Text 12348, 68 rader
Skriven 2006-08-01 18:42:28 av /m (1:379/45)
Ärende: How Microsoft Stacks The Deck When Comparing Windows and Linux Vulnerab
===============================================================================
From: /m <mike@barkto.com>


http://www.emailbattles.com/2006/08/01/how-microsoft-stacks-the-deck-when-compa
ring-windows-and-linux-vulnerabilities/

===
After toting up the vulnerabilities in Windows XP Service Pack 2, Red Hat
Desktop 3 and Red Hat Desktop 4, Microsoft’s Jeff Jones concluded:

   Whether you look at the all up total vulnerabilities,
   look at high severity vulnerabilities, or look at the
   weighted Workload Vulnerability Index, it is hard to
   argue against the fact that Red Hat 3 required less
   vulnerability-driven work than Red Hat 4, and
   Windows XP SP2 required less than either.

Jones’ conclusion is indisputable, as long as you play by his rules. Here are
three of them:

Jones’ Rule for Vendor-Defined Product Vendor-defined products are any apps
included on the CD. Flaws in each product accrue to the vendor’s negative
tally.

Jones’ Rule for Role-Based Products A webserver is a role-based product. Same
goes for a fileserver or database server. A role-based comparison includes the
apps required to fulfill the assigned role, as defined by Microsoft and its
partner, Security Innovation. An example: Steps for “hardeningö the role
products, which would substantially reduce vulnerability, are not implemented.
Thus, while the packet filtering abilities of iptables are at a Linux admin’s
fingertips, they are apparently out of bounds. [pdf]

Jones’ Rule for Fixes
A vulnerability in an application isn’t fixed until the vendor who stamped the
CD distributes it.

Within these proscribed rules, the outcome is inevitable, even admirable.  But
a Linux CD is a convenient store-on-a-disk. You can choose Red Hat, SuSE,
Ubuntu, etc. for installation conformity and ease of updates. And you needn’t
wait for distributor fixes. You can often get them from the original authors.

How do Linux admins find out about problems and updates? By monitoring the
appropriate outlets, like CERT, SANS, SecurityFocus, and many others.

I expect little more from a CD distributor than I expect from a convenience
store. I’m perfectly comfortable using search engines and forums.

It’s not the same with Windows boxes. As Microsoft is the only source for
Windows, the company can be a huge, single point of failure.

Case in point: Remember when the world stood still during the WMF Exploit
fiasco that took out XP SP2, circa New Year’s 2006? Ilfak Guilfanov delivered a
patch while Microsoft dithered.

I expect more from Microsoft, because I must. Everything on the disk came from
Redmond.

In the end, it will always be impossible to squarely compare Windows with
Linux. Each fulfills different needs and expectations.

But as even Jeff Jones would tell you (I hope), the guy who makes the rules
always wins.
===

 /m

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)