Study finds Windows more secure than Linux

The Seattle Time ^ | 2/17/05 | Brier Dudley

[rit]

SAN FRANCISCO — Believe it or not, a Windows Web server is more secure than a similarly set-up Linux server, according to a study presented yesterday by two Florida researchers.

The researchers, appearing at the RSA Conference of computer-security professionals, discussed the findings in an event, "Security Showdown: Windows vs. Linux." One of them, a Linux fan, runs an open-source server at home; the other is a Microsoft enthusiast. They wanted to cut through the near-religious arguments about which system is better from a security standpoint.

"I actually was wrong. The results are very surprising, and there are going to be some people who are skeptical," said Richard Ford, a computer-science professor at the Florida Institute of Technology who favors Linux.

[dalight]

What do you know about this guy? Who funded this study? What does it mean? Honest, like some of the other posters who actually run servers, I just don't get as much from this study as folks who just want to feel good about this OS or that OS.

If Howard Dean came out and said he liked Microsoft, would you see that as something to hang your hat on?

There is a good chance this study is meaningless because its metrics measure not real security but the way the two OS's are updated and how security threats are reported. I think its lame to get all excited about that. Honest, this metric has more to do with Microsoft believing its pointless to tell folks there is a whole and they don't have a fix. Where as Linux screaming, "Here is a hole!," is the way the hole gets fixed.

I will take a seasoned Sys Admin over a university prof in Computer Science any day. Gees.

[dalight]

It would be really different if an actual fact was actually presented. Don't you think?

[antiRepublicrat]

and your access to XML functionality (which is the real independent and non-proprietary cross-platform technology) should be unlimited.

Except that in Office the XML format is proprietary. It is not totally open.

The real test is "cross-platform interoperability" and the range of choices one can make in implementing it. Microsoft is light years ahead of the rest of the field in this respect.

Are you kidding? One reason for the European anti-trust action was Microsoft making communication easy only between its own desktops and servers. That's why even here they're being forced to reveal their APIs and protocols.

[rit]

Supporting Document-Style Web Services before the W3C, which Microsoft has consistently done, will enhance the software development industry more than the operating system suppliers.

What qualifications support such a broad claim like that?

[Rifleman]

Care to address the points I made?

There were no actual computers used in this "study". If I am wrong, quote from the article and prove it.

Please explain how "exploit days to patch release" is NOT a crummy metric for measuring security.

And, is "Get over it." an argument? Or just an attempt to bully or provoke an opponent?

[antiRepublicrat]

They love and worship Linux and facts have no place in the discussion.

You can see the same thing here on the Microsoft side from Kwazy.

[antiRepublicrat]

Most tests are hypothetical. Take any ZDNET benchmarks or the TPC benchmarks or most other tests, and they have to make certain assumptions to imitate real life.

Those benchmarks actually have computers running them. This was just a vulnerability count, nothing more, entirely theoretical.

[usgator]

You can see the same thing here on the Microsoft side from Kwazy.

I'm sure that's true. The same thing happens with MAC vs PC debates, Kerry vs. Bush, Abortion vs. Right-to-life, Fun to argue about, though. Isn't it?

[antiRepublicrat]

Microsoft also rules in servers with the highest market share.

Qualify that. What kind of servers? Small business servers, maybe. Web? No:

High-end servers? MS rarely even plays in that field, with only a few examples that they no doubt gave great deals on in order to get those examples to promote.

[KwasiOwusu]

"If Howard Dean came out and said he liked Microsoft, would you see that as something to hang your hat on? "

He is not Howard Dean.
He is a university Computer Science professor.
I have seen countless posts on internet boards, from open source fanatics quoting some left wing university professor or the other, trashing Microsoft products.
The beauty of this one is ,this guys actually BACKS Linux.
Makes it just so delicious tome. :)
You guys don't have a problem with computer science university professors, you just have a problem with computer science university professors who puncture your bubble.
That is understandable.

"There is a good chance this study is meaningless because its metrics measure not real security but the way the two OS's are updated and how security threats are reported"

Again you are clutching at straws.
There is an even better chance that this study is very solid and gives a very good indication of what happens in real life with Windows and Linux servers.

"I will take a seasoned Sys Admin over a university prof in Computer Science any day"

I don't.
I don't know any System Admins who have invented or written operating systems or network protocols etc etc.
I know computer science university professors who have.

[Frumious Bandersnatch]

I was wrong on Gartner. At the time I posted it, I was doing so from memory. I should have known better, since Gartner has, in the past, distorted their findings in favor of MS.

Anyhoo, what I was thinking of was the Honeypot project.

Honeypot

[antiRepublicrat]

This is real science, and a real professor.

You've obviously never worked at a university, and I have, so the title "doctor" or "professor" means nothing to me anymore. You have to actually look at the individual professor's work to find out if he's worth anything.

[usgator]

nice graph ... but doesn't apache ALSO run from windows? I have a java site which runs on Apache from my windows server. Could this be part of why it ranks so high? I am not an expert in that area so forgive me if I'm wrong.

[antiRepublicrat]

uch of the software produced by the open source movement is based on software that companies like Microsoft and AOL have already introduced

And Excel, Word, DOS and Windows are original products?

[Rifleman]

You may mean OpenOffice Math. That may be because anyone intending to create a document with serious math content will usually use LaTex, which makes those "paste the symbol and try to be wysiwyg and fail" toy typesetting applications sort of redundant.

Also, basing MS's alleged preeminence on an app that not one user in 500 will need and most will not even know about is sort of pitiful. And what in the world could you mean by anti-capitalist? Open Source activist organizations include IBM, Sun and Novell. How much more capitalist do you want? And the whole open source idea is based on private property.

[embedded_rebel]

Quick, hide the cutlery.

[KwasiOwusu]

That is so funny. Ummm..

# 1, my post asked for Gartner.
After all we have just Gartner and IDC for the most part that issue quarterly server and PC sales figures.
Netcraft doesn't count

And # 2, you know and I know that web servers is a very small slice of total servers sold.
Give me figures showing that Linux sold more servers than Microsoft Windows on either the desktop or servers in the latest quarter, or any other quarter you care to name, will you?

[KwasiOwusu]

"This was just a vulnerability count, nothing more, entirely theoretical"

It wasn't

[antiRepublicrat]

The machine won't matter if Universal Data Access becomes the standard and businesses won't have to pay the costs of "machine access capability" as IBM and others want them to do.

Then why is Microsoft pushing a mail protocol that requires a restrictive license (and therefore rejected by the IETF), and refusing to open up their Office XML format so that everyone can read Office documents? Meanwhile, OpenOffice has a completely open XML file format that can be read by anyone or anything.

[Ex-Dem]

I never said that they are original. I meant that OpenOffice was created as a clone of Microsoft Office.