Windows More Secure than Snow Leopard

http://www.pcworld.com/article/172197/vista_windows_7_are_more_secure_than_snow_leopard.html

 

Good way of creating a controversy and drawing attention to oneself ...
I'd say the man is not fully on mark, but ... it doesn't matter really.
Mrk

 

ASLR was first implemented in Linux. Then 5 years later Windows steals the idea. And almost 10 years later, OS X only has a very rudimentary implementation of it.

Even with limited ASLR, I would still trust OS X over Vista if I had to provide an OS for a security illiterate person. Why? Because OS X puts the user on a limited account by default (and all the software *works* with a LUA). As we all know, Windows puts everyone on an admin account by default. Therefore, all the ASLR and DEP in the world doesn't matter as long as Windows does this. It's like building a 50 ft. tall steel reinforced concrete wall around one's house, only to leave a 3 ft gap where anyone can walk in.

Linux > OS X > Windows

If Windows is locked down with LUA and SRP:

Linux > Windows > OS X

(Yes, I know I left out BSD and Solaris, but they are right there with Linux).

 

It's certainly true that Windows is under an attack bombardment far heavier than anything OS X has ever seen. And that does result in more vulnerabilities found and also fixed than a scenario where attacks are much rarer. Still, I don't see too much point in most of these "which OS is more secure" comparisons. Any modern OS is decently secure in the right hands.

Some thoughts, though:

I'm not sure I'd agree with that. As far as I can recall, ASLR was only enabled by default in Linux in 2005, only a year before Vista did the same. So, hardly a five-year difference. Obviously there was development of a rather primitive ASLR long before that. But then, MS was also working on ASLR before Vista release...

I don't think one can steal ideas from an open source OS. If the devs wanted to keep their ideas to themselves, they probably wouldn't make their code open source and freely available to anyone.

On the other hand, one can just set the illiterate person up with LUA in Windows, as well. I do that all the time, and it works. And the more illiterate with computers they are, the less likely it is in my experience that they're going to want to run the kind of software that just won't work in LUA. Further, it seems to me that if people are worried about software not working because of LUA in Windows, then they're going to worry pretty dang much in OS X when none of their Windows software works anymore (sure, Boot Camp, Parallels and stuff, which also include those problems of Windows that switching to OS X was supposed to avoid). So, to be able to switch to OS X, the user must already be willing to dump all their Windows software. In which case they would in fact have to dump much less software if they just switched to LUA in Windows and dumped only the software that doesn't work in LUA, instead of dumping all Windows software they run to switch to OS X. Or in short, moving to LUA in Windows is much easier than moving from Windows to OS X, from a logical perspective. Emotions of course can complicate things.

Personally, I've come to think of OS X as a rather suboptimal choice of OS for most people. Windows has more software and games, and everyone knows Windows - for people who care a lot about these things, Windows is an obvious choice. Linux costs less than OS X, and is more secure, and still has loads of software - an obvious choice for people who like free beer and freedom to hack the OS to their liking. So who would want OS X? Fans of Apple, obviously, but I find Linux or Windows to be a better option for most people. Unless eye candy and the "Apple experience" are really calling to one's heart, in which case OS X it is! But when there's stuff like Ubuntu out there, it's hard to recommend OS X as the first alternative to Windows in my humble opinion...

 

Actually he said that OSX is less secure than Vista by nature and that may very well be true. Now it,s a different story that malware writers are attacking only windows in 99% cases due to market share of windows.

I remember he hacked and owned OSX via safari within minutes( probabaly if i remember well) while it took many hours for windows to be owned.

Another point I will mention, at least for me. While working in windows I have a little know how that what,s going on in my system, especially if I am using some security applications like a sandbox, a HIPS or a behav blocker. If there is an infection, there is good chance that I might suspect it, investigate it and catch it. While if I work in Linux or OSX, I have no idea at all what events are taking place, whether malicious or not. If there is an infection, I might not be suspicious at all. Just a sort of peace of mind.

 

Some thoughts:

This captures my sense of where reality sits, adjusted by the fact that the default choices for Linux/OS X are much more appropriate than those used in Windows if security of the system is an objective. Changes made for Vista and Win 7 helped, they're not quite there yet, but it may be close enough to not really matter with Win 7.

At least to my impression, Linux/Windows vs OS X breaks down more along folks who desire (or at least don't mind) engaging in a appreciable configuration/tweaking/maintenance of a system and those who don't. I'm just speaking from personal experience here with myself and two sons. I use all three flavors, both sons are now Mac based after growing up with Windows PC's. Both are tech oriented, but seem to really prefer to use a computer as a walk-up appliance. From a college student/support basis - a Mac + bootable external drive + Time Capsule - is an incredibly simple, robust, turnkey solution that will readily handle most issues that would ever befall a user. Similar solutions are available in Windows, they're just not quite as tightly integrated and seamless in use. At least from my perspective, this is worth the price premium and, from a total cost of ownership perspective, I'm really not sure it's that much of a premium when all factors are considered.

On Windows vs Linux/OS X and games...., that battle is over and they all lost. The dedicated consoles won. Game over.

On the inertia of a legacy installed software base (and associated training and experience)...., this is a real factor, but it seems partially generational and I personally believe MS has lost track of the difference between pricing discipline and price gouging. Eventually this will have an impact in the marketplace unless MS wakes up in the meantime, although one should wonder whether that battle has actually already been lost by MS as well.

Blue

 

Apparently you haven't heard of this little game called World Of Warcraft...