Printable View
Although i dont like these kind of study, i would like your opinion about this study
http://www.microsoft.com/windowsserv...ievolving.mspx
In special about of its metodology.
I would like to read from you something like that:
"i agree about the study when they wrote this....."
or
"i disagree when they used that.."
Lets keep this thread without Ninja war please.
I have seen this study before and i don't think its a fair comparison.
Things like patches. They claim that Windows has less patches but
what you need to remember is the fact that when you install Linux
you normally get a whole lot of other software bundled in there over
and above the bare operating system that might need patching.
I am willing to bet that two thirds of those patches applied on Linux
have nothing to do directly with OS security since yow could probably
go without that software in a first place.
Second problem is upgrading software. It looks like they had complete
third party modules only for Windows platform and Linux Admins were
forced to integrate different pieces of software that were not exactly
compatible from different sources. Obviously it takes longer.
To me this looks like they are trying to apply Windows model on Linux OS
and that won't work. No Linux admin applies patches on a production
server. You need to have a lab setup with duplicated environment on
which you can test patches before applying them.
Then there are other problems no ones tells you which e-commerce
software was installed in the first place, or what third party upgrades
were used. And the fact that Microsoft had to pay for this study in a
first place should be enough for anyone not to take it too seriously.
The Study was funded by microsoft, run on MS equpment by MS people.....Not a vaild comparioson is the frist thaught that comes to mind.
At Two points thir basic assumptions are wrong in the study.
1)they assume you will apply all of the patches every month in an enterprise windows enviroment this is not true. We test the patches and then apply any that are needed and pass testing. Linux group fallow a similar testing an patching mentality, but thir patches don't come out in an artificialy set monthly cycle.
2) They assuem a yearly upgrade to the lates and gratest version of the OS..again in an enterprise enviroment if it works don't break it, we are still running some NT4 boxes as they do the job we need them to do why upgrade and risk breaking the system?
I also woner about this third party product, they where running one instance of IIS and SQL on the windows serve, but multipul instances of apache and the DB on Linux that seems like the linux crew got shafted by bad softwear choices.
here is a very good disection of the study http://blogs.zdnet.com/Murphy/?p=473...ed&subj=zdblog
<does best at holding back words>
windows dissapoints me... it is a very powerfull operating system.. but they move ahead to fast and leave too many holes behind
i am a hardcore linux junkie... windows is only on my comp for 1 video game... uno.
2 in 3 sys admins failed with linux in that report... 2 were probably inadequet to work with linux to its full powers..
and ok, so windows is easier to install and configure *to an extent and baised on someones point of view*... but i would trust my life in the hands of a well configured linux box over a well configured windows box ANY day...
to get an unbiast result... the test needs to be done by mac... where else do you turn bt the other part of the competition.... eventhough apple and mac are nowhere near the server market as i know.
</does best at holding back words>
Well, I'd like to see a solid, unbiased comparison provided by a disinterested third party and funded via a grant NOT from Bill and Melinda Gates Foundation.
I think the public would be well served by getting a good look and the pros and cons of each side, honestly. I'm in my own study of Linux, via Fedora. Fedora because our organization licenses RedHat and I have to work with it, so calm down. I've used various version of Linux since the original kernel and I find Linux interesting and challenging. I'm still not convinced that it is the OS for the masses.
As for Apple, I thought they just sold I-Pods and porn videos or something. They aren't still making computers are they?
;)
It kind of makes one wounder, Is linux that big of a threat that M$ has to come out with new studies every few months.
I have been using linux for several years and would never go back to windows unless it was to play some new game.
Comparing one OS to another only works on certain levels, the whole "which is more secure" depends on who is running it.
Now if they where to have a study of "which OS holds your hand" I'm sure windows would win hands down.
If Microsoft DIDN'T spend a lot of time analyzing and comparing its OS line with competing OS products, I'd think they weren't serious about staying in business. Part two of that is making sure your current customer base has the information you gathered. That is just basic good business sense.
If the open source and Linux community wants to be anything more than an irritating, itchy patch on Microsoft's flank, it needs to take some ques here. Religious zealotry just drives people off. Just think of consumers as all coming from Missouri: Show Me.
I would have to disagree with that statement based on personal experience. There are certain aspects of Windows that are easier to install and configure, some through command-line and some through GUI. Resolution, wallpaper, and similar configuration settings are just as simple in KDE and Gnome as they are in the explorer.exe shell. If you are referring to kernel/system level configuration, I find the modularity of the linux kernel far more usable than the Windows registry. Not because I do not understand the registry but because it attempts to combine the windows kernel configuration, individual program configuration settings (granted, that is the fault of the software developer, but also for Microsoft for allowing it), internet settings, individual user settings, all within a singular area.Quote:
and ok, so windows is easier to install and configure
I assume it really comes down to the person when saying which is easier to configure. I prefer simplicity and straight-fowardness (ie: slackware with .config files) versus all-in-one area settings. It's not even really about GUI versus command-line, but the ease of use in understanding the tool through natural usage.
What you need to remember is that nearly all the Windows patches are for an insecure default configuration. You can't indemnify Linux for having a loose install and then damn Windows for the same thing. Maintain a consistent standard.Quote:
They claim that Windows has less patches but what you need to remember is the fact that when you install Linux you normally get a whole lot of other software bundled in there over and above the bare operating system that might need patching.
Again, well over 90% of the Windows patches could be avoided by having designed and implemented a sane security policy. When was the last time the Windows OS required a patch for a core flaw? Maintain a consistent standard.Quote:
I am willing to bet that two thirds of those patches applied on Linux have nothing to do directly with OS security since yow could probably go without that software in a first place.
You're in for a surprise. Windows admins are no better.Quote:
No Linux admin applies patches on a production server.
The majority of Apache installs are still on the 1.3 line and are, single-threaded accordingly... hence multiple instances.Quote:
I also woner about this third party product, they where running one instance of IIS and SQL on the windows serve, but multipul instances of apache and the DB on Linux that seems like the linux crew got shafted by bad softwear choices.
This line of thinking indicates little more than an inability to quantify system security capabilities on your part.Quote:
Comparing one OS to another only works on certain levels, the whole "which is more secure" depends on who is running it.
All of that said, always consider the source of a study... but disliking the source does not excuse, much less justify making poor, inconsistent arguments against it.
cheers,
catch
hexadecimal: No the admins where good, the study was riged, they where forced to use a sapcific third party product, it was built for SUSE 9 and used a differnt version of GLIBC then what was on SUSE 8. No admin in there right mind would update GLIBC without updateing every thing...the one linux admin that got it working had to write a ton of code on the fly..if the contest where to be fair the windows admins shoud have had windows 2k boxes with aps built for IIS 6...you just can't do what the linux group was asked to do without major systems changes.
in a real world situation...if that is the product you are going to use you start at SUSE 9..also note that the linux admins where required to load a full install...that means at least three difrent DB engins where running and at least two web servers..... S oyes in that instance windows wors better
One bit that you *nix are annoing me on...you keep sugesting that windows admins would just patch a production box...that is never done, we have dev and qa servers (at least at every place I have ever worked has had this setup) you never do a change to production untill its benn tested...this is just as true in the windows world as it is in the unix world.
It seems in this test they had the admins installl all of the patches that come out...that is never done, we go through the patches and see which are needed and which are meaningless (why would I put a MS office patch on my server?) MS has a long history of releasing patches that break everything...why would I just load that into production.
I started reading this after four glasses of wine, after four consecutive 16 hr. days at work, but accidentally deleted before finishing.
So please bare with me as I am sober now. Here is what I remember of my findings of this study. I Hope this is what you were looking for here.
1) there was a choice between Red Hat and Suse. As Suse had earlier in the target year been acquired by Novel, was this a wise choice?
2) They repeat many, many, many times about how they chose what software applications to use, saying they chose those that were used most by the industry, which would be the best indicator. However, they only mention twice ( once on page 21, second on page 45 ) that the applications had to be written for both Linux and Windows ( first criteria for consideration ). Were there other packages written strictly for Linux that were better suited?
3) What were the applications ( and versions ) used in the study? Or did I miss that?
4) They discuss the problems with SLES 8 during milestone 1 ( “... some upgraded components were out of support from SLSE 8 ...”), then were compounded at milestone 2. At milestone 1 SLES 9 was already available. If you were administering these systems, would you try to patchwork the system at this point or do the upgrade now? Apparently, after the upgrade of SLES everything came back into sync. Just as the requirements of a system may change over time necessitating modifications and enhancements to the systems, so must the update/patching schedules change with those requirements.
5) This was a lab experiment, done over a short period of time and using only their tests to verify the results. It does not take into consideration real world attacks, publicly available ( and private ) exploits, etc. which stress systems daily. How would these have effected each of these systems? These certainly add “pain” to administrators.
A buddy sent me this link from slashdot about this same subject http://interviews.slashdot.org/artic...tid=11&tid=106
I think that is a good reading about "research" and "metodology".
Correct, because any unpatched program that exists on your computer is a possible weakness. If you do not have the software then naturally the patch should not be applied. If you do have the software then it is safer to merely uninstall the program you do not use so that you can avoid the additional unneeded patches for the Windows-based server.Quote:
you keep sugesting that windows admins would just patch a production box
But never, ever, complain that Linux users want Windows admins to keep on top of patches. If we don't encourage common-sense techniques of updating then you end up with events similar to Sasser.
Edit: I never thought of this before, but I now realise that it may come down to trusting the patches you download. With Microsoft it is common that a released patch will create a new bug or glitch that must be fixed with a no-so-quickly-released update. It never occured to me that I trust the open-source development model in Linux so much that when I do update to a more recent program the rare times it may go wrong is almost always fixed within a 24 hour period by the time of patch release. I'm not talking about bleeding edge, but sheer code handling and release to the public.
I've never had that same level of trust in Windows updates.
IKnowNot: you hit the main flaw right on the head...if the application they used required windows 2k would they have foreced the admins to run it on NT4? Why did they try and force the application to run on a older version of SUSE tehn what was required by the app?