The myth that software popularity doesn't affect number of vulnerabilities is a myth

[Asher]

Just for ****s and giggles, I'm going to assume one of the fundamental flaws in the Windows design has to do with it being a monolithic kernel that lets all kernel-level services play in the same memory space...oh wait a second, that's not Windows...that's...Linux?

[Urban Ranger]

Re: Re: Re: The myth that software popularity doesn't affect number of vulnerabilitie

Originally posted by Asher
1) How many people are quoted with the same opinion in the article? (Hint: more than one)

You need to RTFA again. The others have only said that vulnerabilities exist in all OS.

Originally posted by Asher
2) How many people are more qualified to make an opinion in the article? (Hint: all are more qualified than you)

Funny, since you don't have any qualifications to make such a judgement call.

Originally posted by Asher
3) Who has shown some fundamental ignorance about computer security? (Hint: it's the person who confused a stack exploit and a heap exploit, then denied there are heap exploits. Hint2: you)

Just because somebody asserted that there is such a thing as "heap exploit" doesn't mean it exist.

[Urban Ranger]

Originally posted by Asher
Just for ****s and giggles, I'm going to assume one of the fundamental flaws in the Windows design has to do with it being a monolithic kernel that lets all kernel-level services play in the same memory space...oh wait a second, that's not Windows...that's...Linux?

Own goal. Windows does the same thing.

[Asher]

Re: Re: Re: Re: The myth that software popularity doesn't affect number of vulnerabil

Originally posted by Urban Ranger
You need to RTFA again. The others have only said that vulnerabilities exist in all OS.

Biviano works for TrendMicro, no? TrendMicro != Symantec, no?

According to Symantec, as Apple increases its market share - with new low cost products such as the Mac mini - its userbase is likely to come under increasing attack.

Then there's James Turner...

Symantec's concerns were echoed by James Turner, security analyst at Frost & Sullivan Australia, who said many of the people who bought Apple products were not concerned about security, which left them wide open to attack.

Funny, since you don't have any qualifications to make such a judgement call.

More than you, which seems to be more than enough. A drunken ape could run circles 'round you in computer debates.

Just because somebody asserted that there is such a thing as "heap exploit" doesn't mean it exist.

Honestly, you have to be ****ting me.

[Asher]

Originally posted by Urban Ranger
Own goal. Windows does the same thing.

Only with the video card and network drivers, which were moved into kernel-space in NT 4.0 (or more specifically, SP6 for 3.x, IIRC) for performance reasons.

The rest of the kernel does not share the same space, and relies on message-passing (hint: this is the major characteristic of a microkernel).

And for the record, you're not even playing the "Own goal" game correctly, either. You don't "own goal" rhetorical questions. At this point, I call "offsides".

[Fve Crathva]

They didn't put hard drive drivers into the kernel?

SP

[Asher]

Originally posted by Fve Crathva
They didn't put hard drive drivers into the kernel?

SP

That's up to the driver, a lot of them do run in the kernel mode. For desktops, this is common for speed reasons. It's probably even the default behavior these days.

You can run them in ring3 as well, up in userland.

The main point is, with the way Windows NT is designed, it's almost trivial to change between running components in userland and running them in kernel-land. The original design was fully microkernel, and it's evolved ever since. It's probably even something simple like #IFDEFs that ignore message-passing and go straight for kernelspace to do it itself.

The Linux kernel, on the other hand, was designed to be monolithic. You would have to do some massive refactoring to make it monolithic...GNU/Hurd would be done sooner.

And BTW, Urban Ranger...what would you call an exploit that modified the pointer to the next "chunk" in memory/heap to whatever the hacker wanted?

[Asher]

Originally posted by Urban Ranger
That is completely incorrect. There are huge fundamental flaws to the design of Windows. Bruce Schneier said a whole bunch of things here, and that's just part of it. Notice that newsletter was published in February 2002, yet MS has done little to fix the problems outlined.

1) You DanSed me.
2) None of these problems are even remotely close to being "fundamental"
3) Most of those problems have been addressed, even without a Windows release since he wrote those. Half of his points are effectively shot down by the inclusion of DEP in SP2.
4) Many of his ideas are absurd and show a complete lack of understanding of how users use the products (like his idea for Office macros -- give me a break)
5) His remaining points on the "default install" are remedied quite easily in Windows Server 2003 and newer, and even doing things like enabling the firewall by default in XP2.
6) Schiener has a clear agenda to push, and I'm not surprised that you can't see through it. This line in particular cracks me up:

Commercial software is full of bugs, and some of those bugs harbor security vulnerabilities.

It's awesome he qualified that to "commercial" software. Lord knows free software is free of bugs and security vulnerabilities, unlike those pesky commercial software packages.

Please, grace me with your knowledge and insight -- discuss his points and why you think they are fundamental flaws, and how they have not been addressed.

[aneeshm]

I'm no expert in this field , but common sense tells me that faster release cycles , and a higher community participation , coupled with greater peer-review , would tend to make the fixing of burs faster , and bugs rarer , in free software , compared to non-open source software .

I am not , however , willing to bet anything on my judgment in this regard ( because I know that I do not know anything about this ) , so I would recommend we wait and see .

[Fve Crathva]

That would be great, if there was a higher community participation and greater peer review. As it stands, the software that gets reviewed by skilled security professionals is the commercial software (and OpenBSD). The number of eyes viewing code isn't as important as the competence of those eyes. I think open source kicks ass, but the community is too chaotic, too mismanaged, too elite to be effective. And the community just doesn't have enough money circulating in it.

SP

[Agathon]

How retarded. A company trying to sell security solutions for a platform that doesn't really have security problems is scaremongering in order to increase sales of their product.

I'm surprised at you Asher. Your trolls are usually better than this. If you bothered looking, you'd see that Symantec comes out with a prediction like this once or twice a year.

And nothing in that article proves your point. You've been making the same claim now for years with no evidence. What you say might well be true, but you haven't proved it beyond mere speculation.

One could just as easily say that OS X's well-known security would cause more hackers to target it, just for the satisfaction. But that too would be speculation, which is no better than what you have.

[Atahualpa]

According to Symantec, as Apple increases its market share - with new low cost products such as the Mac mini - its userbase is likely to come under increasing attack.

10/10

[Asher]

Originally posted by Agathon
How retarded. A company trying to sell security solutions for a platform that doesn't really have security problems is scaremongering in order to increase sales of their product.

I'm surprised at you Asher. Your trolls are usually better than this. If you bothered looking, you'd see that Symantec comes out with a prediction like this once or twice a year.

It's not just Symantec, you can also see that there are security experts backing up the claim with convincing arguments.

And nothing in that article proves your point. You've been making the same claim now for years with no evidence. What you say might well be true, but you haven't proved it beyond mere speculation.

There's a patch the other day to fix 10 additional MacOS X security vulnerabilities.

Why do you think it's impossible to get viruses on MacOS X?

There are many avenues to take for writing MacOS X viruses, the most popular Windows viruses are "social engineering" viruses or phishing attacks, which can happen on any platform. The fact that those don't appear on Mac either (they usually send .exe's) should be a strong hint for the reasoning behind it. And it has nothing to do with MacOS X being "bulletproof" (it's anything but). There have been more vulnerabilities for MacOS X this year than Windows XP so far, just no one seems to be exploiting them on a wide scale.

It's time to look at this with common sense.

[Kuciwalker]

Originally posted by Lul Thyme
Does anyone actually believe that myth though?

Yes.

[Atahualpa]

Originally posted by Asher
And it has nothing to do with MacOS X being "bulletproof" (it's anything but). There have been more vulnerabilities for MacOS X this year than Windows XP so far, just no one seems to be exploiting them on a wide scale.

It's time to look at this with common sense.

Generally speaking, how old is Windows NT (which XP is based on, no?) and how old is Mac OS X?

But anyway a security flaw != a security flaw and 100 flaws can be less harmful than a single other. You're playing marketing department if you just compare numbers.

However I still doubt that in OS X there are such easily exploitable vulnerabilites such as the Blaster attack, which doesn't even require user action, just a connection to the internet and the absence of a firewall (which was deactivated by default in pre-SP2 and how many OEMs shipped with an enabled firewall???). Flaws like these make MS look stupid. If it's an attachment that the user opens, you can always blame it on the user, especially since this could be considered common knowledge now, but in the case of Blaster you cannot really do so.