[ShoobieRat]

Study finds Windows more secure than Linux
By Brier Dudley
Thursday, February 17, 2005
Seattle Times technology reporter

SAN FRANCISCO - Believe it or not, a Windows Web server is more secure than a similarly set-up Linux server, according to a study presented yesterday by two Florida researchers.

The researchers, appearing at the RSA Conference of computer-security professionals, discussed the findings in an event, "Security Showdown: Windows vs. Linux." One of them, a Linux fan, runs an open-source server at home; the other is a Microsoft enthusiast. They wanted to cut through the near-religious arguments about which system is better from a security standpoint.

"I actually was wrong. The results are very surprising, and there are going to be some people who are skeptical," said Richard Ford, a computer-science professor at the Florida Institute of Technology who favors Linux.

Their research could contribute to the debate about which system costs more for companies to operate. Linux costs less to acquire, but Microsoft is trying to convince buyers that its software is less expensive to run and manage.

The researchers said security management is a key factor in the cost of running any system. "We need a real factual comparison here," said Herbert Thompson, the other researcher. He is director of security research and training at Security Innovation, a company that provides security services and technology. "There's so much speculation on the Web, newsgroups, from certain presenters on an RSA stage, we need real solid facts."

They compared Windows Server 2003 and Red Hat Enterprise Server 3 running databases, scripting engines and Web servers (Microsoft's on one, the open source Apache on the other).

Their criteria included the number of reported vulnerabilities and their severity, as well as the number of patches issued and days of risk — the period from when a vulnerability is first reported to when a patch is issued.

On average, the Windows setup had just over 30 days of risk versus 71 days for the Red Hat setup, their study found.

"That's a very surprising statistic, and I must say the first time I saw this statistic I thought you messed with my database," Ford said to Thompson. Their presentation started jokingly, with Ford reeling off Windows jabs and praising the virtues of freely shared software that's developed collaboratively over the Internet.

But they concluded with statistics showing that the Windows setup had a clear advantage over the Linux alternative.


The setups were hypothetical, however. Both were in the most basic configuration, an approach that some in the audience suggested may tilt the results in favor of Windows, which comes with more features.

Ford said the idea was to represent what an average system administrator may do, as opposed to a "wizard" who could take extra steps to provide plenty of security on a Linux setup, for instance.

The presentation was a preview of a report they plan to issue in 30 days.

[horndude]

http://www.wired.com/news/infostruct...,66022,00.html

[toxicity_27]

The one that Horndude posted, I posted in the Linux forum. I was going to say basically what that article said too, so I don't know what to say now...

[mrdinkel]

If you could lockout remote login, then linux would still be more secure.

The Blaster, Sasser worms worked on buffer overruns in XP,2000, NT.

As far as i know, linux can't be exploited in the same manner.

[gab00n]

That is a load of bull, all you have to do is hook two servers up and see how long they last unprotected. Windows will be gone in a few hours and the new linux distros last for up to 3 months.

I have done these tests myself and know from experience, these are just wankers who have been paid by microsoft to say this crap.
"A new study shows that ford is the most reliable car on the road, really we aren't joking." Now doesn't that sound stupid.

[Mr 1337]

idk man. ive gotten my way into more linux servers than windows servers. for instance my school lol.

[macdude425]

If I'm not mistaken, you just admitted to hacking into your school's computer system. And yes, in my experiences servers running Unix-based OS's do run better. Didn't Microsoft have to run some form of Unix on their servers for a while?

[mrdinkel]

Microsoft's DNS Servers are UNIX...

what a sign of confidence in your products.

[gab00n]

Most schools are useless, i am sure you used a skript to take advantage of a vuln in the non-updated UNIX system.

[Sui]

wow 30 days of risk versus 71...... too bad windows has like 4 times the amount of security holes huh?