Web on watch for common enemies

TalkBack 15 of 16:

Next »

« Previous

• Thread View
• Flat View

Re: Monocultures: Find once, fix once

More significantly, any discussion should consider the fact that, once a flaw has been identified, it can be fixed in most of the world's pc's (100% Java, 90+% IE; the Analysis appears to underestimate IE's share) by a single patch.
The vulnerability is more widespread, but so is the repair.

Hmmm, I suppose that's one way to spin it, but you rely on the assumption that such a condition is a more preferable one than its contrapositive. I don't think you've made the case.

Seems to me the whole "monoculture" premise is that a single vulnerability leaves the Internet open to a gut punch at some time. As comfort value, the fact that the vuln can be patched once leaves me cold.


Another point to consider: Microsoft, including Bill Gates, has stated that the company's products have been more thoroughly tested than any competitors, by the bad guys. They've therefore had to make more repairs, fix more holes.
The company argues that this makes their products better defended, simply because more has been fixed.

I think Firestone would approve that logic but I don't think it would fly with tire buyers.


The obvious answer is, maybe there's more to fix, and Microsoft's products are still catching up. But given the types of errors, such as overflows, is it possible that they are correct, in that they've had to find flaws that are present in most software, while others have not?

Maybe, but that might be about to [url=http://news.netcraft.com/archives/2004/10/25/red_hat_users_targeted_by_bogus_advisory.html]change[/url]. The article referenced talks only about social engineering which is a user flaw more than a software flaw. We'll see if more software flaws in non-MS software soon enough. On the other hand, a server space comparison is closer to apples to apples and my reading suggests there are more MS software vulnerabilities there, too.


I think they're probably wrong, but not certain. Any comments?

I think you're probably right.


.

Posted by: none none   Posted on: 11/29/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Building the Virtualized Enterprise with VMware Infrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now