Windows Vista One Year Vulnerability Report

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Jeff Jones, Security Strategy Director in Microsoft’s Trustworthy Computing group, (a former security consultant to the Air Force, NSA and product manager for McAfee) has released a one year vulnerability report on Windows Vista. The .PDF file is 744k.

The results of the analysis show that Windows Vista has an improved security vulnerability profile over its predecessor. Analysis of security updates also shows that Microsoft improvements to the security update process and development process have reduced the impact of security updates to Windows administrators significantly compared to its predecessor, Windows XP.
Click to expand...
 
Since their site appears to be going up and down with bandwidth/server problems..

vista_year_one.jpg
 
So much so that I had to disable it. It's an irritant and an impediment to progress.

If you're careful about about the web sites you visit, what e-mail attachments you chose to open or what software I'm installing...
 
I somewhat understand why they didn't want to include all the extras tha come with linux. However at the same time, if they are installed by default then I think they should be included as they would be a risk none the less. I would have liked to have seen redhat and Ubuntu listed both as their standard default installations and as reduced.
 
Monkey God said:
I never doubted that UAC works...only that its a huge pain in the ass.
Click to expand...

ICOM said:
So much so that I had to disable it. It's an irritant and an impediment to progress.

If you're careful about about the web sites you visit, what e-mail attachments you chose to open or what software I'm installing...
Click to expand...

I've never had a problem with UAC. [shrug] I game on my machine and run plenty of applications and do weird shit all the time. The ONLY problem I have with Vista is that m-audio STILL hasn't put out drivers for the Delta series cards. Fuckers...
 
GilmourD said:
I've never had a problem with UAC. [shrug] I game on my machine and run plenty of applications and do weird shit all the time. The ONLY problem I have with Vista is that m-audio STILL hasn't put out drivers for the Delta series cards. Fuckers...
Click to expand...

I turned it off. Too damn annoying. Everytime I wanted to do something It hassled me. Jesus Christ its like being married.
 
Any Mac users want to chime in on how the numbers are skewed? If not, apple has one hell of a marketing team to get the public to believe that they are bulletproof
 
Furystrike said:
Any Mac users want to chime in on how the numbers are skewed? If not, apple has one hell of a marketing team to get the public to believe that they are bulletproof
Click to expand...
Oh, those aren't real Mac vulnerabilities. Those are just fake ones like 3rd party application patches. :p
 
Ozymandias said:
...And that's the only reason I put up with Vista and UAC.
Click to expand...

+1. I've seen the UAC and IE7 save people's bacon a couple times. a red address bar sure does get people's attention.

The ONLY reason people think the UAC is a PITA is because the MS Marketing said there was no way people would accept it. Damn I wish the MS engineers had insisted otherwise. Of course who knew that the internet was going to become a dangerous place?
 
All it takes is two teensey tweaks of the secpol manager and UAC stays functional without being a bother. The switch to secure desktop is meant to grab your attention, if you actually read the system messages before clicking it's not necessary. The others are self explanatory once you read through the options.
 
This thread has actually been fairly positive about Vista. Colour me impressed. Still waiting for SP1, of course...

... and I haven't gone to a Mac iLovers site to see the other side, yet.
 
srangara said:
This thread has actually been fairly positive about Vista. Colour me impressed. Still waiting for SP1, of course...

... and I haven't gone to a Mac iLovers site to see the other side, yet.
Click to expand...
I'm pretty frightened myself to do the same.

I'm currently running the RC on all of my machines without any problems. Which reminds me, I need to take a look at the MSDN blogs and forums to see if anything else is going to change between the RC and final release.
 
tesfaye said:
I'm pretty frightened myself to do the same.

I'm currently running the RC on all of my machines without any problems. Which reminds me, I need to take a look at the MSDN blogs and forums to see if anything else is going to change between the RC and final release.
Click to expand...

Personally, I'm still running XP because our company software doesn't work on 64bit nor Vista. It uses MSDE and it's very picky on the version. Vista has SQL Express 2005 and Primavera P5 doesn't play nice with it.

Anyways, I'm waiting for my 3-month feedback program to complete before I get my copy of Vista from Microsoft for free ;-)
 
I'm a Mac user. Want my spin?

Good job Microsoft. Not so good job Apple. But I still don't see the relevancy of counting vulnerabilities, as the number of patched vulnerabilities, and how it long it's taken to patch them, seems like a more important metric. In that respect, Apple does 'okay'. They address vulnerabilities, but take too long to do so. Microsoft's obviously more devoted and move patches more quickly.
 
phide said:
I'm a Mac user. Want my spin?

Good job Microsoft. Not so good job Apple. But I still don't see the relevancy of counting vulnerabilities, as the number of patched vulnerabilities, and how it long it's taken to patch them, seems like a more important metric. In that respect, Apple does 'okay'. They address vulnerabilities, but take too long to do so. Microsoft's obviously more devoted and move patches more quickly.
Click to expand...

Well Microsoft sort of have to. We're attacked more often than Mac users are. I think another advantage Microsoft have is a much larger user and QA base that can cover more area quickly, not to mention third party help.

I'm sure Apple will grow in that area soon too.
 
I will play devil's advocate here.

I read the entire report, bored at work, and he provides solid sources and adequate resources to prove his point. What must be understood is that he is looking at very simple data an achieving a direct result. He looked a "known" issues and what "known" fixes were patched in the first year of a product. This information is public and can be found easily, but what he also discusses is how companies may fix problems without informing people or disclosing less information. I believe it was Red Hat which had an update with "multiple issues" yet that was all it stated, so we are unaware of how many and what exactly was fixed.

This report shows us that even with many issues on all software things are getting done, but what we must understand is that all of these fixes are just a number on paper in this report. We are not disclosed to what was fixed or how big of an issue an issue was or whether a fix had to be patched for a fix.

I can read this report as showing exactly what is says and no more, but as an overall estimate of how exactly Vista v. Red Hat v. OS X, etc. performs is not what it is about. You could correlate answers from this report, but they would mean nothing in the end. It is a good report for what they wanted to let people know, but I would like to see a deeper report examine exact issues and how much a risk each fix was, that would be a report to read.
 
Azhar said:
I'm sure Apple will grow in that area soon too.
Click to expand...
Hopefully. From what I've read, Leopard makes a few improvements with respect to security, but probably too few to make a substantial impact overall, and it likely won't quicken Apple's pace of addressing issues.
 
Furystrike said:
I'm having the darndest time finding a Mac user's take/spin on this report. Any suggestions?
Click to expand...

Well face it, it’s not like you can just stroll into most MAC forums and have an enlightened conversation about computers is it?:rolleyes:
 
theDreamer said:
I will play devil's advocate here.

I read the entire report, bored at work, and he provides solid sources and adequate resources to prove his point. What must be understood is that he is looking at very simple data an achieving a direct result. He looked a "known" issues and what "known" fixes were patched in the first year of a product. This information is public and can be found easily, but what he also discusses is how companies may fix problems without informing people or disclosing less information. I believe it was Red Hat which had an update with "multiple issues" yet that was all it stated, so we are unaware of how many and what exactly was fixed.

This report shows us that even with many issues on all software things are getting done, but what we must understand is that all of these fixes are just a number on paper in this report. We are not disclosed to what was fixed or how big of an issue an issue was or whether a fix had to be patched for a fix.

I can read this report as showing exactly what is says and no more, but as an overall estimate of how exactly Vista v. Red Hat v. OS X, etc. performs is not what it is about. You could correlate answers from this report, but they would mean nothing in the end. It is a good report for what they wanted to let people know, but I would like to see a deeper report examine exact issues and how much a risk each fix was, that would be a report to read.
Click to expand...

I wasn't going to respond until I was able to read the report myself but it sounds like you already did that work for me. I was wondering exactly what you stated here. The severity of the problems can't be taken into account when your mainly just looking at the number of problems. Generally speaking, having a couple of major problems which get patched quickly along with a large number of smaller problems which aren't that big of a deal but they take a bit longer to be patched isn't a problem to me. While I don't like having any security issues; the critical ones need to be fixed ASAP whereas the non-critical ones aren't as important.

It sounds like this report doesn't take any of that into account. I address this mainly due to the comparison between the different OSes. Any "definitive" comparison is flawed if it doesn't take into account severity of issues and how long it takes to fix the critical ones.

If I have a chance later, I might still look through the report to see for myself the information it contains.

 
I'm sure if Windows had an open sourced core like the *nixes we'd see their "known"vulnerabilities shoot up dramatically...

and the fact still stands that there haven't been ANY widespread viruses/worms for any of the *nixes like there have been for Windows, and thats really what counts.....

windows users (of which I am one...) love you spout off how *nix users are too smug, and love to look for any little thing to knock them down a notch or two...

but seriously... no virus scanner, vanilla install, default settings, typical desktop loadad up: a match like that between a windows PC and a *nix PC on grandma's system to see which one gets a virus first, or just becomes a total mess first.... would anyone bet against the *nix? well, would anyone that had much common sense bet against the *nix?
 
brucedeluxe169 said:
I'm sure if Windows had an open sourced core like the *nixes we'd see their "known"vulnerabilities shoot up dramatically...

and the fact still stands that there haven't been ANY widespread viruses/worms for any of the *nixes like there have been for Windows, and thats really what counts.....

windows users (of which I am one...) love you spout off how *nix users are too smug, and love to look for any little thing to knock them down a notch or two...

but seriously... no virus scanner, vanilla install, default settings, typical desktop loadad up: a match like that between a windows PC and a *nix PC on grandma's system to see which one gets a virus first, or just becomes a total mess first.... would anyone bet against the *nix? well, would anyone that had much common sense bet against the *nix?
Click to expand...

According to the chart? Yes, I would. And you know the sad thing is? *nix and Apple isn't as popular, yet they're still in danger of vulnerabilities compared to Windows.

You seem to have forgotten Windows have firewalls of their own as well as ActiveX and phishing filters in their browsers and UAC. You're making it sound like Windows is wide open. It's not.
 
the *nixes have more documented vulnerabilities because their vulnerabilities are much easier to find because of their wide open source codes. OS X has some proprietary bits sitting on top of the Darwin base, but the underlying system is well known and very robust.

seriously, would anyone in their right mind argue that if Windows' source was opened up today that it would have *less* vulnerabilities than the *nixes?

the best measurement of success really should be how much/how easy it is to get malware/spyware/viruses/etc installed onto a particular system. In this regard, the *nixes are miles ahead of Windows. Hell, I don't think i've ever had to download anything like an ad-ware/spyware/malware/virus scanner for any *nix box i've ever seen running.
 
You must log in or register to reply here.
Back
Top