OSNews

I'm not sure what point you were trying to make"

Actually I was referring to the years of that not being the case.

My point was motive. That there is a very large motive to be able to exploit large Linux and BSD systems.

And Linux gets hacked all the time. Just less than Windows:
http://www.zone-h.org/component/option,com_attacks/Itemid,44/

Yes, I know that these are website hacks, and I know what we are talking about is much more than that.

But there is more to security than exploitable code.
Secure by Default and Secure by Design are as important, if not more important than secure code:
http://en.wikipedia.org/wiki/Secure_by_design
http://en.wikipedia.org/wiki/Secure_by_default

As an example, Windows XP Home sets up two (three if you count System) administrative users, by default, with no way to apply a password to them. Then, after you apply a password to your account, it still hides Administrator from you "to protect you" (from forgetting it's password), so that almost every XP Home system *at least* has one Administrator account (aptly named so you don't have to guess) without a password.

This level of insecure defaults and design permeates though Microsoft software.

I set up XP Pro, fully patched (pre IE7), with the MS Shared Computer toolkit, and locked it down with its highest security settings. Leaving only IE accessible for Internet access. I typed "Desktop" into IE and could then create shortcuts to... anything I wanted.

Linux is far from perfect, far from secure especially in code, but it sure as hell does a better job of secure design and secure defaults.

Microsoft is doing better. Much better with Vista, IE7 and IIS6. But there is so much left open, and they still fall short in many areas (UAC for example).

Just an opinion of mine : )

Edited 2007-03-19 03:12

chrono13 - If you are not biased then who else is? You are now just changing your tone because it is proved that Apache has a worst security record as compared to IIS6.

Now you are trying to turn the topic around and then leave your opinion with no example. Where is Microsoft falling short?

You think UAC is bad then what about Ubuntu? They prompt for logged in user's password? Why can't a rogue software show me the same prompt and steal my password? IMHO UAC is better than the password prompting approach of Ubuntu.

Yes, there has been a major improvement in Windows/IIS 6.0; but that is due to pressure being put onto Microsoft by competition rather than a genuine desire by Microsoft to do the right thing and secure their software.

But don't be surprised to see Microsoft going back to its sloppy habits with the launch of Windows 2007 Server - to secure a system, but must be designed from the ground up to be secure; there is no such thing as a 'bug free' operating system, but if you design it properly the first time, patching and controlling the damage caused by a security issue is made alot easier.

Microsoft knows exactly what the problems are with Windows, but it would require them to throw out the whole system and start again; yes, there are some good technologies which Microsoft has, but at the same time, alot of it is motivated by a desire to 'control' rather than simply to deliver the best product to the customer.

Its been seen over and over again; ODF vs OOXML, and no attempt by Microsoft to sit down with the ODF community and voice their concerns - backwards compatibility? bull crap, I can open up a word document and save it as ODF in OpenOffice.org - does ODF need 'Word backwards compatibility' in the ODF specification? of course not, its a rouse by Microsoft to justify re-inventing the wheel.

Passport, another example; "give us all your customer data, and we'll sell it back to you" - another attempt to jam a 'solution' down the throats of customers, and the customers turning around and saying no.

How about Microsoft work on improving their products rather than reinventing the wheel for political purposes which yield no benefits to customers either short or long term.

{ Its been seen over and over again; ODF vs OOXML, and no attempt by Microsoft to sit down with the ODF community and voice their concerns - backwards compatibility? bull crap, I can open up a word document and save it as ODF in OpenOffice.org - does ODF need 'Word backwards compatibility' in the ODF specification? of course not, its a rouse by Microsoft to justify re-inventing the wheel. }

In respect of ODF vs OOXML, Microsoft do not need to justify "re-inventing the wheel" so much as they need to justify "utter avoidance of using open standards".

Wherever there is an existing perfectly adequate open standard, Microsoft avoid it like the plague, lest it become commonly used.

ODF is but one example. Web standards are another, Microsoft Java is another, SVG is another, as is ogg vorbis.

The list is endless. If it is an open standard which any software vendor may use and implement ... Microsoft will do their utmost to see that Windows systems don't support it, so that the standard will hopefully die, and everyone will be forced to use Microsoft's proprietary alternative, which in turn requires that one runs a Windows platform.

Yeah its actually 33 advisories with three unpatched (9%). Thats pretty good considering Apache is open-source--people can inspect the code--and has 20% more marketshare than IIS6. In 2003-4 Apache had about 30-35% more.