Language Selection

English French German Italian Portuguese Spanish

Linux lags Windows in new security report

Filed under
Linux
Microsoft
Security

A report released today indicates Windows Server 2003 may actually be more secure than its most popular Linux competitor when it comes to vulnerabilities and the time it takes to patch them.

"The fact that Security Innovations [which produced the paper] retained 'editorial control' doesn't help; if Microsoft is paying the bills, there can be all sorts of nonverbal pressure behind the scenes. It isn't like it was 'co-funded' by both Microsoft and Red Hat," said Michael D. "Mick" Bauer, senior editor of Linux Journal and director of value-subtracted services for Wiremonkeys.org.

He also questioned the narrow focus. "This study appears to be more concerned with vulnerability counts and patch-release cycles than in actual security or securability. Certainly, if Microsoft has reduced the amounts of bugs in [its] software and gotten faster at patching bugs, that's great. But the bug-patch rat race is only one part of a much more complicated security picture, and the way I see it, Linux still has compelling advantages from a security standpoint."

Such a reaction was anticipated by authors Richard Ford, Herbert H. Thompson and Fabien Casteran. They intentionally ignored threat profiles in favor of inherent vulnerabilities in Windows Server 2003 and two versions of Red Hat Enterprise Linux 3.0. The goal, they said, is to provide a security metric for IT professionals to apply to their own software shopping.

"I don't think people should make adoption decisions purely based on the results, but I think it does at the very least give decision makers and diehards on either side, or even the neutral people, a chance to look beyond hype and speculation and look at hard numbers," said Thompson, director of research at Melbourne, Fla.-based Security Innovation Inc., the application security provider that produced the report.

Thompson denies Microsoft's money influenced results but admits that's a source of contention for a lot of people. "We've gotten funding from Microsoft and as a result of that people have come back and said this automatically must not be relevant and fair and balanced. That's one reason our mission has been to be completely transparent in the methodology."

Full Story.

More in Tux Machines

Hands-On: More adventures with Manjaro-ARM for the Raspberry Pi 2

In my previous post I celebrated the announcement of Manjaro-ARM Linux for the Raspberry Pi 2. I installed it on my Pi 2 with no problems, and I was ready to continue experimenting and investigating with two major objectives - how complete/stable is it, and what are the chances of getting the i3 window manager working on it? Read more

Canonical Will Be Present at MWC 2016 to Showcase Its Ubuntu Convergence

MWC (Mobile World Congress) 2016 is almost upon us, and one of the biggest attraction there will be, of course, Canonical's latest Ubuntu convergence features, which the company behind the world's most popular free operating system will showcase on the new BQ Aquaris M10 Ubuntu Edition tablet device. Read more

Benchmarks Of The ODROID-C2 64-Bit ARM Development Board

Earlier this month Hardkernel announced the ODROID-C2 as a 64-bit ARM development board that would begin shipping in March. Fortunately, you don't need to wait until next month to find out how this $40 USD 64-bit ARM development board is performing: here are some benchmarks. Read more

Pinterest open-sources its Teletraan tool for deploying code

As promised last year when the company introduced it, Pinterest today announced that it has released its Teletraan tool for deploying source code on GitHub under an open source Apache license. “Teletraan is designed to do one thing, deploy code,” Pinterest software engineer Baogang Song wrote in a blog post. “Not only does it support critical features such as zero downtime deploy, rollback, staging and continuous deploy, but it also has convenient features, such as displaying commit details, comparing different deploys, notifying deploy state changes through either email or chat room, displaying OpenTSDB metrics and more.” Read more