March 22, 2005 4:56 PM PST
Linux riskier than Windows?
- Related Stories
-
Microsoft may offer peek at SQL Server code
February 23, 2005 -
Study: Few bugs in MySQL database
February 4, 2005 -
Flaw finders go their own way
January 26, 2005
(continued from previous page)
down into "high," "medium" and "low" severity ratings. Flaws graded as high severity include Red Hat and Microsoft's critical classifications and flaws that allow local users to gain access to system functions. Microsoft had far fewer high-severity flaws in both the default and minimal configurations, according to the paper.
Microsoft did fund the study, the researchers acknowledged. The software giant released a statement on Tuesday that indicated
"When Security Innovations submitted a proposal to Microsoft to research ways to measure vendor software security, we evaluated the proposal and determined that this type of analysis would be useful for our customers and funded their research," the company said in the statement. "We encourage customers to review and evaluate the data in the context of their own computing environments."
Richard Ford, a computer science professor at the Florida Institute of Technology, and Fabien Casteran, a security test engineer at Security Innovations, were the authors of the report alongside Thompson. The researchers hope to stave off criticism by publishing their methods as part of the report.
"The methodology was designed to allow others to validate it for themselves--it has to be quantitative and repeatable," Thompson said. "We didn't just want to hand people the cake; we wanted to give them a recipe as well."
While both days of risk and vulnerability counts aren't true measures of security, Thompson said that they wanted to focus on a metric that mattered to system administrators. The cumulative time they had to wait for patches is a reasonable measure, he argued.
Thompson admitted, however, that security largely depends on the expertise of the administrator.
"I think either (operating system) is infinitely securable by a skilled Jedi administrator," Thompson said. "If I have a Linux guru, then I want that guy to do the Linux web server. I am more of a Window guru, so I would use Windows."
86 comments
Join the conversation! Add your comment (Log in or register)
FUD, FUD, FUD, the lies from Redmond are marching!
The classic LAMP stack (Linux, Apache, MySQL, PHP or Perl) has proven successful time and time again for YEARS.
If I were Microsoft I wouldn't be spreading FUD. Rather, I'd spend the time fixing bugs in my software, and actually making IE as well as IIS more than a piece of junk.
FUD, FUD, FUD, the lies from Redmond are marching!
The classic LAMP stack (Linux, Apache, MySQL, PHP or Perl) has proven successful time and time again for YEARS.
If I were Microsoft I wouldn't be spreading FUD. Rather, I'd spend the time fixing bugs in my software, and actually making IE as well as IIS more than a piece of junk.
OK - so I tell tell people "Whatever your problem, ME isn't the answer". But you buy a decent M$ OS & things are fine - I even had M$-DOS 3.3, and NEVER did it let me down after several YEARS.
OK - so I tell tell people "Whatever your problem, ME isn't the answer". But you buy a decent M$ OS & things are fine - I even had M$-DOS 3.3, and NEVER did it let me down after several YEARS.
Perhaps if they spent more time making solid products they wouldn't have to pay people to publish bogus reports.
Instead of calling folks names, attempt to actually articulate your side of the debate. Document how Linux beats Windows, and why. Keep careful records, and prove your point, by the numbers.
If you can, that is. The nasty reality of what companies already own, where their data already lives, what skill sets are available, where management wants to go, ect. have a way of making simple decisions very complex.
Perhaps if they spent more time making solid products they wouldn't have to pay people to publish bogus reports.
Instead of calling folks names, attempt to actually articulate your side of the debate. Document how Linux beats Windows, and why. Keep careful records, and prove your point, by the numbers.
If you can, that is. The nasty reality of what companies already own, where their data already lives, what skill sets are available, where management wants to go, ect. have a way of making simple decisions very complex.
First, Microsoft never engages their marketing propaganda machine unless they feel a threat. This isnt a bad thing, its a good thing. This mean Microsoft is for the first time publically, acknowledging that Linux based systems are a threat to what it percieves as its dominence in the market. And, as typical with MS, when it cant gather enough hard facts to support its position, it engages its marketing propaganda engine and attacks in the media.
Second, attacks and name calling as in previous posts should be refrained from. Not for the obvious reasons, but for the good of the open-source community. Many decision-makers in these on-the-fence companies are reading these stories and the posts to them while trying to decide if open source is the way to go, or the MS monopoloy should remain in their organizations. MS would portray open source initiatives as a bunch of "high-schoolers" coding immature applications not ready for the "real" world. Lets not give them ammunition to believe we arent at the top of the game along with the proprietary-source market.
We all know how good, and in some cases better open-source software is than the MS stuff.. and this is due to our ability to work as a disconnected collective. Lets present this as a mature, intellegent position in responses to "studies" done by MS paid "researchers".
Because as we know.. When the facts are all presented, we have the winning products.. in the Linux/Novell/Mac arena.
Bob.
---------------------------------------------
"We can never see past the choices we dont understand." - You should know who said this and why.
---------------------------------------------
Of course a smart company will make that a part of their decision process, but only part.
This has been disputed in great detail by Novell.
[http://www.novell.com/linux/truth/response.html]
Thank you for your care for "the good of the open-source community". However if you look more general on the posts here you will find something else than threats for open-source community.
have nice day :)
First, Microsoft never engages their marketing propaganda machine unless they feel a threat. This isnt a bad thing, its a good thing. This mean Microsoft is for the first time publically, acknowledging that Linux based systems are a threat to what it percieves as its dominence in the market. And, as typical with MS, when it cant gather enough hard facts to support its position, it engages its marketing propaganda engine and attacks in the media.
Second, attacks and name calling as in previous posts should be refrained from. Not for the obvious reasons, but for the good of the open-source community. Many decision-makers in these on-the-fence companies are reading these stories and the posts to them while trying to decide if open source is the way to go, or the MS monopoloy should remain in their organizations. MS would portray open source initiatives as a bunch of "high-schoolers" coding immature applications not ready for the "real" world. Lets not give them ammunition to believe we arent at the top of the game along with the proprietary-source market.
We all know how good, and in some cases better open-source software is than the MS stuff.. and this is due to our ability to work as a disconnected collective. Lets present this as a mature, intellegent position in responses to "studies" done by MS paid "researchers".
Because as we know.. When the facts are all presented, we have the winning products.. in the Linux/Novell/Mac arena.
Bob.
---------------------------------------------
"We can never see past the choices we dont understand." - You should know who said this and why.
---------------------------------------------
Of course a smart company will make that a part of their decision process, but only part.
This has been disputed in great detail by Novell.
[http://www.novell.com/linux/truth/response.html]
Thank you for your care for "the good of the open-source community". However if you look more general on the posts here you will find something else than threats for open-source community.
have nice day :)
Now I'm not trying to attack the validity of the report. I am saying that it's hard to believe it when it was commissioned from Microsoft. Guilt by association I suppose.
I haven't read the report, but plan to when I get time. My question is did Microsoft help them properly configure Windows? Did they run Linux straight out of the box without modifing it's configurations? Did they run Windows straight out of the box without reconfiguring security?
I would like to see a report done that wasn't commissioned by Microsoft or a Linux Group that configured each server for it's optimal security and performance. Although no report is every truly going to be unbiased this would come closer.
Now I'm not trying to attack the validity of the report. I am saying that it's hard to believe it when it was commissioned from Microsoft. Guilt by association I suppose.
I haven't read the report, but plan to when I get time. My question is did Microsoft help them properly configure Windows? Did they run Linux straight out of the box without modifing it's configurations? Did they run Windows straight out of the box without reconfiguring security?
I would like to see a report done that wasn't commissioned by Microsoft or a Linux Group that configured each server for it's optimal security and performance. Although no report is every truly going to be unbiased this would come closer.
So unless we start with totally neutral, objective, and COMPREHENSIVE counts, all of this 'study' is "..a clanging of symbols and crashing of gongs....signifying NOTHING!!!"
Last I heard, Microsoft had PRECLUDED this type of study in all of its EULA's!
So unless we start with totally neutral, objective, and COMPREHENSIVE counts, all of this 'study' is "..a clanging of symbols and crashing of gongs....signifying NOTHING!!!"
Last I heard, Microsoft had PRECLUDED this type of study in all of its EULA's!
The truth is Microsoft has the ability to suppress, for a long periods of time, the Public Disclosure of Vulnerabilities with the use of Responsible Disclosure , National Security --- time of war and the Patriot Act . Once the vulnerability is release, Microsoft has a history of attacking the security researcher and dismissing the criticality of the vulnerability, until it impacts the customer. Then, if a worm/virus does impact the community, Blame it on Hackers or the Users for not taking some action.