# Is Windows really less secure? **URL:** \ **Category:** Factual Questions\ **Created:** [April 2, 2005, 1:32am UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345 "2005-04-02T01:32:47Z")\ **Posts on this page:** 14\ **Page:** 2
**Author:** ![Shalmanese](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@Shalmanese](https://boards.straightdope.com/u/Shalmanese)\ **Post date:** [April 3, 2005, 3:51am UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345/21 "2005-04-03T03:51:28Z")
> [@ninetypercent](#): > > I’m certain that the code for say, the Linux kernel, has been analyzed by far more minds than the source code for the Windows XP kernel. I think the same applies to any popular open-source project. The number of people working on Microsoft products is limited by the financial resources of the company, rather than the number of people using whatever product. As the popularity of Linux increases, so does the quality and security of the code. Logically, the open-source community wants as many flaws as possible to be discovered and reported - or less ideally, exploited. When that happens, a number of patches are developed to solve the problem, so the developers responsible for official chances in the code can choose which they think is best. Anyone can submit changes. Anyone can change their copy of the code. Really? How many people have ACTUALLY looked at the deep, nitty gritty bits of the linux kernel? I know quite a few computer savvy people who do regular linux development work and have even peeked into the more popular bits of the kernel once in a while. But none of them are looking at any of the bits of the kernel not directly related to their app dev work and certainly none of them are looking at the kernel from a security perspective in mind. I would wager that the actual code coverage of the kernel is a lot sparser than most people think. Casual scanning of source is not enough to pick out subtle security flaws. ---
**Author:** ![spinky](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@spinky](https://boards.straightdope.com/u/spinky)\ **Post date:** [April 3, 2005, 9:16am UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345/22 "2005-04-03T09:16:55Z")
> [@Shalmanese](#): > > I would say that Windows 2003 Server was the first MS OS that came out giving real serious thought to security. I would rate it about on par with a generic linux box, especially with the new SP2. If you were in a position to say when Microsoft started “giving serious thought to security”, I would think you’d also be in a position to know that there’s no such thing as SP2 for Windows Server 2003. ---
**Author:** ![sleestak](https://avatars.discourse-cdn.com/v4/letter/s/919ad9/32.png) [@sleestak](https://boards.straightdope.com/u/sleestak)\ **Post date:** [April 3, 2005, 9:45am UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345/23 "2005-04-03T09:45:34Z")
Another problem with MS and security is that they basically ignored it for a long time. They would put out patches when holes were found and exploited but security was not a major focus. IIRC MS started the Trustworthy Computing initiative a couple years ago with the focus on making their stuff more secure. I seem to recall that they even stopped development for a while and did a security review of their code. MS is getting better. Historically it seems to me that it always takes MS about three times to get things right. Once they get it right their products are pretty good, not great but not horrid either. If MS keeps focused on security they will get it right sooner or later. But they still need to get better(#1). You can lock a Windows box down pretty tight but you have to know what you are doing. Slee #1. If I have physical access to a MS box I can break into it in about 5 minutes. This particular problem might have been fixed with SP2 but I am not sure about that. If it is on a network it’ll take a lot longer but I will get in. ---
**Author:** ![Shalmanese](https://avatars.discourse-cdn.com/v4/letter/s/45deac/32.png) [@Shalmanese](https://boards.straightdope.com/u/Shalmanese)\ **Post date:** [April 3, 2005, 1:05pm UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345/24 "2005-04-03T13:05:48Z")
> [@ntucker](#): > > If you were in a position to say when Microsoft started “giving serious thought to security”, I would think you’d also be in a position to know that there’s no such thing as SP2 for Windows Server 2003. Oops, I meant SP1 ---
**Author:** ![ninetypercent](https://avatars.discourse-cdn.com/v4/letter/n/9de0a6/32.png) [@ninetypercent](https://boards.straightdope.com/u/ninetypercent)\ **Post date:** [April 3, 2005, 6:37pm UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345/25 "2005-04-03T18:37:14Z")
> [@Shalmanese](#): > > Really? How many people have ACTUALLY looked at the deep, nitty gritty bits of the linux kernel? I know quite a few computer savvy people who do regular linux development work and have even peeked into the more popular bits of the kernel once in a while. But none of them are looking at any of the bits of the kernel not directly related to their app dev work and certainly none of them are looking at the kernel from a security perspective in mind. I would wager that the actual code coverage of the kernel is a lot sparser than most people think. > > Casual scanning of source is not enough to pick out subtle security flaws. I’m sure it’s a small percentage of the number of Linux users; less than 1%. Even so, that could easily be 20,000 people. I seriously doubt Microsoft has even 1/4 that many employees working on the Windows kernel alone. [http://counter.li.org/estimates.php](http://counter.li.org/estimates.php) - estimated number of Linux users ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [April 3, 2005, 7:06pm UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345/26 "2005-04-03T19:06:07Z")
It’s difficult to say just how secure the various unices are, since (as has been pointed out), they’re not as big a target for attacks. But it’s certain that Microsoft security is bad. I’ve seen an awful lot of Microsoft security holes, including many of the “Arbitrary user can run arbitrary code without any authorization” type. A system with even one such vulnerability cannot by any stretch of definitions be considered remotely close to secure. Now, maybe Unix (or some flavor of Unix) has such a vulnerability, too, but if so, it’s never been found. ---
**Author:** ![spinky](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@spinky](https://boards.straightdope.com/u/spinky)\ **Post date:** [April 3, 2005, 7:42pm UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345/27 "2005-04-03T19:42:39Z")
> [@Chronos](#): > > Now, maybe Unix (or some flavor of Unix) has such a vulnerability, too, but if so, it’s never been found. Now that’s a bold statement. The whole concept of a “rootkit” (which provides a way for an arbitrary user to run arbitrary code without authorization) was **invented** on unix, otherwise it would be called an “adminkit” or something. Heck, there was a version of OpenSSH released a year or so ago that had a flaw that authorized root access if you simply left the password blank. You may argue that those exploits are not in the kernel itself, but the same distinction goes for windows. Unix systems do tend to be more secure, but it’s also a function of how they’re set up. People setting up a unix box tend to know that “disable all network services you’re not using, just in case one has a security hole” is a good practice, so the boxes end up locked down much better. ---
**Author:** ![SlowMindThinking](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@SlowMindThinking](https://boards.straightdope.com/u/SlowMindThinking)\ **Post date:** [April 3, 2005, 7:49pm UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345/28 "2005-04-03T19:49:42Z")
Don’t lose track of a point made earlier. Under Windows, you almost have to be an admin. I’m pretty good with computers, but I never figured out how to get Outlook to let my kids and wife see mail from their account, while I could see theirs and mine - without making them admin. They can’t play most games without being admin. (Setting up Runas should be possible, but weird things happen.) Under Linux, it is a piece of cake, no one is admin, except for root, and I never go online as root. The other issue is the kind of security patches. My Suse Linux requires patches, but invariably the security warning is something like “blah blah blah and print something”. Whereas with Windows it is “blah blah blah and take over the computer.” ---
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [April 3, 2005, 9:51pm UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345/29 "2005-04-03T21:51:33Z")
Linux is a very modular design, even if it isn’t technically a microkernel. You can, for example, load and unload device drivers without rebooting the system: There is an API they hook into and they aren’t really a part of the kernel proper, they just get closer to it than applications do. Even within the kernel there’s various components that are largely seperable from each other. This is a big deal when it comes to security. (Look for lsmod, insmod, and modprobe, which should exist on all modern Linux systems.) Security is about minimizing complexity. The way computer people minimize complexity is to put an interface on top: They develop a mental model of how it should interact with the world and how the world should interact with it, and they implement that with code. No code outside the module touches anything beyond the interface. This is easier to understand and easier to fix when something goes wrong, either inside or outside the module. Plus, interfaces can limit what damage you can do. If the interface doesn’t allow you to format the hard drive, no code written to talk to that interface can format the hard drive. This is perhaps less relevant if the code is running in kernelspace, but it’s still an important part in managing complexity and, therefore, boosting security. Perhaps the most important evidence of how modular the kernel is is how many different architectures it runs on now, and how common it is for Linux to be ported to new systems. Porting doesn’t require a rewrite for most hardware systems, especially if gcc already supports that platform. You need only rewrite a handful files and headers. [Here is a visual map of a version of the Linux kernel.](http://kernelmapper.osdn.com/) [An interesting article on porting Linux to a MIPS-based embedded system.](http://www.embedded.com/story/OEG20010221S0092) It isn’t long. ---
**Author:** ![rjung](https://avatars.discourse-cdn.com/v4/letter/r/45deac/32.png) [@rjung](https://boards.straightdope.com/u/rjung)\ **Post date:** [April 4, 2005, 7:14am UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345/30 "2005-04-04T07:14:00Z")
> [@monkeyfist](#): > > How does Mac work in all this. The core OS in MacOS X is an open-source variation of UNIX, called BSD UNIX. As with Linux, thousands of eyeballs have looked at it and nitpicked the vulnerabilities to pieces. Then throw in UNIX’s Primus-knows-how-many-years of development and use, and you’ve got yourself a very secure system. _Then_ throw in the fact that MacOS X ships by default with most vulnerabilities turned off (no root account enabled, no servers activated), and you’ve got one tight-ass mo’fo. The only security goof with MacOS X right now is that it doesn’t ship with the firewall turned on by default, but since all services are turned _off_ by default, it’s not much of a concern. > [@monkeyfist](#): > > I ask because the current argument seems to be suggesting that Microsoft is more vulnerable becuase it favors towards easier user interface. If this is true, how does Mac, suggested to be the most user friendly OS, fair in the security game. Much better than Microsoft Windows. 🙂 Note that the current number of active MacOS X viruses/trojans/exploits is still zero after all these years. As others have noted, Windows is more vulnerable not because it ships with things that make things friendly for the user, but because it ships with things that make things _easier for Microsoft_ – backwards compatibility with legacy software, remote access for customer support, mining of customer information, etc. There is no reason why a system can’t be both secure and user-friendly; it’s simply a matter of careful design and planning. ---
**Author:** ![dasgupta](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@dasgupta](https://boards.straightdope.com/u/dasgupta)\ **Post date:** [April 4, 2005, 1:53pm UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345/31 "2005-04-04T13:53:57Z")
> [@sleestak](#): > > #1. If I have physical access to a MS box I can break into it in about 5 minutes. This particular problem might have been fixed with SP2 but I am not sure about that. If it is on a network it’ll take a lot longer but I will get in. Yes, if you had access to the machine, you could use a \*nix boot disk and change the administrator password. I’ve done it many times myself for old clients. Likewise, I could use a similar method to boot into linux, add a user root2, and change the root password. The first step in any OS security is physical. You don’t let unauthorized users gain **physical** access to your box. A low-level password (ie: BIOS) wouldn’t hurt either, and would protect any OS equally. It might, however, make it difficult to remotely reboot the system, depending on your method of remote connectivity. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [April 4, 2005, 2:19pm UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345/32 "2005-04-04T14:19:27Z")
My impression (as a fairly experienced and competent Windows user/administrator and a relative, but not entirely uninformed, newbie to Linux) is that the security/access models in Windows and Linux seem to attack the problem from opposite directions; By default, Windows seems to be fairly open for file and system access - the security protocols are like extra layers of _protection_ around the system and its files - of one or more of these layers fails, the tendency is for the machine to be more vulnerable In contrast, \*nix seems by default to be highly suspicious of all activity - everyone is guilty (and therefore shut out) unless they can prove their innocence and good intentions; instead of layers of _protection_, there are channels of _enablement_ that create specific modes of access to specifi resources - if one of these fails, the tendency is for the system to become _more_ secure (that is, _less accessible_) - perhaps to the extent of not working at all. …that’s my general impression, anyway and of course none of this might apply to vulnerabilities that are part and parcel of cock-ups in the kernel etc. ---
**Author:** ![micco](https://avatars.discourse-cdn.com/v4/letter/m/5f8ce5/32.png) [@micco](https://boards.straightdope.com/u/micco)\ **Post date:** [April 4, 2005, 7:48pm UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345/33 "2005-04-04T19:48:47Z")
> [@ultrafilter](#): > > Very often, when some big worm hits, Microsoft has had a patch out for some time, but a lot of sysadmins don’t bother keeping up to date with the latest patches. > > My take is that Microsoft could do a lot more in the way of security, especially with regards to IE. However, the users could also do a lot more to take care of what’s out there. Unpatched systems are not always caused by apathy or laziness. In many cases, the admins have the patch and are eager to install it, but they will not do so until it has been properly vetted. There have been cases where the service packs and patches caused problems in other software and brought down a system. If you’re administering production webservers, it is “safer” from an uptime standpoint to leave the server unpatched and risk an attack rather than install an untested patch and leave the system completely unusable (and unrepairable since many patches can’t be rolled back). It takes time to test patches on development systems and guarantee that they won’t cause problems on production servers. No, this doesn’t explain all the unpatched systems. Yes, laziness, apathy and stupidity account for most of them. But at the other extreme, you have the very best administrators running unpatched systems because the patch can’t be trusted (yet). Better to let all those admins in between the two extremes install the patches by reflex and see if they go down. ---
**Author:** ![squeegee](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/squeegee/32/14537_2.png) [@squeegee](https://boards.straightdope.com/u/squeegee)\ **Post date:** [April 4, 2005, 8:18pm UTC](https://boards.straightdope.com/t/is-windows-really-less-secure/297345/34 "2005-04-04T20:18:31Z")
Apparently, it doesn’t matter what MS does to make Windows more secure. [Nobody installs the patches](http://www.informationweek.com/story/showArticle.jhtml?articleID=160403344): > [@](#): > > Business Adoption Of Windows XP SP2 Still Low, Survey Finds. April 4, 2005 > > In a survey of 251 businesses, AssetMetrix finds Microsoft’s most-secure operating system on fewer than 10% of PCs. [Previous page](https://boards.straightdope.com/t/is-windows-really-less-secure/297345.md?page=1)