Slashdot Log In
Vista Security Claims Debunked
Posted by
CowboyNeal
on Thu Jun 28, 2007 07:14 PM
from the setting-things-straight dept.
from the setting-things-straight dept.
An anonymous reader writes "Apparently Microsoft still hasn't learned that counting vendor acknowledged vulnerabilities isn't a good way to establish the security of an OS. As an analysis of Microsoft's claims on Full Disclosure shows, we see that the methodology used was badly flawed. A bug in Firefox (not to mention emacs), counts as a flaw for Linux, while IE bugs get ignored on Vista's chart. Then we see that vulnerabilities aren't vulnerabilities when they're security-challenged features such as Vista's Teredo. Also, there's far too little consideration given to severity, given that it stoops to counting even extra access restrictions on a file in OSX to have something to show. In short, the original Microsoft analysis was good PR and poor research."
Related Stories
[+]
IT: 6 Months On, Vista Security Still Besting Linux 478 comments
Martin writes "Great report on security vulnerabilities for MS/Linux/OS X. This is a revised version of the one Jeff Jones did back on March 21: Windows Vista — 90 Day Vulnerability Report. This time he did what the Linux community had asked. Everyone complained that he did the report based on a full Linux distro including optional components, not on just a base OS install. So this time he did both; Vista still came out on top. I was shocked that Apple was even on the list as I believed all those Mac commercials!"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Microsoft found making PR-FUD-ing research (Score:5, Funny)
Re: (Score:3, Insightful)
Re:Microsoft found making PR-FUD-ing research (Score:5, Insightful)
Such straight forward conclusions are impossible to make. Based on the following points.
- If many people are analysing code, you will find more bugs. If you don't review your code (or for example, don't have peer review - which closed source often lacks.) Then no bugs at all will be discovered.
- The existing number of unfound bugs is related to the number of discovered bugs. Well no not really: The number of found bugs is actually related to how long and how many researchers have been testing and actively looking for the bugs and second to that is how buggy the software is. I can assign a team of one researcher with no experience and they'll never find any bugs in the poorest of software.
- A difficult and obscure to exploit bug (one that requires a perfect storm of conditions) is as important as a bug that is easily exploitable(e.g. drive by downloads). Also with that: Bugs that bring down the whole system versus bugs that only fail a single service.(E.g. blue screen versus failing to display a JPG correctly.)
- Differences in reporting models: Total lack of transparency versus an open forum. E.g. Microsoft vs Linux reporting. You can only compare reporting from the same kind of reporting models. E.g. You can compare kHTML versus Mozilla (as they are both open and have similar review structures), but not Windows vs BSD (the dissimilar reviews allow misrepresentation via favourable skews and different classification paradigms.
Parent
Re:Microsoft found making PR-FUD-ing research (Score:5, Insightful)
Fixed that for you.
Parent
Re:Microsoft found making PR-FUD-ing research (Score:5, Informative)
- The existing number of unfound bugs is related to the number of discovered bugs. Well no not really: The number of found bugs is actually related to how long and how many researchers have been testing and actively looking for the bugs and second to that is how buggy the software is. I can assign a team of one researcher with no experience and they'll never find any bugs in the poorest of software.
Parent
Re:Microsoft found making PR-FUD-ing research (Score:4, Insightful)
Parent
Re:Microsoft found making PR-FUD-ing research (Score:4, Informative)
Windows Vista is "dramatically more secure than any other operating system released", Microsoft founder Bill Gates has told BBC News [bbc.co.uk].
(Emphasis added.)
Parent
Microsoft "Research" (Score:5, Funny)
Parent
Re:Microsoft "Research" (Score:4, Funny)
Parent
The really sad part.... (Score:5, Insightful)
Unfortunately they seem to be so obsessed with winning by FUDing and spinning that they end up making crap. This is a great disservice to the whole computer industry.
Parent
Re:The really sad part.... (Score:4, Insightful)
Parent
Re:The really sad part.... (Score:4, Insightful)
Unlike most people here I do like Vista, but I honestly think that compared to their competitors they have lost a lot of ground in engineering strength compared to what they once were.
Parent
Re:The really sad part.... (Score:4, Informative)
No it wasn't. OS/2 was waaaaay ahead of win95 in pretty much every way.
Parent
Re:The really sad part.... (Score:5, Informative)
Alternatively, press F8 during bootup and disable automatic restarts.
Parent
Re:I'll call bull (Score:4, Interesting)
I call BS too. I used to have an unstable video driver (open source ATI stuff) and I more than once ssh-ed into my box to restart X-windows.
At least on Linux you still have a chance to recover. At least I have open and closed drivers, at least I have a choice.
BTW, the only time I ever had a kernel panic on Linux was when I had faulty RAM... about 7 years ago.
Parent
Re:Heh (Score:4, Insightful)
Heh, you've never used any *nix before, except as a toy. There's a fucking mountain of difference. Does your box run any services for the network? Does it share any printers or disks? Does it have any other users logged into it? Does it run any scheduled tasks or background jobs? If you're doing *any* of these things, then there's no way in hell you want the system to reboot. If you're not doing any of these things, you're not running Linux, you're running a bloody X-terminal.
Parent
Thing I learned in the marketing class I failed: (Score:5, Insightful)
Parent
Re:Thing I learned in the marketing class I failed (Score:5, Insightful)
You haven't read an annual company report recently, or ever for that matter?
Even in sdoftware - or pharmaceutical companies where one would assume that a lot is spent for research the R&D budget is usual ~18% (which varies, of course) while sales and marketing usually eats away approx. half of the costs.
Sales, marketing and distribution is horrendously expensive and gets a far bigger chunk of the budget then R&D.
This is a generalisation, of course, but true for the vast majority of companies.
Parent
Not cheaper ... (Score:4, Insightful)
It's not cheaper (quite the contrary), but the effects of marketing are much more immediate than the effects of research. And it's the quarterly report that counts, not how the company is doing in three years.
Parent
Microsoft is about making money ... not products (Score:5, Insightful)
This means simply that Microsoft will generally pour just enough resources into a product to beat the competition and dominate the marketplace. We saw that with the browser war. When it had to overtake Netscape it came up with a good product. After it killed Netscape, and there was practically no other comparable browser, resources were taken off the browser product because it was good enough and there was no sense whatsoever in improving it.
We saw it with the IDE's. When Microsoft had to compete with Borland {Borland Pascal; Borland C/C++} it came up with the 'Visual' IDE. Visual C, Visual Fortran. It was a good IDE, and it won against Borland. After that ... it languished. Now ... now that we're seeing the Eclipse IDE and SUN's IDE ... suddenly Microsoft floors the accelerator again.
The same holds for the Operating System itself. Windows was systematically tailored to capture the eye of consumers and businesses, which it did very well. Never mind that the internals were {and still are} cludgy. What the user sees is the user-interface; that's what sells. Security flaws? Well ... as long as there is no competitor to which people can switch while retaining their investment in software and training ... security flaws aren't a show-stopper. Getting their own stuff to work was {previous Windows version have so many tightly coupled components that you never knew what would break next when you changed or added anything}, and that's why Jim Allchin very sensibly steered towards a properly engineered Windows. Vista in other words.
Given that we're seeing Linux, OS-X, and Open Solaris competing in more or less the same market we also saw an increased effort from Microsoft to tart up the user interface. Those transparant windows thingies.
This is something fundamental you have to understand about Microsoft. They are calculating folk, and never ever were trailblazers. Tail-light chasers, yes, but never trailblazers. 'Good Enough' is their goal, and their yardstick is ... the competition. Why? Because to Microsoft 'Good Enough' means 'Good enough to win in the marketplace and bring in revenue'. That's how Microsoft became so rich.
Parent
Re:Microsoft is about making money ... not product (Score:4, Insightful)
x86 made only incremental gains from the 486 to the Pentium IV. Suddenly, wham! AMD comes out with the 64-bit Opteron and Athlon 64 and they kick the crap out of Intel on price, performance, and power consumption for a year or so.
Now we've seen a ferocious flurry of innovation from Intel, which has suddenly been pouring money into R&D and taking advantage of its superior manufacturing processes. We've got Intel vs. AMD to thank for quad-core, low-power, hardware virtualization... and best of all, $59 dual-core 64-bit processors from Newegg
Now AMD is falling behind fairly rapidly, and we can expect Intel to slack off its R&D correspondingly. But in a year or five, AMD or someone else (VIA? IBM? MIPS?) will be back with something new and send Intel scrambling again.
Parent
Re:Microsoft is about making money ... not product (Score:4, Insightful)
x86 made only incremental gains from the 486 to the Pentium IV. Suddenly, wham! AMD comes out with the 64-bit Opteron and Athlon 64 and they kick the crap out of Intel on price, performance, and power consumption for a year or so.
I think you need to seriously revise your x86 history.
That is not to say that x86_64 wasn't a significant improvement, but to basically suggest the Pentium, Pentium Pro/II/III and Pentium 4 were just faster 486s is ludicrous. Each of those CPU families represents a serious increase in the design and capabilities of the x86 platform and they all came from Intel. Indeed, one of the main reasons x86_64 was so significant was because it repesents one of the few times AMD has been the leader, not the follower, in the last few decades.
Parent
Re:Microsoft found making PR-FUD-ing research (Score:5, Funny)
(*) MS Water(tm) tested at temperatures below 0 degrees C and above 100 degrees C, GNU/Water and H2O-BSD tested between 0 degrees C and 100 degrees C.
Parent
Shocked! (Score:5, Funny)
You don't need to see our identification. (Score:5, Funny)
Re:You don't need to see our identification. (Score:4, Interesting)
1. I think we all know where the quote is from.
2. Except you.
Parent
Not that surprised... (Score:5, Insightful)
Of course, if anyone should be counting browser flaws as OS flaws, it's MS. MS makes the case that they can't remove IE from the OS since it is integral to it working properly, yet doesn't count them on the vulnerability list.
Meanwhile, FF doesn't even have to come with a Linux distro, and a bug that compromises FF as an app is much less likely to compromise the OS as a whole.
Looks like more FUD to scare non technical people from "illegal" and "unsafe" Linux.
The Microsoft guy did a second report (Score:5, Interesting)
This just debunks the first report.
Re:The Microsoft guy did a second report (Score:5, Insightful)
Regardless of whether it does or does not the claims are as silly and irrelevant as the slashdot stories 'proving' that Linux is more secure.
The number of bugs is not relevant, it there is one bug the system is vulnerable. What matters is the window of vulnerability. The time between discovery of the bug by the bad guys and fixing it by the good guys.
UNIX used to be known for its insecurity. Richie and crew invented the buffer overrun bug, Tony Hoare was referring to this blunder in C when he gave his Turing Award lecture he brought up the fact that the first principle of ALGOL 60 had been security.
The perceived level of security of a system has much less to do with familiarity than any actual objective measure. None of the systems that are on the market today is built well enough for its supporters to start challenging others to this type of dick size measurement contest. Its silly and unhelpful.
Parent
Now... (Score:4, Funny)
Teredo (Score:3, Insightful)
Depending upon your definition of "security", yes. (Score:5, Interesting)
Actually, it would be appropriate.
If you can remove an avenue of attack, you have increased the security of your system.
Now, by removing it from the Internet you have also reduced the FUNCTIONALITY of your system.
So you end up with a less functional, more secure system.
Security is all about evaluating the possible threats and reducing their effectiveness.
No. If it is an avenue for attack, it is an avenue for attack.
If it is vulnerable, it is vulnerable.
We've been over this before with Firefox's avoidance of ActiveX. Sometimes, increasing your security simply means NOT including some functionality.
Parent
Remove the power cord too (Score:4, Funny)
Parent
Submit Macro (Score:5, Funny)
You mean like the "Preview" button right next to the "Submit" one?
Parent
Re:Teredo (Score:5, Funny)
Look, Windows can't even compete on features against Puppy Linux.
No Microsoft sales droid will ever get in a pissing contest against a full blown Linux distro with more than 20,000 packages installable. They'd just end up with a wet leg and a deep-seated sense of personal inadequacy.
Parent
Strangely, It Doesn't Matter (Score:3, Insightful)
I work in a Microsoft shop. And while I have a great boss, (really, no kidding) the company is Microsoft all the way. There is zero logic at play.
But that's the way it goes. I'm old enough to remember when "Made in Japan" was the cultural equivalent of today's "Made in China." That had little basis in reality then, just like Microsoft customers today just aren't ready to comprehend **buying** something other than a Windows box and just take Microsoft's ridiculousness as fact. In time though, I think that can change. Just like the Japanese and their cars.
And here I was... (Score:5, Funny)
Armchair critique (Score:4, Interesting)
This isn't a debunking.
It's an armchair critique of someone else's work.
A competitor (see Live OneCare) wrote an article about an early BETA of a new OS saying is had some issues? Shocking!
What are you saying here, Kristian? Bugs are inevitable, so we should just give Apple a free pass on their share of problems because, well, it affects all software?
Ok, that's enough of that.
I feel Kristian really needs to perform his own research and analysis, and draw his own conclusions.
PS: Don't mod this as flamebait until you read Kristian's entire post. Really.
This was fairly obvious at the time. (Score:5, Insightful)
Any observer from a tech background would know that this would turn his results to shit, but he is;
- A Microsoft Employee
- A Blogger
so that never mattered anyway.Vista on Firewalls... (Score:5, Funny)
I Am So Amazed That MS Would Deceive (Score:5, Funny)
Like literally copying/stealing other people's code line for line and putting it in their OS? (Stacker)
Like putting in software hooks to see if competing office products were running and then crash them or make them run slow? (WordPerfect)
Like swapping code in an OS and a browser to make it appear that the browser was integral to the OS to weasel out of antitrust issues? (Win98 / Explorer)
Naw... I just can't believe that MicroSoft would stoop so low as to try to promote its "ground-up" new OS (that amazingly has many of the exact same vulnerabilities as XP) as being hardened and more secure than Linux and OSX>
They wouldn't do anything like that, would they?
Slander and Libel (Score:4, Interesting)
Stuff like this seems very close to being Slander and Libel [wikipedia.org]. I'm sure a more informed reader will know why it isn't, but even then, it just seems quite close to being so. There are many organizations and individuals with an invested interest in the promotion and sale of Linux.
Brandon Petersen
Re:er (Score:5, Insightful)
Vista updates by default. It is nicely built into the shutdown interface. By default you "update and shut down" if an update is available. Firewall is also built in and seems to be relatively well designed. Very honestly I am impressed with Vista's default security.
The rest of your post I agree with. For example will this help my sister-in-law who loads every toolbar and screensaver known to man? Nope. If a user downloads flaky spyware software, there isn't an OS that can help. But Vista truly is a step in the right direction for the majority of folks who just want to browse and email.
Parent
Don't accept abuse. MS apparently lied. (Score:5, Interesting)
Quote from the Slashdot story: "In short, the original Microsoft analysis was good PR and poor research." It amazes me how easily people accept abuse, and give excuses for being abused. It was not "good PR". My best understanding is that Microsoft's analysis was an intentional lie.
My rule number one in dealing with Microsoft: Unless forced by circumstances, never upgrade to a new version of Windows until the second service pack is released. Let other people have the grief. The huge number of bugs in Windows XP before SP2 was very expensive for us. If I remember correctly, SP2 fixed more than 630 bugs, and some of the fixes were not documented. It is not only the vulnerabilities that are expensive.
Quote from the link in the Slashdot story: "Also, the entire networking stack was rewritten for Vista, and that means lots of new bugs are present. I have already spoken to other researchers who have not disclosed such flaws publicly. However, a good start for learning about some is the Symantec paper that analyzed Vista during the BETA phases and revealed numerous issues."
Microsoft has, in my opinion, a long, long history of not allowing their programmers to finish their jobs. There were even security vulnerabilities in the Microsoft Help protocols!
Parent
Re:Don't accept abuse. MS apparently lied. (Score:4, Informative)
Better yet:
Wait until the service pack is out and independent reviewers are happy with it. Because if people stick to the rule "after SP X things are fine", it is merely an incentive for Microsoft to rush the service packs until the number X in question is reached.
In the case of Vista, it seems Microsoft was already organizing the beta testing for SP1 before the OS was released to end users:
http://news.com.com/2100-1016_3-6152704.html [com.com]
That article was from January 23rd. Looks like the beginning of a trend to increase the SP count as fast as possible.
Parent
Re:Don't accept abuse. MS apparently lied. (Score:4, Insightful)
I don't think it has to be. Let's consider a hypothetical case: suppose you had an chemical plant that for years spewed toxic effluent into the river, and which got a deservedly bad name for this. Then, let's suppose, the cleaned up their act and stopped dumping toxins, maybe compensate the people living locally.
At this point, the company still have a bad image, even though they are now good neighbours, so it's a legitimate tactic to get a PR crew in to address the image problems. You've seen the sort of thing: take some film crews around the plant, make some commercials with lots of pictures of sunlight, ripe wheat, green trees and healthy babies.
On the other hand, they could do pretty much the same thing if they haven't got rid of the toxic effluent, or if they solved the problem by venting it as vapour through the air conditioning system at the nearest school.
The trouble is that companies seem to have figured out that they get about the same effect whether they fix the problem or not. So why spend money fixing the problem if the PR is all that's needed?
So, yeah, PR is pretty much the same thing as lies. It needn't be, and it shouldn't be -- but on the whole, that's the way to bet.
Parent
Re:Get The Facts (Score:5, Funny)
Given Slashdot's exemplary editorial standards, how could it possibly be otherwise?
This is clearly a gross oversight on Taco's part, and will be looked into with the gravest of concern, there can be no doubt. I suspect your well-crafted tag will don the front page in no time, perhaps even in an extra-crisp font to make up for any negligence and mishandling involved.
I look forward to it with heightened eagerness, and commend you on the alacrity and aplomb you've shown in this, your all-important tag-choosing endeavor.
Godspeed, you will prevail.
Parent
Obscure? And the 2nd study is just as bad! (Score:5, Insightful)
Then you claim that the second report addressed all those issues. That's not at all true. Sure, it doesn't count Firefox bugs any more, but that's not the real problem with the study. The real problem is that counting vendor-acknowledged bugs isn't a security metric at all! That's right, it's not the least bit useful for giving either an academic or real-world measure of security. You can't rescue the original study from that flaw without redoing it and abandoning the original premise.
But I guess you wouldn't know that, because you don't know these "obscure" sites that people who know about computer security do. I mean, next thing you know, people will be citing virtual unknowns like Bruce Schneier as if they knew anything about security! Or maybe Fyodor, I bet he doesn't know a damn thing about networking. What did he ever do? Make up that silly fake application they used as a "hacking" tool in the Matrix movies? [/sarcasm]
Parent
Re:Obscure? And the 2nd study is just as bad! (Score:5, Insightful)
"The numbers" would certainly look very different if Microsoft adopted the methodology used by most open source projects of fully disclosing every bug. Or if open source projects mirrored Microsoft's practices. It is very well known that Microsoft does NOT fully disclose all bugs and many cumulative patches silently fix MANY problems. The severity of bugs is also classified very differently.
You are right about one thing, it is all a numbers game. But you are WRONG that it means anything, even that Microsoft is improving. It means NOTHING. Nothing at all. It's only a numbers game. Even if someone else games the numbers differently and Linux-based systems look better, it still means nothing to compare numbers of bugs when very different philosophies and practices govern which bugs are fully disclosed and how their severities are rated.
Parent
Re:Where is the debunking? (Score:5, Informative)
That's because you are gullible enough to believe the hype, aggravated by your lack of will to perform a basic search for the facts. Here is a bit of debunking from a quick google search.
From Secunia's advisory atatistics:
Those are real world facts supported on real world evidence which is freely available to the public. It isn't a random blog entry which is based on god knows what data which is only known by the author and possibly doesn't even exist. So where in fact is there a need to "debunk" a moronic, unsubstantiated claim made by some microsoft employee, specially when there is all that evidence right in front of everyone's face?
Parent