Security pro: Windows easier to 0wn

TalkBack 12 of 73:

Next »

« Previous

• Thread View
• Flat View

Allow me to break it down for you

I agree that the paper is technically correct in many areas, but it doesn't take a broad enough look at why Windows is less secure than Linux, and it make too many assumptions, the biggest one being that the person administering the Windows box will be clueless and the person running the Linux box will be competent.

In fact it shares all of the attributes of the pro-Microsoft TCO studies that Microsoft touts on their webpage.

The paper was written by someone with an adgenda. All the proof you need of this, is to look at the section where they admit that they were able to find 0-day exploits in Mac OSX much MUCH faster than in Windows or Linux, yet they dismiss the findings outright and continue to focus on Windows. Here is the actual quote they make:

"As clearly demonstrated, other than the toy OS Mac OS X, Windows has the lowest TC0 on the market."

One of the things that the paper indirectly hit upon was the Monoculture problem in the "Static Addresses" section. That's about the only area in which I would completely concur with them. The lack of buffer overflow protection is another, but then I have to ask, why are there still buffer overflow exploits being produced for Linux to this day?

In the "User Error" section the paper makes these idiotic statements:

"Few Windows users can identify the purpose of all the processes running on their system."

Duh! Most Windows user are clueless. The same would go for an ineperienced user running Linux.

"Even fewer know what tool to use to discover which processes are listening on which ports. In Linux, this is built into the netstat program."

And in Windows the same functionality is built into the netstat program. This quote is very Michael Moore'ish statement.

"It's unlikely a Windows user will even know how to determine which users are able to log in remotely to their system."

Again the "Windows users are ignorant, Linux users are smart" argument is not valid. The study should assume that in both cases (with Windows and Linux) the admins would be competent.

In the "Patch Maintenance" section they do have one up on Windows at this time. But to bring about this argument, the authors should have compared Fedora Core to Windows and not "Linux" to Windows. What if someone is running Debian or Slackware and installed postfix manually from the source on their box?

Posted by: toadlife   Posted on: 08/14/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now
• Key Strategies for Federal Agencies - Safe and Cost Effective Migration for Legacy Hardware GovConnection The federal government has mandated that federal agencies reduce energy ... Download Now
• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now