Flawed Survey Suggests XP More Secure Than Vista 235
SkeeLo writes "One of Vista's big selling points is security, but a report from CRN concludes that Vista offers little in the way of security advancements over Windows XP. Ars Technica analyzed the report and found some methodological problems. 'The report faults Vista for "providing no improvement in virus protection vs. XP," but of course Windows Vista does not ship with antivirus software — something the reviewer fails to mention. Faulting an AV-less Vista for not stopping viruses is a bit like faulting a door without a lock for opening when the handle is twisted.' That's not all: 'It was also disappointing to see CRN completely ignore the issue of buffer overflows, which has been addressed well in Vista by most accounts. This was a major weak spot with XP, and so far, Vista looks strong in this area, strong enough that Vista may never get its own "SQL Slammer." Why CRN didn't address this is a mystery, as it is no minor matter.'"
Let's see (Score:5, Funny)
Study finding XP more secure than Vista = Y hits.
if (x > y)
post Vista more secure than XP
else
post Vista less secure than XP
Re: (Score:3, Funny)
XP more secure than Vista, apparently.
Google fight [googlefight.com]
Re: (Score:3, Informative)
"study finding xp more secure than vista" -- 0 results
"study finding vista more secure than xp" -- 0 results
"vista more secure than xp" -- 1820 results (note I changed "then" to "than." It's amazing what differences correct spelling can make)
"xp more secure than vista" -- 2 results
Then I wondered how these results
Re: (Score:2)
The only reasonable conclusion, then, is that only idiots post that XP is more secure than Vista.
Re: (Score:2)
I think we have a winner.
Anti-Virus (Score:4, Insightful)
If MS put in a AV software, other AV companies will file for anti-competition lawsuits; If MS didn't, consumers will moan about it too.
Re: (Score:2, Insightful)
Re:Anti-Virus (Score:5, Funny)
No. No! No!!
It is a Genuine advantage
Re: (Score:2)
i still put most of the blame on the user who clicks every popup even if it says "don't click this, your computer will be immediate infected with viruses". i haven't had a virus or spyware infection when running XP, 2000, 98, and for the past several months since i install
Re: (Score:2)
Re: (Score:2, Insightful)
Of course, if they had engineered in things like privilege separation and all the other "security" features of Unix (any of 'em, take your pick, Mac, Linux, what have you) then they'd enjoy all the "intrinsic" lack of NEED for antivirus that Unix systems enjoy.
Had they actually spent the last 7 years improving the underlying privilege model instead of just building and dropping vampireware like WinFS that never saw the light
Re: (Score:2)
You're right that security isn't a product, it's a process, but over the last 6 years we would hope MS would have learnt enough about the issues they faced with XP to incorporate solutions into Vista.. What you have to remember is a product can be the end of a very long proces
Re: (Score:2)
AV is not a lock (Score:4, Insightful)
By the time your AV software comes into play your already infected. So AV software is not the lock on your door. Its the rifle in your house.
Still important, But vary different.
Re: (Score:2)
Re: (Score:2)
I'd say AV software is more like having a bouncer at the door... preferably with a rifle.
-matthew
Re: (Score:2)
Re: (Score:2)
Windows is more like the house with a simple lock on the door. Plenty of other ways to get in, but it's up to the homeowner to implement the security.
Re: (Score:2, Insightful)
Right now linux is more like an empty house. No one bothers to break into the house because they know there's not enough in it for them to do so.
Corporate, government and financial databases aren't enough of an incentive? There's millions of dollars worth of information tied up there for anyone who figures out how to get at it.
What about home routers? If you can hack into few million broadband routers, you've got yourself a major botnet with little to no antivirus. Not to mention you're past the primary protection of the average home network. From there, you could spam networked printers with ad printouts and read the contents of any netork sha
Re: (Score:2)
What? My linux box is 100% secure. (Score:3, Funny)
Re: (Score:2)
AV is a bit like the rifle, because it's the last line of defense, and a pretty damned weak one. I'd say anytime your AV hits, if you didn't see it coming with that particular file, you're doing something wrong.
Urg (Score:5, Insightful)
Or rather.. it's a bit like faulting the construction company when the wall in your house fell over because somebody knocked on the door.
Anywho, anti-virus and personal firewalls are ridicilous concepts. You shouldn't have userland applications necessary for keeping other userland applications out of the actual operating system.
Re: (Score:2)
Anywho, anti-virus and personal firewalls are ridicilous concepts. You shouldn't have userland applications necessary for keeping other userland applications out of the actual operating system.
Even if Vista was as secure as OS X or a tinfoil hat version of linux you'd still have to contend with insecure applications and stupid users. Apple's install base tends to have more
Re: (Score:3, Insightful)
Apple's install base tends to have more of a clue then Windows users and Linux boys can at the very least ID when their infected or comprimised.
What?
If you are talking about the population that uses Apple Mac products, then I think you are HIGHLY misinformed. The main reason why many of them made the switch is PRECISELY BECAUSE of their inadequate knowledge on how to protect their Windows PC from viruses, spyware, etc. Many experienced power users who run Windows (XP, at least) software have NO protection and can still have great security provided strictly by the OS. Are all of those configured BY DEFAULT? Of course not, which is a major reason
Re: (Score:2)
How, exactly? The key to a well-designed trojan is that the user can't easily tell it's there.
Re: (Score:2)
Re: (Score:2)
Was that in the long-ago days before the ".com" extension or the ".bat" file...unless you're referring to some halcyon period before MS-DOS?
Re: (Score:2)
- having users use a least-privileged account that cannot write into C:\WINDOWS and C:\Program Files
- installing a service like TrustNoExe that disallows running programs that are not stored in those directories
Users can download whatever they want, they just cannot run it, install it, etc. They will have to log in as an Administrator first (or at least provide the password).
In a company environment this works very well. At home it probable does less, because the user and th
Re: (Score:2)
MS could have sorted the mess out by locking down vista by default, instead they bottled it and introduced all sorts of shadow directories so the apps still think they have write access to program files and the system registry... and they a
Re: (Score:2)
They are JUST NOW realizing that both a) leaving your system wide open is a bad idea and b)having all app
So how do you do that? (Score:5, Insightful)
Vista already has privilege escalation if that's what everyone is bitching about. So evil apps that want system access will have to ask for it, just like everything else. However if the user says "Sure, you can have that," what can the OS do about it? Apps don't have an "evil bit" they are just code to be executed.
Same deal with the real world. If you choose to unlock your door and let someone in, it's not the fault of the people who made the lock or the door that you did.
I think the grandparent is just another of many Windows haters that seems to think there's some magic that could be done to keep viruses out that MS just won't do. Well, actually there IS such a technology and that would be the scary version of trusted computing. If hardware enforced protections past what the OS could override, and checked signatures on apps, then only valid, signed apps could run. Provided the signing authority did their job, there'd be no viruses. Of course that would mean giving total control of your computer to a third party, something I think none of us want.
What it comes down to is there is no way for an OS to both give someone control of their system and protect them from themselves. The ability to grant the authority to run code at a privileged level implies the ability to do it for both good and bad code. Thus the necessity of virus scanners. They maintain a known list of bad code, and can warn you if you try to run that. I suppose you could build it in to the OS, but it changes nothing, it is just a virus scanner that's part of the OS now. There's no magic juju, other than taking away the user's administrative rights, that will work.
Just to be clear: By taking away administrative rights I don't mean running as a deprivileged user, Vista does that, I mean NO admin access AT ALL. No escalation, period. That'll do it. Indeed we do that at work as much as we can and on those computers, we have no problems as users simply can't install software. However to do it at home, well you can see how that'd be a problem.
Re: (Score:2)
If M$ had not been so monopolistic and tied everything together to give their applications an OS advantage and to keep competitors from equal install capability or equal access to protocols
Ok, major problems with that (Score:2)
Re: (Score:3, Interesting)
Linux (with selinux enabled) can be configured to do that.
You miss the point though. A *user* with administrative privilege. That's the problem with Windows. The only person with admin rights should be the admin. Hopefully someone with enough clue to know what they're installing.
Oh and you need to fi
Re: (Score:2)
is this /.? (Score:4, Funny)
Re: (Score:3, Funny)
Pretty crappy door IMO (Score:3, Insightful)
I'm sorry, but if I bought a security door that claimed it would keep out 99% of criminals, I would be a bit pissed off if I got it home and realised that an actual lock for that door was considered an 'optional extra'. The idea of browsing the internet with IE, no anti-virus and the windows firewall for any length of time, even no longer than it takes to download zonealarm and avg, gives me the heebie-jeebies.
Re: (Score:2)
Re: (Score:2)
If MS put AV in Vista there would be loud cries of "unfair competition, you're taking away our niche!" and we'd be on another round of anti-MS propaganda.
I've always thought there's a huge disconnect between the way most computer users think, and the way people think who'd bitch about that "unfair competition". The operative word in the quoted statement above is "our". Those people constituting the "our" group are much, much less important than the regular computer users.
I, being one of those "most computer users", think that however Windows is secured is just fine by me, as long as it doesn't limit _too_ much of the functionality. I d
Re: (Score:2)
Microsoft should not have to "include an AV program" or "provide one by default" they should eliminate the need for any such thing entirely.
Of course, I am well aware (as is surely those at MS) that it would break too much compatibility of all those many, many legacy apps that keep the custome
Re: (Score:2)
The Flaw is the Survey. (Score:2, Flamebait)
Comparing XP to Vista security is kind of like having a SUV milage competition, except SUV's are sometimes useful and that utility is destroyed by poor fuel economy.
Missed? (Score:3, Interesting)
Also... were these systems ran all the way default, as in, boots up as Administrator with no password? (again, not sure how much that matters in a test like this)
I do agree with the title, flawed survey indeed.
I dont blame Vista or XP so much as I blame IE version X.XX
Id like to see the exact same suite of tests ran against the latest version of Opera, Netscape and Firefox.
Re: (Score:2)
By default the Administrator account in Vista is disabled and you can not log in as Administrator. You need to go to mmc to change this, it isn't visible in the normal "users" control panel applet (and you shouldn't change this, if for no other reason than because MS did not spend a significant amount time testing Vista running as Admin and there
Re: (Score:2)
Oh and administrator does have UAC. I only wish it didn't.. it's a royal pain in the ass trying to get anything done until I've created a privileged cmd.exe shortcut (itself a pain in the ass as they've blocked the name cmd.exe from elevating, you have to create a renamed copy).
Security == knowledge and other stuff (Score:5, Insightful)
- we managed to make the machines behave as we will
- we have invested money into third party security software
- we have invested time (which equals money) into free (as in speech) third party security software
- we have some knowledge and experience into XP security -- after these - what like 7? - years who doesn't?!
Right now we have quite healthly and working infrastructure based on XP and surrounding (like VPNs, IDSs, AVs, proxies, backup, imagining etc.) services. We know how to do it, we have experience.
Now Vista from my standpoint is just big black hole - another system from MS that does not offer me anything significant but opens a can of unknown worms... I don't see any serious businesses building their security infrastructure around brand new shining Vista systems.
Of course in *theory* Vista can be more secure, but from practical standpoint it is new and untested product that has ben rushed to the market.
It really depends on your security definition. Security is not a product - security is a proces in which you have knowledge about what you are doing. In which you have educated users. In which you have policies and audits and so on. Vista isn't anywhere near to be even a stable product from security standpoint.
Re: (Score:2, Funny)
(like VPNs, IDSs, AVs, proxies, backup, imagining etc.)
I like to imagine that my XP install isn't riddled with viruses, too.
Re: (Score:2)
No funny points for you.
Re: (Score:2)
Re: (Score:2, Funny)
flaw-reporting report flawed? (Score:2)
XP: No AV included
Vista: No AV included
Report says: "Vista no improvement over XP"
Report is pretty much correct.
XP vs. Vista is so ... (yawn) ... zzzzz zz z zz (Score:4)
Moot point (Score:2)
Re: (Score:2)
It's not like they are wholesalers who buy 100 units of something for fifty bucks and then turn around and sell 100 units of something for eighty dollars at retail. Perhaps they will someday begin
NO AV != No protection against viruses (Score:5, Insightful)
AV software is the day after pill (Score:2)
Since few people update their AV software each day they use their computer and indeed since the best that AV software can do is reactive in nature... AV software is more like the month after pill or even the 9 months after pill.
At best AV software is doomed to failure. This incident illustrates how serious the lack of security in common practice is. Clearly the perpetrators were a novices. Perhaps they were just a couple script kiddies playing around wondering if the lack of security was real.
If an
Re: (Score:2)
So how do you defend yourself against viruses? The only ways I can think of off the top of my head are:
Re: (Score:2)
Thing is, there is no 100% percent way, as you say. Noone wants "100% security" either, because it's impossible to have. But there are good methods to have a reasonable percentage of security and there are methods that don't guarantee a thing and only bring a marginal increase in security against unwanted code. Antivirus software is the latter. There is a huge fucking
Re: (Score:2)
No Locks on the door? (Score:4, Interesting)
I think the point is that M$ should have learned their lesson last time, and the time before that, and made vista such that having anti-virus software would be unnecessary. Or in the terms of the analogy, Having forgotten to put a lock on the door of their previous house and repeatedly come home to find their underwear scattered all over the yard, you would have thought they would have made a secure door this time.
Shrug, I disagree (Score:2)
the report faults Vista for "providing no improvement in virus protection vs. XP," but of course Windows Vista does not ship with antivirus software
I thought the big issue everyone had with Windows products were that they needed AV products in the first place because they were fundamentally insecure?
Shipping Vista with an AV package would have practically been admitting that they can't make secure products and the only thing left to do is have a separate layer in the OS to try to intercept stuff before it caused problems (or clean up after it), rather than blocking the holes in the first place - which is, I believe, part of the point of Vista's entire
Vista is a faulty OS? (Score:2)
Re: (Score:2)
Point is, Linux and OS X don't ship with AV software because they simply aren't big enough targets for people to actually care about.
Flawed counter argument (Score:2, Interesting)
'The report faults Vista for "providing no improvement in virus protection vs. XP," but of course Windows Vista does not ship with antivirus software -- something the reviewer fails to mention. Faulting an AV-less Vista for not stopping viruses is a bit like faulting a door without a lock for opening when the handle is twisted.'
Vista is supposed to have these features built-in, as well as a host of other improvements. Such as service hardening, anti-malware (which does claim to kill viruses), network a
Inflamatory titles, this applied to corps ONLY! (Score:2)
For whoever doesn't see this screaming at him, here's a breakdown:
In home-user-land, credendials were an option nobody used until Vista. NO amount of buffer-overflow susceptibility can EVEN COME CLOSE to outweighing the security implications of having UAC - a restricted-user+sudo working model rather than XP's work-as-root one. Vista and XP for the home user are incomparable and are in totally different leagues, vista winning by very, very, very long shot.
In corp-land, everybody (who gives a da
Re: (Score:3, Informative)
NO amount of buffer-overflow susceptibility can EVEN COME CLOSE to outweighing the security implications of having UAC - a restricted-user+sudo working model rather than XP's work-as-root one.
Re: (Score:2)
I'm not saying vista in unexploitable, or that particular exploits do not at all contribute to an OS's security rating. I'm saying a car with a seatbelt is better than a car without a seatbelt, regardless of which has what easily-pathchable (hence, minor) flaws.
I don't think there is *ANY* debate as to whether
Re: (Score:2)
Okay, here's the deal on CRN. (Score:2)
They look at things from a distinctly user-centric POV. They're focused on what the apps/solutions/OS they review do for the end user.
As such, they're not a "technical review" in any real way, shape, or form.
The term "fluff piece" comes to mind.
They add just enough to give the business users who read CRN a bare taste of what they're talking about. Any more,
In other news, it has been discovered... (Score:4, Funny)
MacroSubs has affirmed that this is incorrect, however, and stated today that the question will be settled once and for all when their new submarine, entirely made out of screening material, captures the imagination of the nation with its launch in 2009.
So-called "alternative" submarine manufacturers continue to insist on using steel for their doors and heavy lexan for their windows. They claim this quaint, antiquated approach lets them offer better floatation, efficiency at depth, and crew survivability, but independent studies have shown that their apparent "floatation edge" is due to the fact that far fewer of these submarines are produced, not any superiority in design. A. Noying, of an independent think-tank funded in part by contributions from MacroSubs, had this to say:
"Look, we all know that as more of these all-steel and plastic subs get produced, you'll start seeing network effects and their buoyancy will be reduced down to normal levels. Currently, with only a few percent of the market, the oceans aren't interested in them as a point of ingress. This will change soon and you'll see some interesting numbers from my lab to back this up."
When asked about the widespread buoyancy failures of MacroSub submarines around the world, Mr. Noying said only "it's hardly MacroSub's fault if submarine captains tend to drive their submarines into reefs and long-forgotten sea monsters. Their duty is only to make subs buoyant, not idiotproof. However, they are working on an interesting feature called USC, or User Submergence Controls, which should make things a little easier. The submarine will basically ask the captain if he's really, really sure he wants to increase depth, once per fathom. If the captain insists on running into that reef after all the help he's been given, perhaps he shouldn't be driving a sub anyway..."
"Vista remains riddled with holes" (Score:2)
Whose security? (Score:2, Insightful)
Flawed Survey Shows Penguins Eat Own Babies (Score:2)
Other flawed surveys show:
- Bush Is Actually Orangutan In Suit
- RIAA Hates DRM Music, Gives Thousands To College Kids
- Emacs Is Better Than Vim
- IE Is Most Secure Browser Of All Time
- Volcano Likely To Erupt In Redmond
You know what they say: "News for nerds. Stuff that matters."
Dumb statements r us... (Score:3, Insightful)
No, it's like comparing an old door without a lock to a new door without a lock and saying that the new door is no more secure than the old door. (Which sounds reasonable to me)
I guess nobody noticed (Score:5, Informative)
Microsoft is their own worst enemy; they make wild claims about the functionality of their latest version but that functionality never meets their or their customers expectations. Then some exploit points out that they were being economical with the truth. Much like a recently patched (again) exploit that affected 98, NT, 2000, XP and Vista. Seems somewhat odd that an operating system that has been completely rewritten at great expense and effort should be affected by the SAME bug that has been in their products for years.
I mean, how can a company whose email clients automatically launch attachments say that they take security seriously? Let's not get started on the brain-dead file association open / execution misfeatures in every version up to and including Vista. Here's an interesting exercise to see how bad things can get: rename a safe executable to a filename with a WAV extension. Now double-click it; the executable runs. Combine that with browsers and email clients that automatically play WAV files and you've got a very exploitable platform.
What continues to amaze me is that the file type security is applied based on the file extension - but when you execute a file, the system looks at the file header to determine how to open / execute it. This bit of design stupidity has been the cause of millions of systems being exploited. Just a simple check to see if the file header matches the selected file type would go a long way - but no, this is too difficult. Here, have a UAC nuisance instead...
Re: (Score:2)
Re: (Score:3, Funny)
To be fair, with windows you don't have to twist the lock... a strong fart on the way past would do it.
Re: (Score:2)
Re: (Score:3, Informative)
No it's not. I remember in Systems Programming for Windows 95, there was a great quote. They talked about protected mode, descriptor tables and so on. At the end of it, the author said something like
"I bet now you're trying to work out if it's possible to subvert this stuff. Well, it's so easy that there's no point. Windows doesn't protect the descriptor tables from Ring 3 [the least privileged] code so it's easy to create a trap gate or call gate
Re:Anything to slam MS (Score:4, Informative)
Study #1 finds that Microsoft has made no improvements (XP -> Vista)
Study #2 finds Study #1 to be incorrect and badly done.
In essence, the story accepts that XP isn't as secure as it could be, but Vista improves on this significantly. Its one of the most pro-MS stories I've seen on slashdot for a little while now. Of course, I'd never touch Vista personally, but that doesn't mean it isn't an improvement over XP in security.
Re: (Score:2)
I'm all about bashing MS, but using spurious logic to do so is just detrimental to the entire anti-MS movement.
Re:Anything to slam MS (Score:5, Funny)
It's almost done logging me in, in fact.
Re: (Score:2, Funny)
Personally, I am waiting until at LEAST SP1 is released before I install it.
Re:Anything to slam MS (Score:4, Interesting)
My comment was based on my experience earlier this week on Monday, only the second time I've been close enough to be able to identify a Vista install, and the very first time I'd used it. It had just been installed (as well as Office 2007) by one of my colleagues on a brand new HP laptop. No, didn't get asked to Allow or Cancel anything, but what I did experience didn't surprise me in the least.
From the instant I hit Ctrl-Alt-Delete (and this is after waiting for the machine to finish choking itself) it was the same familiar Windows experience - watching the HDD LED as if it's going to give some sort of indication as to when it might be safe to go on to the next step as the machine crawls through the login procedure - totally unresponsive for the majority of the time.
People bag Windows about insecurity, DRM and UAC all the time - they're not the things I have problems with. I play the game, keep machines patched, AV installed if the shareholders demand it, and so on. My only real gripe with Windows it simply that I habitually find small sub-tasks to do like clip my fingernails or organise desk-drawers while waiting for countless delays my Windows box gives me. Screwed if I'm going to spend a month of my life waiting for start menus to render.
Where with a different OS, I'd start the kettle boiling and check my email while that's going on, in Windows I launch outlook and then go and see to the kettle, because I know which will make me wait longer.
Re: (Score:2, Insightful)
Re: (Score:3, Interesting)
There are people who write worms and bot-net building trojans, but they have nothing to do with the virus scene.
Re: (Score:2)
Virii and trojans are so last century.
Re: (Score:2)
Re: (Score:2)
Personally, until I see an actual list of the questions, their sequence, the methodology, and the counts (with regional breakdowns, time of day, self-selection criteria versus random phone calls, how they handled people with unlisted cell numbers), any statistical study is meaningless.
Re: (Score:2)
Except, we're on slashdot, therefore I can presume that we are normally referring to such individuals.
You can presume that, but that is not what you clearly stated:
Since most consumers aren't buying WinVista if they can avoid it.
"Since most of us aren't..." would have allowed you to claim a presumption about /. users that may have been more accurate (which is still debatable as there are people here who seem to love Vista, and there has never been a poll to determine how many here will wait and how many here will not).
Nonetheless, a contradictory presumption of your own clearly worded statement is ridiculous. Most consumers are not /. readers. All /. readers combi
Re: (Score:2, Insightful)
Re: (Score:2)
But, if that were true, chip sales by Intel and AMD would be down
Gas prices are up, home sales down, the economic outlook is uncertain. U.S. Economic Growth Weakest in Over 4 Years [nytimes.com] So all discretionary spending is down.
But the Geek is just whistling in the dark when he claims that those that will be entering the market for a new PC won't be looking at Vista.
What draws these customers isn't the warmed-over XP box.
It'
Re:Isn't greater security a selling point of Vista (Score:2)
And how fast would MS find themselves in court again for monopolising everything if they HAD included A/V.
Re: (Score:2, Informative)
A lot of work was done to support running as normal user. This does not get much attention, but it means that I can (and I do) run as a normal user without administrative credentials (it is much harder to do this in XP). If I have to manage the system, I have to use full administrative credentials (read, su root). I
Re: (Score:2)
You mis-spelled predictable. The issue isn't that more people use Windows; the issue is that the same exploit reliably works on vast numbers of Windows machines. It's not the popularity, it's the monoculture [wikipedia.org], combined with a broken design that is trivially easy to exploit. Another example of monoculture and utter lack of security combining to create havoc is the Morris Worm [wikipedia.org] of 1988. Happily, *nix systems have moved on since then.
Re: (Score:2)
How could Microsoft have done better? If Microsoft had bundled antivirus software with the OS, the other antivirus software companies (McAfee, Norton, etc.) would sue Microsoft for anti-competitive practices. If Microsoft doesn't bundle antivirus software with the OS, CRN write a review saying Vista without antivirus software is no
Re: (Score:2)
Re: (Score:2)
No, all I said is that complaining that Vista-without-antivirus is no better at defending against virus attacks than XP-without-antivirus is about as dumb as complaining that Vista-without-printer is no better at printing out documents than XP-without-printer.
Note that I specifically chose the wording "defend against virus attacks" as opposed to "r