"A Windows Web server is more secure than a similarly set-up Linux server"
Well, since I have a clue what I'm doing, I don't set up my boxen like the ones in the study are set up. Therefore, to me this is irrelevant. My *nix machines have never been compromised, nor have my Windows machines, but I don't have to worry about the *nix machines or run anti-stuff (virii, spyware) on them. In contrast, I run anti-virus scanners on a *nix box to scan the a Windows machine and incoming mail, as it's easier to delete infected files that way, and the *nix machine doesn't get infected anyway. My firewall is pf running on OpenBSD, my servers are FreeBSD as is my workstation, though I run Linux sometimes as a workstation and server, and I keep Windows around for games and because my clients use it (otherwise, I could go without it). Changing to Windows servers, workstation and security tools would be a serious downgrade. Why would I want to do that?
"but I don't have to worry about the *nix machines or run anti-stuff (virii, spyware) on them"
Yada yada yada.
We have had tons of security holes in Linux in the past 12 months alone, but we still keep seeing these boasts about "never had any security problems on my Linux box" from open source fanatics on this board all the time, something which is not backed up by the facts, as in this from your own open source loving slashdot:
"Security Holes Draw Linux Developers' Ire
Posted by timothy on Mon Jan 10, '05 07:01 AM from the quick-draw-me-an-ire dept. jd writes "In what looks to be a split that could potentially undermine efforts to assure people that Linux is secure and stable, the developers of the GRSecurity kit and RSBAC are getting increasingly angry over security holes in Linux and the design of the Linux Security Modules. LWN has published a short article by Brad Spengler, the guy behind GRSecurity and it has stoked up a fierce storm, with claims of critical patches being ignored, good security practices being ignored for political reasons, etc. Regardless of the merits of the case by either side, this needs to be aired and examined before it becomes more of a problem. Especially in light of the recent kernel vulnerability debated on Slashdot."
Time for (even) better security? (Score:5, Insightful) by moz25 (262020) on Monday January 10, @07:05AM (#11308973)
(http://www.backgroundsarchive.com/)
Given that I'm getting lousy uptimes on my Linux servers because of the mandatory kernel upgrades, I certainly welcome a (constructive) critical look at Linux kernel security. "
http://it.slashdot.org/article.pl?sid=05/01/10/035225&from=rss
More Linux security holes:
http://www.eweek.com/article2/0,1759,1612368,00.asp
http://www.eweek.com/article2/0,1759,1530811,00.asp
Doesn't exactly gel with your claims of rock solid Linux with just one security problem with Linux does it?