Gadgetopia

I'd agree that Microsoft is probably the worst offender when it comes to system vulnerability, but the only reason that all the worms and viruses we see are for Windows is that the virus writers know that writing them to exploit Windows will allow them to get the most coverage. If everyone switched to OS X or Linux, you'd start to see Mac and Linux worms making their way around.

Not that I know the author's mind, but i'm sure that last comment about switching to Mac or Linux was a bit tongue in cheek. Joe may be correct in saying that we'd see more Mac & Linux attacks if they were more predominant, but that in no way excuses the sloppy job MS does in making its software secure in the here and now. Not that it can't be made more secure, but making it that way is far from simple.

If someone was to come up to your house and throw a brick through a window, was that part of your house a security hole, a vulnerability? Should we blame the construction company for doing a sloppy job?

I'm sure Microsoft doesn't intentionally let the flaws exist in the software it produces. I'm also certain they'd like to avoid the negative press and huge support headaches that come with these attacks.

There are always going to be malicious people intent on destruction. Even if Microsoft could make their software so secure that there's only one tiny, obscure flaw in it, then that one flaw would still be exploited by such people.

Here's a good example of what we're talking about: Scalper and Slapper exploit holes in Apache and OpenSSL running on Linux, OS X or most anything else.

http://isc.incidents.org/analysis.html?id=177

At least if you're running Apache, you only have to worry about this about once or twice a year, instead of almost weekly as with IIS.

What is sloppy is having "features" that are used by almost no one, are made active by default, which hackers can use to their advantage (and everyone else's disadvantage.) If there is a possibility that a feature like Remote Procedure Call can be exploited, and the average user isn't likely to use it, wouldn't it make sense to have it inactive by default?

Is Microsoft alone in sloppy releases? Not a chance. But they are probably the worst offender.

True - if there were more Mac users, there'd be more Mac viruses. But the viruses would be much easier to use, nicer looking and more elegant.

Bare in mind if Linux or MacOSX was that popular the would be virueses and worms but in a small number and patches are dealt with quickly on the unix clone systems so the threat wouldn't be as mucch