thelinuxlink.net

I just read this on the Register - I never would have thought it though:

http://www.theregister.co.uk/2006/01/05 ... abilities/

-Gordon

So counting the number of vulnerabilities means one is more secure than the other? Discounting the severity of security holes, and looking only at the windows operating system, which doesn't do any server software itself that I can think of, and comparing that to linux, which invariably has more services to worry about, like ssh, apache, postfix, and other software that is supposed to be open to others, not to mention running multiple desktop environments which all have different security problems as well, and I don't see this as a comparison that makes any sense.

I think of my sister having to reinstall Windows XP three times in about 5 months, and other friends having to deal with viruses, worms, adware and spyware constantly, and the fact that she's had no security problems under Ubuntu, and this just really doesn't mean anything to me, unless I'm missing something.

Here's a quote from the website this article is based on:

2005 Year-End Index
Information in the US-CERT Cyber Security Bulletin is a compilation and includes information published by outside sources, so the information should not be considered the result of US-CERT analysis. Software vulnerabilities are categorized in the appropriate section reflecting the operating system on which the vulnerability was reported; however, this does not mean that the vulnerability only affects the operating system reported since this information is obtained from open-source information.

Right up front they basically say that this shouldn't be used as a comparison between operating systems, because vulnerabilities reported weren't checked to see if they affected other operating systems. So if a security nut uses linux and reports the problem on linux, it's then considered a strike against the linux operating system, that is, if you try to look at it the same way "The Register" did, instead of looking at it as evidence that security minded individuals use linux and find more security holes.

It was also obtained from "open-source" information, which makes me think it would be more likely to report "open-source" vulnerabilities.

When reports like this show up, and they go against every experience I have, I can't help but be terribly skeptical.

gordonmarkus wrote:I just read this on the Register - I never would have thought it though:

http://www.theregister.co.uk/2006/01/05 ... abilities/

Old news. Last time this was brought up there was article after article refuting this. Basically: Microsoft doesn't report many of their vulnerabilities, so there's no telling how many there really are. Also most Windows vulnerabilities are severe, where far fewer Linux vulverabilities are severe. Add in the fact that Linux exploits get fixed more quickly and you'll see that there's no real win for Microsoft here.

A system is only as good as its administrator. If you install a bad program from an email its your fault. The only way to stop that is to have every single known virus scanned for in the email attachment before installing it which is what a lot of virus scanners do now.

Gomer_X wrote:Basically: Microsoft doesn't report many of their vulnerabilities, so there's no telling how many there really are.

Completely agree, it's funny that this recent WMF vulnerablility actually was in Windows since version 3.0, which was released in October 1990 aka over 15 years ago, and not even found by Microsoft, to me that is a sign of them not auditing/reviewing their sourcecode, the OpenBSD people does that, which, again, shows that proprietary code is LESS secure than open operating systems, with a proprietary OS you an never know what the attacker knows, if he knows more or less than you do, and only the company making the OS can fix a vulnerability, you can't do it yourself. Another fun thing is that, obviously, Microsoft is not issuing patches for the thousands of people who are still using crappy Windows 95 (<-- This was a REALLY crappy OS).

CptnObvious999 wrote:If you install a bad program from an email its your fault.

No, I'd say that's Microsoft fault, for gods sake, it was THEM who embedded dangerous scripting languages into email, if someone did that with say Thunderbird, other people would just take it right out.

Tsuroerusu wrote:

CptnObvious999 wrote:If you install a bad program from an email its your fault.

No, I'd say that's Microsoft fault, for gods sake, it was THEM who embedded dangerous scripting languages into email, if someone did that with say Thunderbird, other people would just take it right out.

Is ActiveX in Outlook? I know they allow JavaScript which is pretty stupid.

CptnObvious999 wrote:

Tsuroerusu wrote:

CptnObvious999 wrote:If you install a bad program from an email its your fault.

No, I'd say that's Microsoft fault, for gods sake, it was THEM who embedded dangerous scripting languages into email, if someone did that with say Thunderbird, other people would just take it right out.

Is ActiveX in Outlook? I know they allow JavaScript which is pretty stupid.

VBscript certainly is, I think ActiveX is in there too, wouldn't surprise me, because both OE and Outlook uses the IE browser engine.

The point is there's simply no way to block a determined or wilfully ignorant end-user from blowing up their boxen. You can point to root vs regular user, but I'd say that to any regular user, /home is really all they care about, and to hell with the kernel.

Snarkout wrote:The point is there's simply no way to block a determined or wilfully ignorant end-user from blowing up their boxen. You can point to root vs regular user, but I'd say that to any regular user, /home is really all they care about, and to hell with the kernel.

Exactly, but is UNIX flawed since root can do anything? On windows they protect you from yourself so does this make it worse for absolute noobs? I don't mean we should get rid of it (I like being "god" ) but maybe there should be some sort of noobie security policy made...

CptnObvious999 wrote:

Snarkout wrote: but is UNIX flawed since root can do anything? On windows they protect you from yourself so does this make it worse for absolute noobs? I don't mean we should get rid of it (I like being "god" ) but maybe there should be some sort of noobie security policy made...

I don't see how you can get rid of root. Doing so would make it impossible to fully administer you system. I personally prefer sudo and the way OS X makes use of administration. By default, your admin users can admin the system fully, but any serious or potentially harmful change requires that you enter your password. It just doesn't do it for you. Thus, a user with admin capability under linux using sudo or OS X must wilfully make such a change. If you are an admin user under Windows, there is not prompting. It does it.

Furthermore, you don't have processes sneaking in and wrecking havoc on your system like Windows does.