Free Republic
Browse · Search
News/Activism
Topics · Post Article

Skip to comments.

Linux, Open Source have 'more security problems than Windows'
The Register, NewsForge ^ | 11.15.2002 | Robin Miller

Posted on 11/15/2002 8:18:56 AM PST by AdA$tra

According to a report published November 12 by Aberdeen Group^, "Security advisories for open source and Linux software accounted for 16 out of the 29 security advisories - about one of every two advisories - published for the first 10 months of 2002 by Cert (www.cert.org^, Computer Emergency Response Team)."

Aberdeen says Microsoft products have had no new virus or trojan horse advisories in the first 10 months of 2002, while Unix, Linux, and Open Source software went from one in 2001 to two in the first 10 months of 2002, that in the same 2002 time period "networking equipment" (operating system unspecified) had six advisories, and Mac OSX had four.

In other words, all except Microsoft had increases in reported vulnerabilities this year.

"Contrary to popular misperception," the report says, "Microsoft does not have the worst track record when it comes to security vulnerabilities. Also contrary to popular wisdom, Unix- and Linux-based systems are just as vulnerable to viruses, Trojan horses, and worms. Furthermore, Apple's products are now just as vulnerable, now that it is fielding an operating system with embedded Internet protocols and Unix utilities. Lastly, the incorporation of open source software in routers, Web server software, firewalls, databases, Internet chat software, and security software is turning most Internet-aware computing devices and applications into possible infectious carriers."

The report lauds Microsoft for having overhauled its development process in an attempt to fix security problems, and says, "Perhaps it is time for some of the suppliers of open source and Linux software to take similar measures."

(You'll need to register with Aberdeen to read the rest of the report -- it's one of their free ones -- but I believe I've covered the Linux-relevant high points here.)

And yet, here I sit with my virus-free, trojan-free Linux box, receiving tons of viruses and trojans from Windows users (that don't affect me), watching news item after news item about sites run on Windows servers getting defaced and broken into.

According to what I've heard from my many sysadmin and network security specialist friends, no OS or network-connected software is secure unless it's administered properly and security patches are applied as soon as they are available.

And then, after I started writing this story, a ZDNet article with the headline Linux utility site hacked, infected^ came across my monitor, and I started wondering, "What if these Aberdeen people are right? What if this isn't just Microsoft-sponsored nonsense?"

A look at CERT's 2002 Advisories^ and Incident Notes^ pages was not overly reassuring. Yes, I saw some Microsoft vulnerabilities there that Aberdeen apparently missed, and one for Oracle.

I also think we have enough Microsoft viruses left over from last year that we don't need any new ones this year.

But the real issue is that we all need to be more security-conscious. The Aberdeen report points out that the system with the most reported vulnerabilities can change from year to year, but that the overall vulnerability and incident trend is up. Way up. In other words, whatever operating systems we use, we all need to watch out more for security flaws than we have in the past, and work harder to protect ourselves from them.


TOPICS: Business/Economy; Extended News; Technical
KEYWORDS: computersecurityin; hacking; linux; opensource; security; unix; windows
Navigation: use the links below to view more comments.
first 1-2021-4041-6061-8081-86 next last
Friday tech junkie post for fun and interesting conversation hopefully. I was apalled that anyone would think Linux, Unix and Apple OS's could be flawed in any way. Maybe shocked and perhaps a little saddened would be a more apt description of how I felt.
1 posted on 11/15/2002 8:18:56 AM PST by AdA$tra
[ Post Reply | Private Reply | View Replies]

To: rdb3; Knitebane
Ima hollerin'
2 posted on 11/15/2002 8:20:04 AM PST by AdA$tra
[ Post Reply | Private Reply | To 1 | View Replies]

To: AdA$tra
What you bet Micro$oft paid for the study to be done, and for the results that they wanted?
3 posted on 11/15/2002 8:20:38 AM PST by mhking
[ Post Reply | Private Reply | To 1 | View Replies]

To: mhking
LOL. Tin foil hat deployed!
4 posted on 11/15/2002 8:23:30 AM PST by AdA$tra
[ Post Reply | Private Reply | To 3 | View Replies]

To: Bush2000
Ping!
5 posted on 11/15/2002 8:23:46 AM PST by TomServo
[ Post Reply | Private Reply | To 1 | View Replies]

To: AdA$tra
I'll pass. Thanx for the ping, though.

No mercy.
Coming soon: Tha SYNDICATE.
101 things that the Mozilla browser can do that Internet Explorer cannot.

6 posted on 11/15/2002 8:25:36 AM PST by rdb3
[ Post Reply | Private Reply | To 2 | View Replies]

To: AdA$tra
OpenBSD - www.openbsd.org. One security hole in the default install - in the last six years.
7 posted on 11/15/2002 8:45:00 AM PST by ikka
[ Post Reply | Private Reply | To 1 | View Replies]

To: AdA$tra
Microsoft had no NEW advisories in the period selected while Linux had two. But how many existing unresolved MS advisories from before that period are still out there? And what's the average resolution time for open-source issues vs. MS issues?

When a story highlights one bad data point like this, without context, it sounds like a Democrat attack ad. "Congressman Joe Linux never once denied his barnyard dalliances. Not once. Call Joe Linux and ask him why he won't tell the truth about romance with barnyard animals?"
8 posted on 11/15/2002 8:48:32 AM PST by Norman Conquest
[ Post Reply | Private Reply | To 1 | View Replies]

To: AdA$tra
No new advisories in the first 10 months? I must of been dreaming when I go to windowsupdate every month and see new updates for some security problem.
Does the open source include Sendmail and BIND bugs? IMHO, those should be thrown out of the count as they are the buggiest pieces of junk on a linux system. Well that and WU-FTP.
9 posted on 11/15/2002 8:57:09 AM PST by lelio
[ Post Reply | Private Reply | To 1 | View Replies]

To: ikka
One security hole in the default install - in the last six years.

The hole has been there for six years! Can't we get the granola-eating, sandal-wearing, free-software-writing hippies to fix that? :o)

10 posted on 11/15/2002 8:59:18 AM PST by Grit
[ Post Reply | Private Reply | To 7 | View Replies]

To: AdA$tra
There are different sets of definitions being used here. Included under Linux flaws are all flaws found in all applications used with Linux. To get a more accurate comparison, all applications used with Microsoft systems should be included as Microsoft flaws. Unfortunately, there is no mechanism for effectively collecting data on such "Microsoft" flaws.
11 posted on 11/15/2002 9:08:01 AM PST by per loin
[ Post Reply | Private Reply | To 1 | View Replies]

To: Grit
http://www.openssh.com/txt/preauth.adv
12 posted on 11/15/2002 9:08:59 AM PST by toenail
[ Post Reply | Private Reply | To 10 | View Replies]

To: Norman Conquest
Congressman Ed Windows has been spreading LIES about Joe Linux. But why shouldn't he? Since Ed Windows EATS BABIES for breakfast every day, he certainly won't have a problem with lying about his opponent. Remember, Joe Linux LOVES babies, he doesn't EAT them. Call Ed Windows and ask him when he is going to stop eating babies.
13 posted on 11/15/2002 9:13:28 AM PST by Billy_bob_bob
[ Post Reply | Private Reply | To 8 | View Replies]

To: AdA$tra
Linux sucks. Always has, probably always will. Like it or not Windows 2000 Professional is all-around the hands down best operating system in existance.
14 posted on 11/15/2002 9:16:24 AM PST by That Subliminal Kid
[ Post Reply | Private Reply | To 1 | View Replies]

To: That Subliminal Kid
Linux sucks. Always has, probably always will.

That strange, half my systems run Linux and half run Windows, and it's the Windows systems that suck for me.

I guess it all depends on the meaning of the word "suck".

15 posted on 11/15/2002 9:22:25 AM PST by The Duke
[ Post Reply | Private Reply | To 14 | View Replies]

To: per loin; All

Microsoft calls 'foul' on OS vulnerability data

Microsoft Corp. is responding to a report published last week by London-based security intelligence firm mi2g Ltd. that claimed the Apple Macintosh (news - web sites) operating system and certain varieties of Unix (news - web sites) are less vulnerable to attack than the popular Windows and Linux (news - web sites) operating systems.

The report, a summary of which was released to the public by mi2g, attributed 44 percent of the software vulnerabilities announced in the first 10 months of 2002 to Microsoft's Windows operating system and 19 percent to the open source Linux OS.

By comparison, the company attributed only 1.9 percent to Apple Computer Inc.'s Macintosh OS.

This above posted article claims *no* MS issues this year!? What an amazing lie. Tell me this media spin isn't being swallowed whole by FReepers? Is FReeRepublic becoming an MS propaganda site, now?

This kind of thing does for MS what the Wellstone funeral did for the D party. When MS falsifies a benchmark, or pays for a false report, developers notice. We do not forget.

16 posted on 11/15/2002 9:32:05 AM PST by Dominic Harr
[ Post Reply | Private Reply | To 11 | View Replies]

To: per loin
They way I have always looked at is that if you were on a rifle range and you put targets up labeled Linux, Open BSD and Windows. Then you give all the hackers rifles and tell them only to only shoot at the Windows target. Then act amazed at the fact that only Windows has holes in it. Retask the hackers to shoot at ANY other target and it is amazing how the holes would start appearing.
17 posted on 11/15/2002 9:36:52 AM PST by AdA$tra
[ Post Reply | Private Reply | To 11 | View Replies]

To: That Subliminal Kid
Linux sucks. Always has, probably always will.

Yes, but a good operating system would swallow.
18 posted on 11/15/2002 9:39:50 AM PST by AdA$tra
[ Post Reply | Private Reply | To 14 | View Replies]

To: That Subliminal Kid
Like it or not Windows 2000 Professional is all-around the hands down best operating system in existance.

You wouldn't happen to know where large chunks of W2K, like the TCP/IP stack, came from, now would you?

19 posted on 11/15/2002 9:40:20 AM PST by ikka
[ Post Reply | Private Reply | To 14 | View Replies]

To: *Computer Security In
http://www.freerepublic.com/perl/bump-list
20 posted on 11/15/2002 9:43:00 AM PST by Free the USA
[ Post Reply | Private Reply | To 19 | View Replies]


Navigation: use the links below to view more comments.
first 1-2021-4041-6061-8081-86 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
News/Activism
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson