Slashdot Log In
More Than Half of Known Vista Bugs are Unpatched
Posted by
Zonk
on Fri Jun 22, 2007 09:05 AM
from the bugtracker-is-half-empty-attitude dept.
from the bugtracker-is-half-empty-attitude dept.
MsManhattan writes "Microsoft security executive Jeff Jones has disclosed that in the first six months of Vista's release, the company has patched fewer than half of the operating system's known bugs. Microsoft has fixed only 12 of 27 reported Vista vulnerabilities whereas it patched 36 of 39 known bugs in Windows XP in the first six months following its release. Jones says that's because "Windows Vista continues to show a trend of fewer total and fewer high-severity vulnerabilities at the six month mark compared to ... Windows XP," but he did not address the 15 unpatched flaws."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Why would you ever..... (Score:3, Insightful)
Re:Why would you ever..... (Score:5, Insightful)
If you RTFA, you'll see that Vista's unpatched vulnerabilities are not considered "critical" because, thanks to Vista's improved security model, are virtually impossible to exploit.
Slashdot actually managed to spin a highly positive analysis of Vista into something that suggests Vista is not only worse than XP, but Microsoft is somehow going out of its way *not* to fix it.
Gotta love it. Slashdot is the GOP of technology news sites.
Parent
Re:Why would you ever..... (Score:5, Funny)
And I think you'll see that thanks to my new and improved door lock, the fact that I leave my windows unlatched is not a critical security issue.
Parent
Re:Why would you ever..... (Score:4, Insightful)
But no matter how good your code is, things will be missed. That's the point of having things like Address Space Layout Randomization, IE 7 Protected Mode, Session 0 Isolation, and the dozens of other security layers that Microsoft added to Vista.
Furthermore, being rated non-critical can often mean that it requires significant user action (like turning off multiple security features) in order to make a user vulnerable.
What's next, are you going to blame Microsoft when a user smacks their motherboard with a hammer?
The fact of the matter is, that at least so far, Vista is proving to be the most secure OS on the market. (Aside from perhaps OpenBSD, of course.
Otherwise, keep your silly analogies to yourself.
Parent
Re:Why would you ever..... (Score:5, Interesting)
That's quite a statement. I don't have evidence supporting anything either way but I still have a hard time swallowing that one given my past experiences. More secure than previous Windows systems, perhaps. Most secure OS on the market? That's probably a bit of a stretch. Personally, I would still be far more comfortable with the security of any of the BSDs, Linux, Mac OS X, Solaris, or any other flavor of UNIX. Not to mention more obscure operating systems.
Furthermore, it's extremely difficult to prove such things. Simply looking at the number of vulnerabilities is nowhere near adequate and, given your statement, I think the burden of proof would be on you.
Parent
Re:Why would you ever..... (Score:5, Interesting)
It's very difficult to compare the security of OpenBSD to Vista, because of what is included. OpenBSD, for example, doesn't include a web browser in the base system. It includes X11, but not a complete desktop environment. For it to be a fair comparison, you would have to compare OpenBSD + GNOME (for example). On the other hand, OpenBSD includes a number of things that aren't in Vista, such as a compiler, so you might have to throw in Visual Studio. But that's an IDE, so maybe throw Eclipse into the OpenBSD pile...
Parent
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
You sir should think before you post.
You might want to follow your own advice.
You're committing a logical fallacy in your post. You equate the fact that your Macs have never been compromised (that you know of) to the their actual security. This is an invalid equation.
I could write a piece of software that had a 1000 known critical security vulnerabilities, but it might never get hacked. Does that then mean that my software is secure? Of course not.
Factors that contribute to whether or not something gets compromised include the number of vulne
Re:Why would you ever..... (Score:4, Insightful)
Parent
Re: (Score:3, Insightful)
Always that old security by obscurity mantra. Who cares WHY I don't get my Mac house burgled as often as my neighbors Windows house. Maybe my house doesn't have bars on the windows and bank safe doors and locks either. What is nice is that burglars bypass my house and go to the ones down the street. I also don't have to waste money on added security and guard services. The bottom line is that there are NO Mac botnets, whereas there are thou
Re: (Score:3, Interesting)
I dun
Fallacy (Score:3, Informative)
You might want to follow your own advice.
That goes for you too!
You're committing a logical fallacy in your post. You equate the fact that your Macs have never been compromised (that you know of) to the their actual security. This is an invalid equation.
I don't think this qualifies as an "invalid equation." Maybe if he was trying to say that a Mac is a PC, or that OSX is Vista, that would be an invalid equation.
What you are thinking of sounds much more like the fallacy o
Re: (Score:2)
Re:Why would you ever..... (Score:5, Funny)
User: Allow, Allow, Allow (dangit where is the free pron already?)
Vista: The program ~tracker.exe is attempting to change the firewall settings, Cancel or Allow?
User: Change the what? Allow...come on
Vista: The run32.dll has been altered since the last system scan do you wish to proceed? Cancel or Allow?
User: sigh....Allow
Vista: Windows has been updated and must be restarted, Cancel or Allow?
User: hmmmm....don't remember getting updates but updates are good...Allow
Several weeks later....
User: What is going on with all of these popups and free pron offers? Isn't Vista supposed to be more secure?
Support: Did you try rebooting?
User: yes, yes, yes I have already done that.
Support: Well, we can send you a new motherboard w/installation instructions....
User: Thanks, but my bank is on the other line...I am having some trouble with my accounts. Can I call you back?
Support: We are here to serve all of your customer service needs.
User: Uh, yeah whatever, bye.
The moral of this story is that no matter how many times the user is forced to click Allow, I agree, Yes, or Continue in order to shoot themselves the foot they will find a way to do it guaranteed. It may be true that Vista is better than XP is or was out of the box, but they have to assume that even though the user would have to click Allow ten times for some malware to get through that it will happen and not just to a couple of people either. They should at least tell people that they are working on the fixes instead of saying, "well if you are smart you wont get hacked, just don't always click allow."
Parent
Re: (Score:2, Insightful)
Actual quote? (Score:2)
Did the guy say half the bugs or half the vulnerabilities? Half the vulnerabilities seems bad to me. Half the known bugs is not bad at all- in fact I would consider that somewhere around par for software development.
Either way I agree it sounds bad.
Re:Actual quote? (Score:5, Informative)
It sounds bad because the person who posted it to Slashdot, and Slashdot's editors, want it to sounds bad. Are you new here or something?
Parent
Wrong title (Score:5, Informative)
That's the reason why only half of them were fixed while in XP most of them.
Re: (Score:2)
Of course, this being
Flawed Logic (Score:4, Interesting)
The second sentence, while double-plus-good Microsoft PR speak, is critically flawed reasoning.
If the parent said "Known Vista vulnerabilities..." I would agree, but that still glides over many fundamental liabilities that Microsoft products push onto the customer like:
1. The concept of security in Microsoft products means protect Microsoft's intellectual property.
2. No one can reasonably predict the scope or scale of Microsoft vulnerabilities.
3. Given Microsoft's history of producing "secure" operating systems, it is reasonable to assume there is no evidence end-user security features makes it through to the end product. Note carefully, Microsoft has *very* talented programmers who can code securely after all their monopoly status affords them this luxury. I'm saying that their work doesn't make it all the way through the management gauntlet. UAC is a perfect example. It is not a security boundary. http://blogs.zdnet.com/security/?p=175 [zdnet.com]
The Vista train will pull out of the station eventually because Microsoft's monopoly makes this a sure thing. As every other Microsoft OS has shown, there will be critical vulnerability surprises. It's a matter of when, not if.
Parent
Re: (Score:2)
Vistas been out for a few months; XP has been out for more than half a decade. Obviously there are more known bugs in XP than Vista.
Not the article I read. (Score:2, Insightful)
The article I read trashed M$'s sorry analysis and told me to expect more of the same from Vista as we've seen with every other M$ OS:
Rubbish. (Score:4, Funny)
Re:Rubbish. (Score:4, Funny)
Parent
Re:Rubbish. (Score:5, Funny)
/chain yanking
Parent
Re: (Score:2, Informative)
Re: (Score:2)
Re: (Score:2)
>Kinda of funny to post THAT on the wrong article, isn't it.
That was the joke. Hence the
We have our first trans-article Slashdot joke. Party tonight
Simple Explanation (Score:4, Insightful)
Big deal... (Score:3, Funny)
In Other Words (Score:5, Insightful)
So, they're not fixing the bugs because Vista is less buggy than XP? Whatever happened to fixing it because it was broken?
Re: (Score:2)
The saying is: If it ain't broke, don't fix it. If it was the way round you said, the software industry would disappear under an infinite pile of gant charts.
Re: (Score:2)
Microsoft often waits to patch these kinds of vulnerabilities until they've taken care of more important things, like critical bugs, and sometimes chooses to roll them up into a service pack. This allows for more thorough testing and decreases the chance t
Re: (Score:2)
Re: (Score:2)
This is the difference between using Service Packs and using individual patches for individual packages/applications. It's a Monolith versus granular approach.
Because of the scale MS has to work on and support people it's far easier for them to work within the monolithic model.
As for why th
Vista is the youngest in the series (Score:5, Funny)
Apparently the developers of Vista are following that trend too!
I know we slag them off... (Score:5, Funny)
I know our hobby is slagging of microsoft, but hey, copying Linux seems to be working out for them.
Oh, damn. My carefully crafted, pro microsoft reply, slipped into the usual M$ bashing. They are such an easy target. I can't help my self. Just like women drivers. I don't mean to joke at their expense, but sometimes the jokes, they slip out. I mean, I asked my girlfriend if my indicators were working and she said 'Yes. No. Yes. No.'
An oldie but a goldie. Feel free to use that one.
monk.e.boy
Vista flaws are not as critical as XP (Score:3, Insightful)
Talk about spin (Score:2, Insightful)
An article on engadget that is pointing to the EXACT same data...yet the title there most certainly provides a seriously different outlook does it not? I do not blame anyone, however, as if I had seen an ACTUAL nuetral title along the lines of 'microsoft employee posts dubious data of questionable usefulness to anyone except PR departments' I would without doubt have just scrolled on...
Re: (Score:2)
Wait wait wait... you mean you're not blaming Microsoft or the Government?!? What kind of slashdot poster are you?
So damned complex (Score:2)
They are not security holes. They are the patents (Score:2, Funny)
Interesting (Score:2)
Is this the same guy who was bragging... (Score:2)
Does this count all the secret fixes? (Score:4, Insightful)
Microsoft has acknowledged that they include secret undocumented patches in hotfixes, patches that would count against their "score" if they were required to count them... open source software doesn't have the luxury of hiding their dirty laundry like that. And it's not just Linux that suffers from that "disadvantage", OS X has an awful lot of open-source components, and many of Apple's updates have been patches rolled in from them.
Microsoft's gaming the system here. Statements like this should be granted no credibility.
Re: (Score:2)
Famous in Slashdot-land, maybe. In the real world, not so much. Perhaps you should start being a little more critical of what the internet tells you.
Re:Does this count all the secret fixes? (Score:5, Interesting)
Skeletins in Microsoft's Patch-day Closet [zdnet.com]
It's interesting that you attack Microsoft for secrecy but say nothing about Apple, which is famous for its hostile attitude towards people who discover exploits as well as their secrecy about their patches are what they fix.
You seem to be under a misapprehension here. I'm not defending Apple. I'm simply pointing out that Microsoft has more ability to hide security flaws in their software than any company that uses a significant amount of open-source software, and thus they can artificially reduce their "score" in this game to a far greater extent than either of the other organizations mentioned by Jones. That is, regardless of Apple's motivations and actions, they are simply not capable of hiding patches as effectively as Microsoft.
So:
1. Microsoft has more ability to "game the system" than Red Hat, Apple, or any other organization using a significant amount of open-source software in their product.
2. Microsoft has acknowledged that they are engaged in gaming the system.
I would be happy to discuss Apple's past behavior in an appropriate context. In fact if you google around you'll find that I've been quite critical of Apple when I've felt it warranted. There's plenty of other skeletons in Microsoft's closet if you want to get into a fan war, but you'll have to find someone else for THAT debate... again, google around, you'll find I defend Microsoft when I believe it's warranted. Basically, I'm poorly equipped for the kind of debate that requires uncritical acceptance or dismissal of of one company's position on every subject.
Here and now, Microsoft's figures can not be accepted on face value. Unless Microsoft reveals ALL the details of the vulnerabilities they've corrected they can't be considered comparable to even Apple's figures with their heavy loading of open source software, let alone Red Hat's.
Parent
Where is the 12 out of 27 number coming from? (Score:2)
Did someone make up the numbers so that it can be posted on Slashdot?
Two steps forward, one step back. (Score:3, Interesting)
Re: (Score:3, Funny)
"The only reason XP is the target of so many viruses is because it is so widely used! If Vista was as popular as Windows XP, there would be just as many viruses written for those platforms!"
(firmly tongue in cheek, I'm aware that Vista's UAC is still a pale imitation of a real security model).