OSNews

huh I didn't vote
I just didn't have any arguments against that.
But you seemed to have those arguments...

"I'm not sure why people vote on this forum. They obviously don't think their votes through."

Should have put that in caps so more people get the message. This score system is pointless.

Not completely. It shuts up the worst trolls. I think it's a good start and there are some things they can do to make it better. I actually liked it better before they got into the whole "only vote down for these reasons" thing. The trouble was they didn't put an accompanying "only vote up for these reasons".
And now you see that almost everyone has a positive vote average because there's so much unmatched up voting. You're thinking, I wanna vote him down cause I disagree; but it's also cause he's totally offbase and some idiots voted him up to 5!

And you can see the problem with many of the older programs which keep their settings in non-user level places. Even IE kept them under program files in Win98SE IIRC.
Microsoft Windows, and its users, clearly have a smaller focus on user seperation than Unix users.

I don't really care if Windows have "smaller focus on user separation", the original claim in the article was that it was something that "became relevant only recently". Privilege separation is something built inside the OS from the very beginning, and every Windows Logo certified app works perfectly under LUA: writes configuration to CSIDL_COMMON_DOCUMENTS/CSIDL_PROFILE directories and HKCU etc. You can use RunAs tool for launching processes under different credentials.

In corporate environment EVERY app pretty much has to be LUA-friendly, else it won't work. So someone please tell me how privilege escalation bugs are "not relevant". Google on "shatter attacks", "windows kernel privilege escalation"..

was going to agree, until you mentioned Posix. Let's look at some of these vulnerabilities...
Adobe Acrobat Reader mailListIsPdf() Buffer Overflow (Updated)
CenterICQ Insecure Temporary File
CVS 'Cvsbug.In' Script Insecure Temporary File Creation (Updated)
Eric Raymond Fetchmail 'fetchmailconf' Information Disclosure
Yea, acrobat is so Posix. Fetchmail might be Posix in ESR's world, but it's not in this one .

But! Besides POSIX, i also mentioned "other open-source frameworks" It really doesn't matter which one is used, is it Qt, GTK, wxWidgets, FLKT...you won't se much commercial Windows apps built on open-source frameworks or POSIX subsystem for Windows (SFU), as much as you won't see Linux apps built on closed-source frameworks.

It doesn't really matter if particular FOSS app has a Windows port, where almost no-one uses it in favour of proprietary apps, but it DOES matter if it's by default packaged with most popular distros. And this is what matters - common usage scenario. Almost noone uses for example fetchmail/mplayer on Windows, so it doesn't matter!

Reading comprehension. They said critical. Were those all critical? Secunia tracks all flaws, not just critical ones.

The percantage deviation on criticality doesn't compensate for 4 times more bugs RHEL seems to have. 22% * 256 advisories on RHEL vs. 39% * 76 advisories on WS2K3. Do the math yourself

Also, RHEL supports a lot more software than Microsoft does (and moreso than Microsoft Windows entails).

Who cares, we count the bugs in linux kernel + packages bundled with RHEL vs. bugs in WS2K3 as a complete OS (NTOSKRNL + Win32 userland apps).

Firefox is not remote exploitable. Seeing as how Firefox doesn't accept incoming connections, or even watch for them, I don't see how it can be remotely exploited.

Oh yes it is. Did you even read the vuln description?
http://www.frsirt.com/exploits/20050507.firefox0day.php

"If a user clicks anywhere on a specially crafted page, this code will automatically create and execute a malicious batch/exe file."

Just like the WMF flaw. But it really depends on what you describe as "remotely exploitable". For me it means that bad guys can break into my computer remotely, without my interaction. In this context, both the FF and WMF flaw are NOT remotely exploitable.

But it could also mean that it could be exploited simply by visiting a malicious web site. In this sense the WMF flaw was designated as "remotely exploitable", and so is this FF flaw.

Edited 2006-01-07 00:58

Who cares, we count the bugs in linux kernel + packages bundled with RHEL vs. bugs in WS2K3 as a complete OS (NTOSKRNL + Win32 userland apps).

That's where you are wrong. A bug in ServU is a ServU bug, not a win3k bug, so it won't show up in win3k vulnerabilities, while every single bug found in all ftp servers, databases, languages (java, php, etc..) supported by RH will show up.

Regardless, I think these pictures sum it up rather well why win3k is less secure than RHEL:

Win3K: http://secunia.com/graph/?type=sol&period=all&prod=1173

RHEL: http://secunia.com/graph/?type=sol&period=all&prod=1044

So someone please tell me how privilege escalation bugs are "not relevant". Google on "shatter attacks", "windows kernel privilege escalation"..
Because there are few multi-user Windows machines. I already told you this. Microsoft does listen to its customers, and few of them have multi-user machines. They may have reduced privilidges, but they're probably the only user on their computer. Their domain has thousands of users, and domain priv escalation would be a bad thing; but their computer has them.


It doesn't really matter if particular FOSS app has a Windows port, where almost no-one uses it in favour of proprietary apps, but it DOES matter if it's by default packaged with most popular distros. And this is what matters - common usage scenario. Almost noone uses for example fetchmail/mplayer on Windows, so it doesn't matter!
Fetchmail isn't available for Windows .

The percantage deviation on criticality doesn't compensate for 4 times more bugs RHEL seems to have. 22% * 256 advisories on RHEL vs. 39% * 76 advisories on WS2K3. Do the math yourself
Ah, but RHEL ships how much software, and Windows ships how much software? Where's that Windows PDF viewer again?
I know Secunia doesn't include acrobat holes as Windows holes.

Oh yes it is. Did you even read the vuln description?
http://www.frsirt.com/exploits/20050507.firefox0day.php

"If a user clicks anywhere on a specially crafted page, this code will automatically create and execute a malicious batch/exe file."
Remote exploits do not involve user interaction. As you said, and I said, but for some reason you're still arguing.

The nice thing about Javascript flaws is that you can shut Javascript off . I have it off, and turn it on for certain pages. Of course, you can shut off WMF; not that anyone knew what it was before last week.

FOSS bashing seems to be as in today as Microsoft bashing was 3 years ago. Maybe it's cause Firefox went mainstream? We've lost our punk edge and sold out I guess .

I think that is only partly true at most. It seems to me that there is a organized campaign of anti-FOSS posting and astroturfing by MS employees and MS partner employees that appeared to come into effect a few months ago. The other factor is, as GNU/LINUX gets more widely used in in the corporate area, then people with only a Windows background in IT start to feel a little scared and let of steam against FOSS.

I noticed that on this site. There are a lot of anti-foss people around since august 2005.

They jump on Linux/BSD and FF on every opportunity, in fact, they have been saying things like;

"calm down eh, calm down, there is no danger. this exploit will only affect stupid people who click on porn sites.."

yeah right.

I have read the microsoft reports, and I have used Windows from version 3.0 up. I know wmf files are ubiquitous in ALL versions of Windows.

Microsoft should be forced by a court of law to fix ALL versions of Windows and btw, all versions of Office, Publisher, Works etc which have wmf support built in.

AND... Another thing.

When I am looking for new support staff, I do not even give interviews to MCSEs anymore. I took one on once, and he did not have a clue about any system other than Windows. I have no time or money to train them type up properly.

This is an interesting theory I've heard stated before. I've been writing it off as conspiracy conjecture.
But, I have noticed that the pro-Microsoft factor on this site has gotten about 5,000x more knowledgable than they used to be!
Microsoft does let its people waste infinite amounts of time taking videos and blogging (scobleizer), so maybe they encourage some people to go argue in the larger internet forums.
But I'm just making a theory: I'm not subscribing to it!

Unix has focused on seperate users since, well, probably day 1
...
So, that's 35 years now.
Well, this is both true and false and here's why:

What about GNU/Linux.. is not Unix? Yes? No?

RH Linux was available 35 years ago?

The first desktop OS for Windows to include NT was in 2001.

So Windows NT Workstation was server OS?

Besides, we're in 2006.. right?

I don't know if I mentioned it in that post or not but: Linux runs Unix programs.
That means its designed a LOT like Unix.

See how that makes the statement work?