Study finds Windows more secure than Linux

The Seattle Time ^ | 2/17/05 | Brier Dudley

[rit]

SAN FRANCISCO — Believe it or not, a Windows Web server is more secure than a similarly set-up Linux server, according to a study presented yesterday by two Florida researchers.

The researchers, appearing at the RSA Conference of computer-security professionals, discussed the findings in an event, "Security Showdown: Windows vs. Linux." One of them, a Linux fan, runs an open-source server at home; the other is a Microsoft enthusiast. They wanted to cut through the near-religious arguments about which system is better from a security standpoint.

"I actually was wrong. The results are very surprising, and there are going to be some people who are skeptical," said Richard Ford, a computer-science professor at the Florida Institute of Technology who favors Linux.

[dalight]

There is an even better chance that this study is very solid and gives a very good indication of what happens in real life with Windows and Linux servers.

Argg..anyway. I just didn't see any justification for any of the arguments you have made or this conclusion from anything in this article or any "fact" which I still haven't seen one from you.. just opinion.

The only University professor that I know who wrote a major operating system that enjoys any market share today is Linus Torvalds.. mmmm.. I guess if we were going to talk about a group of university professors.. perhaps that would include the folks at UC Berkeley.. duh.. gees.. what operating system did these guys create..

There are some real Sys Admins posting on FR. They have interesting things to say if you listen. Just the same, there are lots or really interesting folks of all stripes around here.

Enjoy this study, folks who make a living dealing with this sort of thing have to look into whether this study is bogus before deciding what it means. There is more than one person here telling you there is a potential problem with this study.

[rit]

The perception of XML interoperability is inconsistent with the real world Microsoft Word format. As Gates is quoted, "Office documents, spreadsheets and forms can be saved in an XML file format that is freely available for anyone to license and use". Similarly, Microsoft protocols are freely available for anyone to license and use. The term "freely" does not imply "free of cost". In addition, with XML binary format now being supported, a vendor can easily lock in their XML documents so that they can be parsed only by their own applications (this is what MS is doing).

You make an argument about XML interoperability and conclude that somehow it is Microsoft that started it all. That is inconsistent with historical facts.

I am not a Microsoft fan, nor do I embrace the GPL. I run a research team focused on service oriented architectures. I hold 9 US patents and have been published (both book and literature).

[usgator]

Open source is still no benefit if it brings increased costs limited capabilities along with it.

Tried to talk the same sense into a company I recently did a project for. All they kept saying was "But, it's free!" They had two Linux cult members who fought me every step of the way and I eventually gave up.

[antiRepublicrat]

When that happens software development shops will no longer be restricted to marketing themselves as experts in one particular development platform but will instead be able to approach potential customers or clients on an open basis, regardless of which development platform they may have

What a new and interesting concept Microsoft came up with there. Now tell me, how old is CORBA?

[Ernest_at_the_Beach]

Was this sponsored research?

[antiRepublicrat]

I'd bet unlicensed MS copies FAR outweigh unbought Linux versions.

I'd agree for desktops, but not for servers.

[dalight]

Apache runs on windows. Its not that very significant in the Windows market but the number of Apache servers is increasing on Windows too. As well as Tomcat/Jetty/JBoss implementations for Windows and MySQL and PostgreSQL for Windows..

[KosmicKitty]

I read the title to my husband 5 minutes ago

I still can't get him off the floor he's laughing so hard.

Linux server here, we don't do Winders!!!!

[Ernest_at_the_Beach]

Slashdot has some History:

Integrity?(Score:4, Informative)
by samtihen (798412) * on Thursday February 17, @12:06PM (#11701190)
(http://www.samtihen.com/) Well, apparently this is the second time Microsoft has come out on top of a research project by Mr. Richard Ford [fit.edu].

http://www.virusbtn.com/magazine/articles/letters/ 2004/01_01.xml [virusbtn.com]

Apparently there was some question to the validity of an earlier project because it was sponsored by Microsoft.

However, I would like to note that both researchers seem very well educated, especially in computer security. And, additionally, they both note that a lot more could be done to lock down the Linux server.

[dalight]

Who keeps the statistics on how many Linux servers are sold? Ooops.. guess that is going to be a hard number to find.

[usgator]

I've used all the products above except Jetty. Never heard of it. I gotta admit mySQL surprised me ... never used it until about 6 months ago (for a small web project) ... not too bad ... SQL Server may have some tuff competition in a few years!

[usgator]

Who keeps the statistics on how many Linux servers are sold? Ooops.. guess that is going to be a hard number to find.

Thanks a lot! Now all I have do do is get the coffee spray off the monitor!

[Ernest_at_the_Beach]

The setups were hypothetical, however. Both were in the most basic configuration, an approach that some in the audience suggested may tilt the results in favor of Windows, which comes with more features.

Ford said the idea was to represent what an average system administrator may do, as opposed to a "wizard" who could take extra steps to provide plenty of security on a Linux setup, for instance.

Microsoft might have done a better initial setup, what server administrator would run a Linux server without doing some setup efforts !!!!!

[antiRepublicrat]

I know that Microsoft is very concerned about the spread of viruses and worms and they are making proposals to restrict their spread, which is what I am guessing -- and it's just a guess -- is involved with the mail protocol issue you raise. You may enlighten me further if you have more details.

Very good guess, you're right. Microsoft's anti-spoofing solution, called "Sender ID" was kicked back by the IETF because of intellectual property issues. As of now, Microsoft refuses to disclose what IP claims it has or patents it intends to file over the solution, and because of the license it couldn't be implemented in most free software, including the server running most of the Web -- Apache. Microsoft wouldn't even agree to disclose everything and accept the standard RAND (Reasonable And Non-Discriminatory) terms.

It other words, it looks like Microsoft wants to own how email is transmitted, and control who can and can't implement the standard.

XML is an open standard in and of itself

And totally useless without a published DTD.

Why shouldn't Microsoft keep that software marketable and not release the APIs for its use?

Fine, but don't claim they support interoperability when they restrict access to their data formats. That's exactly the opposite.

[StJacques]

". . . They have enabled their operating systems to handle Office XML better because they are the only ones with full access to the DTD. . . ."

DTDs are not used in MS Office. They employ XML Schemas. And anyone is capable of writing a new XML Schema and DOM manipulation code to format and manipulate information in MS Office XML documents. I have done so myself. Did I create the same functionality as that which is available on the Windows operating systems? No. But was I able to use the information? You bet. And our clients loved it.

". . . Which they immediately made proprietary so that others couldn't operate with Windows machines as well as Windows machines could. Face it, Microsoft has a history of format lock-in. Meanwhile, by their very nature, open source products have fully open and accessible formats and protocols. . . ."

First; it's not the XML which is proprietary in the case of MS Office Documents, it's the operating system components that use the XML. There is not one format for any XML document anywhere on planet earth that is proprietary.

Second; all of the information created at user-level in MS Office XML Documents for Word, Excel, and Outlook is accessible outside of the Windows operating systems. It is the full capabilities for manipulation and use of that information that is restricted to Microsoft's proprietary technologies. That still establishes cross-platform interoperablility provided that a developer making use of the MS Office XML Document knows how to extract the information. That doesn't mean that he or she can manipulate the information to the same extent one can using the Windows operating system.

[knews_hound]

Those who can, do.

Those who cant, teach.

To dismiss real world experiance in favor of Academic credentials is not only insulting, its foolish.

Cheers,

knews hound

[B Knotts]

Red Hat != Linux

And, on "reported vulnerabilities," they are probably comparing all of Red Hat, including thousands of programs/applications, against Windows with nothing installed except IIS.

Apples and oranges.

[StJacques]

". . . You make an argument about XML interoperability and conclude that somehow it is Microsoft that started it all. That is inconsistent with historical facts. . . ."

You are correct. Maybe I should have pinged you on my post #105 above. I wrote:

". . . Microsoft's response was that XML should form the basis for cross-platform interoperability. In this respect, they followed IBM's lead, since it was IBM who first asked the W3C to adopt XML standards in 1996 to provide a cross-platform capability that would form an alternative to ActiveX. . . ."

And as for binary processing, that is a restrictive use of XML to be sure. And I applaud you for your publishing work and your capabilities in service-oriented architectures. I have spoken on the latter at conferences and elsewhere and I have worked as a technical reviewer for Wrox Press on XML Web Services (Schema-Based Programming).

[dalight]

I think the folks who are troubled about Microsoft's behavior extend way past the folks who you would label as anti-capitalists. Microsoft has created a long history of not playing fair, writing software that breaks their competitor's offerings and forcing PC makers to help them stamp out potential alternatives. So, if any company has earned their Black Hat it is Microsoft.

As for open sourcers, they come in all stripes. The whole movement would be still on the sidelines if IBM and others weren't pumping billions of dollars into Open Source. Don't kid yourself, there is a bigger game afoot.

[rit]

Another researcher also claims Microsoft's Office file formats are not open. See Analyst: MS Office Formats Not Open.