FreeRepublic , LLC
PO BOX 9771
FRESNO, CA 93794
STOP BY AND BUMP THE FUNDRAISER THREAD
Posted on 01/13/2003 7:45:29 AM PST by ImaGraftedBranch
November 26, 2002 | Paul Thurrott
Most Unsecure OS? Yep, It's Linux
According to a new Aberdeen Group report, open-source solution Linux has surpassed Windows as the most vulnerable OS, contrary to the high-profile press Microsoft's security woes receive. Furthermore, the Aberdeen Group reports that more than 50 percent of all security advisories that CERT issued in the first 10 months of 2002 were for Linux and other open-source software solutions. The report muddles the argument that proprietary software such as Windows is inherently less secure than open solutions. And here's another blow to the status quo: Proprietary UNIX solutions were responsible for just as many security advisories as Linux in the same time period. Could Windows be the most secure mainstream OS available today?
"Open-source software, commonly used in many versions of Linux, UNIX, and network routing equipment, is now the major source of elevated security vulnerabilities for IT buyers," the report reads. "Security advisories for open-source and Linux software accounted for 16 out of the 29 security advisories--about one of every two advisories--published for the first 10 months of 2002. During this same time, vulnerabilities affecting Microsoft products numbered seven, or about one in four of all advisories."
The stunning report makes several claims that seem to fly in the face of widely accepted beliefs. First, the Aberdeen Group says that Windows-based Trojan horse attacks peaked in 2001, when CERT released six such advisories, then bottomed out this year, when CERT didn't issue any alerts. However, Trojan horse-based attacks on Linux, UNIX, and open-source projects jumped from one in 2001 to two in 2002. The Aberdeen Group says this information proves that Linux and UNIX are just as prone to Trojan horse attacks as any other OS, despite press reports to the contrary, and that Mac OS X, which is based on UNIX, is also vulnerable to such attacks. Even more troubling, perhaps, is the use of open-source software in routers, Web servers, firewalls, and other Internet-connected solutions. The Aberdeen Group says that this situation sets up these devices and software products to be "infectious carriers" that intruders can easily usurp.
According to the Aberdeen Group, the open-source community's claim that it can fix security vulnerabilities more quickly than proprietary developers can means little. The group says that the open-source software and hardware solutions need more rigorous security testing before they're released to customers. This statement is particularly problematic because many Linux distributions lack the sophisticated automatic-update technologies modern Windows versions contain.
We can rail against Microsoft and its security policies, but far more people and systems use Microsoft's software than the competition's software. I believe that we'll never know how secure Linux is, compared with Windows, until a comparable number of people and systems use Linux. But despite the fact that Linux isn't as prevalent as Windows, we're still seeing a dramatic increase in Linux security advisories today. I think the conclusion is obvious.
When there are 50 million Linux PCs to match the 50 million windows PCs, it will be extremely obvious that open source is not the way to go. You think the number of problems windows has had was bad? Wait until you have 50 million people using it, then fixing all of the problems -- as well as distributing them -- to people that purchased Linux because administrative costs were so low. Oh, Yeah -- we fired our administrators after we bought Linux....oops.
Security advisories for open-source and Linux software accounted for 16 out of the 29 security advisories
They are not saying that Linux had more security problems than Windows, they are lumping Linux together with ALL open source software. There is a big difference.
Paul Thurrott Write for Windows & .NET Magazine Paul Thurrott is the news editor for Windows & .NET Magazine. He writes a weekly editorial for Windows & .NET Magazine UPDATE (http://www.win2000mag.net/email) and writes a daily Windows news and information newsletter called WinInfo Daily UPDATE (http://www.wininformant.com).
Did a quick google search on Thurott. He's got a dog in this fight, that's for sure.
Tell me again why all my customers are trying like crazy to get onto a Linux or Unix-based platform and away from NT and MS in general.
Tell me why, of all the scans that my web servers get, the bulk of them are from Windows boxes that have been compromised with the NIMDA virus (a patch for which has been out for a year).
It's old, and was indeed posted before.
It is a falsified report. Funny stuff, actually. Look into how they arrived at their conclusions . . .
Propaganda has to be repeated, to be effective.
And yes, Smeagol2000 was there.
Nasty little linuxes, smeagol will throttle them, yessss, preciousssss.
The Aberdeen Group is lulling unwary Windows users into a false sense of security with their flawed analysis. Counting advisories is not the way to determine which platform is most vulnerable.
History shows that *nix system users are more diligent about reporting security issues as soon as they are discovered, and issuing a fix as soon as possible. Microsoft ignores security issues, avoids issuing security advisories and delays issuing fixes.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.