By Richi Jennings. August 26, 2010.
My irritation with fabois and fanboishness knows no bounds. In this occasional series of posts, let's examine some fanboi falsehoods and technological tropes -- in The Long View.
Fanbois. These people have an intense desire to evangelize their chosen technology and convert users of competing products to their One True Way. Whether it's Mac fanbois mocking Windows users, or iPhone fanbois taunting Android wielders, their behavior is childish, cultish, and frankly a little disturbing.
Here's a typical recent comment, from somebody taking the pen-name of La Jollan:
Microsoft has been successful at spreading the meme that Windows only seems more vulnerable because hackers tend to target it more because of its ubiquity. But Windows is fundamentally flawed by being based on a system for which security was an after-thought.
Ah, this old chestnut: Mac OS is inherently more secure than Windows. The comment could be straight from the Cupertino PR talking-points playbook. It deals up-front with the obvious counter-argument -- that Windows exploits are more prevalent because Windows' bigger installed base makes it a juicier target.
The thing is, I see no evidence that Windows and Mac OS are significantly different in the security of their code. I also see no evidence that Windows and Mac OS get significantly different patch volumes.
In fact one could argue -- if one were so inclined -- that, because people are trying harder to find vulnerabilities in Windows, the security of Mac OS code is actually worse. In other words, similar patch volumes mean that the OS that's used more would be more secure. (Such a conclusion is unproven, however.)
I do perceive that there's a mature, systematic patching program at Microsoft's MSRC, which is in contrast to the more secretive program at Apple -- giving at least the impression that things are a little more ad hoc in Cupertino than Redmond.
I also perceive that the vast majority of the critical vulnerabilities discovered in Windows are due to legacy code. The recent .LNK/shotcut vulnerability lay unknown in Windows for about 15 years, before Belorussian malware hunters found it.
Similarly, many Mac OS patches relate to old code inherited from NeXTSTEP, FreeBSD, NetBSD, or Mach; as well as GNU subsystems, such as the CUPS print server.
As for old Windows code being designed before security was a priority for Microsoft? Sure, but then so was much of this old UNIX code on which Mac OS is based. As Amir Lev commented last year, much of this technology was designed...
...back in the days when the Internet was a kinder, gentler place. A time when ... the only users of the network were experimental souls, with good karma, who were trusted by all the other users. Yes, there really was such a time!
By and large, this is old news. Windows 7 is a very different animal to Windows 95, the last truly pre-Web version.
It's hard to do a fair, like-for-like comparison of the two operating systems' patch volumes, but I can see no justification for this quasi-religious belief that Mac OS is more secure than Windows. Can you? Leave a comment below...
|Richi Jennings is an independent analyst/consultant, specializing in blogging, email, and security. A cross-functional IT geek since 1985, you can follow him as @richi on Twitter, pretend to be richij's friend on Facebook, or just use good old email: TLV@richij.com.|