It's easier to claim being a linux fan when you're not.

Take a look at this.

We seem to be having a lot of these kind of articles lately. More FUD against Linux as it becomes more popular.

sounds to me like they know their study was shoddy and slanted, but they don't think you'll have enough care to prove them wrong, you'll just accept what they preach like a good little [something].

I wonder if they have heard bout the Honeynet Project? Their recent findings are that a network with unpatched/unsecured Windows boxes is cracked within minutes. Whereas an unpatched/unsecured Linux box will stay safe for months.

More FUD - they're getting desperate now

It seems that for the tests, they used freshly installed out of the box installs of Red Hat and Server 2003. So really, we are comparing the windows kernel, and the minimal software that comes with against Redhat's what? 6GB of optional software add-ons (no doubt they did a 'full' install). So if we compare the patches against the raw size of software being patched I think we can safely conclude that Redhat's percentage of patches to MB of installed software is much lower.

Not to mention that the amount of patches you had to install is a highly dubious way of contending a systems security. The real question is how many vulns in windows remained *unpatched* (if not undescovered...).

Also, of no surprise, this was funded by M$:
http://www.fit.edu/research/view.htm...ion=ASC&id=166
http://www.fit.edu/research/view.htm...tion=ASC&id=21

"FL Tech will deliver services to define and document all the various aspects of testing for security vulnerabilities in Microsoft software, as directed by Microsoft"

Note the 'as directed by Microsoft'

Next please....

Not that I've read the report, but given the metrics mentioned in the article, it would seem quite plausible to me that MS Server 2003 would come out on top of Red Hat. That's not to say that they are the only measures of security. Seems like all the FUD of the past month has really been centered around this, too.

I'd like to see a study comparing the security of the kernels, not the frequency or availability of pathces. There are very simple kernel modifications that neither make that can do a lot to mitigate existing vulnerabilities.

This seems like a pretty worthless "study" if all they measured were the total number of vulnerabilities and the actual and average response times to patch them. Gee guys, how about including something that matters, like say the severity of the vulnerabilities? My point is that if Linux had 10 minor vulnerabilities that could enable a malicious person to conduct low-impact mischief, but Windows had 7 critical vulnerabilities that could enable a malicious person to run arbitrary code, then the "superior" score for Windows is meaningless. -- J.W.