Slashdot Log In
Study Finds Windows More Secure Than Linux
Posted by
Zonk
on Thu Feb 17, 2005 12:05 PM
from the an-interesting-definition-of-secure dept.
from the an-interesting-definition-of-secure dept.
cfelde writes "A Windows Web server is more secure than a similarly set-up Linux server, according to a study presented yesterday by two Florida researchers." In addition to the Seattle Times article, there is also coverage on VNUnet. From the article: "The researchers, appearing at the RSA Conference of computer-security professionals, discussed the findings in an event, 'Security Showdown: Windows vs. Linux.' One of them, a Linux fan, runs an open-source server at home; the other is a Microsoft enthusiast. They wanted to cut through the near-religious arguments about which system is better from a security standpoint."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Another study (Score:5, Funny)
Knock Knock Joke (Score:5, Funny)
Who's there?
Knock Knock.
Who's there?
Knock Knock.
Who's there?
Knock Knock.
Who's there?
Knock Knock.
Who's there?
Knock Knock.
Who's there?
Knock Knock.
Who's there?
Phillip Glass
My 8 year old daughter, a great afficionado of knock knock jokes, didn't appreciate it.
Parent
Integrity? (Score:5, Informative)
Well, apparently this is the second time Microsoft has come out on top of a research project by Mr. Richard Ford [fit.edu].
http://www.virusbtn.com/magazine/articles/letters/ 2004/01_01.xml [virusbtn.com]
Apparently there was some question to the validity of an earlier project because it was sponsored by Microsoft.
However, I would like to note that both researchers seem very well educated, especially in computer security. And, additionally, they both note that a lot more could be done to lock down the Linux server.
A lot more could certainly be done... (Score:5, Insightful)
OpenBSD runs chroot() Apache. Does IIS have similar capability?
The chroot() patch was never taken up, but it would probably not be that difficult to install on Linux.
I would be disinclined to run any other way at this point.
Parent
Re:Integrity? (Score:5, Insightful)
Their criteria included the number of reported vulnerabilities and their severity, as well as the number of patches issued and days of risk -- the period from when a vulnerability is first reported to when a patch is issued.
I hoped for a deeper analysis, like the security model used or how it behaves in networks. But it just back to counting vulnerabilities.
--Nothing to see here, move on.
Parent
Re:Integrity? (Score:5, Insightful)
I challenge the assumption that Redhat vulnerabilities are equal to Microsoft vulnerabilities.
Given the history of malware, they clearly are not.
This study is nothing more than a more formalized version of a certain form of trolling once popular on COLA.
Parent
Re:More FUD (Score:5, Funny)
And, to the grandparent -- if you read your own link, the previous study was not sponsored by Microsoft.
Parent
These studies are pointless. Both can be secure (Score:5, Insightful)
A webserver needs port 80 and maybe 443 open. Any webserver can be secured.
Where's the news?
Newsflash... ONE Linux Fan.. (Score:5, Insightful)
A Linux enthusiast at the RSA Conference in San Francisco has reluctantly concluded that Microsoft produces more secure code than its open source rivals.
In an academic study due to be released next month Dr Richard Ford, from the Florida Institute of Technology, and Dr Herbert Thompson, from application security firm Security Innovation, analysed vulnerabilities and patching and were forced to conclude that Windows Server 2003 is more secure than Red Hat Linux.
Now, I'll concede that Dr. Ford and Dr. Thompson do sound reputable, but one is an admitted Windows enthusiast and while the other one is a Linux fan who changed his minds, this hardly sounds like a study
It's an interesting question, and I'm sure there is no clear cut answer, but a more systematic study (with more parties, rather than just two scientists) is going to be needed to answer this sort of question before the 'results' are trumpetted. I'm sure Microsoft will pick this one up and run with it, however.. more of those annoying ads that seem peppered throughout Slashdot.
Not only that, but I find this quote odd.. (Score:5, Insightful)
Umm, so MS showed him their source code? I find that a little hard to believe.
If he can't see the source, how can he make any determination at all?
Parent
Re:Newsflash... ONE Linux Fan.. (Score:5, Insightful)
I'm getting a little disturbed at the way all pro-Linux studies are being accepted and all other studies are being dismissed here. Critical thinking should always be welcome. And, yes, Linux is NOT perfect, it is NOT flawless, and it IS full of security holes like anything else. Nobody should take their operating systems so personally that they feel attacked when Linux is criticized.
Note that this doesn't go for everybody. But there are a lot of zealots in the community who need to learn to see outside their own perspective.
Parent
Re:Newsflash... ONE Linux Fan.. (Score:5, Informative)
Um, no. Your average system administrator earns about $62k has at least 2 years experience, and generally a bachelors degree in a related field. At least according to most industry figures. [salary.com]
The job title also entails tweaking system configurations for security, evaluating patches, etc. etc.
Parent
Not again... (Score:5, Insightful)
So Windows is more secure than Red Hat because Microsoft chooses to report less vulnerabilities and release less patches? Hmmm...
(Move along, nothing new to see here.)
Non Story (Score:5, Insightful)
The security of a server... (Score:5, Insightful)
Now let the flaming begin, so you can all argue about the number of patches/updates required for each system, how long it takes for Linux/Windows to respond to problems, and all that good stuff. We all know that's the only reason this kind of story shows up on Slashdot is to start a good flame/troll war!
Self-Evident (Score:5, Insightful)
I'm no zealot (Score:5, Insightful)
No matter how fast a patch is issued, you still have to install it for it to work.
Delay in announcing MS vulnerabilities? (Score:5, Insightful)
Enthusiast?! (Score:5, Funny)
Hardly a study (Score:5, Insightful)
Sorry, but this "study" is not a study.
Why was this even posted?
RTFA then talk (Score:5, Funny)
"Believe it or not, a Windows Web server is more secure than a [i]similarly set-up[/i] Linux server, according to a study presented yesterday by two Florida researchers."
So when you load a linux server with software that has known security holes....they are both equally as secure.
It's not groundbreaking news.
"Days of Risk" vs. Full Disclosure (Score:5, Insightful)
Secondly, there's no discussion of how the criticality of a vulnerability was weighed. If every "day of risk" for Windows was "critical," and every "day of risk" for RedHat was "moderate," then I'd differ with their conclusions. Further, there was no mention of whether they considered actual exploits in the wild.
Also in the news... (Score:5, Funny)
Horribly flawed (Score:5, Insightful)
Are they joking? Their metric (reported vulnerabilities) is absurd for a number of reasons.
1) Microsoft reports only a fraction of its vulnerabilities. Remember when Win2000 had over 65000 known (to Microsoft) flaws? No more than a handful were ever reported. Microsoft reports flaws only after bearing enormous public humiliation. Of course Microsoft's flaw count is going to be low. Microsoft hides them all until forced to disclose.
2) Linux vendors report every hair out of place. It doesn't matter if the flaw causes a D to look like an O on the third day of the Summer Solstice, but only if that day matches the 4th digit of PI, and only if the computer has calculated the cure for cancer at exactly 15 milliseconds after the user's orgasm.
3) Seriousness of vulnerabilities. Due to the nature of full disclosure under Linux, it will -always- have higher reported flaw counts than Windows. The vast majority of reported Linux flaws, however, are relatively benign, while the vast majority of reported Windows flaws hand over complete control of your computer to some third party.
4) Widespread Propagation. Windows, by its intended design, makes propagating exploits to these vulnerabilities trivially easy (automatic, actually), while this has yet to be accomplished on Linux (and likely won't be).
Sorry, but this "study" is complete nonsense.
Quality Research (Score:5, Insightful)