Win XP vs. Mac: Viruses

[Sup3rkirby]

This should be interesting to watch with soo many Microsoft Fans here.

Sometimes I'll see a report or something on a new virus that is infecting computers and such. But one thing I've noticed in a few(if not all) of them is that there is always a sentence like "...Due to a security flaw in Windows..." or something like that. It's never "Due to a security flaw in Macintosh". I am sure there are viruses that affect the Mac OS, but it seems that MS really has trouble keeping their OS safe from viruses.

Why, the blaster worm had a message going staight out to bill about how bad his OS was.

Anyone here who has a Mac care to note something on the subject?

My opinion: either crazy programmers purposely target every possible problem in Windows with viruses and such, or MS does a crappy job with their OS.
I don't have a Mac and never have, so I don't know anything about those.

[PeOfEo]

this is simple: more people use windows so therefore more flaws are exposed. The typical users also generally do not know what is secure and what is not secure.

[JPnyc]

Popularity is always the antidote to security.

[Stephen Philbin]

I don't have a Mac, but I do know Symantec stopped making anti virus software for the Mac because "it was pointless".

[JPnyc]

Naturally. If you're a twisted individual who wants to write a malicious program, who are you gonna spend you time writing it for? For 3% of the computing world, or for the other 97%? (or whatever the actual figures are, the premise would still apply).

[Stephen Philbin]

There is the matter of ratio to consider though. I don't know how accurate they were, but I remember seeing some stats saying that there was something like 3 Linux web servers for every one Windows server, yet for every one Linux box that was compromised, three Windows boxes were compromised. That's a ratio of nine to one.

As I said, I've no idea how accurate those stats were and what constituted a "compromise" was not stated, but I still think it illustrates that it isn't all based on the install base. As a matter of fact, I don't accept that argument at all. I accept it is an influence, but far from being the sole reason. I think probably the largest influence is the reputation of Microsoft. To what extent (if any) microsoft deserve it or not, I don't know, but Microsoft do have a reputation for being rather dirty and aggressive. Whether they deserve that reputation or not is another matter entirely, but the fact remains that if people think that, they are going to lash out at what they percieve to be an unjust company in whatever way they can.

Then there's that unchecked buffer thing isn't there? I'd imagine that's the "bread and butter" of this sort of thing. Y'know, where input to applications simply doesn't get checked to make sure it's not longer than it's supposed to be, thus wreaking havok. And doesn't everything run with full top level privileges? "SYSTEM" is it called on Windows?

Popularity does have something to do with it, but I think there's a lot more to it than that.

[PeOfEo]

However I have seen studies on just webserves that show windows servers to be just as secure and stable as linux servers. I could try to look up those articles I have read and post them here tonight.

[Stephen Philbin]

How a computer is configured obviously plays a very large part in the security of it, but I think the downfall of Windows in that respect is its "user friendliness". It's actually one of the things that drove me mad. The user interface is overly simplified and under explained for my liking. I know it makes everything look easier to use and most folks prefer it that way, but for me it just meant I was left clueless most of the time and was not made aware of any potential security risks or possible enhancements or even just ways of letting me get stuff done easier. Most of the configurability seems to have just vanished. I never really felt like I knew what I was doing and that I was probably missing something (usually missing a lot lol).

Obviously server maintainance folks will most likely be aware of most issues, but how's yer average desktop user supposed to be albe to keep things in good shape when they don't know if they have or are going to create risks. I suppose a solution might be to make the system more secure by default, but then that may well make some problems for the average desktop user.

[JPnyc]

Well that's why MS has tightened up the security for the avg. home user in the latest releases. What you say is true, MS had options for better security all along, but only the savvy user would've known of em. The avg. windows user was hung out to dry.

[omnicity]

As a long-term Mac user I can tell you that I have to apply security patches much less often to my PowerBook than to any of my PC's.

Personally I think that there are many factors at work, depending on the nature of the writer of the malware. Bear in mind that many of these are now written commercially, in order to create bot-nets. Any such 'positive' virii depend on 'best return': virus writers believe that it is easier to get a result from writing for windows than for Mac or Linux. Partly this is due to the number of targets, and partly due to the ease of attack, and partly due to the likelihood of carrying out a successful compromise.

On the other hand 'negative' viruses, written to destroy, will attack whatever target is most disliked, ie Windows, usually. If Osama was a PC hacker, then you would expect viruses to attack all possible platforms - that is probably the only true test of system security, as the relative infection rates could then be calculated independantly.

The final factor is availability of malware tools - a 'script kiddie' can only use the tools that he has, learning how to code for Linux or Mac is quite a big leap if all you know is Windows.

A final point to refute an earlier argument - the Mac has always been easier to use than a PC, therefore very few Mac users know how to adjust security settings - if that was the only reason for being attacked, the Mac should be taking more hits than Windows, which it isn't.

[Stephen Philbin]

My point was not usability. My point was about over simplification combined with a lack of helpful information. My current OS (Suse Linux 9.3 Professional) is easily the most useable OS i've ever had, but it has tons of into. if I find something I am unsure of, I just enter a command with no instructions followed by "-h" and bam, loads of info on how to use it. More info, more knowledge, less risk.

[PeOfEo]

I would argue against your mac is easier to use than pc argument, that is all a matter of opinion. My computer braindead parents even have a basic understanding about how to use windows.

[omnicity]

PeOfEo - your parents may know a little about how to configure their PC, but if they had bought a Mac they would know nothing about how to configure security on it, yet there are still fewer Mac compromises than Windows.

Mr Herer - DOS generally uses /? for all of its commands - much more intuitive than minus h. I can't believe that you would even think of comparing any command line system with a WIMP interface for usability

[PeOfEo]

Obviously there are fewer Mac compromises, but there is still the whole there are only 10 people using Macs for home use in the continental united states.

[Stephen Philbin]

Mr Herer - DOS generally uses /? for all of its commands - much more intuitive than minus h.

lmao. If you're going to come out with crap as outright absurd as that then I can see talking to you is just plain pointless. What's next? K is a better letter than V?

[wamboid]

lmao. If you're going to come out with crap as outright absurd as that then I can see talking to you is just plain pointless. What's next? K is a better letter than V?
Neither is actually intuitive at all. I doubt anyone that is handed a computer for the first time would say to themselves "Hmm, I need help. I wonder if typing -h or /? will give me any clues?."

[omnicity]

That was a rather large part of my point - since Suse Linux 9.3 appears less intuitive and more confusing than an OS that was officially abandoned 10 years ago it can't be great for an average user.

As for the comparison of commands, the minus sign has a well known meaning in English, which has nothing to do with an optional modifier switch. h is a single letter, and therefore has no meaning by itself.
A forward slash has little meaning in English, and is therefore less likely to confuse. ? is a question mark, with strong links to the concept of 'huh?'

A button marked 'Help' is 100 times more obvious, though, as is the feedback of a checkmark in a box.