More Than Half of Known Vista Bugs are Unpatched

MsManhattan writes "Microsoft security executive Jeff Jones has disclosed that in the first six months of Vista's release, the company has patched fewer than half of the operating system's known bugs. Microsoft has fixed only 12 of 27 reported Vista vulnerabilities whereas it patched 36 of 39 known bugs in Windows XP in the first six months following its release. Jones says that's because "Windows Vista continues to show a trend of fewer total and fewer high-severity vulnerabilities at the six month mark compared to ... Windows XP," but he did not address the 15 unpatched flaws."

Why would you ever.....

[otacon]

announce something like that? That's not exactly the best PR for Vista. Then again Vista isn't exactly good PR for Microsoft.

Re:Why would you ever.....

[ThinkFr33ly]

Well, they didn't.

If you RTFA, you'll see that Vista's unpatched vulnerabilities are not considered "critical" because, thanks to Vista's improved security model, are virtually impossible to exploit.

Slashdot actually managed to spin a highly positive analysis of Vista into something that suggests Vista is not only worse than XP, but Microsoft is somehow going out of its way *not* to fix it.

Gotta love it. Slashdot is the GOP of technology news sites.

Re:Why would you ever.....

[morgan_greywolf]

If you RTFA, you'll see that Vista's unpatched vulnerabilities are not considered "critical" because, thanks to Vista's improved security model, are virtually impossible to exploit.

And I think you'll see that thanks to my new and improved door lock, the fact that I leave my windows unlatched is not a critical security issue.

Re:Why would you ever.....

[ThinkFr33ly]

And I think you'll see that thanks to my new and improved door lock, the fact that I leave my windows unlatched is not a critical security issue.

What a completely nonsensical and inaccurate comparison. Microsoft's Secure Development Lifecycle has almost certainly dramatically improved the quality of their code. This report, plus 3rd party counts of vulnerabilities, support this conclusion.

But no matter how good your code is, things will be missed. That's the point of having things like Address Space Layout Randomization, IE 7 Protected Mode, Session 0 Isolation, and the dozens of other security layers that Microsoft added to Vista.

Furthermore, being rated non-critical can often mean that it requires significant user action (like turning off multiple security features) in order to make a user vulnerable.

What's next, are you going to blame Microsoft when a user smacks their motherboard with a hammer?

The fact of the matter is, that at least so far, Vista is proving to be the most secure OS on the market. (Aside from perhaps OpenBSD, of course. :) If you have data that suggests otherwise, then provide it.

Otherwise, keep your silly analogies to yourself.

Re:Why would you ever.....

[bmw]

The fact of the matter is, that at least so far, Vista is proving to be the most secure OS on the market. (Aside from perhaps OpenBSD, of course. :) If you have data that suggests otherwise, then provide it.

That's quite a statement. I don't have evidence supporting anything either way but I still have a hard time swallowing that one given my past experiences. More secure than previous Windows systems, perhaps. Most secure OS on the market? That's probably a bit of a stretch. Personally, I would still be far more comfortable with the security of any of the BSDs, Linux, Mac OS X, Solaris, or any other flavor of UNIX. Not to mention more obscure operating systems.

Furthermore, it's extremely difficult to prove such things. Simply looking at the number of vulnerabilities is nowhere near adequate and, given your statement, I think the burden of proof would be on you.

Re:

[greenbird]

Numbers are out there... Dare I suggest, "Open up and say ahh." ;)

And the "numbers" people like you point to are complete BS. Vista is simple an operating system and a very basic one at that. Yet you compare the number of vulnerabilities in it to the number of vulnerabilities in a full blown linux distro that provides a million times as much functionality. Lets see, Vista, very basic OS functionality, linux distro, very advance OS functionality plus 1000 applications. Yeah, that's a valid comparison. Hell, even the most basic linux or unix setup provides far more functi

Re:Why would you ever.....

[TheRaven64]

Vista is proving to be the most secure OS on the market. (Aside from perhaps OpenBSD, of course. :)

I believe the most secure OS on the market at the moment is probably OpenVMS. Certain others, like Symbian, seem to do well too. I don't know of many Symbian compromises, in spite of the hundreds of millions of Symbian devices that spend 100% of their time connected to the network. I believe even WinCE has a better security record than Vista to date, so it's not even the most secure Microsoft operating system out there... OpenBSD has had a couple of security holes recently, but probably less than Vista.

It's very difficult to compare the security of OpenBSD to Vista, because of what is included. OpenBSD, for example, doesn't include a web browser in the base system. It includes X11, but not a complete desktop environment. For it to be a fair comparison, you would have to compare OpenBSD + GNOME (for example). On the other hand, OpenBSD includes a number of things that aren't in Vista, such as a compiler, so you might have to throw in Visual Studio. But that's an IDE, so maybe throw Eclipse into the OpenBSD pile...

Re:

[IamTheRealMike]

Certain others, like Symbian, seem to do well too. I don't know of many Symbian compromises, in spite of the hundreds of millions of Symbian devices that spend 100% of their time connected to the network.

Are you kidding me? Try switching your phones Bluetooth on and walking around a city for a few days. You'll almost certainly be asked to receive a .sis file - this is a Symbian virus. The most common exploit in Symbian is actually not a buffer overflow from what I understand but a GUI modality exploit ...

Re:

[danbert8]

I would argue that MS-DOS is more secure than Vista because you have to be physically present to run programs and you can't run malware in the background.

Re:

[shaitand]

'What a completely nonsensical and inaccurate comparison.'

Your right, let me fix it. A comparable view would be not locking the doors or the windows because you have an alarm that would sound if they are opened.

'This report, plus 3rd party counts of vulnerabilities'

This report is from the vendor, it doesn't support anything. As for vulnerability counts, despite Microsoft's love of them it has been well established that they provide no meaningful metric of security.

'almost certainly dramatically improved the

Re:

[ThinkFr33ly]

You sir should think before you post.

You might want to follow your own advice.

You're committing a logical fallacy in your post. You equate the fact that your Macs have never been compromised (that you know of) to the their actual security. This is an invalid equation.

I could write a piece of software that had a 1000 known critical security vulnerabilities, but it might never get hacked. Does that then mean that my software is secure? Of course not.

Factors that contribute to whether or not something gets compromised include the number of vulne

Re:

[Anonymous Coward]

"Objective fact" for which you only provide an assertion and not a shred of evidence. Put up or shut-up.

Bottom line: M$ experience sucks.

[twitter]

the fact that your Macs have never been compromised (that you know of) to the their actual security. This is an invalid equation.

The fact that only M$ machines get screwed and die along with your work is a good reason to avoid the platform.

Re:

[drinkypoo]

The fact that only M$ machines get screwed and die along with your work is a good reason to avoid the platform.

That, my friend, is a bunch of fucking bullshit.

I have a Dual G5 to my right. It is now running 10.4.10. At least under 10.3.whatever and 10.4.whatever-before-10 (

I also run on Linux and, I have to say, it still has problems resuming from the fucking screensaver if I close the lid. PATHETIC. Sometimes I can fix it by logging in remotely and killing the screensaver process[es]. Sometimes I have

Re:

[drinkypoo]

Notice how he doesn't say that he has any grief with Mac OS X.

Do you mean me or the guy before me? Because I actually wrote a whole paragraph about how the OSX machine is crapping on me on a regular basis, and then apparently I lost it somehow. Probably I accidentally selected text and typed over it, but maybe it's a black turtleneck conspiracy. Can't blame it on Apple directly though, because I slashdot from Firefox on Ubuntu.

Re:

[dedazo]

ACPI was intentionally sabotaged

You linking to that post is hilarious. You figure no one will notice this reply [slashdot.org] and the subsequent ones in that thread?

Re:Why would you ever.....

[Enrique1218]

OSX has more vulnerabilities than XP or Vista. Where do you get that number? Please publish the links to at least 3 source of said number. I am just curious. This being slashdot and all. I am befuddled how so many haven't mastered citing a reference.

Re:

[JonXP]

Well, I don't know if you'll accept one well-trusted source instead of three random blogs, but here you go:

According to Secunia (for 2007):
Vista - 7 advisories, 2 unpatched (unpatched vulns listed as not critical)
OSX - 16 advisories, 3 unpatched (unpatched vulns listed as less critical)

There's too few to have a meaningful comparison of vuln severity levels, but OSX would win on percentages.

For what the original poster actually said "...even more than XP in recent years..."

Here is 2006:
XP - 45 Advisories (36

Re:

[partenon]

Links please?

Statistics for 2007, directly from Secunia website:

- OSX
Affected By 103 Secunia advisories
Unpatched 5% (5 of 103 Secunia advisories)

- XP
Affected By 186 Secunia advisories
Unpatched 16% (30 of 186 Secunia advisories)

- Vista
Affected By 10 Secunia advisories
Unpatched 20% (2 of 10 Secunia advisories)

Source:
http://secunia.com/product/13223/?task=statistics_ 2007 [secunia.com]
http://secunia.com/product/22/?task=statistics_200 7 [secunia.com]
http://secunia.com/product/96/?task=statistics_200 7 [secunia.com]

Re:

[molarmass192]

Macs have had far more known vulnerabilities than Vista, and even than XP in recent years. That's an objective fact.

No ... that's a SUBJECTIVE fact. That's the most full of shit statement I think I've ever seen posted here. You're comparing a MS OS built primarily for playing video games and running a web browser to an OS built on a core designed to be a hardened server on the internet. I've never EVER had a Linux / Solaris / Mac box compromised while I routinely see compromised XP boxes. Also, I know of

Re:

[arminw]

.....The consensus outside of Redmond is that Vista is the epitome of bloated resource hungry software.......

Indeed true. I Installed VISTA in Parallels on my Mac and it is dog slow compared to XP. I got VISTA not so much to use it, but just to learn about it first hand. I actually USE a few Windows programs only in Win2K and XP. Win2K runs the same software MUCH faster than XP. VISTA's activation scheme is a lot more fragile than XP. It has already asked to be activated twice. It did do it though.

You are r

Re:

[arminw]

......Similarly, Mac OS X is used by far fewer people than XP.......

Always that old security by obscurity mantra. Who cares WHY I don't get my Mac house burgled as often as my neighbors Windows house. Maybe my house doesn't have bars on the windows and bank safe doors and locks either. What is nice is that burglars bypass my house and go to the ones down the street. I also don't have to waste money on added security and guard services. The bottom line is that there are NO Mac botnets, whereas there are thou

Re:

[skarphace]

Theoretical vulnerabilities mean nothing in the end, but the number of compromised computers is what counts.

Not when you're debating system security. You may as well run Windows 1.0 if you think being in a group so small that no cracker would waste their time on writing a worm for your system actually makes you secure.

Always that old security by obscurity mantra. Who cares WHY I don't get my Mac house burgled as often as my neighbors Windows house. Maybe my house doesn't have bars on the windows and b

Re:

[arminw]

......that no cracker would waste their time on writing a worm for your system.........

Is that not just great?! It's not just that there are fewer Macs, but also that the vast majority of hackers have lot of experience in how to break into Windows boxes. There are lots of tools around to help them break into those. Hackers are lazy bastards, otherwise they would get honest jobs. Learning all about how Macs work and building hacking tools, in order to break into them is a lot of work. So even if there were

Re:

[bhirsch]

You should care. In fact, you should be thankful for Windows' success; it is what you owe your Mac's safety to. The more people who switch to Apple computers, the more dangerous they are to use.

Re:

[arminw]

.... The more people who switch to Apple computers, the more dangerous they are to use.......

Not true. Even if 50% of all computer were Macs, the number of Mac hacks would not rise dramatically. Hackers are lazy, otherwise they'd get real jobs. If you were a hacker, which half of all computers would you rather attack? The easy half you know and have hacking tools for, or the other half for which you have nothing and are inherently harder to crack? There is no reason to assume that a hacked Mac would be more

Re:

[toddestan]

Not true. Even if 50% of all computer were Macs, the number of Mac hacks would not rise dramatically. Hackers are lazy, otherwise they'd get real jobs. If you were a hacker, which half of all computers would you rather attack? The easy half you know and have hacking tools for, or the other half for which you have nothing and are inherently harder to crack? There is no reason to assume that a hacked Mac would be more valuable to a criminal wanting to steal your private data than a hacked Windows system.

I dun

Re:

[IamTheRealMike]

Who cares WHY I don't get my Mac house burgled as often as my neighbors Windows house.

Smart people would care.

The problem with your line of reasoning is that it is self defeating. Let's say I go around telling everybody that Macs are more secure than Windows PCs. This isn't true if you take security in the objective sense - Mac OS X is of the same design era as Windows and Linux, and has lots of vulnerabilities. What's more, Apple don't seem to have any equivalent to the Secure Development Lifecycle ju

Re:

[chthon]

When I started in 1990 in the PC industry, there where Mac viruses plenty. The Mac was even more vulnerable than a PC, due to the auto execution of code when a floppy was inserted. I suppose most Mac viruses went the way of the dodo after the move to OS X, or maybe earlier after the move to the PowerPC platform.

Fallacy

[Anonymous Coward]

You sir should think before you post.
You might want to follow your own advice.

That goes for you too!

You're committing a logical fallacy in your post. You equate the fact that your Macs have never been compromised (that you know of) to the their actual security. This is an invalid equation.

I don't think this qualifies as an "invalid equation." Maybe if he was trying to say that a Mac is a PC, or that OSX is Vista, that would be an invalid equation.

What you are thinking of sounds much more like the fallacy o

Re:

[Zeek40]

I think a more apt comparison would be: "And I think you'll see that thanks to the fact that everything I own is either bolted to the floor or inside a vault, the fact that I leave my windows unlatched is not a critical security issue."

Re:

[Christopher_G_Lewis]

Well, yes, if the windows are on the 2nd floor and are covered with bars.

Re:

[Ucklak]

Don't have to RTFA

Microsoft has fixed only 12 of 27 reported Vista vulnerabilities whereas it patched 36 of 39 known bugs in Windows XP

As most analogies suck, if the OS was akin to a house, the 15 vulnerabilites should be something like:

1. Doorbell light not working
2. Doorknobs dirty and stick sometimes.
3. Windows have bad seals and moisture is visible inside.
4. Garage has unfinished walls
5. Backyard is not landscaped
6. House needs to be painted
7. Carpet needs to be replaced
8. House backs to a busy

Re:

[ThinkFr33ly]

Most analogies do indeed suck... especially ones that compare something as incredibly complex as a modern operating system to something as relatively trivial as a house.

Re:

[Lesrahpem]

I think the security industry has a pretty skewed idea of "virtually impossible" to exploit. The people who are saying these bugs are impossible to exploit are engineers and PR people, not people who actually have experience exploiting such bugs in the real world.

Re:

[Chris Kamel]

The same report, in fact, also says:
In the first 6 months, Red Hat fixed 119 of the 129 that had been publicly disclosed at release time, but new disclosures during the period meant that 65 issues were widely disclosed, but unpatched at the end of the first 6 months. 12 of the unfixed issues were High severity and 7 were Medium severity according to NVD ratings.
and
During the first 6 months, Ubuntu fixed 145 vulnerabilities affecting Ubuntu 6.06 LTS. 47 of those fixed were rated High severity in the NVD.

Re:

[Knuckles]

But of course we don't care about all that here on /.

Exactly, because for RedHat and Ubuntu they count the fixes for all applications that come with the OS. For example, Ubuntu released Ubuntu Security Notice USN-467-1 on May 31, 2007: "gimp vulnerability". The numbers for Windows, however, do not include the vulnerabilities in Photoshop.

Re:

[zippthorne]

Ok, I'll bite. Why GOP?

Re:

[shaitand]

'vulnerabilities are not considered "critical"'

By one source. And yes, this is the same bozo who attempts to claim critical flaws aren't critical at all because there are exploitable and unproven fail-safe security measures that might prevent them from being exploited.

'Slashdot actually managed to spin a highly positive analysis of Vista'

Actually you have it reversed. This was Microsoft's attempt to spin an extremely poor security effort in a positive manner.

'Microsoft is somehow going out of its way *not*

Re:Why would you ever.....

[CodeBuster]

Vista: The program ~_AllofTheBestOffers.exe is attempting to escalate its privilege level, Cancel or Allow?

User: Allow, Allow, Allow (dangit where is the free pron already?)

Vista: The program ~tracker.exe is attempting to change the firewall settings, Cancel or Allow?

User: Change the what? Allow...come on

Vista: The run32.dll has been altered since the last system scan do you wish to proceed? Cancel or Allow?

User: sigh....Allow

Vista: Windows has been updated and must be restarted, Cancel or Allow?

User: hmmmm....don't remember getting updates but updates are good...Allow

Several weeks later....

User: What is going on with all of these popups and free pron offers? Isn't Vista supposed to be more secure?

Support: Did you try rebooting?

User: yes, yes, yes I have already done that.

Support: Well, we can send you a new motherboard w/installation instructions....

User: Thanks, but my bank is on the other line...I am having some trouble with my accounts. Can I call you back?

Support: We are here to serve all of your customer service needs.

User: Uh, yeah whatever, bye.

The moral of this story is that no matter how many times the user is forced to click Allow, I agree, Yes, or Continue in order to shoot themselves the foot they will find a way to do it guaranteed. It may be true that Vista is better than XP is or was out of the box, but they have to assume that even though the user would have to click Allow ten times for some malware to get through that it will happen and not just to a couple of people either. They should at least tell people that they are working on the fixes instead of saying, "well if you are smart you wont get hacked, just don't always click allow."

Re:

[farrellj]

Actually, Linux *is* mainstream today!

Based upon the latest figures from NetCraft.

Over half of the Webservers on the Net today run Apache, and the vast majority are hosted on Linux systems...so Let's be conservativer and say only half of the 53% of the systems running Apache are on Linux, that would give Linux a share, on the low end, of 26.5%. Add into that, lighttpd which runs mostly on Linux, which has 1.2%...so on the low end of the estimate Linux runs at least 27% of the web servers on the Net, and if

Re:

[SwordsmanLuke]

Actually, they didn't announce anything *like* that. This article has more slant than... well the original *very slanted* report. The report this article is referencing is actually trying to make the point that Vista is (according to Microsoft's metrics) teh most secoor OS EVAR!!! The report compares the number of bugs disclosed in the first 6 months of the OS' existence which remained unfixed after 90 days. It seems to me that a more telling metric for security would be the longer term trend of bugs di

Actual quote?

[sobachatina]

What I would like to know is what the guy actually said. The article starts by saying that half the BUGS were fixed and then starts talking about half of the vulnerabilities and then uses the two words interchangeably.

Did the guy say half the bugs or half the vulnerabilities? Half the vulnerabilities seems bad to me. Half the known bugs is not bad at all- in fact I would consider that somewhere around par for software development.

Either way I agree it sounds bad.

Re:Actual quote?

[ThinkFr33ly]

Then read the actual report: http://www.csoonline.com/pdf/6_Month_Vista_Vuln_Re port.pdf [csoonline.com]

It sounds bad because the person who posted it to Slashdot, and Slashdot's editors, want it to sounds bad. Are you new here or something?

Re:

[nusuth]

Then again Vista isn't exactly good PR for Microsoft.

I recently bought a notebook with Vista Home Premium preloaded. Due to all negative things I've heard about Vista, I was prepared to downgrade. I was determined not to waste my time fixing a broken OS just because I could. However I was pleasantly surprised. It is, of course, nothing like what was promised a few years ago but it is an improvement over XP. The only problem I've had (about networking with XP) took five minutes to solve. It has also been ro

Wrong title

[trifish]

First, the author of the submission doesn't know the difference between a bug and a vulnerability. Second, the title ought to read: "Vista Vulnerabilies are Less Serious than in XP" (and there are fewer vulnerabilities in Vista than in XP in total).

That's the reason why only half of them were fixed while in XP most of them.

Re:

[MMC Monster]

Absolutely. Congrats should go out to MSFT that their new OS is more secure than their previous OS.

Of course, this being /., people will gripe that the default installation has any security flaws at all. That being said, most vulnerabilities could be mitigated by user education, anyway.

Flawed Logic

[asphaltjesus]

First sentence is correct. Author didn't distinguish bug/vulernability.

The second sentence, while double-plus-good Microsoft PR speak, is critically flawed reasoning.

If the parent said "Known Vista vulnerabilities..." I would agree, but that still glides over many fundamental liabilities that Microsoft products push onto the customer like:
1. The concept of security in Microsoft products means protect Microsoft's intellectual property.
2. No one can reasonably predict the scope or scale of Microsoft vulnerabilities.
3. Given Microsoft's history of producing "secure" operating systems, it is reasonable to assume there is no evidence end-user security features makes it through to the end product. Note carefully, Microsoft has *very* talented programmers who can code securely after all their monopoly status affords them this luxury. I'm saying that their work doesn't make it all the way through the management gauntlet. UAC is a perfect example. It is not a security boundary. http://blogs.zdnet.com/security/?p=175 [zdnet.com]

The Vista train will pull out of the station eventually because Microsoft's monopoly makes this a sure thing. As every other Microsoft OS has shown, there will be critical vulnerability surprises. It's a matter of when, not if.

MOD PARENT UP!

[Futurepower(R)]

Mod parent up!!! Good point about Microsoft management. In my opinion, Microsoft programmers are not allowed to finish their work.

My rule number one in dealing with Microsoft: Unless forced by circumstances, never upgrade to a new version of Windows until the second service pack is released. Let other people have the grief.

The huge number of bugs in Windows XP before SP2 was very expensive for us. If I remember correctly, SP2 fixed more than 630 bugs, and some of the fixes were not documented. It is n

Re:

[neoform]

"and there are fewer vulnerabilities in Vista than in XP in total"

Vistas been out for a few months; XP has been out for more than half a decade. Obviously there are more known bugs in XP than Vista.

Re:

[trifish]

Vistas been out for a few months; XP has been out for more than half a decade. Obviously there are more known bugs in XP than Vista.

You're obviously good at taking things out of context. If you read TFA (or at least the Slashdot summary), you'll know the context. TFA talks about vulnerabilities discovered in the 6 months after Vista release. You didn't really think I claimed that there were only 36 vulnerabilities discovered in XP in 6 years of its existence?

Not the article I read.

[twitter]

The article I read trashed M$'s sorry analysis and told me to expect more of the same from Vista as we've seen with every other M$ OS:

He published the data in an effort to show how Microsoft's software development methodology, called the Security Development Lifecycle (SDL) is yielding dividends. But his method of comparing Windows to Linux and Mac OS X is problematic, according to some.

"This is an apples-to-oranges comparison," said HD Moore, one of the hackers behind the popular Metasploit penetration

Re:

[dedazo]

The article you read, is it the one that fails to make a distinction between a bug and a vulnerability? Because that's the one I read. Oh, wait. We're in the Spin Zone. Sorry. Um, "M$ Windoze suxxorz LOLOLZ LINUX ROXXORZ!!!one!!!1!" There, that sounds about right. Facts and reality are so annoying and distracting anyway. Who needs them.

Re:

[Jugalator]

Exactly -- the first thing that popped into my head when seeing this was "but how SERIOUS are they then? are we talking of stuff requiring local systm access and a bootable Vista CD, remote attacks, or what exactly?"

Since the article didn't say outright in the summary, and it would have used the first opportunity to do so if they were serious (because this is Slashdot), I just assumed they were as little problematic in possible exploits as the currently unpatched minor security problems in multiple Linux ke

Re:

[Jugalator]

Secunia reports 9 unpatched vulnerabilities in OpenBSD 4. Vista currently has 15 according to this report.
Sure, OpenBSD "wins" in such as stupid comparison, but seriously... Is it a big deal...?

Re:

[brunascle]

no, all 9 are patched [secunia.com]. 0 unpatched.

Re:

[trifish]

the difference between a bug and a vulnerability is the intelligence of the attacker

The difference can be observed on the numbers: There are hundreds of known bugs, but only a few known vulnerabilities in Windows. Claiming that all bugs can be turned into vulnerabilities is ... inherent (and in some cases even provable) nonsense.

Rubbish.

[onion2k]

I've got two older brothers, I don't think that makes me stupid. ;)

Re:Rubbish.

[chalkyj]

As demonstrated by your uncanny ability to reply to the correct article [slashdot.org], right?

Re:Rubbish.

[Aqua_boy17]

I've got two older brothers, I don't think that makes me stupid. ;)

It doesn't. Only doing something like posting in the wrong thread would do that.

/chain yanking

Re:

[onion2k]

That was the joke. Hence the ;). Slashdot mods didn't get it though.

Re:

[MysteriousPreacher]

I got it - nice joke, it's more interesting than this Fox Newsesque presentation of the article as yet another "OMG, VISTA SUX0RS COMPARED TO XP!!1!" piece.

Re:

[suv4x4]

>Kinda of funny to post THAT on the wrong article, isn't it.

That was the joke. Hence the ;). Slashdot mods didn't get it though.

We have our first trans-article Slashdot joke. Party tonight :)

Simple Explanation

[Aqua_boy17]

From TFA:

"it will be more interesting to look at vulnerability statistics once Vista becomes more popular than XP, and the target of more hackers."

I for one am glad Microsoft releases fixes for XP problems in a more timely fashion than Vista. I would expect that when Vista deployments outnumber XP, the situation will reverse itself. So where's the story here?

Re:

[TheNetAvenger]

for one am glad Microsoft releases fixes for XP problems in a more timely fashion than Vista. I would expect that when Vista deployments outnumber XP, the situation will reverse itself. So where's the story here?

The story is, Vista now is more widely used than OS X and many *nix distributions, and with comparison to them, it is significantly ahead of all of them in terms of security. This is no longer about Vista vs XP or based on installations with Vista vs XP.

So one example coming from this report is now

Big deal...

[Kainaw]

Big deal. The VA has been trying fix VistA [wikipedia.org] since 1985.

In Other Words

[camperdave]

Jones says that's because "Windows Vista continues to show a trend of fewer total and fewer high-severity vulnerabilities at the six month mark compared to ... Windows XP,"

So, they're not fixing the bugs because Vista is less buggy than XP? Whatever happened to fixing it because it was broken?

Re:

[niceone]

Whatever happened to fixing it because it was broken?

The saying is: If it ain't broke, don't fix it. If it was the way round you said, the software industry would disappear under an infinite pile of gant charts.

Re:

[ThinkFr33ly]

Microsoft quickly patched all of the critical vulnerabilities in Vista. Those vulnerabilities that are not rated critical, which comprise 100% of the unpatched vulnerabilities mentioned in the article, are simply not very likely to cause issues for people.

Microsoft often waits to patch these kinds of vulnerabilities until they've taken care of more important things, like critical bugs, and sometimes chooses to roll them up into a service pack. This allows for more thorough testing and decreases the chance t

Re:

[lseltzer]

I think the delay is more likely attributable to them putting less-severe bug fixes on a longer and more rigorous test cycle.

Re:

[Churla]

Maybe it's because whereas the geekcore like the idea of seeing dozens of small patches/updates to packages come down when they do an apt-get update the general populace likes seeing one package which fixes several bugs.

This is the difference between using Service Packs and using individual patches for individual packages/applications. It's a Monolith versus granular approach.

Because of the scale MS has to work on and support people it's far easier for them to work within the monolithic model.

As for why th

Re:

[drsmithy]

This is the difference between using Service Packs and using individual patches for individual packages/applications. It's a Monolith versus granular approach.

You do realise a SP is basically just a bunch of individual patches bundled up together into a single, easily installable entity, right ? Like, say, Red Hat does with their regular repackaging to "RHAS 4 Update 3", etc.

Re:

[Churla]

Yes, exactly.

RHAS 4 Update 3 == SP for linux.

You can tell if when troubleshooting something you ask them "What SP/Update/Cluster Patch (for solaris) are you on?"

It's in how it's presented and perceived by the end users. Windows end users often don't want to see every little thing and every little fix. They want some big fix which hits on a regular schedule that they can install.

Vista is the youngest in the series

[Anonymous Coward]

So naturally his IQ is 3 points lower than his older brother XP.

Apparently the developers of Vista are following that trend too!

I know we slag them off...

[monk.e.boy]

I know our hobby is slagging of microsoft, but hey, copying Linux seems to be working out for them.

Oh, damn. My carefully crafted, pro microsoft reply, slipped into the usual M$ bashing. They are such an easy target. I can't help my self. Just like women drivers. I don't mean to joke at their expense, but sometimes the jokes, they slip out. I mean, I asked my girlfriend if my indicators were working and she said 'Yes. No. Yes. No.'

An oldie but a goldie. Feel free to use that one.

monk.e.boy

Re:

[Bacon Bits]

I mean, I asked my girlfriend if my indicators were working and she said 'Yes. No. Yes. No.'

An oldie but a goldie. Feel free to use that one.

A slashdot user with a girlfriend? That is a good joke.

Vista flaws are not as critical as XP

[erroneus]

The simple fact is, there are still more XP loaded systems than Vista. Vista isn't yet a target except in areas where XP and Vista share the same flaw. ...I kinda hope it stays like that for a while too.

Talk about spin

[Anonymous Coward]

http://www.engadget.com/2007/06/22/report-vista-mo re-secure-than-os-x-and-linux/ [engadget.com]
An article on engadget that is pointing to the EXACT same data...yet the title there most certainly provides a seriously different outlook does it not? I do not blame anyone, however, as if I had seen an ACTUAL nuetral title along the lines of 'microsoft employee posts dubious data of questionable usefulness to anyone except PR departments' I would without doubt have just scrolled on...

Re:

[GrayCalx]

I do not blame anyone...

Wait wait wait... you mean you're not blaming Microsoft or the Government?!? What kind of slashdot poster are you?

So damned complex

[mulvane]

They have made the underlying security model so damned complex that it takes 6 months to figure out how to patch a bug/whole.

They are not security holes. They are the patents

[140Mandak262Jamuna]

Those 27 disclosed vulnerabilities cover some or all of the 237 patents that Microsoft has. Dont you dare fix any of them with a third party tool. You will be violating the patent rights of MSFT!

Interesting

[ta bu shi da yu]

I wonder exactly what the data would be like if you compared vulnerabilities in 3rd-party software AND Microsoft issues vs. security problems in Linux distributions?

Is this the same guy who was bragging...

[jpellino]

About their patch time being 29 days to OSX's 46 and hundreds for linux?

Does this count all the secret fixes?

[argent]

Jones argued that Vista had a lower number of vulnerabilities than competitive operating system products such as Red Hat Enterprise Linux and Mac OS X.

Microsoft has acknowledged that they include secret undocumented patches in hotfixes, patches that would count against their "score" if they were required to count them... open source software doesn't have the luxury of hiding their dirty laundry like that. And it's not just Linux that suffers from that "disadvantage", OS X has an awful lot of open-source components, and many of Apple's updates have been patches rolled in from them.

Microsoft's gaming the system here. Statements like this should be granted no credibility.

Re:

[Goaway]

Apple, which is famous for its hostile attitude towards people who discover exploits as well as their secrecy about their patches are what they fix.

Famous in Slashdot-land, maybe. In the real world, not so much. Perhaps you should start being a little more critical of what the internet tells you.

Re:Does this count all the secret fixes?

[argent]

While I've certainly heard of Microsoft not disclosing the vulnerabilities until their patches are released, I've never heard of them patching things completely in secret. Do you have any citations to back that up?

Skeletins in Microsoft's Patch-day Closet [zdnet.com]

It's interesting that you attack Microsoft for secrecy but say nothing about Apple, which is famous for its hostile attitude towards people who discover exploits as well as their secrecy about their patches are what they fix.

You seem to be under a misapprehension here. I'm not defending Apple. I'm simply pointing out that Microsoft has more ability to hide security flaws in their software than any company that uses a significant amount of open-source software, and thus they can artificially reduce their "score" in this game to a far greater extent than either of the other organizations mentioned by Jones. That is, regardless of Apple's motivations and actions, they are simply not capable of hiding patches as effectively as Microsoft.

So:

1. Microsoft has more ability to "game the system" than Red Hat, Apple, or any other organization using a significant amount of open-source software in their product.

2. Microsoft has acknowledged that they are engaged in gaming the system.

I would be happy to discuss Apple's past behavior in an appropriate context. In fact if you google around you'll find that I've been quite critical of Apple when I've felt it warranted. There's plenty of other skeletons in Microsoft's closet if you want to get into a fan war, but you'll have to find someone else for THAT debate... again, google around, you'll find I defend Microsoft when I believe it's warranted. Basically, I'm poorly equipped for the kind of debate that requires uncritical acceptance or dismissal of of one company's position on every subject.

Here and now, Microsoft's figures can not be accepted on face value. Unless Microsoft reveals ALL the details of the vulnerabilities they've corrected they can't be considered comparable to even Apple's figures with their heavy loading of open source software, let alone Red Hat's.

Re:

[ThinkFr33ly]

According to that ZDNet article, Microsoft did exactly what I described. They didn't release the details of the bug until they released the patch. But they did described those bugs in the bulletin for the patch release. In other words, they weren't secret, and they would be counted in the bug analysis.

Is it possible that Microsoft completely conceals bug fixes and never announces them, even after they are fixed? Sure. But there is no evidence of that.

As you said, it's true that it would be harder for open s

Where is the 12 out of 27 number coming from?

[figleaf]

There is no mention of 27 disclosed vulnerabilities in the report or on secunia.
Did someone make up the numbers so that it can be posted on Slashdot? ;)

Re:

[figleaf]

Here is the original report http://blogs.csoonline.com/windows_vista_6_month_v ulnerability_report [csoonline.com]
and the secunia link for Vista : http://secunia.com/product/13223/?task=statistics [secunia.com]

Two steps forward, one step back.

[fahrbot-bot]

My guess is that it may be harder to fix things in Vista without breaking something else (like DRM functions) ...

Alternate headline:Vista more secure than OSX/Linu

[I'm Don Giovanni]

I find it fascinating that Engadget's headline on this very same story is:
Report: Vista more secure than OS X and Linux [engadget.com]

Way to spin, slashdot!!

only 25% fewer bugs in 1-6 mon? Most secure OS?

[Locutus]

If they continue to produce 'new' operating systems every 5 years with only a 25% better bug/vulnerability rate, just how long will it be before Bill Gates' statement of Windows Vista being "the most secure OS available" will actually become a publicly accepted true? I had to state it as "publicly accepted truth" since Microsofts version of the law, contracts, and truth are very different from what the general population understands and accepts as such.

Too bad the severities weren't listed but then again, w

Apples and..?

[Quantam]

Wow. There's a statistic in that article that really leaves an impression, and no, it's not 36/39 vs 12/27; it's 23 vs 1 - the number of severe security holes in XP and Vista found in the first six months. That brings up a few questions, like whether these metrics are the same (one person brought up the question of secret, unannounced fixes, another the issue of the number of people looking for problems). But if these numbers are comparable (heck, even if the Vista number is 3 or 4 times lower than is reali

bugs or vulnerabilities?

[swordgeek]

Neither /. nor the original article seem to understand that not all bugs are security vulnerabilities. Is it the case that more than half the known BUGS in Vista are unpatched, or less than half the known SECURITY BUGS are unpatched?

Potentially huge difference.

Re:

[Doctor Crumb]

Let's dig up one of the old /. favourites:

"The only reason XP is the target of so many viruses is because it is so widely used! If Vista was as popular as Windows XP, there would be just as many viruses written for those platforms!"

(firmly tongue in cheek, I'm aware that Vista's UAC is still a pale imitation of a real security model).

Re:

[TheNetAvenger]

Why would anyone bother putting out security patches for an OS that nobody uses yet?

And sadly it is used more than OS X and most *nix distributions already.

So if we take OS X as an example, with regard to security and patches and vulnerbilities, Vista is more widely used and had far less patches and remains more secure to date.

This is where the Apple people should say, "oh crap..."

Re:

[TheRaven64]

Interesting numbers. What's your target audience? I'm surprised Mac OS X is so popular (6.29% doesn't sound like much, but it's over the 3-5% I usually see for OS X market share).

Re:

[secPM_MS]

From the data we have available, it appears that Vista has significantly reduced numbers of and severity of vulnerabilities compared to XP. Knowing what we did in Vista compared to XP, this is not surprising. Looking at the bulletin data, there seems to be at least a 2 fold reduction in issues. I would note that it is far easier to run in a safer default configuration in Vista than it is in XP, making such users all the more safer -- I am writing this from a notebook where I am running a LongHorn beta buil

Re:

[I'm Don Giovanni]

Softest of all targets is the wetware at the top of the stack -- it is vulnerable to social engineering.

Well, that depends on the wetware in question. ;) For lots of people, the wetware is probably the hardest of all targets, not the softest.

Re:

[MadMidnightBomber]

Vista is secure as long as the user doesn't "allow" anything bad to happen. The idea alone is a security risk in the making. Of course no security hole is "critical" as long as there's the omnipresent popup before it happens to affect your PC. Because then it's the user's fault. YOU clicked "allow", YOU are to blame.

Whereas Linux stops the user from running trojans or doing anything else bad? I don't think so.

Vista has made major improvements in security with things like ASLR and it is harder to exploit