More Than Half of Known Vista Bugs are Unpatched 257
MsManhattan writes "Microsoft security executive Jeff Jones has disclosed that in the first six months of Vista's release, the company has patched fewer than half of the operating system's known bugs. Microsoft has fixed only 12 of 27 reported Vista vulnerabilities whereas it patched 36 of 39 known bugs in Windows XP in the first six months following its release. Jones says that's because "Windows Vista continues to show a trend of fewer total and fewer high-severity vulnerabilities at the six month mark compared to ... Windows XP," but he did not address the 15 unpatched flaws."
Why would you ever..... (Score:3, Insightful)
Simple Explanation (Score:4, Insightful)
In Other Words (Score:5, Insightful)
So, they're not fixing the bugs because Vista is less buggy than XP? Whatever happened to fixing it because it was broken?
Vista flaws are not as critical as XP (Score:3, Insightful)
Talk about spin (Score:2, Insightful)
An article on engadget that is pointing to the EXACT same data...yet the title there most certainly provides a seriously different outlook does it not? I do not blame anyone, however, as if I had seen an ACTUAL nuetral title along the lines of 'microsoft employee posts dubious data of questionable usefulness to anyone except PR departments' I would without doubt have just scrolled on...
Re:Why would you ever..... (Score:5, Insightful)
If you RTFA, you'll see that Vista's unpatched vulnerabilities are not considered "critical" because, thanks to Vista's improved security model, are virtually impossible to exploit.
Slashdot actually managed to spin a highly positive analysis of Vista into something that suggests Vista is not only worse than XP, but Microsoft is somehow going out of its way *not* to fix it.
Gotta love it. Slashdot is the GOP of technology news sites.
Re:Wrong title (Score:0, Insightful)
As the OpenBSD guys say "the difference between a bug and a vulnerability is the intelligence of the attacker".
Re:Why would you ever..... (Score:2, Insightful)
If you want to read the actual report, check out the link to the PDF from this page: http://www.vnunet.com/vnunet/news/2192615/microsof t-claims-vista-secure/ [vnunet.com]
Does this count all the secret fixes? (Score:4, Insightful)
Microsoft has acknowledged that they include secret undocumented patches in hotfixes, patches that would count against their "score" if they were required to count them... open source software doesn't have the luxury of hiding their dirty laundry like that. And it's not just Linux that suffers from that "disadvantage", OS X has an awful lot of open-source components, and many of Apple's updates have been patches rolled in from them.
Microsoft's gaming the system here. Statements like this should be granted no credibility.
Re:Why would you ever..... (Score:4, Insightful)
But no matter how good your code is, things will be missed. That's the point of having things like Address Space Layout Randomization, IE 7 Protected Mode, Session 0 Isolation, and the dozens of other security layers that Microsoft added to Vista.
Furthermore, being rated non-critical can often mean that it requires significant user action (like turning off multiple security features) in order to make a user vulnerable.
What's next, are you going to blame Microsoft when a user smacks their motherboard with a hammer?
The fact of the matter is, that at least so far, Vista is proving to be the most secure OS on the market. (Aside from perhaps OpenBSD, of course.
Otherwise, keep your silly analogies to yourself.
Re:Does this count all the secret fixes? (Score:1, Insightful)
Re:Why would you ever..... (Score:3, Insightful)
You're committing a logical fallacy in your post. You equate the fact that your Macs have never been compromised (that you know of) to the their actual security. This is an invalid equation.
I could write a piece of software that had a 1000 known critical security vulnerabilities, but it might never get hacked. Does that then mean that my software is secure? Of course not.
Factors that contribute to whether or not something gets compromised include the number of vulnerabilities in the code, but it's not limited to just that. Usage is a big factor. In the cause of my buggy piece of software, if I'm the only one who uses it, it's unlikely to be a target.
Similarly, Mac OS X is used by far fewer people than XP. And, as of April, Vista was used by about 50% as many people as use Mac OS X. Change are, Vista is now used by more people than Mac OS X. So a direct comparison is now at least more valid.
Macs have had far more known vulnerabilities than Vista, and even than XP in recent years. That's an objective fact. A fact that can't be changed by how much Steve Jobs coolaid you drink.
Not the article I read. (Score:2, Insightful)
The article I read trashed M$'s sorry analysis and told me to expect more of the same from Vista as we've seen with every other M$ OS:
Re:Why would you ever..... (Score:2, Insightful)
Re:Why would you ever..... (Score:4, Insightful)
Re:Why would you ever..... (Score:3, Insightful)
Always that old security by obscurity mantra. Who cares WHY I don't get my Mac house burgled as often as my neighbors Windows house. Maybe my house doesn't have bars on the windows and bank safe doors and locks either. What is nice is that burglars bypass my house and go to the ones down the street. I also don't have to waste money on added security and guard services. The bottom line is that there are NO Mac botnets, whereas there are thousands if not millions of Windows machines in the service of criminals today. Theoretical vulnerabilities mean nothing in the end, but the number of compromised computers is what counts.
Re:Why would you ever..... (Score:1, Insightful)
"I can use Linux how ever the hell I want and not worry about stupid OS design"
Really? That's funny. Make a change to a setting in Gnome and tell me where it's stored. ~/.gnome? ~/.gnome2_private? ~/.gconf? /etc? /usr/local/etc? It's a lottery. Couple that with applications that explode files all over your hard drive (/usr, /usr/lib, /opt, /etc and so forth) and you have an absurdly complicated, clumsily constructed OS built from thousands of components from a massively splintered development group.
It's pretty stupid OS design. Sure, it's better than Windows in some respects, but go look at OS X, VMS or Syllable for proper OS design.
"bad programming letting infectious software damage my system"
How utterly laughable. There have been 123 security advisories [secunia.com] for kernel 2.6.x. Ubuntu 6.06, the Long-Term Support release, has had 145 advisories [secunia.com]. Core libraries and components have suffered major vulnerabilities. Do those numbers not bother you? Linux is pretty weak security wise. Sure, nobody is crafting exploits for the tiny percentage of desktop Linux users right now, but it's still shockingly bad.
Your post sums up the massive blind zealotry in the open source world that puts many of us off using Linux. It's a vast, hugely complicated OS with many security problems cropping up regularly. Just because it isn't exploited to the same level as Windows doesn't change that fact.
But congratulations on the supreme ignorant zealotry in your post. Keep your fingers in your ears and singing "blah blah blah" when any problem is mentioned!