolute vs. Relative.

[GNUALMAFUERTE]

Precisely. Windows is the most insecure OS ever in BOTH definitions.

Carefully worded response from MS

[LinuxInDallas]

Microsoft claims that they are investing more in security than anyone else. Investing heavily and having an actual secure product are not the same. Their heavy investment is because they have so far to go.

Oh please

[Tanman]

I'm sure that if you install linux from a distro that's 2-3 years old that updating all of that goes really quickly and smoothly.

Re:Oh please

[0123456]

I'm sure that if you install linux from a distro that's 2-3 years old that updating all of that goes really quickly and smoothly.

And that Linux distro includes thousands of applications, probably a few dozen installed by default, whereas Windows is just the operating system and a web browser.

Install just the base OS, X11 and Firefox and I suspect you'll see far less security updates on the Linux system than Vista.

Re:Microsoft products are the most secure lawnmowe

[davecb]

Alas, the "common criteria" are a watered-down disappointment, written to allow one to certify anything. It's been successfully used to make what we used to call a "d-grade" system to look relatively good.

To be fair, it's also been used to make some decent system look decent.

--dave

Re:Microsoft products are the most secure lawnmowe

[gumbi west]

Do you have a link with more information on this? Is this current?

Re:Complete that thought

[cdrguru]

If you have users in a corporate environment that have Administrator rights and click on anything that is clickable then maybe Parental Controls are the right choice. Because clearly the employees are a bunch of children that need to be controlled.

It's a mind trick!

[Frank Dreben]

"These aren't the droids you're looking for..."

Ford and Microsoft

[nacturation]

I love the weasel words that come out in these kinds of discussions. "Most" - what is "most"? One competitor? (Maybe, Apple?).

This reminds me of that Ford commercial I saw a month or two ago, where some dude is talking about how Ford won some kind of "most improved" award. That's like a retarded child who goes from flunking everything to getting straight C- grades ... relatively speaking, that's a far greater improvement that the straight A student who starts getting a few A+ grades.

Nobody cares that Microsoft's "focus and investment continues to surpass others". When Microsoft's boat has thousands of holes in it and is sinking faster than the Titanic, is it anything to boast about that you have a great investment in a massive number of people highly focused on sticking their fingers in the holes? Compare that to Apple's boat, where they only have a modest investment because there are only a few holes.

Re:Ford and Microsoft

[kimvette]

is it anything to boast about that you have a great investment in a massive number of people highly focused on sticking their fingers in the holes? Compare that to Apple's boat, where they only have a modest investment because there are only a few holes.

That's because they've already patched the gaping holes with the arms and legs of early iPhone and iPad adopters!

Re:Microsoft products are the most secure lawnmowe

[davecb]

http://www.radium.ncsc.mil/tpep/epl/index.html is the list of approved products, but none is recent. Everyone does CC these days, as they're easier.

--dave

Re:OpenBSD Security is a Myth...

[sortius_nod]

First line of the blog.

Firstly, I would to apologize for, and clarify the title of this article. I wanted to use a title which would hold attention and encourage discussion while remaining true to the argument I make. I certainly don’t mean to imply that OpenBSD is a horribly insecure operating system – it isn’t.

Marketing weasel words as usual

[JustNiz]

>> "leaders like Cisco tell us regularly that our focus and investment continues to surpass others."

They're probably right, however "focus" and "investment" do not indicate or replace actual results.

Great job with the section

[Lars T.]

So after all the people complaining that there are so many Apple stories have been told a million times how to not see them, this article gets posted to the Apple section. Pure genius.

The Age Of Doublespeak

[zunipus]

AKA 'Newspeak' by George Orwell. Black is white. Hate is love. War is peace. Windows is secure.

It's about time the world got off the MS arsenic. Bravo Google. I wish the US federal government would follow your example so we don't get pwned by the Red Chinese hackers (the Red Hacker Alliance) every other week.

I keep track of Mac security over at:

http://mac-security.blogspot.com/

Maybe competitors don't need to work so hard

[pev]

'Doing a much better job of making our products more secure' ... ?

As a statement it's a little loaded - if it was secure in the first place you wouldn't need to have a small army of people showing how pro-active you are, it'd just be secure and that would be the end of the drama...!

Microsoft is obviously correct

[ILuvRamen]

They're 100% correct, which is why they said it. They're the most secure by a gigantic margin, people just don't target macs, android machines, or Linux with viruses because that would be stupid. But if suddenly tomorrow Apple got 75% or so of the market share, they'd get crushed by a dozen viruses at once. There wouldn't be an internet connected mac still running on this planet. Microsoft is still completely idiotic when it comes to security though, trust me. Asking the user if they want to run some cryptically named exe file before it executes is not security.

WTF? OMG. LOL. Yeah--cat got my tongue /.

[darkpixel2k]

Now Microsoft is fighting back, claiming its products are the most secure

And in related news, network admins are losing a lot of weight today by laughing their asses off...

Re:Microsoft products are the most secure lawnmowe

[NatasRevol]

Ironically, Windows Mobile 6.0 is apparently more secure than Windows Vista and Server 2008.

Windows is secure OS for running viruses and bots

[alukin]

Yeah, Windows is most secure and reliable environment for viruses, bots, worms and other malware. Windows is the best platform for botnets and the excellent tool for DDoS-ers. Zillions of cracked commercial software allows quick, secure and reliable distribution of trojans. No other platform on the market can't do it better.

I'm just saying...

[kikito]

There's one certain blog post that is screaming for a hacker hijack.

Microsoft: More problems to fix than anyone else.

[Usdom]

Microsoft: "When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else. And it's not just the hackers; third-party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others." Translation: "Our software is being constantly upgraded and fixed because the security is so bad it is a constant struggle. Those other guys hardly have to fix anything! Their stuff just works."

Re:Some Helpful Advice

[Slur]

...Microsoft spends significantly more than Apple on R&D...

Wait, I thought Apple was Microsoft's R&D department.

I'm a Mac guy but the past security contests..

[BlackBloq]

Microsoft products get owed the least in the hackoffs as of the last few years. Hate to say but it's true.

Improvement

[ThunderBird89]

Granted, Microsoft is the best at making their products more secure. That's because they have the worst security, so it's not hard to improve on that...

It's scary they believe this

[gig]

They have their heads so far up their asses that they may actually believe this. They think this is about the number of fixes or some particular technology they have just come up with, or some statistic about number of fixes. It's not. It's about the actual real world. The fact is, if you replace a Windows system with a Mac system, you are safer, more secure, and have increased reliability. That is just a plain fact. The Mac has zero worms, zero viruses, and only 2 Trojans that don't even run on the current Snow Leopard version. How can that even be compared to the ongoing tire fire that is Windows? Even iPhone is more robust than Windows.

Re:Some Helpful Advice

[SgtChaireBourne]

It is but a few years ago M$ got slammed for spending more on marketing than anything else. After that, they just changed the line item for marketing to read 'research and development' and kept using the money for marketing.

It's the design, stupid

[XB-70]

The Monadnock is the tallest commercial building in the world with masonry load-bearing walls. It was built in Chicago in 1891. You can't build any higher than that without girders because the masonry would crumble. The same with Windows: when your core architechture has inherent design limitations, you make it any better other than to patch the outside. Until Microsoft re-designs its O/S, it will continue to have much, much larger security issues that other BSD/Unlix/Linux designs. It's Darninian: consider that some 80% of the internet, which holds much of the world's commerce is NOT built on Microsoft.

RE:

[helix2301]

Microsoft had to say something Google dropping them made the news. I guess they are afraid if Google drops them who will then follow in Google's footsteps. The snowball effect they are concerned about.

Huh

[Aradiel]

Frankly I wouldn't trust anything Microsoft says when promoting their products: I don't think I'll ever forgive them for claiming IE8 supports all of CSS 2.1 and some things that aren't in the standard, since IE8 doesn't understand max-height.

it's not about technology or design

[yyxx]

One can argue at length whether Linux is more secure by design or whether it uses more secure technology (it is certainly at least state of the art).

But for Google in particular, Linux is a much better choice than Windows: Google has its own internal Linux distribution, and they're shipping Android and ChromeOS. They review a lot of the code and contribute a lot more. Even if all things were equal otherwise, that alone makes Linux a much more secure choice for Google.

Another huge difference between Windows and Linux is installation: most Linux users just get all their software from their distribution, and the distribution manages, reviews, and fixes security issues centrally. That's much better than your typical Windows installation, which gets software from dozens of vendors and freeware sites, with no consistent updates and no consistent monitoring of security issues.

This is exactly my argument...

[Slash.Poop]

I know I will get slammed but whatever.

"And it's not just the hackers; third-party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others."

Exactly. When a vulnerability is discovered Microsoft has 100s of people who are paid specifically to ID it and fix it. When a high priority security issue is discovered Microsoft pushes out a fix within hours or maybe a day or two. Other companies, you will be lucky to get a fix within a week or a month.

Yes, I know there are examples where the fast response did not happen. However, 90% of the time you even hear about a security hole is because Microsoft has just released a patch for it.

I think it's the wrong fundamental problem....

[HerculesMO]

Windows being secure isn't only about security features, but the stupidity and willingness of users to click "Okay". UAC does something by at least asking before an installation of something, but a user can still click "Yes".

Isn't the fundamental issue of Windows more malware than it is security flaws? Sure, some hackers may be able to take advantage of some security flaws, but this is similar on Apache and elsewhere -- and the odds are, if it's a security flaw they can use, they won't share it either.

Botnets around the world are set up using malware -- not security holes. Once you are in the system and are granted rights because the user let you have them, how can you really prevent that? Google making this change is more tantamount to show that "We don't need MS" than I think, anything else. They are coming out with their own OS now, and to show they can function organizationally without Windows can enable customers and businesses to think the same way.

I like Windows, but I also know how to use it well. There are a lot of instances of people (here especially) who have grown accustomed to bashing MS for the sake of being MS, yet these same people won't bash Apple even though their business practices are nowadays, probably even worse. An OS is a tool -- if you can get your work done with it in the timeframe you want and at the price you want, and mitigate the security through the use of common sense and firewalls, then use whatever the hell you want. BSD, Ubuntu, Mac, Windows, Solaris, etc. But for Google to say it's due to security issues is disingenuous at best, and for the rest of you to say MS is terrible at security is just stupid. They can't throw it all away folks -- their entire business is based around the idea of upgradability of prior systems, and they've managed to maintain that while adding good amounts of security from XP to Win7. Oddly enough... I can still play DOS games on Windows 7, and that's a great reason for MS's success thus far.

I still use a hardware firewall though :)

Re:I think it's the wrong fundamental problem....

[Todd Knarr]

Botnets around the world are set up using malware -- not security holes. Once you are in the system and are granted rights because the user let you have them, how can you really prevent that?

Exactly. Which is where you see the differences between Unix systems and Windows. On Windows, for instance, if you have UAC enabled and malware does something nasty, you get a prompt from Windows asking you whether to allow it or not and you get the option of allowing it. On Unix, if a piece of malware tries doing something nasty to the system, it gets told "Sorry, you don't have permission to do that.". The user does not get the option of letting the nasty thing happen. The software doesn't have permission to do that, so it doesn't get to do that. If the user wants whatever it is to happen, they first have to actively set the permissions to allow it.

Unix has the attitude of "The user didn't set things up to allow that, they must not want to allow that.". Windows takes the attitude of "The user didn't set things up to allow that, they may have made a mistake and we'd better ask them about it.".

Re:Microsoft products are the most secure lawnmowe

[davecb]

Multics got B2 by fiat, since it only fell down on the design documentation side (according to the rumors, back when I used to be a Multician), so I mildly suspect that B2 is only properly reachable by a project with security in the design from the very beginning...

--dave

Re:Security has improved

[Joce640k]

The baseline for Windows XP was around 'zero' (remember all popup those message windows anybody in the entire world could make appear on your original Windows XP machine?). It's not hard to improve from there.

The biggest problem will always be between the keyboard and the chair but I don't think there's less 'critical' patches lately than at any other point in Windows history ('critical' exploits are those that can propagate to other machines without any user intervention).

Stockolm Syndrome

[stoicio]

'When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else. And it's not just the hackers; third-party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others.'

That is called 'Stockholm Syndrome'.

How did this get modded up?

[Clueless Nick]

I don't like Apple at all, but to say that the iPhone and the iPad were sandboxes for OS X is downright insane. The iPhone has been around for about three years, and the iPad has just been launched. OS X was launched in 1999 as a *Server* OS first.

No, the cat does not, in fact, "got my tongue."

[Impy the Impiuos Imp]

At the end of the day, Microsoft is probably right. Were Apple or Google's products dominant, and be so for years, they would be the primary target of hackers. Legion around here are those touting Linux's security, when it, too, does not suffer massive effort from hundreds of hackers trying to hack it for real profit, often from poor countries with weak currency.

In other words, the supposed superior security of Apple, Google, and Linux is probably more related to security-through-obscurity than any brutish, awesome-o capabilities. How would they hold up against not a few hackers, but hundreds or thousands, each on a mission from (the) God (of money)?

You're on crack if you think, "Quite well, thank you!"

Re:No, the cat does not, in fact, "got my tongue."

[Todd Knarr]

I'd counter this by pointing to two things. First is the server arena. There, Unix (and in particular Linux) tend to dominate. Windows is a minority player. Those machines are targeted for attacks all the time, and they can't even be as protected as desktops are because they need to be publicly exposed to do their jobs. Yet do we hear of daily or weekly patches to Apache or the Linux kernel to close security holes? Do we hear of Unix/Linux servers being breached so frequently that it isn't even news anymore? No. The majority of server breaches are still in the minority of servers that run Windows. If it's simply market share, why is Windows still the most-breached OS in an arena where it's a bit player?

Second, I'd point out that Unix has been used in university environments almost since the day it was created. It's constantly open to attack by computer science majors and other students in an environment where the administrators not only can't lock the attackers out, they have to give them multiple legitimate user accounts. And yet Unix systems in that environment aren't routinely breached, their security remains intact and it's unusual for a break-in attempt to be successful. If it's merely exposure that makes Windows so vulnerable, why is it that equally-widely-used Unix systems aren't equally vulnerable?

parsing...

[Scrameustache]

I love the weasel words that come out in these kinds of discussions.

echo(parse(" we're doing a better job making our products more secure"));

We used to not give a shit about security, but we're playing catch-up now!

echo(parse("third-party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others."));

The guys I golf with tell me the others guys who golf with them aren't throwing as much money at this problem as us.

Sympathy for the Devil

[Rambo Tribble]

It is hard to argue that Microsoft is making a concerted and costly effort to address the security issues with their products. Unfortunately, there's an old saw in the computing industry, which is more than applicable, "Garbage in, garbage out". A pig with lipstick is still a pig.

And...

[mldi]

... Mommy tells me I'm special, more special than all the other kids, so *sticks out tongue*!

What does MS use in house?

[Fuzzpault]

Anyone have any idea on what MS uses for an OS in house? All Windows? If it's so secure then shouldn't all their employees be using it?

love the wording

[brre]

"[some say] we're doing a better job making our products more secure than anyone else"

Jeez, how many levels of indirection is that?

Are your products secure? Or not?

I'm doing a better job turning water into wine. I can't do it. But some folks say I'm doing a better job making water more like wine than anyone else.

Re:SECUNIA.COM on Win7, Linux 2.6x, MacOS X

[nacturation]

You compare all of OS X to only Windows 7. Biased much? How about comparing the timeframes. Windows 7 was launched around October 2009. OS X Snow Leopard was launched around September 2009. Comparing those timeframes for OS X yields better information than you provide:

Windows 7:
12 advisories in 2010
4 advisories in 2009

OS X:
5 advisories in 2010
5 advisories since September 2009

And some of those OS X advisories may be for versions prior to Snow Leopard... I'm not interested in investigating further. Want to throw Vista in there too? 15 advisories in 2010 and 15 more since September 2009. My comparison was between Microsoft's and Apple's boat, so I'll leave you to continue bashing Linux all you like.

Re:SECUNIA.COM on Win7, Linux 2.6x, MacOS X

[nacturation]

Thank you for the riveting discussion. I've enjoyed it.