Linked by Thom Holwerda on Fri 5th Nov 2010 13:10 UTC
Apple It's the end of the line for Apple's line of servers, the Xserve. The Cupertino giant has just announced that the Xserve line (no more future models, either) will no longer be sold after January 31, 2011, and advises people interested in Mac OS X Server to buy either a Mac Mini or a Mac Pro with Snow Leopard Server installed.
Thread beginning with comment 448702
To view parent comment, click here.
To read all comments associated with this story, please click here.
Valhalla
Member since:
2006-01-24


Windows Server 2008 will have a better security record this year than RHEL.

I'm curious, how is this established? I've seen a lots of critical updates for Windows 2008 Server this year, here was the first link I found when googling:

http://arstechnica.com/microsoft/news/2010/09/microsoft-patch-tuesd...

Contains 3 critical and two important patches relevant to Server 2008, which concerns Remote Code Execution, and Elevation of Privilege. And this was ONE patch tuesday update, something tells me there's more.

Reply Parent Score: 3

Valhalla Member since:
2006-01-24



Thanks, but from what I gather these stats don't take in to account the severity of the vulnerability? I mean remote code execution has to be the most severe and not comparable to a vulnerability that needs to be applied locally.

Edit: also the Secunia stats lists Server 2008 as having 7% of known vulnerabilities yet unpatched, while RHEL lists none.

Edited 2010-11-05 19:48 UTC

Reply Parent Score: 2

toast88 Member since:
2009-09-23



Two remarks here:

1. RHEL is far more comprehensive when it comes to software and services shipping than Windows Server. While a Windows Server is more or less naked after installation (except for some server services), a RHEL comes with a huge amount of software available for installation and you have to keep in mind that RedHat is keeping ALL of these packages secure. So, in order to be fair, you'd have to include various software like Microsoft Office and so on in these comparison charts.

2. As opposed to Microsoft, RedHat has patched ALL of the reported vulnerabilities. And this is far more striking than having less vulnerabilities. How do I benefit from less vulnerabilities when around 15% of them remain unpatched?

Adrian

Reply Parent Score: 2

nt_jerkface Member since:
2009-08-26


I'm curious, how is this established? I've seen a lots of critical updates for Windows 2008 Server this year, here was the first link I found when googling:


Patch tuesday stats are going to include IE and other local application vulnerabilities that would not be running on a dedicated server.

Based on remote exploits in the core system that were used to take down websites Linux will have the worst record.

Reply Parent Score: 2

Valhalla Member since:
2006-01-24


Patch tuesday stats are going to include IE and other local application vulnerabilities that would not be running on a dedicated server.

Same holds true for RHEL. From Secunia's site:
-"It should also be noted that some operating systems (e.g. certain Linux distributions) bundle together a large number of software packages, and are therefore affected by vulnerabilities, which do not affect other operating systems (e.g. Microsoft Windows) that don't bundle together a similar amount of software packages."

There's no reason to think that these bundled applications would be running in a RHEL server, yet their vulnerabilities count. Again very flawed.

Based on remote exploits in the core system that were used to take down websites Linux will have the worst record.

Were can I see that stats for this?

Overall, using Secunia's stats as a comparison between system security seems (as they themselves state) pointless. There's no available information on the severity of vulnerabilities, and they don't even take into account whether or not they've been patched or not when counting the vulnerabilities. Having 7% of known vulnerabilities unpatched as is listed for Windows 2008 however, seems very bad.

Reply Parent Score: 2