August 25, 2008 8:07 AM PDT
Picturing Linux vs. Windows security
For those that may be more visually inclined, looking at a few pictures may prove instructive in Linux (and Apache) vs. Windows (and IIS) web server security. The more convoluted the system, the more opportunities to exploit its security:
The basic argument goes like this. In its long evolution, Windows has grown so complicated that it is harder to secure. Well, these images make the point very well. Both images are a complete map of the system calls that occur when a web server serves up a single page of html with a single picture. The same page and picture. A system call is an opportunity to address memory. A hacker investigates each memory access to see if it is vulnerable to a buffer overflow attack. The developer must do QA on each of these entry points. The more system calls, the greater potential for vulnerability, the more effort needed to create secure applications.
I don't think this is by any means conclusive, but have a peek at the Linux/Apache system calls and the Windows/IIS system calls. Both are fairly complex, but Windows takes the prize for King of Convolution.
Does this mean Linux is more secure? Not necessarily, but perhaps it does indicate that Linux can be more easily secured.
Matt Asay brings a decade of in-the-trenches open-source business and legal experience to The Open Road, with an emphasis on emerging open-source business strategies and opportunities. Matt is vice president of business development at Alfresco, a company that develops open-source software for content management. He is a member of the CNET Blog Network and is not an employee of CNET. Disclosure. You can follow Matt on Twitter @mjasay. 
I normally read your articles for some good insight on the latest in open source and linux and I like it a lot. Its the only blog in my firefox bookmarks toolbar. But this post with two figures at least 3 years old and a link to another 4 year old article from a website that's known more for its sarcasm than anything serious isn't what we expect from a veteran like you, especially in a topic so crazily debated amongst open source enthusiasts and their opponents.