8 ms·

Is there any evidence that Windows 7 is less secured than Snow Leopard? Windows employs more advanced security techniques. IE has outlasted Safari in Pwn2Own si

Is there any evidence that Windows 7 is less secured than Snow Leopard? Windows employs more advanced security techniques. IE has outlasted Safari in Pwn2Own since IE8. Windows releases security fixes much faster. If they favor OS X over Windows that is completely fine, but I think they are implying something that isn't true in regards to security. If someone exploits OS X on them, is everyone moving to Linux next?

memoryfault 16y ago
And what happens when someone exploits Linux?
- melling 16y ago
  You have a nice ecosystem of Unix OS's. Solaris, OpenBSD, NetBSD, ... and a handful of major Linux distros: Ubuntu, Fedora, Suse, Gentoo, Debian, etc. Once you've gone Unix you have lots of choices, including the Mac. Did Google roll their own Linux? Which kernel do you target? which apps?
  - doty 16y ago
    It seems reasonable to assume that they'd standardize on a distribution, and centrally manage patching client machines. I cannot imagine that they would expect every employee to concern themselves with such things.
  - Perceval 16y ago
    Google reportedly has a modified version of LTS Ubuntu used internally: http://en.wikipedia.org/wiki/Goobuntu http://en.wikipedia.org/wiki/Goobuntu
melling 16y ago
Market share: Windows 90%, Mac 9%, Linux 1%. Where are virus writers going to put most of their effort? Windows being as secure as Mac wouldn't help make it safer because a lot more implemented exploits are going to exist in the wild.
- yummyfajitas 16y ago
  While this move may prevent infection by FR33_PR0N.wmv.exe, I don't see how it will prevent being hacked by China (the major concern).
  - jimbokun 16y ago
    I believe the Chinese government has Windows source code, and Google does not. The Darwin and BSD layers of Mac OS X are open source, so Google can at least study the code to understand the security implications of using OS X. In other words, with open source Google is on a more level playing field against potential attackers.
    - microkid 16y ago
      No offense, but level playing field is ridiculous. Think about what you're saying, you're saying Google is going to sit there and review all of the source code, and all patches and new releases to that source code. Really? Do you actually believe this... As per China having the source, do you really think it matters? If someone wants to break in, they're going to get in... (regardless if its Windows/Linux/Mac) why... because that's their job and they are going to spend every minute of every day until they figure it out, and that's what makes them better than you. Majority of the time the issue is not software itself, but the policies in place. Hell, why even break in technically, when I can probably call one of these 10,000 employees up and they'll give me their password. Duh. If you believe security is 1-dimensional, then you are bound to fail. History has shown this time and time again, just read a book / biography in regards to this topic.
      - pook 16y ago
        More importantly but less vociferously, by Google switching to an open source OS, it means anyone, anywhere, can fix vulnerabilities. Not just Google. Considering the difficulty of patching security holes in proprietary software versus patching holes in open software, Google indeed would hugely benefit by drastically reducing the difference between the cost of defense and the cost of cracking. It's not so much levelling the playing field, as removing Harrison Bergeron's buckshot-filled equality harness.
RyanMcGreal 16y ago
Mac OSX is inferior from a security standpoint, but enjoys herd immunity so the actual risk of infection is lower.
- chancho 16y ago
  Herd immunity? That's a pretty bad metaphor. There is not "safety in numbers" on the Mac. Safety comes from their lack of numbers. Unless you meant to imply that Macs are like the kids at school whose dipshit parents don't vaccinate them.
  - manvsmachine 16y ago
    Actually, that's not what herd immunity means. Herd immunity is based on the concept that, if a large enough subset of the population is protected from infection, then others in the population are inherently more protected due to lower transmission rates. For herd immunity to apply in this case, we'd be assuming that OS X users are more likely to take proper measures to ensure that their system is not compromised (which may or may not be the case).
    - teaspoon 16y ago
      If Windows computers make up a majority of the market, then the transmission rate for viruses that target only OS X is low. Therefore, you could argue that computers collectively enjoy herd immunity versus OS X viruses, even if machines running OS X individually have weaker security than average.
  - RyanMcGreal 16y ago
    Herd immunity doesn't mean "safety in numbers". It means insulation from transmission vectors because the rest of the herd is immune from diseases that might infect you. An isolated OSX machine surrounded by Windows machines in a network is relatively isolated from virus transmission vectors. Then again, Jeff Goldblum was able to write a virus on his Mac that he used to infect the alien mothership, so maybe they're not so secure after all...
Retric 16y ago
Security contests are poor measures of security. A "new" windows flaw is a valuable commodity and most people who are aware of such things are not going to use them to "win" a contest. In the real world there are three issues, systems that are not up to date, systems that are more open than ideal, and unknown issues. The ideal contest wold take a reasonably permissive system that's 3 months out of date and see how long that lasts under normal usage.
tptacek 16y ago
No. There is no evidence that Windows 7 is less secure than Mac OS X Snow Leopard --- at least, not clear evidence (we could certainly spend a few days tit-for-tat'ing about this disclosure or that, but it wouldn't amount to a coherent argument).
- raggi 16y ago
  Except for in default configuration, with a user account that's passworded, there's this massive at-console exploit that requires no specialist knowledge other than very basic shell knowledge. cmd+s on boot.
  - eru 16y ago
    If you have physical access to the machine, all bets are off anyway.

memoryfault 16y ago

And what happens when someone exploits Linux?

melling 16y ago
You have a nice ecosystem of Unix OS's. Solaris, OpenBSD, NetBSD, ... and a handful of major Linux distros: Ubuntu, Fedora, Suse, Gentoo, Debian, etc. Once you've gone Unix you have lots of choices, including the Mac. Did Google roll their own Linux? Which kernel do you target? which apps?
- doty 16y ago
  It seems reasonable to assume that they'd standardize on a distribution, and centrally manage patching client machines. I cannot imagine that they would expect every employee to concern themselves with such things.
- Perceval 16y ago
  Google reportedly has a modified version of LTS Ubuntu used internally: http://en.wikipedia.org/wiki/Goobuntu http://en.wikipedia.org/wiki/Goobuntu

melling 16y ago

Market share: Windows 90%, Mac 9%, Linux 1%. Where are virus writers going to put most of their effort? Windows being as secure as Mac wouldn't help make it safer because a lot more implemented exploits are going to exist in the wild.

yummyfajitas 16y ago
While this move may prevent infection by FR33_PR0N.wmv.exe, I don't see how it will prevent being hacked by China (the major concern).
- jimbokun 16y ago
  I believe the Chinese government has Windows source code, and Google does not. The Darwin and BSD layers of Mac OS X are open source, so Google can at least study the code to understand the security implications of using OS X. In other words, with open source Google is on a more level playing field against potential attackers.
  - microkid 16y ago
    No offense, but level playing field is ridiculous. Think about what you're saying, you're saying Google is going to sit there and review all of the source code, and all patches and new releases to that source code. Really? Do you actually believe this... As per China having the source, do you really think it matters? If someone wants to break in, they're going to get in... (regardless if its Windows/Linux/Mac) why... because that's their job and they are going to spend every minute of every day until they figure it out, and that's what makes them better than you. Majority of the time the issue is not software itself, but the policies in place. Hell, why even break in technically, when I can probably call one of these 10,000 employees up and they'll give me their password. Duh. If you believe security is 1-dimensional, then you are bound to fail. History has shown this time and time again, just read a book / biography in regards to this topic.
    - pook 16y ago
      More importantly but less vociferously, by Google switching to an open source OS, it means anyone, anywhere, can fix vulnerabilities. Not just Google. Considering the difficulty of patching security holes in proprietary software versus patching holes in open software, Google indeed would hugely benefit by drastically reducing the difference between the cost of defense and the cost of cracking. It's not so much levelling the playing field, as removing Harrison Bergeron's buckshot-filled equality harness.

RyanMcGreal 16y ago

Mac OSX is inferior from a security standpoint, but enjoys herd immunity so the actual risk of infection is lower.

chancho 16y ago
Herd immunity? That's a pretty bad metaphor. There is not "safety in numbers" on the Mac. Safety comes from their lack of numbers. Unless you meant to imply that Macs are like the kids at school whose dipshit parents don't vaccinate them.
- manvsmachine 16y ago
  Actually, that's not what herd immunity means. Herd immunity is based on the concept that, if a large enough subset of the population is protected from infection, then others in the population are inherently more protected due to lower transmission rates. For herd immunity to apply in this case, we'd be assuming that OS X users are more likely to take proper measures to ensure that their system is not compromised (which may or may not be the case).
  - teaspoon 16y ago
    If Windows computers make up a majority of the market, then the transmission rate for viruses that target only OS X is low. Therefore, you could argue that computers collectively enjoy herd immunity versus OS X viruses, even if machines running OS X individually have weaker security than average.
- RyanMcGreal 16y ago
  Herd immunity doesn't mean "safety in numbers". It means insulation from transmission vectors because the rest of the herd is immune from diseases that might infect you. An isolated OSX machine surrounded by Windows machines in a network is relatively isolated from virus transmission vectors. Then again, Jeff Goldblum was able to write a virus on his Mac that he used to infect the alien mothership, so maybe they're not so secure after all...

Retric 16y ago

Security contests are poor measures of security. A "new" windows flaw is a valuable commodity and most people who are aware of such things are not going to use them to "win" a contest. In the real world there are three issues, systems that are not up to date, systems that are more open than ideal, and unknown issues. The ideal contest wold take a reasonably permissive system that's 3 months out of date and see how long that lasts under normal usage.

tptacek 16y ago

No. There is no evidence that Windows 7 is less secure than Mac OS X Snow Leopard --- at least, not clear evidence (we could certainly spend a few days tit-for-tat'ing about this disclosure or that, but it wouldn't amount to a coherent argument).

raggi 16y ago
Except for in default configuration, with a user account that's passworded, there's this massive at-console exploit that requires no specialist knowledge other than very basic shell knowledge. cmd+s on boot.
- eru 16y ago
  If you have physical access to the machine, all bets are off anyway.