"THE" reason why M$ O/S are not so secure

i was watching a documentary and found out why M$ "cant" build a very secure software. It is because as they say

"users dont want to use softwares that are so secure that they cant use it"

I dont remember who said it but he was a M$ software specialist...

So there you go.. the answer to the question "why is M$ softwares never secure enough?"

They want their softwares to be more "usable" than "secure".

Why is linux very secure? because its not user friendly...

Why is Windows not so secure? because it is VERY user friendly...

Hum.. I thought this was rather obvious. Systems that are so simple that everyone can use them cannot have fargoing security. Also, 90% of the computer-using people are using M$. This creates a certain opportunity. Since allmost everyone uses it, many are busy finding holes in it too. I wouldn't dare blame it completely on the user-friendly aspect though.
Remember when they built DOS? It was nothing but a bad copy of C/PM but it was STANDARD. So they got wre they're now. Still, I'm not surprised by anything when it comes to M$....

Grtz,

That's no good excuse for buliding an insecure OS. What about MAC, it's pretty secure, isn't it? And usable too.

The problem is all the usable features add many lines of code that need to be checked for security holes. That takes a lot of effort and money, which MS don't want to provide. It's easier to release the product, and let the users find the errors. Fixing them is not such a big deal once they're located.

Well, while I do agree that MS OS's are often really really insecure (unless you harden the box yourself), the user friendly nature of Windows is getting excessive. Fair enough, making an OS user friendly is an admirable goal, leading to increased sales/usage of the system.. But a balance must be struck...
Having a secure OS which is really difficult to use will benefit only true computer users.. but having a 100% user friendly OS which is horribly insecure will help next to nobody..

I am actually amazed that nearly every Windows computer active on the net has not been eradicated, as the amount of holes in the Windows OS, (many of which are used in a home / small office situation, and aren't patched/updated) really could allow for destructive worms/virii, hell even dedicated black hats (would require a lot of them though, waaay too many Winboxes out there), to infiltrate and destroy the boxes... Could never happen, could happen tommorow...

My Question is, if it does happen... Would you pay that price again? Would you settle for an insecure OS.. just because it has a dog to help you find a file for you?

I think the ideal situation would be for M$ to release the source code for windows (like THAT will ever happen) you could then go about plugging the holes yourself like you can with freeBSD. Iwas hoping that the anti trust case against M$ would force them to go "open source" but alas...NOT

This topic arised when Win 95 had to be launched.
The reason why M$ didn't do much about security is that the marketing dep. of M$ knew that by implementing encryption/firewall and more security features would make the home computer user not wanna use Win95 becvause it would look too complicated.
It's all about the money.

Now the question is since when has linux been a 'very secure' os.

never?
I get security advisories from SuSE almost daily.

http://www.securityfocus.com/cgi-bin...or&which=title

http://www.securityfocus.com/cgi-bin...or&which=title

http://www.securityfocus.com/cgi-bin...r&which=vendor

http://www.securityfocus.com/cgi-bin...r&which=vendor

*** http://www.securityfocus.com/cgi-bin...r&which=vendor

http://www.securityfocus.com/cgi-bin...or&which=title

http://www.securityfocus.com/cgi-bin...or&which=title

hmmm.... can anybody say Vishul basic??
if M$ would actually spend some time on one project rather than pumping out a new OS for every day of the week, maybe they'd have time to fix the problems. I dont suspect they'll ever go open source (which inevitably means waiting and waiting for a service pack or hotfix to patch a problem) so the latency time will always be larger between updates....

such a sad thing, the world needs the userfriendliness... but I do get sick of doing the mad patch dance constantly.

It would be easier if there were some sort of well designed and updated repository to provide a simpler way to get ahold of any and all patches from a particular date, microsofts site can get annoying...

Quote:

---

Originally posted by THEJRC
hmmm.... can anybody say Vishul basic??

---

What do you mean by this?
If your stating that Windows is written in Visual Basic, which is why its insecure, I don't think Windows would be written in VB..
Any flavour of Windows would be written in some form of C/C++.. Otherwise it would take 2 weeks to load, rather than 20 minutes....

Could you please clarify your comment about VB?

Thanks in Advance,
Matty Cross

P.S. Oblio, it is unfair to group all linux distributions together. It would be more fair to state that the SuSe linux distribution isn't that secure, if your receiving security advisories every day...
On Bugtrack 2000 (I think that's the one), Linux distributions had a large number of vulnerabilities discovered.. but it was less than windows.

oh and tell me who has a better track record? Redhat? They all distribute their products with insecure programs. And how can you possibly claim windows to be written in C++.

Quote:

---

Originally posted by oblio
Now the question is since when has linux been a 'very secure' os.

never?
I get security advisories from SuSE almost daily.

http://www.securityfocus.com/cgi-bin...or&which=title

http://www.securityfocus.com/cgi-bin...or&which=title

http://www.securityfocus.com/cgi-bin...r&which=vendor

http://www.securityfocus.com/cgi-bin...r&which=vendor

*** http://www.securityfocus.com/cgi-bin...r&which=vendor

http://www.securityfocus.com/cgi-bin...or&which=title

http://www.securityfocus.com/cgi-bin...or&which=title

---

oblio, I agree with you, Linux does not offer perfect security either, but I can't name a single OS that has absolutely no holes or security problems. As for security in comparison to a windows product, I believe that the lateset kernel of linux is more secure than most of the microsoft software products available. People are beginning to realize that they have to give up ease of use for security. Why do you think that microsoft has a firewall prepackaged with XP. They take a small step in the right direction with different logins for each user, but how about root permissions. How about before being able to delete necessary system files or programs or making major system changes, a root password must be entered. How about free upgrade CD's sent out to everyone who bought their OS that included all the patches and security fixes. Another thing, before they make a new version of a product they should look at all the security problems in the old version and fix them. Ive seen the same problem occur in several different versions of IE.

Oblio has a good point....but I have to agree with the Preacher. Linux does have security concerns..however the open source nature of it lets these concerns be detected and addressed in a much more timely fashion. Just try to get your hands on some windows source code and you will see what I mean.

Linux is safe, not secure.
Look at Alldas, the statisitics indicate that Windows is no 1 being attacked and Linux on the 2nd place.
OpenBSD on the other hand has better security. Solaris is nice but noy secure as well.

Quote:

---

Originally posted by Focmaester
Linux is safe, not secure.
Look at Alldas, the statisitics indicate that Windows is no 1 being attacked and Linux on the 2nd place.
OpenBSD on the other hand has better security. Solaris is nice but noy secure as well.

---

The more people who use an OS, the more security problems will arise. Since Linux and Windows are both widely used, its obvious that a lot of security flaws are in the spotlight. However, fewer security flaws for a less used OS like BeOS are out there. Linux is more secure, but nothing is 100%.

Quote:

---

Originally posted by ThePreacher


The more people who use an OS, the more security problems will arise. Since Linux and Windows are both widely used, its obvious that a lot of security flaws are in the spotlight. However, fewer security flaws for a less used OS like BeOS are out there. Linux is more secure, but nothing is 100%.

---

Not only that, there are a lot of dirty virusses and trojans out there that can xploit *nix/linux systems.
But kiddies don't know a lot about Linux (yet) in order to cause more damage then there is now. Who knows what is yet to come.

aaaaayyy now....

VB is all over M$ products, I did not mean to imply that M$ is based on VB.... was simply noticing that quite a number of the flaws happen to be exploits on that particular language...

as far as ANYTHING being secure.... just look at how TCP/IP was exploited (SYN flooding, etc.) nothings perfect.... IMHO operating systems such as BSD, Solaris, and HP-UX are more solid simply because of their age, it takes time to find holes, and more time to patch holes.... and we continue to find holes even in those OSes that have been around... Linux does have a large amount of holes as well... its also young. The blame for such risks shouldnt be place on the OS however....

If I lose data from any of my servers, whether Suse, Solaris, BSD, or NT based.... its my butt.... an administrators job is to watch for exploits, updates, bugs, and proactively reduce the damage factor. I can honestly say I spend more time backing up and patching than anything else.... but when I do it right.... I dont need to do anything else.

just my opinion though I'm a tool user, I use multiple platforms for multiple tasks, and I do my best to make sure they all stay as stable as possible regardless of how I feel about the manufacturer

JRC

I would have to agree that the degree of user friendliness contributes the amount of insecurity in OSes. Linux is a more complicated OS and not as many people mess with it because of the complications and the fact that everyone uses Windows. Now, everyone uses Windows because it is more popular, it is user friendly, and it already has many people using its earlier versions. The so-called script kiddies would most likely attack the people using the OS that is more well known because it grants them access to a larger variety of users.

the term script kiddie was created in reference to the drones on linux running simple off the shelf code. Security focus claims 9/10 blackhats use linux

well M$ does have a point..

check this thread out...


http://www.antionline.com/showthread...hreadid=135948

this shows why M$ cant make their products very secure..

Quote:

---

I think the ideal situation would be for M$ to release the source code for windows (like THAT will ever happen) you could then go about plugging the holes yourself like you can with freeBSD. Iwas hoping that the anti trust case against M$ would force them to go "open source" but alas...NOT

---

1: if they released the "source code", because of the way they've acted about it the past few years, nobody would believe it and ask for "the real source code". I know I wouldn't believe 100% that it would be the source code for anything MS released.

2: yes, I fully believe that if they released Win95's source code (version A), it'd take about 6 months to strip the bugs out and cut the codebase down to probably 1/4 of what it started out. That's what Open Source is all about and yet these MS fscknuts don't realize that. We don't care about 'stealing' the code so much as we want it to be stable and do what it says it's supposed to do.

3: I think the source code for Windows is supposed to be released after the JFK assassination documents are supposed to be released (wasn't that supposed be in 2000?)...HAH, I'll just not wait.

look its all about money and how much of it the can suck out of you. You see microsoft can secure it but why when the can just come out with a service pack or an upgrade to fix it for a price. You see they can sell us just about anything they want and they know that we will run right out and get it, If the advertising for the product is good enough. So you see that is the real reason that MS is so unsecure. Did you know that Microsoft has enough software unpublished to keep them in busseness for life.

Well that is all I have to say about that. thanks for reading.

I have read all the post and there is an important thing that I don't have read.
The difference from Microsoft and Linux is: Microsoft is an OS closed source, Linux not.
Ok I have discovered the hot water ;) but is a foundamental question, when I write something in VB I think that my line can work, but really I don't know the impact on the "kernel" :( Otherwise, with Linux I can Have All the documentation and the source code that I need, I can do what I want , I can create modules, call to a function and so on.
So Linux is more secure than Microsoft?
Yes but Linux is more hardest to prepare respect to a NT or 2k Server.
Linux can obtain the level A and NT and 2k only C2 (red book) yes, but after good check on what services are on the machine, remove all the user not used, use PAM and OpenSSH, make a good firewall with IPChains or IPTables, make a smallest Kernel only for the hardware that U need ...........
Until Microsoft will remain a closed source OS will be more insecure than a Open Source OS.
Microsoft is more easy?
True.
But I don't like to play a game using cheat ;)

Quote:

---

Originally posted by oblio
And how can you possibly claim windows to be written in C++.

---

Simply by the fact that DLL's are written in c++ and windows is generally based on Dynamically Linked Librarys.