Why Windows is less secure then Linux

[Gouki]

An article written on a ZDNet blog is showing (yeah, with graphics) why Windows is less secure then Linux.

Apparently, the brilliant mind behind this operation is basing himself (and the whole statement) on a HTTP Server application.

This sure was good for a laugh, however, I'm afraid people are running out of things to say about Windows that they start making this not-so-good-things to say.

Just because IIS does more system calls than Apache doesn't mean that the WHOLE OS is less secure.

Sad ...

[Scubar]

there isnt really anythignwrong with MS, the browser IE is pretty crap buts thats only because of fact it uses Active X , apart from that the only reason i could say its less secure is because itrs the mainstram OS and therefore crackers and virus writers specifically target it.

[Zxian]

On the other hand, if you look at the Windows picture, it seems more modular than the Linux version. That indicates to me that there's more abstraction in the implementation (at least if Microsoft has done something right). If there's more abstraction, then there should be less direct memory access in each part.

[LLXX]

All that's been (dubiously) proved is that Apache is more efficient than IIS, and nothing more.

He is basing his claims on pure misconception. There are so many things wrong with his article that I only list the more obvious here...

1. System calls access memory; so what? Normal instructions do that too.

2. Buffer overflows and the like are caused by unchecked input; once input has been checked properly there is no need to "do QA on each of these entry points".

3. Apache is running on a Linux kernel. IIS is running on a Windows kernel. They are completely separate kernels with separate sets of system calls! This is like comparing apples to oranges.

4. Those diagrams look like they were taken from something else. Too bad the "larger view" wasn't much larger.

[Gouki]

I agree with every comment you made. If they wanted to show how efficient Apache was, or the other way around, they should at least test it on the same OS.

I don't agree with all the 'trash-talk' about IIS. If Amazon, eBay, etc have it as a frontend server, it *can't* be that bad.

However, going X vs Y will not get us anywhere. It never did, and never will.