Well, that's perhaps reductionist a bit too far to be a useful statement. There are other things outside the kernel that are important too, and design decisions

Well, that's perhaps reductionist a bit too far to be a useful statement. There are other things outside the kernel that are important too, and design decisions that matter to user space. Things like OLE can be said in retrospect wasn't a good idea security wise. Autorun kept delivering for more than a decade. Perhaps GDI could do with a security model. That sort of things makes it unnecessarily difficult to secure the system. The reason we don't hear about Windows router botnets is because nobody bothers building those boxes in the first place. You put your Windows box behind a small Linux box in order to connect it to the Internet, not the other way around.