OEM vs Retail XP Pro

[Matt]

The fact of your simple fact is it isn't true. There are less than 100
viruses for Linux (even fewer that are 'popular') but they do exist and
are growing in number.

The 'no virus' argument has always been a 'damned if you do' kind of
thing with Linux because part of what's 'protected' it is the rather
small market share. I.E. if one wants to inflict damage on a multitude
of systems then you pick a platform that's popular enough to propagate
it. And as Linux becomes more popular it'll attract more attackers and
lose that 'feature' Linux aficionados are touting as a reason to make it
more popular. The curse of success.

http://www.theregister.co.uk/security/security_report_windows_vs_linux/
http://www.theregister.co.uk/security/security_report_windows_vs_linux/#myth1

Myth: There's Safety In Small Numbers

Perhaps the most oft-repeated myth regarding Windows vs. Linux security
is the claim that Windows has more incidents of viruses, worms, Trojans
and other problems because malicious hackers tend to confine their
activities to breaking into the software with the largest installed
base. This reasoning is applied to defend Windows and Windows
applications. Windows dominates the desktop; therefore Windows and
Windows applications are the focus of the most attacks, which is why you
don't see viruses, worms and Trojans for Linux. While this may be true,
at least in part, the intentional implication is not necessarily true:
That Linux and Linux applications are no more secure than Windows and
Windows applications, but Linux is simply too trifling a target to
bother attacking.

This reasoning backfires when one considers that Apache is by far the
most popular web server software on the Internet. According to the
September 2004 Netcraft web site survey, [1] 68% of web sites run the
Apache web server. Only 21% of web sites run Microsoft IIS. If security
problems boil down to the simple fact that malicious hackers target the
largest installed base, it follows that we should see more worms,
viruses, and other malware targeting Apache and the underlying operating
systems for Apache than for Windows and IIS. Furthermore, we should see
more successful attacks against Apache than against IIS, since the
implication of the myth is that the problem is one of numbers, not
vulnerabilities.

Yet this is precisely the opposite of what we find, historically. IIS
has long been the primary target for worms and other attacks, and these
attacks have been largely successful. The Code Red worm that exploited a
buffer overrun in an IIS service to gain control of the web servers
infected some 300,000 servers, and the number of infections only stopped
because the worm was deliberately written to stop spreading. Code Red.A
had an even faster rate of infection, although it too self-terminated
after three weeks. Another worm, IISWorm, had a limited impact only
because the worm was badly written, not because IIS successfully
protected itself.

Yes, worms for Apache have been known to exist, such as the Slapper
worm. (Slapper actually exploited a known vulnerability in OpenSSL, not
Apache). But Apache worms rarely make headlines because they have such a
limited range of effect, and are easily eradicated. Target sites were
already plugging the known OpenSSL hole. It was also trivially easy to
clean and restore infected site with a few commands, and without as much
as a reboot, thanks to the modular nature of Linux and UNIX.

Perhaps this is why, according to Netcraft, 47 of the top 50 web sites
with the longest running uptime (times between reboots) run Apache. [2]
None of the top 50 web sites runs Windows or Microsoft IIS. So if it is
true that malicious hackers attack the most numerous software platforms,
that raises the question as to why hackers are so successful at breaking
into the most popular desktop software and operating system, infect
300,000 IIS servers, but are unable to do similar damage to the most
popular web server and its operating systems?

 

[Matt]

http://www.theregister.co.uk/2005/02/23/beijing_backs_bill/

Beijing council has made a substantial purchase of Microsoft software,
despite deciding late last year that it would buy products from local
developers.

The original £3.5m contract with Microsoft was so heavily criticised
that the council cancelled it. New procurement rules were drawn up to
encourage government bodies to buy locally produced software. Domestic
software was defined as anything which was at least 50 per cent
developed in China. Government departments would need special
permission to purchase non-domestic software.

But the council has reversed this policy and bought Office and Windows
products

Oh, I wouldn't read too much into this one-time purchase. China is
something like 3000 years old ... I'm sure they are taking a longer view.

Nobody can suppose that this is a complete 180. It is only a purchase
by Beijing, not by China. It just looks like an expedient exception to
a standing policy. You left out this part:

 

[Matt]

Matt writes:




Just like Apple, except that the somebody else that Apple copied wasn't
trying to make money from it.

Oh, I think I see. You're saying that MS is just like Apple by being
different from MS.

 

[Matt]

Matt writes:




Windows is tremendously popular in Asia, much more so than Linux.
Windows is free in countries like China, since there is no enforcement
of copyrights; and since that removes the single biggest possible
obstacle to using Windows in these countries, Windows is actually the OS
of choice on the desktop.

Well of course it is.

Yes.

Show me an example.

And there will be peace and plenty throughout the world. God bless us,
everyone!

Not if you can prevent it, I expect.

 

[Mxsmanic]

This reasoning backfires when one considers that Apache is by far the
most popular web server software on the Internet.

The article's reasoning backfires when it starts trying to compare
desktops with servers. These are two entirely different worlds.

If IIS is more often attacked than Apache, part of the reason is likely
to be that there's always a Windows system behind IIS, whereas one never
quite knows with Apache, and in any case, a Windows system offers far
more flexibility to hackers than a UNIX system, especially since UNIX
servers may be configured and stripped to do only what they are told,
whereas Windows systems tend to have a complete suite of applications
installed and available.

People who run Windows servers and IIS tend to be a lot more
unsophistcated than people who run UNIX, also, and a lack of
sophistication is a very, very dangerous thing when one is talking about
system administration of servers exposed to the Internet. UNIX
sysadmins are more likely to find and fix any security holes than
Windows sysadmins.

Finally, feature bloat handicaps IIS. Microsoft is essentially a
desktop software company, and still lacks clues when it comes to
building good server software. IIS is bloated in the way that desktop
products tend to be bloated, and this is the exact opposite of what one
needs in a server environment. Bloating increases the necessary
resources, makes administration more complex and error-prone, and above
all, it leaves a lot more bugs and security holes in the software. And
the desktop tendency to hide everything from the user is a serious
liability on a server, where the software should be as open and
transparent as possible.

That's why most Web sites run Apache, and Apache continues to gain
ground (typically with UNIX underneath, although it will run on Windows
as well).

 

[Mxsmanic]

You left out this part:

If Linux were the preferred software, than the government wouldn't be
setting deadlines for pirated products--you can't pirate something that
is already free.

 

[Mxsmanic]

Show me an example.

Intel.

 

[Matt]

Matt writes:




If Linux were the preferred software, than the government wouldn't be
setting deadlines for pirated products--you can't pirate something that
is already free.

Right right right, genius ... Linux is not preferred right now ...

Try to imagine that things change. Try to imagine that they are working
toward software independence, and notice that that country has been
around for 3000 years.

 

[Conor]

http://linux.sys-con.com/read/38026.htm

You've not answered the question. All that article says is some people
from MS turned up to have a look.

I'll ask again.

What ideas have Microsoft taken from KDE and incorporated into their
Longhorn desktop?

OTOH there's a long list of stuff in KDE thats in Win9x.

 

[Conor]

A Linux user can choose to run any of a wide variety of desktops. The
desktop is not part of Linux. Not clear that you or MS can grasp the
concept of software layering.

Most of the non Gnome/KDE ones resemble the old DOS GUIs pre Windows 3.

 

[Conor]

Nobody can suppose that this is a complete 180. It is only a purchase
by Beijing, not by China. It just looks like an expedient exception to
a standing policy. You left out this part:

The fact is the Chinese Govt ordered all govt agencies to use Linux
over Windows. The fact that Beijung Council was allowed to use Windows
suggests that the Chinese Govt, because of its totalitarian
dictatorship stance, has done a 180 otherwise it'd be "use linux at all
costs".

 

[Conor]

Try to imagine that things change. Try to imagine that they are working
toward software independence, and notice that that country has been
around for 3000 years.

Software independence cuts you off from the rest of the world. China is
trying to become the dominant manufacturing power in the world.

Oh and Matt, is 2005 the year of the Linux desktop or is that 2006.
2007, 2008?

 

[Conor]

Oh, I think I see. You're saying that MS is just like Apple by being
different from MS.

See? Linux does make you stupid.

 

[John Doe]

Right right right, genius ... Linux is not preferred right now
...

Try to imagine that things change. Try to imagine that they are
working toward software independence, and notice that that
country has been around for 3000 years.

China and Japan and one or two other countries are, or at least
were, working on their own version of Linux.

Telling, or at least evidence, would be whether they have
increased the budgets for that project.

Have fun.

 

[Conor]

Show me an example.

Dell.
Intel.
ATI.
Matrox.

 

[Mxsmanic]

Try to imagine that things change. Try to imagine that they are working
toward software independence, and notice that that country has been
around for 3000 years.

Then remember that Linux wasn't written in the Third World, and ask
yourself why they'd continue to use software written abroad if they are
trying to gain software independence.

They might well start to write their own operating systems, but they
won't switch to Linux, which is no less "foreign" than Windows XP.

 

[Mxsmanic]

The fact is the Chinese Govt ordered all govt agencies to use Linux
over Windows. The fact that Beijung Council was allowed to use Windows
suggests that the Chinese Govt, because of its totalitarian
dictatorship stance, has done a 180 otherwise it'd be "use linux at all
costs".

The Chinese government contains a very high proportion of engineers at
the upper levels. They probably realized that Linux just wasn't going
to cut it, and so allowed Windows.

 

[Matt]

Matt writes:




Then remember that Linux wasn't written in the Third World, and ask
yourself why they'd continue to use software written abroad if they are
trying to gain software independence.

This is getting tiresome.

.... because they can make whatever changes they want, they can read the
source code, they can put in their own back doors and shut others' back
doors, and they don't have to pay anything. They don't have to ask
anybody's permission to do what they want. Independence.

They might well start to write their own operating systems, but they
won't switch to Linux, which is no less "foreign" than Windows XP.

They won't write their own OSes from scratch. They will adapt Linux to
their purposes. They will as much as they can move to Linux derivatives
for general purpose computing.

 

[David Maynard]

The fact of your simple fact is it isn't true. There are less than 100
viruses for Linux (even fewer that are 'popular') but they do exist
and are growing in number.

The 'no virus' argument has always been a 'damned if you do' kind of
thing with Linux because part of what's 'protected' it is the rather
small market share. I.E. if one wants to inflict damage on a multitude
of systems then you pick a platform that's popular enough to propagate
it. And as Linux becomes more popular it'll attract more attackers and
lose that 'feature' Linux aficionados are touting as a reason to make
it more popular. The curse of success.

http://www.theregister.co.uk/security/security_report_windows_vs_linux/
http://www.theregister.co.uk/security/security_report_windows_vs_linux/#myth1


Myth: There's Safety In Small Numbers

Perhaps the most oft-repeated myth regarding Windows vs. Linux security
is the claim that Windows has more incidents of viruses, worms, Trojans
and other problems because malicious hackers tend to confine their
activities to breaking into the software with the largest installed
base. This reasoning is applied to defend Windows and Windows
applications. Windows dominates the desktop; therefore Windows and
Windows applications are the focus of the most attacks, which is why you
don't see viruses, worms and Trojans for Linux. While this may be true,
at least in part, the intentional implication is not necessarily true:
That Linux and Linux applications are no more secure than Windows and
Windows applications, but Linux is simply too trifling a target to
bother attacking.

This reasoning backfires when one considers that Apache is by far the
most popular web server software on the Internet. According to the
September 2004 Netcraft web site survey, [1] 68% of web sites run the
Apache web server. Only 21% of web sites run Microsoft IIS. If security
problems boil down to the simple fact that malicious hackers target the
largest installed base, it follows that we should see more worms,
viruses, and other malware targeting Apache and the underlying operating
systems for Apache than for Windows and IIS. Furthermore, we should see
more successful attacks against Apache than against IIS, since the
implication of the myth is that the problem is one of numbers, not
vulnerabilities.

Yet this is precisely the opposite of what we find, historically. IIS
has long been the primary target for worms and other attacks, and these
attacks have been largely successful. The Code Red worm that exploited a
buffer overrun in an IIS service to gain control of the web servers
infected some 300,000 servers, and the number of infections only stopped
because the worm was deliberately written to stop spreading. Code Red.A
had an even faster rate of infection, although it too self-terminated
after three weeks. Another worm, IISWorm, had a limited impact only
because the worm was badly written, not because IIS successfully
protected itself.

Yes, worms for Apache have been known to exist, such as the Slapper
worm. (Slapper actually exploited a known vulnerability in OpenSSL, not
Apache). But Apache worms rarely make headlines because they have such a
limited range of effect, and are easily eradicated. Target sites were
already plugging the known OpenSSL hole. It was also trivially easy to
clean and restore infected site with a few commands, and without as much
as a reboot, thanks to the modular nature of Linux and UNIX.

Perhaps this is why, according to Netcraft, 47 of the top 50 web sites
with the longest running uptime (times between reboots) run Apache. [2]
None of the top 50 web sites runs Windows or Microsoft IIS. So if it is
true that malicious hackers attack the most numerous software platforms,
that raises the question as to why hackers are so successful at breaking
into the most popular desktop software and operating system, infect
300,000 IIS servers, but are unable to do similar damage to the most
popular web server and its operating systems?

One of the problems in having someone else do your 'arguing' for you is
it's often the wrong argument. To wit, I never claimed what the article
argues about: that Linux is "no more secure than Windows" and made no
qualitative or quantitative comparison at all, one way or the other. What I
*have* done is rebut the broad brush claims Linux fanatics throw out simply
from worship.

The article is quite similar, jumbling O.S. and 'applications' as well as
desktop and server markets and assuming all motivations translate equally.
Isn't it amusing that when Linux aficionados want to apologize for 'ease of
use' issues the GUI is "not a part of Linux" but suddenly "Apache" is, even
though it's cross platform.

The logic that attackers would necessarily go for the most popular 'server'
presumes they aren't going after 'Windows' in the generic simply because
'Windows', including desktops, is not only the overwhelming market share
but from, as I mentioned, the inherent hatred of MS and 'Bill Gates' that
permeates in certain circles. If you want to attack 'the demon devil' then
you attack him in all his manifestations. Secondly, because of the
overwhelming market share of 'Windows', and Windows related products, you
have an overwhelming number of programmers more familiar with it and,
hence, better prepared to attack it. The article's presumption of 'motive',
as well as opportunity, do not hold. (Mxsmaniac had other valid points that
I will not repeat but simply say I agree with, at least to the extent that
they're possibilities.)

What is true is the point I originally made, that Linux is not 'immune' or
invulnerable to viruses, trojans, DoS, and other attacks (and my
speculation that they'll increase as, or if, Linux becomes more popular).
And the near hysterical response to the fact that Linux viruses exists,
regardless of how many, just highlights that they're responding from
emotional O.S. worship (HERESY! My O.S. has no flaws!) rather than any
rational argument.

 

[Ruel Smith]

Intel.

Intel is heavily involved in Linux.