5 ms·
I think there's certainly an element of tall poppy syndrome here. Windows, for example, used to be targeted because its security was a complete joke until quite
by bartread 1y ago
I think there's certainly an element of tall poppy syndrome here. Windows, for example, used to be targeted because its security was a complete joke until quite late in the XP era (SP3 IIRC). But there's always been, and still is, and element that it's targeted because it's a big, juicy target.
A huge portion of the desktop and server market are running Windows. It used to be almost all Windows, at least on the desktop. Nowadays mobile computing has become far more important so Windows doesn't have the end user dominance it once did, but there are still a huge portion of end user devices running Windows.
Same on the back end: it's just a big juicy target, and the bang for buck that hackers get from it is huge given how prevalent it remains in corporate and government environments.
- dijit 1y agoyet nearly all internet facing servers are linux; and we don't see the same volume of issues.
- hnlmorg 1y agoI hate Microsoft products as much as the next person, but I don’t think your statement is entirely fair: SharePoint isn’t Windows. It’s a Microsoft product that’s only available for Windows Server. But it’s not Windows. The reason I make that distinction is because if you widen the scope of services available on Linux then you might come a lot closer to the same volume of issues. For example, take a look at how frequently CVEs are raised against popular CMSs.
- dijit 1y agoSure, I get the point, a more apt comparison might actually be RedHat though, since they're doing E2E packaging for a product suite. I mean, Linux isn't even Linux - At the risk of invoking a meme: Linux is actually GNU + Linux; and even then there's a web-server on top, and software that it runs. So, a working comparison might be Wikipedia? As far as I understand it; that's the largest CMS on the planet.
- hnlmorg 1y agoNeither Wikipedia nor Redhat are as big targets as Microsoft’s ecosystems. Not even remotely.
- dijit 1y agook, nginx+linux power nearly every website, is that close enough of a sizable target? As mentioned, even if we exclude websites, Linux is a pretty enormous target. Much more enormous than microsoft - by an order of magnitude or more, yet: we don’t seem to have these kind of issues. Curious, don’t you think?
- hnlmorg 1y agoNginx doesn’t have the same attack surface. Microsoft’s back office suite is massive. So you’re talking about Nginx + a CMS + online office suite + video conferencing + identity providers and so on and so forth. There isn’t really a direct comparison in the FOSS world. It’s either smaller in scope or smaller in terms of high profile organisation adoption. This is why I think it’s easier to ignore the “Linux” part. Not because Linux is technically a kernel, but because there isn’t a directly comparable solution that targets Linux / GNU or whatever other base OS moniker you want to use. Same is true for BSD, Darwin and so on. The alternatives to Microsoft’s dominance are typically more narrow in scope and usually proprietary too (eg Okta for identities, Google Docs for O365, etc) Does this mean that Microsoft products are secure? Not really. It just means we cannot make a fair comparison against FOSS when it comes to these specific types of attacks.
- notakio 1y agoIf every car in your neighborhood that gets broken into is manufactured by a single manufacturer, it is in your interest in asking why that is, and perhaps considering that fact when shopping for a new car.
- jodrellblank 1y ago
- graemep 1y ago> For example, take a look at how frequently CVEs are raised against popular CMSs. One popular CMS in particular?