Linux Distributions Respond to Forrester 262
dave writes "GNU/Linux vendors Debian, Mandrake, Red Hat, and SUSE have joined together to give a common statement about the Forrester report entitled "Is Linux more Secure than Windows?". Despite the report's claim to incorporate a qualitative assessment of vendor reactions to serious vulnerabilities, it treats all vulnerabilities are equal, regardless of their risk to users. As a result, the conclusions drawn by Forrester have extremely limited real-world value for customers assessing the practical issue of how quickly serious vulnerabilities get fixed."
IT Research shops (Score:5, Interesting)
The executive management of the agency that I work for pays Meta $500/hr to evaluate project plans... they always rubber stamp whatever answer the execs want.
Re:IT Research shops (Score:5, Insightful)
The executive management of the agency that I work for pays Meta $500/hr to evaluate project plans... they always rubber stamp whatever answer the execs want.
And then when the project fails, they can go the higher-ups or shareholders and say "See, the plan was sound, it was that Anonymous little shit down in IT that screwed it up. Lay him/her off and ship the job to India!"
Then they all go celebrate their cost-cutting with booze and hookers, whilst lighting their cigars with $100 bills.
Re:IT Research shops (Score:4, Informative)
Their logic seems to be windows IP will bolster Solaris!?! Wow.
Betcha microsoft or some exec who gets a bonus paid for that report.
A comment on Forrester from one of their own. (Score:5, Insightful)
Rob Enderle [enderlegroup.com], formerly of Forrester writes:
Re:A comment on Forrester from one of their own. (Score:5, Interesting)
From the rest of that article Enderle obviously has an axe to grind. It is quite possible he was threatened by a minority in the Linux community that can't seem to grow up and has obviously decided to hold a grudge against Linux as a whole.
His argument for taking SCO's side boils down to "I'm pissed at some Linux fanboys!" That's fine but I hope he doesn't expect anyone to ever take him seriously as an analyst again(if they ever did). Almost by definition Analysts and Critics must have a thick skin because there's always someone who is going to insult them. Once they lose their objectivity they are effectively washed up.
He further insults the integrity of Groklaw without actually pointing to any flaws in the facts that Groklaw presents. He ignores all the evidence mounting up against SCO and the fact that SCO has been back pedaling so fast they're tripping over themselves to get out of the way of the coming storm.
Re:A comment on Forrester from one of their own. (Score:3, Interesting)
Here is the quote you're referring to -->
For me the course of events looked like the community had said once a crime had been committed that "there is no evidence", then when evidence was found they changed their tune to say "what was stolen didn't belong to SCO in the first place". If they had started with the second position and behaved reasonably I might have believed them, since they didn't, I didn't.
Not onl
Malleable Statistics (Score:5, Insightful)
Re:Malleable Statistics (Score:5, Insightful)
Re:Malleable Statistics (Score:3, Interesting)
Something True (Score:2, Insightful)
Yeah! Its So Obvious Linux Is More Secure Than Windows!
Just [theregister.co.uk] Don't Store Your Important [internetnews.com] Source [theregister.co.uk] Code [apacheweek.com] On It [stargeek.com].... :))))))))))))
no way! (Score:5, Funny)
Re:no way! (Score:2, Insightful)
Re:no way! (Score:5, Insightful)
Re:no way! (Score:2, Insightful)
And are these companies hiding this bias? The is no question what their agenda is (well, I suppose if one was an utter moron and didn't realize what each of these have in common). And, is the research ([sic]) company claiming to be unbiased? If I'm not mistaken, they claim to have done an independent investigation. Yet, I'm
Re:I dub thee -1 Slashbot (Score:2)
Oh, wait, I already pointed out that is a stock laundering scheme.
Never mind.
We can respond... (Score:2, Insightful)
Re:We can respond... (Score:3, Insightful)
Re:We can respond... (Score:3, Interesting)
BTW, here's the report....if you have 900 USD to get it:
The Forrester Report [forrester.com]
Analyst hacks will never bit the hand that feeds (Score:5, Insightful)
The most dramatic thing from my point of view is that SuSe, Red Hat, Mandrake and community based Debian all got together to formulate a common reply. This is the BEST news we could ever hope for - a common on unified front - no forking when it comes to security.
Re:Analyst hacks will never bit the hand that feed (Score:2, Insightful)
Re:Analyst hacks will never bit the hand that feed (Score:5, Informative)
you would be correct [microsoft.com]
From the article:
"In 2003, Microsoft Corporation commissioned Forrester Research, Inc., to conduct a study to measure the potential market of people in the United States who are most likely to benefit from the use of accessible technology for computers."
Re:Analyst hacks will never bit the hand that feed (Score:2, Insightful)
Re:Analyst hacks will never bit the hand that feed (Score:3, Interesting)
Re:Analyst hacks will never bit the hand that feed (Score:4, Interesting)
I don't know if you took the time to read the response from the Linux vendors to the Forrestor report but it is clear that if Forrestor conducted the analysis as described that they made a HUGE statistical error. The question naturally must be asked "how could a supposedly well funded source miss such an obvious gaff?" It takes time and money to do research, surely Forrestor has one above average statistician on staff.
To have performed such a study and in the end wasted their money would seem incredulous. This is akin to being asked to write a word processor and coming up with a spreadsheet program. A natural supposition than is to question the motives of the researchers, however this could easily be a case of "never put down to malice what can easily be attributed to incompetence."
Re:Analyst hacks will never bit the hand that feed (Score:4, Insightful)
Comment removed (Score:5, Funny)
Re:very slanted (Score:2, Interesting)
Re:very slanted (Score:5, Insightful)
First of all, it's called a "mean", not an average. It's a type of average. The median is also an average. So is the mode.
Secondly, the median is not necessarily a better representation, just different. With the median, for example, you have *no idea* whether there are any extreme outliers. 1,1,2,5000000,90000000000. Median is 2. Is that representative of that set of numbers? Not really. The mean would give you a much better idea of what range of numbers you're dealing with in that case. That's why real statistics with distribution curves and standard deviation are important.
Anyway, I'm done nitpicking. I agree that these reports are blatantly skewed. This is not really a surprise. Almost all research is funded and biased these days. Much like news media. It's a simple fact of life. The important thing is to know your source, and try to understand their motivations.
When the next "scientific study" comes along saying that P2P increases music sales, no matter how much you believe that to be true, you need to take a look at who's writing it, and why. Is this some graduate student who is probably downloading his own MP3s all the time and just trying to justify their habits to the world? Perhaps not, but it's wise to make sure before you start throwing his or her study around as if it were gospel.
Sorry if that sounded as if it was directed at you, it wasn't really. It's just some good advice (in my opinion).
Re:very slanted (Score:2, Funny)
Re:very slanted (Score:3, Funny)
Re:Analyst hacks will never bit the hand that feed (Score:5, Informative)
Even given the positive spin towards Microsoft, however, Forrester's comments [internetwk.com] on the study are a barely lukewarm endorsement of Microsoft, and don't seem to be too critical of Linux. Check out some of the comments by Forrester analyst Laura Koetzle:
Surprisingly, Microsoft did the best job at patching vulnerabilities fast, even though it ranked at the top with the largest percentage of its security holes rated as high
So they DID acknowledge that Microsoft's platform had the most HIGH RISK vulnerabilities, althought this fact is glossed over in the article. Koetzle also acknowledges that the study did NOT look at how WELL the patches addressed the problem (MS often needs to issue more than one patch to get it right, and sometimes they fix one bug and introduce another).
"The fact that the Linux distributors fixed such a high percentage of their vulnerabilities is a remarkable achievement," she said. "Even Debian, in last place, was pretty darn thorough."
Sure doesn't sound like something you'd expect an MS-paid cheerleader to day about the competition...
This is very much a case of your mileage may vary
Translation: even if patches are made fast they can still leak...
The bottom line? Any of these platforms can be operated securely
Quite the ringing endorsement for MS ain't it? Nice to see their people so solidly back their studies...
Re:Analyst hacks will never bit the hand that feed (Score:3, Insightful)
Microsoft, for the first time, paid in full advance even before a full proposal could be drafted, or even basic details.
They initially wanted a TCO study, and our CEO told them to NOT DO THAT, he is very honest, and knew beforehand Windows would lose. On the other hand, ew do not know what will happen.
The reality is that under some very common scenarios, at least
If you think that mass-circulated study is bad... (Score:2, Informative)
Re:If you think that mass-circulated study is bad. (Score:2)
In this day and age, nobody seems to ever admit doing wrong.
just in case (Score:5, Informative)
GNU/Linux vendors Debian, Mandrake, Red Hat, and SUSE have joined together to give a common statement about the Forrester report entitled "Is Linux more Secure than Windows?". Despite the report's claim to incorporate a qualitative assessment of vendor reactions to serious vulnerabilities, it treats all vulnerabilities are equal, regardless of their risk to users. As a result, the conclusions drawn by Forrester have extremely limited real-world value for customers assessing the practical issue of how quickly serious vulnerabilities get fixed.
The security response teams of GNU/Linux distributors Debian, Mandrakesoft, Red Hat and SUSE have assisted Forrester in gathering and correcting data about vulnerabilities in their products. The gathered data was used at Forrester for a report that became titled "Is Linux more secure than Windows?". While the Linux vulnerability data that is the basis for the report is considered to be sufficiently accurate and useful, Debian, Mandrakesoft, Red Hat and SUSE, from now on referred to as "We", are concerned about the correctness of the conclusions made in the report.
We believe that it is in the interest of our usership and the OpenSource community to respond to the Forrester report in the form of a common statement:
We were approached by Forrester in February 2004 to help them refine their raw data. Forrester collected data about the vulnerabilities that affected Linux during a one year period and looked at how many days it took us to provide fixes to our users. Significant efforts have been put in not only making sure that the underlying dataset for the Linux vulnerabilities was correct, but also to articulate the special technical and organisational care taken in the response processes in the professional Open Source security field. This expertise is greatly appreciated by our usership since it adds a high value to our products, but we see that most of this value has been ignored in the methods used for the analysis of the vulnerability data, leading to erroneous conclusions.
Our Security Response Teams and security specialized organisations of respectable reputation (such as the CERT/DHS, BSI, NIST, NISCC) exchange information about vulnerabilities and cooperate on the measures and procedures to react to them. Each vulnerability gets individually investigated and evaluated; the severity of the vulnerability is then determined by each of the individual teams based on the risk and impact as well as other, mostly technical, properties of the weakness and the software affected. This severity is then used to determine the priority at which a fix for a vulnerability is being worked on weighed against other vulnerabilities in our current queue. Our users will know that for critical flaws we can respond within hours. This prioritisation means that lower severity issues will often be delayed to let the more important issues get resolved first.
Even though the Forrester report claims so, it does not make that distinction when it measures the time elapsed between the public knowledge of a security flaw and the availiability of a vendor's fix. For each vendor the report gives just a simple average, the "All/Distribution days of risk", which gives an inconclusive picture of the reality that users experience. The average erroneously treats all vulnerabilities as equal, regardless of the risk. Not all vulnerabilities have an equal impact on all users. An attempt has been made to allocate a severity to vulnerabilities using data from a third party, however the classification of "high-severity" vulnerabilities is not sufficient: The mere announcement of a vulnerability by a particular security organisation does not necessarily make the vulnerability severe - similarly, the ability to exploit a weakness over the network (remote) is often irrelevant to the vulnerability's severity.
We believe the report does not treat the open source vendors and single closed source vendor in th
You left out a part... (Score:3, Informative)
The report and it's value (Score:4, Troll)
Then, there is the relevence of bugs. SE-Linux makes many otherwise serious glitches a mere nuicense. As do other modules in the LSM.
There is no chroot() in Windows, to the best of my knowledge. This also changes the severity of a bug from catastrophic to irritant, in Unix.
Finally, Nessus and SAINT are more often used to scan Unix boxes than Windows ones.
Re:The report and it's value (Score:5, Informative)
Microsoft publishes extensive security checklists for various roles, and automates this process for the most likely deployment scenarios via the IIS Lockdown tool and local / group policy templates. You can manage a large fleet of computers using Group Policy in AD, so your lockdowns quickly apply to all computers, not just one.
Nessus scans at the network level and works acceptably to find most Windows network-based vulnerabilities. I use Nessus myself when doing vulnerability assessments as a shortcut / initial pass. Nessus is not good at finding configuration or local user weaknesses.
However, in Windows, the use of ACLs, low privilege service accounts, and utilizing fine grained privileges replaces big ass isolation required by Unix-like operating systems simply because most Unix-like OSs don't have this level of security architecture or fine grained access control.
I don't use SAINT, so I have no comment on that.
Just because an OS is different or you personally don't have knowledge of lockdowns, doesn't make another OS insecure. It requires bad coding practices and poor configuration to do that. Thanks to Windows' popularity, there's more than enough of this to go around.
Andrew
Re:The report and it's value (Score:2)
On Microsoft's Side (Score:3, Insightful)
Re:On Microsoft's Side (Score:5, Informative)
Microsoft finds their flaws in a number of ways, businesses that report them, and white hat hackers they do this for a living.
But to answer your question a little better. If you look back at the flaws in IE, consumers, not businesses, were the ones that got attacked before the patches were out. Again, because it was a person, it is hard to track down the exact problem that occured to them. IE has the flaws that were exploited before the patches came out. Phishing scams from the address bar.
Re:On Microsoft's Side (Score:2, Informative)
I think it was Stanford University that got hit with some of the RPC DCOM vulnerabilities before a patch was released. No, it wasn't one of the worms, it was hackers backdooring systems.
Debian's a vendor? (Score:2, Insightful)
Re:Debian's a vendor? (Score:5, Informative)
I rely on then for providing me a rock-stable, thoroughly tested distribution and any security upates to that distribution.
I, in turn, (since I'm not a really good coder) spread the good word that these people know what they're doing. If I find a bug or security vulnerability, I report it to them ASAP. I also test out thier new stuff, and report bugs and such for them, and suggest ways that thye might improve thier products.
They give me something, I pay them in the currency they want. They are indeed a vendor.
Soko
"Secure box" (Score:5, Interesting)
What would be a very interesting read would be to have sys admins lock down the box (perhaps those do consulting for corporations) and then test how well they're set up.
Granted, it's up to the admin at that point so have many admins on different boxes.
Money talks (Score:5, Insightful)
how can they claim that since Micro$oft receives bug reports that are not publicly announced???
It is easy to announce the bug along with the patch after having it hidden for 6 months...
Re:Money talks (Score:2)
At Microsoft, and any other closed source company for that matter, bugs can be fixed inhouse and only then announced along with a patch. This is simply the nature of closed source software.
Interstingly, there have been occasions where people have sent bug reports to Microsoft and
Re:Money talks (Score:5, Informative)
reference [eeye.com]
I don't buy for a minute that 1) Microsoft releases patches faster or 2) that Microsoft even gives a damn about security, except for the black eye it gives them.
The cold-hard turth about Forrester and Gartner (Score:5, Interesting)
Oh, and one more thing... (Score:2)
Re:The cold-hard turth about Forrester and Gartner (Score:2, Insightful)
Unfortunately, the largest herd is heading for a cliff.
Or would a better analogy be:
Unfortunately, the largest herd is surrounded by a pack of wolves.
The first is funnier, but the second is probably more accurate (IE script kiddies mostly target MS Products), and it was more along the lines of my first thought.
Re:The cold-hard turth about Forrester and Gartner (Score:2)
Re:The cold-hard turth about Forrester and Gartner (Score:2, Informative)
I worked for a world known brand that took these very seriously. They took a bunch of Jupiter reports (IIRC, they are basically the same thing). They based the whole IT strategy on a these things. All handed down from the global management team "The new direction". "We will use only best of breed" (MS and cisco) "no linux on the desktop" (surprised me that that was mentioned specifically) and a bunch of other things that basically came directly out of a bunch of these reports.
I think this
Re:The cold-hard turth about Forrester and Gartner (Score:3, Interesting)
You're absolutely right. One of the first jobs I was given when I joined my current employer was to write a technical paper explaining why we should migrate from Lotus Notes to Exchange. My remit was not to do any analysis, but to provide justification for the decision our regional president had already made.
I made a lot of use of reports from the Giga and Meta groups, coincidentally sponsored by Microsoft. In the end I had a fairly respectable looking document with lots of plausible-looking quotes tha
Re:The cold-hard turth about Forrester and Gartner (Score:2)
I recevied it in my mail and I couldn't believe it (Score:2, Funny)
Time to go back to sleep and dream of Distributions uniting forces.
Missing Distributions? (Score:5, Funny)
Re:Missing Distributions? (Score:2)
MS-Funded Research States Sky Is Red (Score:5, Interesting)
Buried in all the hoopla, they never tell you that all the smoggy red photos were taken at around the time sunsets happen.
Statistics and numbers in general can be thrown any which way to serve the purpose of the writer. It's an unfortunate side-effect of being biased by nature. Even if someone were to WANT to be impartial, they'll often offer a slant merely by presenting data a certain way.
It's difficult to find people to trust when money is on the line somewhere. With Microsoft's track record and its acknowledged need for "Trustworthy Computing" (a marketing term), it's difficult to take their word. Unfortunately, with that money, they have enough marketing power to buy research, and flood biz execs with enough propaganda...and when they constantly hear that kind of information from what they'd consider mainstream sources, they start to believe it as fact.
Now that's dangerous.
Proof Linux is more secure (Score:2, Funny)
some merit in the study (Score:4, Insightful)
But if linux were on every desktop, I'll bet you'd be getting a few emails every day with attachments like "your_paper.sh" that most of us would trivially delete, but many would stupidly run (and these are the same users who would login as root to check their email).
It wouldn't be fair to use instances like this (albeit they're not common yet) to show that linux is more vulnerable than windows.
Therefore, I believe that by quantifying the vulnerabilities and response time, Forrester is on the right track, they just need to take into consideration this response, and find a better method of quantifying the data.
Re:some merit in the study (Score:4, Interesting)
I see what your saying, but the way package management is going, pretty soon Linux setups will just download security updates on their own, meaning that findning a binary to exploit will get really difficult. In the Windows world, if you find a buffer overrun, you can often assume that 95% of the Windows machines out there will also have the same exploit. In Linux, this wouldn't be the case even with many more users, as package management really takes care of things automatically.
Therefore, I believe that by quantifying the vulnerabilities and response time, Forrester is on the right track, they just need to take into consideration this response, and find a better method of quantifying the data.
I agree.
Re:some merit in the study (Score:2)
Do you need to? I wouldn't give a flying SCO if my
Re:some merit in the study (Score:2)
This is different from the
Re:some merit in the study (Score:2)
I agree, but you missed my point. Microsoft has a mechanism for patching Windows, but not all those third party applications. I'm not sure if it can even patch software like Word. In the Linux world, all of your software gets to you through your OS supplier, which is a big differenc.
Re:some merit in the study (Score:3, Interesting)
The Open Source model definitely is an advantage as far as security goes. Having the code around can speed up bug detection and consequently, speed up fixes. There's also the fact that a programmer's name is at stake -- if you take pride in your work, you
ease of use vs. security (Score:3, Insightful)
I changed the security level to "normal" because I just got freaked out by how strange it was; I only wanted to see if I could get the box running at all, and the heightened security level was making
p.s. -- replying to my own post (Score:2)
So the fact that it takes a certai
Re:some merit in the study (Score:2)
In any case, no study on OS security should care too much about vulnerabili
Re:some merit in the study (Score:3, Funny)
Damn. Got another attachment-- "your_paper.sh". The "sh" must stand for "super-helpful." Cool.
Let's see if I can read it. Do I want to view it, or save it? Uhm... view it.
Gibberish. Starts with "#!/bin/bash". Should have known. Dam
Mark Twain echoed Benjamin Disraeli (Score:3, Interesting)
Local Vulnerbilities (Score:5, Insightful)
3 or 4 games, unsafe handling of common scoreboard files producing exploits.
WHAT THE HELL? That's Unix security for you... even GAMES that have vulns get attention. Windows only gets remotely exploitable vuln attention.
Consider how many windows programs use shared registry keys, consider how many read/write to common temp folders, or common locations on disk. Have any of the probably hundreds of overflows involved in reading a temp file from C:\Winnt\Temp been taken into consideration with WIndows? Heck no, nobody even cares. Windows too many remote vulns to even pay attention to stuff like that.
Consider gzip's unsafe handling of temporary files. I wonder how many Winzip/Windows Compressed Folders have? NOBODY HAS EVEN LOOKED.
Article Summary (Score:3, Funny)
These reports are useless (Score:5, Insightful)
Funny, the report was ALL about WRONG. Nothing was close to reality. How did they get it SO WRONG?
In another situation, I was directed by Management to ask one of these big research firms about embedded database products. At the time they didn't have any expertise in that area. However, they found a kid internal to the company that was willing to learn so they could write a report. It seemed silly and convoluted. Here's a guy without the necessary understanding or expertise, and in a few weeks he's going to learn and gather enough information to write a report? A Report that other people will use to make decisions? Crazy!
In the end, I concluded that these reports are useless "on the ground". They're only useful for those who wish to pretend that they've done adequate research.
So my short answer is: These research firms exist to just cover butts and promote positions. Any IT management personnel that subscribe to their services should be FIRED. It's negligent to cite their reports; it's negligent to use them as a resource. If you need expertise, hire a consultant with REAL expertise, not a generic and biased report. If you want a biased report, the sales guys will come to you for free.
No matter who says what (Score:5, Interesting)
I don't have to spend all my time in a panic worried about patches and viruses and other such nonsense. Neither do my friends and family, I converted them to Linux too. Now I don't have to worry about them either.
What does Windows offer me that I can't do with Linux? Nothing. Why should I use Windows which is constant trouble and extremely high maintenence and is a constant cash drain, versus the ONE TIME PURCHASE (if I choose to purchase v. free download) of a Linux distro, in my case Suse, that is mine, with no strings attached and will cost me no further money, ever?
Once I own the $89 Suse distro I never have to spend another penny on it or any other software, ever. It works. It's secure. Anyone that says it isn't is a stupid SOB or a liar or both.
Actual Conversation (Score:3, Funny)
"Does it randomly reboot?"
"Sometimes."
"You have automatic reboot on. It's like a Blue Screen of Death, but without the pretty colors."
Actually (Score:2)
Re:Actually (Score:2)
It's not a horrible report (Score:3, Interesting)
Perhaps of more concern to administrators should be the nondisclosed vulnerabilities found by researchers such as eEye that are not patched. I can't find the link now, but eEye alone has dozens of vulnerabilities they've let MS know about, but haven't been patched for sometimes hundreds of days. eEye is just being courteous by non disclosing the bugs until MS fixes them. By using the disclosure time as a 'start time', Forrester is ignoring lead time developers get. It's my experience following Bugtraq and Full Disclosure mailing lists as well as many OSS projects that most major OSS developers respond quicker to their lead time before disclosure.
Forrester is completely ignoring vulnerabilities that are not public knowledge, which is misrepresenting the problem.
Exponential Security (Score:4, Insightful)
Although I've herd MS say that the reason Linux hasn't had as many big security problems is because they aren't used as much, I think the truth will turn out to be just the opposite. Not to mention that a hacker who finds a security flaw in Linux is more tempted to get fame by reporting it, and that fame becomes more prestigious as Linus grows, but a hacker who finds a security flaw in windows will be more tempted to gain fame by exploiting it.
Their opinion is meaningless (Score:2)
One of the biggest strenghts in linux is it's flexibility. Windoze lacks the flexibility required to create a diverse environment.
I hereby declare that Windows security is not as good as Linux.
In our shop windows is really safe (Score:2)
will make a good 'letter to the editor' (Score:3, Interesting)
Say an article about security is published in a magazine. The article takes a really good critical look at Linux vs. Windows and genuinely points out a few areas of improvement. Well, that just prompts the open source community to rev up their engines and (should they agree with the evaluation) they'll just go out and fix it! In fact, there's a pretty good chance that the fix is available in a development version in time to send a letter to the editor for the next month's issue.
Now compare that to Windows. Microsoft would spend two, maybe three times that long debating with the media about whether or not it's a problem or a 'feature', and then whether or not it will be fixed immediately or we have to wait until 2031 for Looooooonghorn to be released. Then they'll just sit on it for a while to see if people really care about it being fixed, and how much. They might also, at this point, have their lawyers spend three weeks writing the licensing agreement for the patch, should it be created. Then they put the whole thing on hold and wait until somebody exploits the problem. Then, only if everything else has gone completely in their favor and the problem has been exploited and the existance of the problem has reached at least two major media outlets, they might work on a patch and distribute it....
Then Microsoft will brag about how quickly they've updated their software in response to the problem...
Well duh. (Score:2)
Thats probably why they went from having all but two floors of the building they were in in Cambridge to only two floors and part of a third.
Don't forget (Score:2)
Dr. Forester also has a plane.
Re:Don't forget (Score:2)
My Take.. (Score:3, Interesting)
Anyways, my question is about the severity of the vulnerabilities. When you get right down to it, Microsoft generally only offers one web server, one mail server, one database server, etc..etc..etc.. A standard distribution OTOH includes a huge array of software. For example, I can choose sendmail, postfix, qmail, exim and others for my mail server; apache, aolserver, boa, dhttpd, zope, etc for my web server; php, ruby, python, perl, cgi, etc for my scripting needs; mysql, postgresql, berkley db, firebird, etc for a database; gnome, kde, xfce, etc for a window manager
you get the point.
In addition to the multitude of different configurations that I could have for a particular system, I can also, if desired, cut out everything that is not essential to maintain as barebones of a system as possible (heck this even includes lots of kernel modules/features).. I can run everything through a localized firewall, block ports, limit IP ranges for various services, chroot/jail certain services, etc..etc..etc..
So I guess my question is:
1. Does this report simply gather up all published security issues and compare? Or do they look at "best practices" on both platforms and only compare packages that, for example, would be installed on a web server, mail server, database server, standard desktop, etc?
2. What is the true damage that could be done by successfully exploiting these issues? Ie, I'm sure most BIND installations are in a chroot/jail
Sure, raw data might indicate that a Red Hat distro has the same number of exploits as a Windows system, but I am much more interested in the applicability of those exploits to my systems and ultimately the increased chance of exploit.
My Real World Experience Disagrees With Forrester (Score:4, Insightful)
Much of my daily spam now comes from compromised Windows boxes being run as spam zombies.
My personal data was stolen from a company I trusted because their server was running IIS and it was infected with Slammer.
I suffer because of Windows insecurity almost constantly, yet no operating system *except* Windows has ever caused me any such grief. Clearly the Forrester "data" is FUD. Plain and simple.
Re:Slant (Score:5, Insightful)
Excuse me (Score:3, Funny)
Re:Slant (Score:3, Insightful)
Besides. It's the community take on events that I'm interested in. I can check out the wire services if I just want the news.
Re:Slant (Score:2, Insightful)
I did notice though that that is about the first full length article LX has themselves published (instead of pointing to other Linux sites) so kudos to them:)
Re:Slant (Score:5, Funny)
Re:Slant (Score:2)
Besides, uh... on what planet is Slashdot impartial? Duh.
Re:Forrester's right, you know (Score:3, Insightful)
If anything, I'd say that validates Linux's usefullness.
Now I only wish someone could tell me what this has to do with the number of bugs...
Re:Forrester's right, you know (Score:2, Insightful)
How is a windows machine different if windows is the server? The system goes down and you loose all data. You can run RAID in linux just like you can with a Win server. You can do tap
Re:Forrester's right, you know (Score:2)
Given that Windows very real security problems have gotten widespread media coverage over the past year or two, now even the corporate suits are aware of them. Windows m
Re:Forrester's right, you know (Score:2)
Of course, that had nothing to do with the report. The report never focuses on the amount or value of the data, only on how the systems security is.
But the response is quite a bit more correct. By treating everything the same, you miss the big pix and allocate resources to minor issues.
Most admins use a triage system in deciding how to admin a set of systems. You focus on the critical ones first then move to none-critical. That is the same way that patches should be looked at. Give more weight to critica
Re:As opposed to LinuxWorld or NewsForge Reports (Score:3, Funny)
Re:My responce (Score:2)
Viruses and Trojans
48091 DOS/Windows
404 Unix/Linux
and 48211 other destructive programs.
This count changes every few days on the Win side and not in a month for Unix/Linux.
Which one is more vulnerable? You decide.