Re: bill gates' claim about security vulnerabilities per LOC in Unix versus Windows

Terry Milnes wrote:

> Thats simple, these worms are designed to exploit the most commonly 
> used OS's, used by for the most part, people who are toatally ignorant 
> of how their systems work.

This "most commonly used OS's" argument sound plausible, but it can't be 
a blanket truth.  Yes, virus/worm/exploit writers will generally target 
the most common systems in use, but didn't the latest NetCraft survey 
say that 2/3 of all web sites are served by Apache, now?  (can't 
remember the link--it was on slashdot in the last week or so).  I 
understand that "sites" doesn't necessarily correspond to "servers", but 
we can agree that the absolute populations of ISS and Apache servers are 
within an order of magnitude or so.  And yet, Apache doesn't have the 
numbers or severity of bugs that IIS does--it would be nice to see a 
detailed statistical analysis of HOW relevant that disparity is, but I 
don't know of any numbers that are reliable enough to use as a starting 
point.  But the difference does exist.

(for the record, the Apache/IIS comparison isn't so much a "Windows vs. 
Unix" question as it is a "Microsoft vs. open-source" issue.  And not 
all open-source projects are as good as Apache.  I think we just need to 
realize that the number of remote root bugs doesn't have to be 
proportional to the install base population, if your software is 
well-designed and well-coded.)

I would TOTALLY agree with you, though, that user ignorance is a big 
contributor to the problems of the Windows world.  That's what happens 
when you try to put "A computer on every desktop".  I can remember the 
first time I installed Slackware as a NATing router on my DSL line--I 
was just lucky that my ISP was firewalling me upstream.

The desktop environment itself makes this all terribly complicated, 
too.  Linus Torvalds' latest interview (from the Alaskan cruise) makes 
the bright point that coding and building secure, stable, good servers 
is easy compared to secure, stable, good desktop machines.  Personally, 
I think that the open-source community has a lot of re-thinking and 
re-designing to accomplish before it can build something for the desktop 
that is quite as cool as Linux/*BSD is for the server.

But then again, I just installed Slack 9.1 with ALSA, a 2.6.0 test 
kernel, and KDE 3.1, and my girlfriend doesn't notice the difference 
between it and XP (which, I have to admit, does have a well-considered 
UI for non-administrative desktop users).  So maybe the OSS boys are 
doing something right.

-Ryan