Skip to Content

FUD: Windows is "most secure OS"

Andy Patrizio has an incredibly sloppy story entitled "Surprise, Microsoft Listed as Most Secure OS" at internetnews.com, which purports to summarize the recently released Symantec Internet Security Thread Report Volume XI. But if you look closely at the actual report (PDF), you'll see that this claim that Windows is "Most Secure" is based merely on Microsoft's relative speediness in patching security holes. That is, what apparently makes Windows "most secure" is that in the Jul-Dec 2006 timeframe Microsoft took an average of only 21 days to patch holes, while Red Hat (linux) took took 58 and Apple took 66. Okay, so Microsoft is best right? But that's silly, why would the speed of responding to holes by itself determine which OS is most secure? It should clearly matter how serious the holes were in the first place! If you're slow to patch relatively innocuous holes, is that not better than quickly patching a larger number of more serious holes? And when we look at the breakdown we see that in this period Microsoft had 39 disclosed vulnerabilities, and "12 were considered high severity, 20 were medium." Apple, on the other hand, issued 43 patches, and only "one was considered high severity, 31 were medium." So basically, Microsoft is quicker at patching 12 times as many high severity vulnerabilities, and that apparently makes Windows "more secure."

Now it's worth noting that none of this settles the question of which OS is more secure, but it does show the completely specious reasoning behind that headline claiming Windows is the "Most Secure OS." And of course it's this sort of lazy reporting (compounded by Patrizio's sniffing at Apple's advertising of better security) that creates a meme that others may pick up and pass on without quite realizing that it based on a straightforward misreading. In other words, it's pure FUD.

Andy Patrizio has an incredibly sloppy story entitled "Surprise, Microsoft Listed as Most Secure OS" at internetnews.com, which purports to...
 

Add a Comment

*0 / 3000 Character Maximum

23 Comments

Filter by:
Grail

My Windows machine is the most secure of all my computers.

About two years ago, the power supply failed. Since then I've been doing all my work and play on my Mac. Windows machine is switched off, disconnected from the network. I've had to do nothing more to maintain that machine for two years.

In the intervening two years, my Mac has had a few OS updates, security updates, I even had to reboot it once due to a kernel panic.

Two years - about 10 compulsory reboots on the Mac and 0 changes of state on the Windows PC. Therefore my Windows PC is much more reliable than my Mac.

March 25 2007 at 10:20 PM Report abuse +1 rate up rate down Reply
compton

Lima says: "Micro$oft do not realizes that nobody buys these crap it pumps outside Redmond.

M$ has to realize that nothing can be done to prevent it from going down in free fall, as it is doing since 2003."

Ah if that were but true. However MS has built its huge empire on exactly this sort of BS, wrapped up in satin.

Exploitation of the ignorant is the name of the game; keeping the ignorant in the dark is one of MS's specialities. Excuse the mixed metaphor, but pulling the wool over your customers' eyes makes it a lot easier to fleece 'em!

As for this particular report, am I the only one to wonder about a relation between MS's attempts to push firms such as Symantec out of the market, with their crappy 'Defender'? ie Symantec conspires to have some reporter come up with this kind of Gates-fellating article in the hope that Redmond will tolerate their continued existance?

March 24 2007 at 8:12 AM Report abuse rate up rate down Reply
Mike

This dumb article is based on a statistics created by M$ using the following parameters:

1) first, choose a range of dates when other OS has received more patches than Vista

2) publish a graphic telling HEY, VISTA IS MORE SECURE THAN ALL OTHER SYSTEMS, LOOK AT HOW MANY HOLES WE HAVE DISCOVERED THIS MONTH!

Using this method you can say the Mojave Desert has more rain than London and Boston. Just wait for the day when you have rain in the Mojave Desert and no rain in London and Boston. Let's talk about number of vulnerabilities x lifespan. Tiger has 2 years. Let's Vista complete 2 years and compare vulnerabilities then.

Micro$oft do not realizes that nobody buys these crap it pumps outside Redmond.

M$ has to realize that nothing can be done to prevent it from going down in free fall, as it is doing since 2003.

March 23 2007 at 3:28 PM Report abuse rate up rate down Reply
John Strachan

I reread the report after actually Patrizio's article and I stand corrected. There were actually patches in MacOSX that were mentioned in the white page. However, Patrizio's article did gloss over a couple of points ...

Firstly, the white paper makes no mention about the absolute number of vulnerabilities in the operating system, it just discusses the fact that the MS numbers are based on a sample set of 39 whereas the MacOSX numbers are based on a sample set of 43. You cannot use absolute numbers when you are talking about a SAMPLE set.

It is also interesting to note that the wording used by Symantec is "Of the 39 Microsoft vulnerabilities DISCLOSED" whereas there is no mention of disclosure in the Apple analysis "Out of the 43 vulnerabilities in Mac OSX". Makes you wonder exactly who did the disclosure and whether Symantec took the vendor's word on how many vulnerabilities were found. Even if the number for MS is accurate, is it better that a vendor actually FINDS vulnerabilities or is it more important that the number is low and there may be unknown vulnerabilities lurking out there?

March 23 2007 at 3:18 PM Report abuse rate up rate down Reply
Mike

as one said one day... Microsoft has all the friends money can buy....

March 23 2007 at 3:07 PM Report abuse rate up rate down Reply
Juan Motai

If Windows is more secure than other operating systems then Symantec's products are even less necessary on a Windows machine than on my Macintosh.
I have zero need for any Symantec product on my Macintosh.

March 23 2007 at 3:02 PM Report abuse rate up rate down Reply
John Strachan

I just skimmed the whole report. The reason that Apple Safari (and it is the Safari web browser, not the whole OS) gets any kind of a black mark is because the one vulnerabilty in the second half of the 2006 that was identified took over 62 days to patch. However, in the paper, Symantec takes care to mention that "this increase is based on a sample set of only one vulnerabilty, a sample size that is too small to ensure valid conclusions." They also mention that the problem "affected a third-party HTML rendering component, so it is possible that the third-party nature may have slowed the patch release time." (Pg 44). Also the total number of vulnerabilites identified for this time period were 4, two less than in 2005.

Meanwhile, for the same time period, MSIE had 54 vulnerabilities identified, an increase from the 25 documented in the second half of 2005. The sample size chosen for Microsoft was 15 as opposed to Safari's 1 and the patches had a maximum development time of 78 days.

So in other words, although MSIE had 50 more vulnerabilities, increased the number of vulnerabilities over the past year (as opposed to Safari's reduction) and actually took longer to sort out at least the worst one, it supposedly is more secure ... right?

This is as poor a case of reporting as I have seen. Obviously the writer can't read, because it looks like he simply looked at the bar graphs and wrote his article.

March 23 2007 at 3:00 PM Report abuse rate up rate down Reply
JulesLt

Malfoy - Mr.Blogger doesn't need a degree in security to criticise a journalist - Andy Patrizio - for their interpretation of Symantec's data, especially when they reach a conclusion Symantec don't support. Their techies don't believe it's the most secure OS, but that MS are the most responsive.

>There are a few things more humorous than this, >one involves euro teenagers on irc discussing
>U.S. foreign policy. Could someone be less
>qualified to be part of that discussion?
>Probably not.
Because, as we all know, only Americans are allowed to have opinions about US Foreign Policy. Ever noticed the Foreign bit in that phrase? It's about what you're doing in the rest of the world, and guess what, the rest of the world has an opinion about it! Not that America's ever made a mistake in it's foreign policy, of course.

March 23 2007 at 1:04 PM Report abuse rate up rate down Reply
Johnny Thrash

I'm glad security functionality and stability.

All these people defending Windows. I'm glad I don't need an extra 300$ in security tools, spyware tools, and antivirus tools JUST to run my operating system with any sense of security, even if it is false.

I've been a programmer, developer, administrator and technician on Windows systems for over 15 years. Nothing has really changed with it. I finally got tired of the neverending battle and switched to something that just does what I want it to... not what IT wants to.

Thank you Apple for security, stability, beauty, functionality, design, and most of all ... thank you for my Macintosh.

March 23 2007 at 1:01 PM Report abuse rate up rate down Reply
Liquidmark

@Malfoy Roark

It's called an opinion. Live with it.

March 23 2007 at 11:13 AM Report abuse rate up rate down Reply
Buy an ad here

Hot Apps on TUAW

Tweets

© 2012 AOL Inc. All Rights Reserved.