It is very interesting to take in to account that 99 percent of the vulnerabilities in Red Hat were found in third-party components. That means that only 6.33 vulnerabilities were found in the OS itself. While 96% of the bugs in Vista were in the OS itself. The arguement to compare based on functionality and shipped software is an important one. If the comparision was done with ONLY OS code the results would not be in Vista's favor.

I also agree that judging the security of a system only by the number of bugs found/fixed leaves a lot to be desired in the conclusion. To many variables get left out that would have an impact on the conclusion.

ritter955

With Vista, my new laptop was worse... and WAY worse than my previous 3yr-old lappie.

It's probably more secure because even virii will crash on it.

Bokusatsu_Tenshi

No, actually, I wouldn't be. If Microsoft started showing that they were much more committed to getting exploitable vulnerabilities fixed as quickly as possible -- and if they were more transparent about the ones they find -- then I'd applaud them I have no real beef with MS, I just don't like marketing spins like this. I use, on a daily basis, OSX, Linux, BSD, and XP for various things.. each has it's place.

-olly

ollywompus

bgbs

Going by this logic - Windows Vista is most secure, because it is least used.
After all that effort and investment behind Vista - is this really something to cheer about? :)

akshayxyz

techne1

lafond66

quagmire0

NightElfMohawk

ntux

This is just another sales move, aimed at the simple user.

Stop the windows is better, macs are better, linux is better crap. It's really boring....

Lman

imTheKing

If you don't move the dinosaur won't eat you.

ianken

nutbastard

"Vista haven't SOLD 100 million copies, Vista has been bundled with 100 million new computers maybe, there was no choice for the ppl buying the computers so there was no sale realy."

As far as I know, when the OS comes bundled with the computer, it is yours to keep even if you don't want to use it, and use something else.
As far as Microsoft and their books, it's sold buddy!... they got paid by the OEM manufacturer.

The upshot is that AT LEAST you get to pick your OS on PC's or no OS at all.

What choice do Apple users have?
Can you buy a new Mac WITHOUT the OS?

Seems to me Apple users still have no choice even if they consider their OS bastly superior.

LOL with your comment.

Still, regardless, 100 Vista platforms were sold.
I would like to see the "REAL" figures of those that downgraded back to XP... I bet they are a handfull.

And don't come back saying corporations chose XP last year...blah, blah, blah... I worked at a very large corporation and they were 5 years behing in OS implementation. That's provably an indutry average.

I got a new workstation last November with Vista. Period. Against all arguments of the IT support and management.
ZERO problems.

aec007

lucky_you

7.10 gutsy gibbon is where it's at.

Rob C

but with *nix, it's pounded into your head constantly, NEVER RUN AS ROOT and never sudo something that you don't know what it is.

*nix is more secure for yet another reason: The people who use *nix effectively aren't dubya-level in their cognitive skills. In all likelyhood, anyone whos used linux for a reasonable amount of time has f'd up their OS multiple times by using ROOT flippantly, and has had their fingers burned in a way they understand.

If you execute " sudo rm -f -r * " trust me, there will be no doubt in your mind what exactly screwed things up.

With windows, it gets royally fucked but no one knows what they did to do it. It just starts manifesting itself over time. ("What did you do?" "Nothing, I just turned it on and it's all messed up" - heard this a thousand times.) It gets slower but doesn't tell you theres a problem. theres some cryptic ffg32.exe nonsense processes that weren't there 2 weeks ago, and even using a multitude of reg tools, you cant get the bitch to stop running at startup. Install and remove a bunch of software on a daily basis in windows and you WILL end up with a serious problem.

i've installed / uninstalled multiple dozens of ubuntu apps just back and forth in a single continuous session without rebooting, without conflicts, and without performance degradation.

Just try it on windows. Do a fresh install, and just start putting LEGITIMATE 3rd party software on it, say, adobe stuff or SUN stuff or apple suff, hell even microsoft stuff, uninstall some, reinstall, add some more, just keep doing that. You'll be rebooting for days. Anyways, do that, then go back and uninstall everything you put on after the OS install. Now check and see how much drive space has disappeared, how much longer boot time is, what weird processes are STILL RUNNING. thats the big reason why windows sucks the big one (and im eyeing you suspiciously, OS X!)

nutbastard

system22

UAC doesn't pop up for trivial things. It only occurs when a process needs to launch as an Administrator. If you can't do something as a "User", you can't do it without a UAC prompt. That's how *nix works, too.

Actually, what I said is slightly untrue. Vista has fileystem and registry virtualization tricks it can do to prevent apps that need to on occasion write to \Program Files\ from requiring Admin privileges.

Mio

I also find this fellows arguments a bit misleading. Why doesn't he look at the number of patches since the software was released? If he did that then XP would probably look pretty frightening in comparison to any other system of the same age.

blaerk

except that malicious programs will of COURSE prompt for root and after 1,000 "OK"s to the UAC, most people will just hand it over.

nutbastard

Pope John Peeps II

As to my scenario. Look up basic probability. The number of times something happens does not affect it's odds. if it's 50/50, it'll be 50/50 no matter how often it happens.

Pope John Peeps II

Aberracus

sonburn

fusion324

JJ910

please dont mess with the info mr MS executive.

Also Vista IS ITSELF a non desired software or malaware so it really is not an OS, (just kidding)

Aberracus

Mio

Furthermore, as someone pointed out, Windows is always run in superuser mode, which means that successful exploits are much more damaging, harder to detect and harder to get rid of. Windows keeps your hands tied so tightly that while you by default allow programs full root access to your system, you as the superuser, personally, have less control over your filesystem than the programs you download do!

nutbastard

Mio

Experience with Windows has led me to believe that Vista must be rock solid and secure because no one has been able to get it running or been able to connect it to the internet, yet.

Remember that a pig wearing lipstick is still a pig.

blaerk

Is there anything in this analysis which will prove one piece of software is "more secure" than another? No, that is not my intention.

He then continues on to say:

My own context for vulnerability analysis is to measure against the goal of reducing customer risk. To me, all other things being equal, fewer vulnerabilities make it easier to manage risk. All other things being equal, fewer patches mean more time to spend on other security projects to reduce risk.

This might help you argument that Vista is more secure because it looks secure (rather than because it actually is, which is not), which is the same to say that Tobacco is less likely to produce cancer if there are less warnings on its package...

whiskey

Mio

winkydink

nutbastard

system22

It's also been pointed out that the picture might be less rosy for Vista if you graded the exploits by severity.

Additionally, the way they have collected their data requires that your operating system be at least a year old. Assuming that security had improved in all operating systems, this would tend to make the youngest eligible OS (Vista) stand out as better than it actually is. Going further, they picked a RHEL version that will be three years old in February, and a Ubuntu release that is nearly two years old, in spite of a younger eligible one (Edgy Eft, from October 2006) being available. We'd have to wait until later in the year to have comparable Leopard figures, but I'm sure someone will find that data now and extrapolate for comparison.

To be really thorough though, you'd have to measure the number of bugs relative to *what you can do with the machine*. We all know that OpenBSD is the most secure operating system, but it's very locked down, not so usable. I'd say Vista is somewhat more usable than OpenBSD, yet it's a whole lot more vulnerable as well. On the other hand, Mac OS X Tiger is more usable than Vista, and just as secure (remember to look at the yellow bit).

So I don't see how Vista wins here.

philippw

MastaFalse

whiskey

The more patches that were issued, the more fixes that were done, the MORE secure something is. No OS is ever statically secure, there are always vulnerabilities being found in every OS... that's a fact of programming life.

So by saying "we patched less and found less than the other guy" doesn't make you more secure... quite to the contrary, it means the other guy is working HARDER to find and patch vulnerabilities then you are! The results they are showing highlight quite the opposite then what they are claiming... by those results, Vista is the LEAST secure.

Look at this: the most secure OS on the 'net is widely considered to be OpenBSD... I'm willing to bet that they had more patches and vulnerability fixes than ANYONE: the whole reason they are the most secure is because they are constantly fanatical about fixing everything, so they are looking harder, therefore have more patches and updates.

This guy is a marketing-spin douchebag to the Nth degree. Just because you close your eyes to the traffic hazards you are driving through doesn't make you a safer driver.

-olly

ollywompus

CarbonatedWater

If the app is popular and open source, there simply isn't a way to "hide" malicious code in it. Theres too many *nix geeks who get their rocks off by ALWAYS compiling from source, and many of them will routinely go through and review the code before doing so.

If it's in the official Ubuntu repositories you can bet your ass it's been combed through.

The other big reason linux is more secure is many black hats LOVE open source principles, and they only have beef with the MS and apple closed-source paradigm.

The rest dont give a shit and are really after your CC # and other info, or are just misanthropic in general and enjoy unleashing chaos - but those people will always go after the most widely used OS, and it just so happens that because the most widely used OS is closed, people are used to throwing all manner of code onto their computers without any sort of oversight, both in the OS and in the DL'd program.

nutbastard

TheSonOfKrypton

smeee

aec007

Obviously XP has several times as many users than Vista.

Mio

...is what I meant to say :)

skinned

Also as someone rightly pointed out, the Vista's vulnerability:fix is attrocious.

As for the 1000 burglars comment - flawed; if you have one burglar, you have a a small chance that a superbly skilled burglar is trying to get in. A single successful burglar is less likely to kill you in a botched robbery than 500/1000.

Lastly, they can try every entry point at the same time. They won't all line up and try the same door in succession.

skinned

All security patches aren't the same, and there are good measures of the severity that aren't included here.

Microsoft benefits from not counting vulnerabilites in key apps that Linux and MacOS distribute. If Apple or Ubuntu releases a patch to fix a vuln in PHP, should it count? In the consumer space, few Mac users will turn Apache on in OS X. PHP can be loaded on Windows, but any vulnurabilites are the user's lookout. Windows Server 2003 R2 should have been listed.

So, if we can see a comparison by criticality of similarly functional OSes, then it's apples to apples...

MCroft

BoinK

mfak33

Vista has a significantly smaller market share than xp.

boe

Joseph

Floobtronics

jimjeobobfred

How come that logic was permitted for Apples, but not for Windows?

This is, of course, assuming that no one uses Vista. I know more people who use Vista than OSX.4 or any Apple OS, but most people I know still do use XP.

mangasm

Joseph

Mio

It WILL be the dominant operating system in the world in the near future, so the whole no one uses it argument absolutely does not apply.

And if you think that UAC was the only improvement to Vista's security, than you're horribly wrong. Turning off UAC is probably the single most idiotic thing you can do for a Vista install, yes. But it's not the only change to security. The brand new network stack, ASLR, etc. are all big new features too.

Mio

Im going back to DOS.

SomeoneUKno

Microsoft has also been shown to only report vulnerabilities that have already been made public by others. They quietly patch (and not count) other vulnerabilities. The higher numbers for Linux vs the two proprietary OS's there are more indicative of full disclosure rather than more holes.

Finally, what is the mean time between a vulnerability being discovered and patched for each OS? That is what I *really* need to know to evaluate security. Microsoft is marketing these numbers to imply few vulnerabilities but what I see are large periods of time where the vulnerabilities are left open for exploitation.

It boils down to which provider can you trust to code well and be honest about the quality of their security?

Oh... didn't Microsoft just higher a linux guy to run their security division for Vista? If linux is so bad, that's an awfully strange choice.

shawn_dude

Gimmeslack12

Vista might be more secure as well since it takes so long to do anything, it might take days for a virus to actually run.

boe

All I can say is that I think you missed my point. My point was that adding an extra layer of HW security has been just as good as loading my PC down with every imaginable resident security application recommended to Windows users, and cheaper in the long run.

I guess I explained it kind of ham handed? Sorry for that, but I can only go with what I have experienced, and in that capacity. A router has served me far better then resident applications that eat up ram and CPU cycles. Admittedly since my PC is primarily a gaming unit I want it devoid of resident apps.

axiomatic

its because nobody uses it!

kadtech

Aneurism

brian

Number1gun

1. Yes, you really can cut numbers any way you like to prove any point.

2. Admittedly, I have read on many fronts that Vista has many less security problems than any other modern commercial OS. And yes, it is at least partially due to the fact that no one uses Vista.

3. I should knock on wood when I say this, but credit has to be given to all of the operating systems. It has been quite a while since the love-letter type wide-scale virus attacks.

All of which is to say -- interesting reading, but ultimately, who cares?

Monty

tchangtx

englishman

englishman

It's just as easy to write a virus that assumes user-level priveleges on OSX as it is on Windows. The problem is that it's rarely done because a user-level virus is generally orders of magnitude easier to get rid of, and limitted in what it can do. Thanks be to Vista's notion of process Integrity Levels, however, executing code doesn't start with Admin priveleges unless it explicity requests it from the user, which is a good thing for security.

Mio

axio just got pwnt!

stinkyboy

Mio

I think you comment was really stupid, honestly.
So Vista Ultimate is $319 (I bought the OEM @ $250 over a year ago)..OK.

Vista will not protect your system as good as $169 router.
What good is a router if you don't have computer with an OS to use it???

A good Firewall/virus software is $60~$70....

What good is the software if you don't have an OS to run it under????

The $319 analogy is stupid, plain and simple. You are getting an OS!... with basic protection.
You need to get protection somewhere else.

BTW, if MS was to completely close the loop and install antivirus software, etc in Windows for free... everyone in the industry would cry foul and sue them.

Symantec, AVG, McAfee, Neo32, etc... would be obsolete companies. Why would you buy their products when the OS could include them free?

Then MS would be the bad guy, a-g-a-i-n, wouldn't it?

aec007

it adds a lot to the creditability that the report is written by microsoft
reminds me of an arabic proverb;
"no one says their water is murky"
except when bill gates said that vista sucks (:

bishara

pek

theespacepope

If you're a retard.

t3knomanser

Yes, MS fixed less security flaws than OS X or most Linux distros. However, that says nothing about the actual risk posed to the system. MS fixes primarily exploited flaws, not all security flaws it finds. Linux and OS X typically fix all or nearly all detected security-related flaws. Also, there's a big difference between a security flaw that may let a local program read memory of another local program with the same access rights, versus a security flaw that lets a remote user (think Internet) control your computer or install malware. To MS, those flaws are apparently the same severity.

geowrian

Hyruu

image18301

Hyruu

applesgoinpies

MrMaestr0

Pope John Peeps II

Triborough

except for the viruses its already had i assume you mean lol vulnerabilities and the real world are two completely different things.

speakerwizard

Vista Ultimate Retail = $319.99 & protects only 1 PC.
High Quality Home Router (D-Link DGL-4500 Xtreme N Gaming Router - Retail) = $169.99 & it protects every PC in the house.

Now I'm not saying a router protects you against spyware or virus, you are on your own there. But a home router usually has a better built in Firewall than any software can provide.

I use a router + manual scans of spyware and virus software. I don't have to load a bunch of "resident" system tray applications that slow your machine down. I have yet to have a spyware or virus problem working this way, and my PC is thankfully devoid of resident apps. Vista is slow enough already without a bunch of useless apps clogging up its RAM.

axiomatic

Don't let the trendiness of Windows-bashing keep you from considering that his statement, qualified as it was, could very well be right.

Sqube

What a moronic comment, of course he says Windows is the best, that's what he's paid to do.

werk

Pope John Peeps II

TheCyberBob

And that's why MICROSOFT is still MICROSOFT.

xint

imTheKing

imTheKing

homerjay

spaceman37

This first thing actually doesn't logically have anything to do with how "secure" a program is. If a thousand burglars are trying to get into your house instead of just one, each still has the same basic chance of getting in. It's simply that there are more rolls of the dice. But this is not something Microsoft can control, so making this part of your security argument is kind of dumb.

2) or just how damaging each exploit can be

This is a sensible argument.

Pope John Peeps II

uberfu

Brookespeed

baltwade

seriously it makes one hell of a difference.

Aaaannd, even though the sales figures are fudged (what goes out is not always whats installed) i bet theres more installs of vista floating around than OSX.

I'd like to know what year 1 means though.. is it comparing the first year each os was released? they cant be seriously talking about this year?

speakafreaka

But the "pretty" chart above is interestingly labeled "Year 1" for the software titles_ So does this mean that Vista in 2006 was more secure than Ubuntu in 2004 and Red hat in 1994 and OS X Tiger in 2005 ?

That seems a likely conclusion based on his own logic_

uberfu

And it has to be mentioned here that Linux developers tend to patch what are almost always non-issues. Considering how easy and painless patching every single app in a, say, Ubuntu install, they can patch much more regularly. There's also the fact that a typical Ubuntu installation has much, much more bundled with it to patch than Windows Vista.

When there is a patch for Windows, it's because it's either a freakin' gaping hole in their security or because they amassed a huge amount of smaller holes.

Guizzy

thepeopleselbow

I really think you cannot compare the security of Vista with the User Account Control on. No one in their right mind uses Vista with UAC on.

Lizard_King

Of course, from what our tiny brains make of the case, such an argument doesn't take into account factors like just how many people are trying to exploit a particular platform/vulnerability

baltwade

yoshi

SchruteBuck

//damn

sgodun

sgodun

sgodun

"Uh, we don't actually have any installations in the field, and therefore we aren't really vulnerable."

Monsterdog

Crazymonkey

...what a non-sense statement from this guy...

xrmb

ossnap