5 ms·

I bet Microsoft are enjoying the fact that it is Linux that seems to have all the security vulnerabilities these days!

by weavie 12y ago

tomswartz07 12y ago
Heh, yeah- those two major failures certainly overshadow the hundreds of issues Win has. :)
- gokhan 12y ago
  Can you name those hundreds of issues discovered on Windows stack for, say, 2014? I'm on IIS and I really want to know if I'm missing something. MS had it's fair share of security flaws in the past but give them credit for their current state. You sound like people still talking about BSODs, while it's certainly a thing in the past.
  - freehunter 12y ago
    I get BSODs all the time on Windows 8.1 because of my video card drivers.
  - WorldWideWayne 12y ago
    Here is the list of security advisories for all Microsoft products and they even list some non-Microsoft products like Adobe Flash, etc: - https://technet.microsoft.com/en-us/library/security/dn631936.aspx https://technet.microsoft.com/en-us/library/security/dn63193... I don't know where to get the multitude of security advisories for Unix systems listed all in one spot, but here are some links for popular distros: - https://www.debian.org/security/ https://www.debian.org/security/ - http://www.ubuntu.com/usn/ http://www.ubuntu.com/usn/ - https://access.redhat.com/security/updates/active/ https://access.redhat.com/security/updates/active/ - http://www.slackware.com/security/list.php?l=slackware-security&y=2014 http://www.slackware.com/security/list.php?l=slackware-secur... Anyone know where to go in order to get the Unix vulns all in one list?
    - XzetaU8 12y ago
      http://www.cvedetails.com/vendor/firstchar-L/6/?sha=973e5d936dcd6bafaeb7b62f90488cfa77d4ad51&trc=461&order=1 http://www.cvedetails.com/vendor/firstchar-L/6/?sha=973e5d93... http://www.exploit-db.com/platform/?p=linux http://www.exploit-db.com/platform/?p=linux
- WorldWideWayne 12y ago
  Do two hugely impactful nix-centric security bugs overshadow the hundreds of minor ones found in Microsoft products? Yes, certainly.
- duaneb 12y ago
  I was under the impression that windows server is pretty stable/secure these days.
krapp 12y ago
On the one hand, if this had been in Windows, no one in the public would have been able to stumble across it, though you would expect them to be paying rooms full of engineers to make sure that's never necessary (and yet stuff happens.) On the other hand, despite the premise of open source that 'many eyes make all bugs shallow', the amount of code in the wild and the complexity of it (and the diversity of implementation languages) has pretty much guaranteed that there's more code than possible coverage. No one has to come up with clever marketing for Microsoft exploits because everyone expects there to be tons of them, given the level of complexity, and that Microsoft will push patches for them, because it affects their bottom line. Meanwhile, it seems in the open source world, you need PR campaigns to goad the community into due diligence.
- drzaiusapelord 12y ago
  Considering most exploits are found via fuzzing tools, I think your assumption is pretty far away from reality. If people could casually look at code and see vulnerabilities, then we wouldn't have any. Also: MS Shared Source initiative
  - krapp 12y ago
    But people can casually look at code and see vulnerabilities, any time they want. Although your point about the methods of exploits changing the dynamic is valid. >Also: MS Shared Source initiative Fair point.
    - drzaiusapelord 12y ago
      >But people can casually look at code and see vulnerabilities, any time they want. I think you're dismissing the level of experience, smarts, and inter-disciplinary knowledge it takes to find a bug like this. More than likely, even those with all those skills and at the 1% of them can't just eyeball code and go, "Ah yes, here." They're instead writing a lot of little tools and seeing what they can break. Then they go back, see what broke, and work out if its possible to exploit that exception or crash condition. These types of tools and methods work just as well with closed source. Attacking closed source seems very unfair to me in these scenarios.

I bet Microsoft are enjoying the fact that it is Linux that seems to have all the security vulnerabilities these days!

by weavie 12y ago

I bet Microsoft are enjoying the fact that it is Linux that seems to have all the security vulnerabilities these days!

tomswartz07 12y ago

Heh, yeah- those two major failures certainly overshadow the hundreds of issues Win has. :)

gokhan 12y ago
Can you name those hundreds of issues discovered on Windows stack for, say, 2014? I'm on IIS and I really want to know if I'm missing something. MS had it's fair share of security flaws in the past but give them credit for their current state. You sound like people still talking about BSODs, while it's certainly a thing in the past.
- freehunter 12y ago
  I get BSODs all the time on Windows 8.1 because of my video card drivers.
- WorldWideWayne 12y ago
  Here is the list of security advisories for all Microsoft products and they even list some non-Microsoft products like Adobe Flash, etc: - https://technet.microsoft.com/en-us/library/security/dn631936.aspx https://technet.microsoft.com/en-us/library/security/dn63193... I don't know where to get the multitude of security advisories for Unix systems listed all in one spot, but here are some links for popular distros: - https://www.debian.org/security/ https://www.debian.org/security/ - http://www.ubuntu.com/usn/ http://www.ubuntu.com/usn/ - https://access.redhat.com/security/updates/active/ https://access.redhat.com/security/updates/active/ - http://www.slackware.com/security/list.php?l=slackware-security&y=2014 http://www.slackware.com/security/list.php?l=slackware-secur... Anyone know where to go in order to get the Unix vulns all in one list?
  - XzetaU8 12y ago
    http://www.cvedetails.com/vendor/firstchar-L/6/?sha=973e5d936dcd6bafaeb7b62f90488cfa77d4ad51&trc=461&order=1 http://www.cvedetails.com/vendor/firstchar-L/6/?sha=973e5d93... http://www.exploit-db.com/platform/?p=linux http://www.exploit-db.com/platform/?p=linux
WorldWideWayne 12y ago
Do two hugely impactful nix-centric security bugs overshadow the hundreds of minor ones found in Microsoft products? Yes, certainly.
duaneb 12y ago
I was under the impression that windows server is pretty stable/secure these days.

krapp 12y ago

On the one hand, if this had been in Windows, no one in the public would have been able to stumble across it, though you would expect them to be paying rooms full of engineers to make sure that's never necessary (and yet stuff happens.) On the other hand, despite the premise of open source that 'many eyes make all bugs shallow', the amount of code in the wild and the complexity of it (and the diversity of implementation languages) has pretty much guaranteed that there's more code than possible coverage. No one has to come up with clever marketing for Microsoft exploits because everyone expects there to be tons of them, given the level of complexity, and that Microsoft will push patches for them, because it affects their bottom line. Meanwhile, it seems in the open source world, you need PR campaigns to goad the community into due diligence.

drzaiusapelord 12y ago
Considering most exploits are found via fuzzing tools, I think your assumption is pretty far away from reality. If people could casually look at code and see vulnerabilities, then we wouldn't have any. Also: MS Shared Source initiative
- krapp 12y ago
  But people can casually look at code and see vulnerabilities, any time they want. Although your point about the methods of exploits changing the dynamic is valid. >Also: MS Shared Source initiative Fair point.
  - drzaiusapelord 12y ago
    >But people can casually look at code and see vulnerabilities, any time they want. I think you're dismissing the level of experience, smarts, and inter-disciplinary knowledge it takes to find a bug like this. More than likely, even those with all those skills and at the 1% of them can't just eyeball code and go, "Ah yes, here." They're instead writing a lot of little tools and seeing what they can break. Then they go back, see what broke, and work out if its possible to exploit that exception or crash condition. These types of tools and methods work just as well with closed source. Attacking closed source seems very unfair to me in these scenarios.