Is Windows more secure than BSD/Gnu/Linux/UNIX?

[el-half]

BTW, im a Mainframe borned System Programmer, so every pc platform looks "weak" for me

Why is that actually? Years ago my dad was project leader for various programs that were being developed to run on mainframes. Hehe, those programmers actually actually had to write their code on paper, then some typist typed it on a machine that made those cards with holes in it ("pons kaart" in dutch, don't know the english). The mainframe they used had a massive amount of 200KB RAM . I think they are now mostly swichting from AS400 to Bull or something like that. My dad says a mainframe is much more reliable than a pc.
What are other main differences that make you say a pc is weak?

[kr5kernel]

This is the age old debate, there is one on every message forum...Window can be secure, themore you strip ot down and patch mission critical applications, the more secure it will be. Same for Linux, if you focus on just a few server-esque applications (ie web, email, ssh) you can definitly harden it to your liking. As for M$, they control to much of the market for Linux to make the immediate leap to being on the desktop of every new computer, it's come a long way, a very long way gui wise, but people are often intimidated by horror stories of long and complicated installs and what not. Im an avid Linux user, but I also support an Windows network. I don't press my views on Linux to others as being the "best", but it my experience its all about preference, Linux is great for computation and server based operation, but as far as home computing, its hard to convince Joe Blow that Linux will be easier for him to use.

[MrCoffee]

Lurker mode off:

Has anyone here read Cliff Stoll's The Cuckcoo's Egg?
Or Underground by Suelette Dreyfus ?

My point being, hacks and exploits have been around forever. Before people were busy taking advantage of the code in Windows, they were busy finding holes in Unix, or VMS or whatever OS seemed like a good place to explore (if you want to term it that way). Windows covers a huge number of desktops worldwide, so it is a huge target (not to mention that most people capable of exploiting Windows hate MS)

Each OS has strengths and weakness, based on it's use. Windows CAN be a strong OS, secure, and hardened, just check out the tutorials on how to do that. SHIPPED from MS, it really isnt. Maybe that will change.

Anyways, nothing has really changed. You can go back 20 years and find newspaper articles about how one company or another was hacked, and find they were running most any OS. People have always claimed that thier OS is better, more secure, etc. But when it comes right down to it, if you have enough people trying to break it, it is going to get broken. Round up the same number of hackers/crackers whatevers, point them at Mac OS X, or SuSE or Solaris 9, as the ones pointed at windows at the moment, and I bet you'll get a huge increase in vulnerabilities.

We all hear about the Windows exploits, they make the news, but I get security notifications about my RedHat 9 too, as well as Solaris, as SuSE and IRIX (Rarely), but they exsist.

Your best bet is to forget which is more or less secure, and learn as much as you can about which ever you choose, and secure it the best you can. Or switch back to CP/M

[cacosapo]

El-half, the smile face at end of the expression was used to denote sarcasm.

As you described, maybe ive worked with same T-Rex as your dad....

Mainframes were designed to be robust, bullet-proof computers. PC, on the other hand, were designed to be "usable". So Its a market diference that makes the platforms very different.
After 40 years of experience, MF OS and Hardware has a very robust design against attacks.

Backing on subject, i true believe that *nix will gain market on low platform. Maybe it will reach 50% on retail till 2010. Just wait until that and see how many virus, trojans and malware related will be written for *nix...

Ahn, just to foresee, lets do an analysis about stability.

*Nix is so for more stable than Windows, BUT:

- I can see the efforts from MS to make Windows more Robust. And as the time goes by, Windows is really better than in the past (with some exceptions...:P)

- On the other hand, *nix distros are trying to be more "appreciate" by regular ppl, more "user-friendly (read this as "for dumb users"). So what you can see now: *nix crash! more, more and more. (not likely windows at this time). Try to use hard some graphic interfaces and see! Or try to game on that!

so what is happening:

Easy & Weak...............................................................................................Hard & Strong
Windows ------------------------------------------->
......................................................................... <------------------------------------------ Linux

When those arrows reach balance, we will have both with the same "weight" on the market.


(i think that the machine name is "card puncher" or simply puncher.)

Man, iam a T-REX here.

[AngelicKnight]

Good thread gore. I know we have a zillion "which is better?" threads, but from my understanding this is supposed to be geared more towards the somewhat deceptive article gore is referring too. Somewhat deceptive, I say, because of things like this:

An independent analysis of long-term Linux deployments concludes that operating expenses for some companies can overcome initial purchase savings, making Linux's total cost of ownership greater than that of Windows. In particular:

It's not a lie, but it's not the whole truth either. Yes, starting or migrating to Linux in a business environment with untrained users is considerably more expensive than using Windows. However, what they didn't tell you is that that's a short-range analysis. In the long-run, however, the more expensive Linux, if deployed right, will likely more than pay for itself and actually end up being a cheaper solution. Once your employees are trained and your initial software environment is set up, you'll 1) spend less money on overly priced licensed software since you'll be using GNU licenses and open-source software and 2) you won't have to dish out more ridiculous amounts of money to update or purchase additional licenses (the nightmare of Windows server environments). So in the long-run analysis, the story flips, and Linux is potentially cheaper, if you go about it right. But sure, you have to pay more (money and opportunity costs) on the front end to enjoy those benefits.

After an analysis of publicly-available pricing and licensing terms, a Microsoft-sponsored cost comparison by BearingPoint shows that licensing and support costs do not significantly differ between Windows Server 2003, Red Hat Enterprise Linux 3, or Novell/SUSE Linux 8. Across the enterprise and medium business scenarios studied, the three vendors were found to be comparable based on licensing and support costs, and despite perception, Windows Server 2003 was found to be less than one or both of the commercial Linux offerings in several cases. Read more.

Note only two distros of Linux were included in the study.

Few Plan to Migrate Windows to Linux

This is merely saying "because this is the way it's always been."

# Responsiveness: On average, Microsoft had a fix available 25 days after a security issue was publicly disclosed.
# Thoroughness: Microsoft was the only vendor to have corrected 100% of the publicly known flaws during the study's time period.

True, but how often do they have to make those 100% corrections. Plus read it again, carefully. I LOVE this language: "of the publically known flaws". Meaning, there are even more flaws, you just don't know about them!

Anyway, I could go on and on, but you get the picture. This is a typical business tactic though, and it's done all the time outside of the MS/Linux world. Take some statistics, then present them so they're ambiguous enough to mean what you want, but accurate enough not to be a lie per se.

Now, the reality of things: The level of security is dependant upon the user, not the operating system. A Windows box can become as a secure as a Linux box, and a Linux box as insecure as Windows. An idiot behind a Linux OS is still very much an idiot. Those who really know what they're doing can even secure a Win95 box.

Microsoft's real "edge" over Linux is merely in philosophy -- ease of use over level of security. MS has always focused on the former, and Linux the latter. Windows is usually harder to secure but easier to use, and Linux is usually easier to secure but harder to use. So it depends on the individual.

Those truly interested in security, however, should master both.

Lastly, Windows is more targeted by the "bad guys" because it's more popular (for now). As Linux gains more popularity, we're seeing more flaws being discovered and taken advantage of within it. Keep in mind, Firefox vulnerabilities started coming minutes after CERT announced that IE was insecure and should be abandoned.

So those are my thoughts...

[cheyenne1212]

I've said it before, I'll say it again.

For me Windows is far more secure and scalable than what Linux could ever be for me.
why?

Cause All I use is windows, I guarantee you that I could get windows just as secure as someone could who knew linux.

It all depends on what you know. So if you have a company with a IT department that has worked with windows all the time, chances are that migrating to linux is gonna cost you more money and time, and possibly leave you vulnerable for a while until everything is up and running to how they want it. due to the fact that the tech guys would have to "re-learn" the system and if something went down chances are it wouldn't be back up as fast as they could get a windows system back up.

Now I do like linux I have used it, but I don't plan on incorporating it into the companies that I manage networks for. I can manage windows applications/servers far more easier and cheaper than what I coud a linux network at this time.

[OverdueSpy]

Ok. This thread is based upon the age old discussion of which OS is more secure.... here is your answer:

Zone-H developed a very good, and impartial, analysis of webserver security some time back. What the information revealed, was that it really doesn't really matter what OS you are using. What matters is what is deemed as L33T at that particular time, among other geo-political considerations. All the information was derived from actual compromised websites.

Now go look at the stats: http://www.zone-h.org/en/winvslinux2

Yes, Microsoft is in fact the only company to make an OS that is still infected with viruses.

A false assumption. BLISS blew that concept out of the water.
http://vil.nai.com/vil/content/v_100155.htm

[pooh sun tzu]

I'm amazed to the point of shedding a tear. I can't tell you how incredibly cool it is to see people start saying (more often and now in herds) "The OS is as secure as you make it, and any OS if you know it well enough can be as strong as the next".

I'm proud of each and every one of you little OS loving geeks.

Window can be secure, themore you strip ot down and patch mission critical applications, the more secure it will be. Same for Linux, if you focus on just a few server-esque applications (ie web, email, ssh) you can definitly harden it to your liking.

Your best bet is to forget which is more or less secure, and learn as much as you can about which ever you choose, and secure it the best you can.

- I can see the efforts from MS to make Windows more Robust. And as the time goes by, Windows is really better than in the past (with some exceptions...:P)

- On the other hand, *nix distros are trying to be more "appreciate" by regular ppl, more "user-friendly (read this as "for dumb users"). So what you can see now: *nix crash! more, more and more. (not likely windows at this time). Try to use hard some graphic interfaces and see! Or try to game on that!

Those truly interested in security, however, should master both.

It all depends on what you know.

Seriously guys, after seeing this much of a change (and yes, I don't care what anybody says, seeing this kind of responce is a HUGE change for AO/geekdom) I don't think I have any reason to come to the forums now As long there are people who will remind others that "The OS doesn't make the security, the admin makes the OS preform the security.", then I could die a happy pooh.

[cheyenne1212]

That has always been my belief pooh that the OS is only as secure as the user.

IF a company told me to switch them to a linux based solution I would do but I would first have to tell them that I will no longer be able to secure their systems like I was able to with windows until I master the OS.

So in the end its just like what your saying.
OS is only as secure as the person that sits behind the monitor.

[Soda_Popinsky]

I've never successfully locked down a box o' linux, but I've never really tried to hard to. All I know is, when I nmap my updated default windows installation, and my updated linux installation, linux has more open ports. Obviously because I usually do full installs that install every package, but I would rather not sit through an install saying, "yes...no....no..yes..no"
Maybe theres some other way, but I don't know about it.

Anyway, one or the other may be more secure. But neither is insecure when minimal precautions are taken.