Linux and open-source less secure than other platforms

[manly]

Originally posted by: n0cmonkey

Show me some good code. Answer any of my questions about Microsoft's code audit, code review, or code integrity assurance. Until then, I have to rely on code that has been written with security in mind, buy security knowledgable people, that has had a fair track record, and has been reviewed by plenty of eyes.

What, you don't like Microsoft's security track record? They invented Trustworthy Computing you know.

 

[Ameesh]

Originally posted by: BatmanNate

Originally posted by: Descartes

Originally posted by: BatmanNate

Originally posted by: Descartes

Originally posted by: BatmanNate

Originally posted by: Descartes
I searched but couldn't find this posted.

According to an Aberdeen study, Linux' Security Problems Outstrip Microsoft's.

That's a pretty big generalization considering all of the distros that use the linux kernel, not to mention that security is dependent on the knowledge and experience of the administrator of the system to customize it correctly for the given task. In my experience with serving, my linux based setup was far more secure than my Win2k one.

Funny how such reason isn't given when people post Windows-related vulnerabilities

You're absolutely correct, it is widely dependent on the knowlege and experience of the administrator. The point is that open-source software is often written very, very poorly. Any developer who's ever looked in earlier kernel code, or any of the countless open-source apps that businesses running linux depend on will confirm this. It's not as bad as it used to be (like back in the mid-90s), but it's still often more hobby code than production code.

Then why do large corporations rely on open source solutions when there are so much supierior commercial solutions available? Money isn't a barrier for companies like Microsoft, who's hotmail servers ran exclusively on FreeBSD (an open source OS) for years because Win2k Server could not handle it. For all I know, it might still be running it. (minus the front end servers) Also, Apache is the most popular web server on the internet, it is open source. Google is not run on MS products either. Doesn't look like just a hobby to me.

Did I say *all* of open-source? No. You pointed out one of the more salient and successful projects on the planet: Apache. Look at cert, or any of the vulnerability watch lists.

There are many open-source projects that are extremely successful, but there are disproportionately more that are not. This also applies to open-source software used on Windows, not just Linux.

Also, I'm not aware of why MS had hotmail running on FreeBSD. I seriously doubt it had anything to do w/ win2k not being able to service the requests, but more of a development issue. If you have evidence to the contrary, please prove me wrong.

O. K.

if you think the register is a credible news source you're more niavie then i thought.

 

[BatmanNate]

Originally posted by: Ameesh

Originally posted by: BatmanNate

Originally posted by: Descartes

Originally posted by: BatmanNate

Originally posted by: Descartes

Originally posted by: BatmanNate

Originally posted by: Descartes
I searched but couldn't find this posted.

According to an Aberdeen study, Linux' Security Problems Outstrip Microsoft's.

That's a pretty big generalization considering all of the distros that use the linux kernel, not to mention that security is dependent on the knowledge and experience of the administrator of the system to customize it correctly for the given task. In my experience with serving, my linux based setup was far more secure than my Win2k one.

Funny how such reason isn't given when people post Windows-related vulnerabilities

You're absolutely correct, it is widely dependent on the knowlege and experience of the administrator. The point is that open-source software is often written very, very poorly. Any developer who's ever looked in earlier kernel code, or any of the countless open-source apps that businesses running linux depend on will confirm this. It's not as bad as it used to be (like back in the mid-90s), but it's still often more hobby code than production code.

Then why do large corporations rely on open source solutions when there are so much supierior commercial solutions available? Money isn't a barrier for companies like Microsoft, who's hotmail servers ran exclusively on FreeBSD (an open source OS) for years because Win2k Server could not handle it. For all I know, it might still be running it. (minus the front end servers) Also, Apache is the most popular web server on the internet, it is open source. Google is not run on MS products either. Doesn't look like just a hobby to me.

Did I say *all* of open-source? No. You pointed out one of the more salient and successful projects on the planet: Apache. Look at cert, or any of the vulnerability watch lists.

There are many open-source projects that are extremely successful, but there are disproportionately more that are not. This also applies to open-source software used on Windows, not just Linux.

Also, I'm not aware of why MS had hotmail running on FreeBSD. I seriously doubt it had anything to do w/ win2k not being able to service the requests, but more of a development issue. If you have evidence to the contrary, please prove me wrong.

O. K.

if you think the register is a credible news source you're more niavie then i thought.

More credible in this arena that anything you post, seeing as you work for the company in question.

(Understandably creating a bias)

 

[Ameesh]

Originally posted by: n0cmonkey

Originally posted by: Ameesh
this point is lost on all these people who think they are programmers cause they wrote some shell script. They don't seem to understand what good code and what bad code is. they just like to root for the underdog.

Show me some good code. Answer any of my questions about Microsoft's code audit, code review, or code integrity assurance. Until then, I have to rely on code that has been written with security in mind, buy security knowledgable people, that has had a fair track record, and has been reviewed by plenty of eyes.

what questions are those? I'll try to answer the ones i am allowed to. as for showing you code you know i can't do that. If you goto certain universities they have access to our source code which they use to teach off of. Unfortunalty i cant find the link to the list of them so you may want to ask your cs department.

 

[Vinny N]

The best reason I've heard reiterated for the use of open source is that you can know what's in your choice of software. When using something from Microsoft, you have no idea what preset backdoors if any might exist in that software. I think this reasoning could be heard recently in a slashdot article where someone asked why China would develop its own CPU when there are vastly more powerful solutions already available, and it's the same reason, how can they know what each and everyone one of those registers does on the CPU, the only certainty is to use something that they can have intimate knowledge of.

 

[n0cmonkey]

Originally posted by: Ameesh

Originally posted by: n0cmonkey

Originally posted by: Ameesh
this point is lost on all these people who think they are programmers cause they wrote some shell script. They don't seem to understand what good code and what bad code is. they just like to root for the underdog.

Show me some good code. Answer any of my questions about Microsoft's code audit, code review, or code integrity assurance. Until then, I have to rely on code that has been written with security in mind, buy security knowledgable people, that has had a fair track record, and has been reviewed by plenty of eyes.

what questions are those?

What are Microsoft's procedures for code audits?
What do they use to keep track of the code in a manner that the break-ins on their site does not affect code integrity?
How many people generally review their code for security problems?
How many independant people (ie. outside of Microsoft) review their code?
What is their general time frame for releasing patches?
What is their stance on the problems out there they have been unable/unwilling to patch (specifically the known ie bugs that are yet unpatched)?

I'll try to answer the ones i am allowed to.

Of course, we dont want you getting in trouble

as for showing you code you know i can't do that. If you goto certain universities they have access to our source code which they use to teach off of. Unfortunalty i cant find the link to the list of them so you may want to ask your cs department.

I could probably find enough if I looked hard enough on line. Beats the hell out of going to college.

 

[FelixDeCat]

I agree with Aberdeens. We all know Unix is crappy anyway.

 

[benliong]

Originally posted by: Ameesh

Originally posted by: BatmanNate

Originally posted by: Descartes

Originally posted by: BatmanNate

Originally posted by: Descartes

Originally posted by: BatmanNate

Originally posted by: Descartes
I searched but couldn't find this posted.

According to an Aberdeen study, Linux' Security Problems Outstrip Microsoft's.

That's a pretty big generalization considering all of the distros that use the linux kernel, not to mention that security is dependent on the knowledge and experience of the administrator of the system to customize it correctly for the given task. In my experience with serving, my linux based setup was far more secure than my Win2k one.

Funny how such reason isn't given when people post Windows-related vulnerabilities

You're absolutely correct, it is widely dependent on the knowlege and experience of the administrator. The point is that open-source software is often written very, very poorly. Any developer who's ever looked in earlier kernel code, or any of the countless open-source apps that businesses running linux depend on will confirm this. It's not as bad as it used to be (like back in the mid-90s), but it's still often more hobby code than production code.

Then why do large corporations rely on open source solutions when there are so much supierior commercial solutions available? Money isn't a barrier for companies like Microsoft, who's hotmail servers ran exclusively on FreeBSD (an open source OS) for years because Win2k Server could not handle it. For all I know, it might still be running it. (minus the front end servers) Also, Apache is the most popular web server on the internet, it is open source. Google is not run on MS products either. Doesn't look like just a hobby to me.

Did I say *all* of open-source? No. You pointed out one of the more salient and successful projects on the planet: Apache. Look at cert, or any of the vulnerability watch lists.

There are many open-source projects that are extremely successful, but there are disproportionately more that are not. This also applies to open-source software used on Windows, not just Linux.

Also, I'm not aware of why MS had hotmail running on FreeBSD. I seriously doubt it had anything to do w/ win2k not being able to service the requests, but more of a development issue. If you have evidence to the contrary, please prove me wrong.

O. K.

if you think the register is a credible news source you're more niavie then i thought.

This is the first time I heard people questioning credibility of register for tech-related stuffs. Well, maybe it's just me. We can however be pretty sure of the switch from FreeBSD to Win2k with this
Link from Microsoft. There must be a reason for microsoft not doing the switch with NT 4.0. Hotmail was purchased in 1997, and nothing has been done to convert it into using MS products until mid-2000. Think about it.