"PC's get more virus's than Macs'"

[Ayah]

I've never gotton a virus on Windows.

 

[Brazen]

Originally posted by: Smilin

Originally posted by: Brazen

Originally posted by: Uber

1) There are a lot more Windows computers to infect
2) Beacuse of number 1, many viruses are written specifically to infect Windows

People keep saying this, but then, if Apache has like 70% of the webserver share, how come IIS is the one that keeps getting more viruses and exploits found?

FUD Alert!

Why is it that people bashing MS on secuity get a free pass and are never required to back it up? All you have to do is say "ABC from so and so is more secure than XYZ for Microsoft", provide no facts and it's automatically true. Try the opposite and everyone wants proof.

It takes all of 5 seconds to disprove that whole IIS vs Apache statement. Here's a pre-canned google search to get you started:

http://www.google.com/search?hl=en&q=iis+versus+apache+exploits

Hmm, I think it's funny that you bash MY post as being FUD. The FUD is all the claims that popularity automatically means an increase in vulnerabilities and viruses. And yeah, your google links make me laugh. They compare number of patches for IIS vs Apache, so I guess if it doesn't get fixed then it doesn't count :laugh:

Here is an excerpt that sums it up pretty good:

That?s a total of 25 security vulnerabilities in 5 years for a program that is, at this very moment, serving 11 million active sites. Many of the vulnerabilities were platform-specific, and some were no more serious than exposing the full pathname of a script under certain non-remotely-controllable conditions. There are no outstanding unfixed vulnerabilities

Whereas the latest IIS exploit (from the article) allowed a hacker "to gain complete control over an Army web server."

...and maybe people don't ask for "proof" on Microsoft's awful security track record because it's well documented and many have seen if for themselves. It's like asking for proof that the sky is blue!

I might also mention that, my guess is a strong majority of firewall appliances out there are running some form of linux or bsd (granted that would be two different programs, netfilter on linux and pf(?) on bsd) and they are not just notoriously hackable or overrun with viruses.

 

[Markbnj]

The FUD is all the claims that popularity automatically means an increase in vulnerabilities and viruses.

It certainly doesn't mean an increase in vulnerabilities, but it certainly does mean an increase in exploited vulnerabilities.

 

[Smilin]

Originally posted by: Brazen

Originally posted by: Smilin

Originally posted by: Brazen

Originally posted by: Uber

1) There are a lot more Windows computers to infect
2) Beacuse of number 1, many viruses are written specifically to infect Windows

People keep saying this, but then, if Apache has like 70% of the webserver share, how come IIS is the one that keeps getting more viruses and exploits found?

FUD Alert!

Why is it that people bashing MS on secuity get a free pass and are never required to back it up? All you have to do is say "ABC from so and so is more secure than XYZ for Microsoft", provide no facts and it's automatically true. Try the opposite and everyone wants proof.

It takes all of 5 seconds to disprove that whole IIS vs Apache statement. Here's a pre-canned google search to get you started:

http://www.google.com/search?hl=en&q=iis+versus+apache+exploits

Hmm, I think it's funny that you bash MY post as being FUD. The FUD is all the claims that popularity automatically means an increase in vulnerabilities and viruses. And yeah, your google links make me laugh. They compare number of patches for IIS vs Apache, so I guess if it doesn't get fixed then it doesn't count :laugh:

Here is an excerpt that sums it up pretty good:

That?s a total of 25 security vulnerabilities in 5 years for a program that is, at this very moment, serving 11 million active sites. Many of the vulnerabilities were platform-specific, and some were no more serious than exposing the full pathname of a script under certain non-remotely-controllable conditions. There are no outstanding unfixed vulnerabilities

Whereas the latest IIS exploit (from the article) allowed a hacker "to gain complete control over an Army web server."

I am hereby issuing yet another FUD alert! The article you just linked to:

1. Gathers it?s Apache data from Apacheweek.com
2. Is years out of date.
3. Does not list all vulnerabilities
4. Falsely says that all vulnerabilities have been patched.
5. Says an actual IIS exploit allows complete control of a machine when no such exploit exists and then as proof provides a dead hyperlink.
?More on this in a minute?

...and maybe people don't ask for "proof" on Microsoft's awful security track record because it's well documented and many have seen if for themselves. It's like asking for proof that the sky is blue!

See that?s EXACTLY what I?m talking about when I say ?people bashing MS on security get a free pass and are never required to back it up.?. Thanks for completely proving my point.

Let?s shove the FUD to the side and get to some facts:

We?ll take a look at the latest and greatest from Apache and MS and instead of quoting your article which gets its information from Apacheweek.com let?s use some REAL information from Secunia.

IIS 6.0 came out three years ago. In all those years IIS 6.0 has had three total security advisories. None allow a full system compromise (as your article said), none are rated beyond moderate. None remain unpatched today!

Source: http://secunia.com/product/1438/?task=advisories

By contrast Apache 2.0.x has had 33 security advisories. Including several rated highly critical. Of these 33, three remain unpatched today!

Source: http://secunia.com/product/73/?task=advisories



I?m not going to sit here and say IIS, Windows, or any other MS product is the holy grail of security. I?m also not going to say Apache sucks. But it?s an absolute crock that people use some 1995 mentality to go busting on MS about security today when the facts just don?t support it. People will just say, ?MS isn?t secure? and everyone will nod their head like a bunch of brainwashed zombies. The topic of this thread is another example.

 

[smp]

I grew up using windows and I keep myself virus free. I use macs too and the servers here at work (and formerly at home) mostly run some flavour of linux.
So ok, what's my point?
Well, out of the box Windows creates an admin account for the first user, this is usually mom or dad or uncle Leo or what have you and then they go on to use the internet, email etc and soon enough they are riddled with spyware and viruses. You give the same users a brand new mac and they won't get viruses and spyware.

Whatever the reasons behind this, the statement is mostly accurate. You can't expect much from commercials, they aren't about to start going into details about the why and how like people do in this thread.
Now, on to the REAL QUESTION:

Why do people feel inclined to support one platform or another? Seriously, aren't we past this? I use them all and find faults with all of them and strengths with all of them.
it's like herd mentality is bred into us through culture or what? Why do we have to pick a freakin side?!!! Why?!!!
Use the right tool for the right job whatever your reasons are.

 

[batmang]

if you ask me, osx > windows os.
why? because windows 98/2k/xp are all going to get some sort of spyware, viri and whatever else evil programs can come up with.

i <3 linux.

 

[f1sh3r]

edited to be on topic.

most PCs run windows therefore PCs have more virii than Macs.

i work at best buy and we get a lot of people in wanting macs because of those commercials. drives me nuts. these are the same people that want the best computer package for $400. i guess after the geeksquad installs antivirus/antispyware, diagnoses and reformats their computer 2x a year, theyd prolly be better off getting a mac.

Originally posted by: lxskllr
Apple doesn't get as many virus' because nobody cares enough to write any for it. Linux doesn't get virus' because you can't get your wifi card working, so you never actually get on the net to catch any

*chuckles* linus is working on it

/my wireless works fine.

 

[n0cmonkey]

Originally posted by: sm8000

Originally posted by: n0cmonkey

Originally posted by: spikespiegal

Personal Computer is code for Windows on x86 hardware?

So when one of our divisions runs Windows Virtual machines inside their IBM AS400 with a x386 card, then that half million dollar server is a PC?

What's the "code" then for running Linux on athlon64? 'Girlfriend?"

Freak.

<- Mac user, Linux user, OpenBSD user, Windows user
<- PPC user, Sparc user, Sparc64 user, AMD64 user, i386 user

Wow! You just need to be an Alpha user and your collection will be complete.

I've got some of the parts for one, just never bothered to put it together.

I forgot mention my ARM machines on there too...

 

[n0cmonkey]

Originally posted by: kamper

Originally posted by: n0cmonkey
<- Mac user, Linux user, OpenBSD user, Windows user
<- PPC user, Sparc user, Sparc64 user, AMD64 user, i386 user

You have a zaurus too don't you?

Yep, that's one of the ARMs I forgot.

 

[nweaver]

Originally posted by: Smilin

Originally posted by: Brazen

Originally posted by: Smilin

Originally posted by: Brazen

Originally posted by: Uber

1) There are a lot more Windows computers to infect
2) Beacuse of number 1, many viruses are written specifically to infect Windows

People keep saying this, but then, if Apache has like 70% of the webserver share, how come IIS is the one that keeps getting more viruses and exploits found?

FUD Alert!

Why is it that people bashing MS on secuity get a free pass and are never required to back it up? All you have to do is say "ABC from so and so is more secure than XYZ for Microsoft", provide no facts and it's automatically true. Try the opposite and everyone wants proof.

It takes all of 5 seconds to disprove that whole IIS vs Apache statement. Here's a pre-canned google search to get you started:

http://www.google.com/search?hl=en&q=iis+versus+apache+exploits

Hmm, I think it's funny that you bash MY post as being FUD. The FUD is all the claims that popularity automatically means an increase in vulnerabilities and viruses. And yeah, your google links make me laugh. They compare number of patches for IIS vs Apache, so I guess if it doesn't get fixed then it doesn't count :laugh:

Here is an excerpt that sums it up pretty good:

That?s a total of 25 security vulnerabilities in 5 years for a program that is, at this very moment, serving 11 million active sites. Many of the vulnerabilities were platform-specific, and some were no more serious than exposing the full pathname of a script under certain non-remotely-controllable conditions. There are no outstanding unfixed vulnerabilities

Whereas the latest IIS exploit (from the article) allowed a hacker "to gain complete control over an Army web server."

I am hereby issuing yet another FUD alert! The article you just linked to:

1. Gathers it?s Apache data from Apacheweek.com
2. Is years out of date.
3. Does not list all vulnerabilities
4. Falsely says that all vulnerabilities have been patched.
5. Says an actual IIS exploit allows complete control of a machine when no such exploit exists and then as proof provides a dead hyperlink.
?More on this in a minute?

...and maybe people don't ask for "proof" on Microsoft's awful security track record because it's well documented and many have seen if for themselves. It's like asking for proof that the sky is blue!

See that?s EXACTLY what I?m talking about when I say ?people bashing MS on security get a free pass and are never required to back it up.?. Thanks for completely proving my point.

Let?s shove the FUD to the side and get to some facts:

We?ll take a look at the latest and greatest from Apache and MS and instead of quoting your article which gets its information from Apacheweek.com let?s use some REAL information from Secunia.

IIS 6.0 came out three years ago. In all those years IIS 6.0 has had three total security advisories. None allow a full system compromise (as your article said), none are rated beyond moderate. None remain unpatched today!

Source: http://secunia.com/product/1438/?task=advisories

By contrast Apache 2.0.x has had 33 security advisories. Including several rated highly critical. Of these 33, three remain unpatched today!

Source: http://secunia.com/product/73/?task=advisories



I?m not going to sit here and say IIS, Windows, or any other MS product is the holy grail of security. I?m also not going to say Apache sucks. But it?s an absolute crock that people use some 1995 mentality to go busting on MS about security today when the facts just don?t support it. People will just say, ?MS isn?t secure? and everyone will nod their head like a bunch of brainwashed zombies. The topic of this thread is another example.

From my experience, most folks run 1.3 for Mission Critical web stuff...

ecunia has issued a total of 19 Secunia advisories in 2003-2006 for Apache 1.3.x. Currently, 5% (1 out of 19) are marked as Unpatched with the most severe being rated Less critical


The text of the one unpatched vunerability...

Secunia Advisory: SA13925
Release Date: 2005-01-20
Last Update: 2005-02-07

Critical:
Less critical
Impact: Privilege escalation
Where: Local system
Solution Status: Unpatched

Software: Apache 1.3.x
Apache 2.0.x

CVE reference: CVE-2004-1387 (Secunia mirror)

This advisory is currently marked as unpatched!
- Companies can be alerted when a patch is released!


Description:
Javier Fernández-Sanguino Peña has reported a vulnerability in Apache, which potentially can be exploited by malicious, local users to perform certain actions on a vulnerable system with escalated privileges.

The vulnerability is caused due to the check_forensic script creating temporary files insecurely. This can be exploited via symlink attacks to create or overwrite arbitrary files on the system with the privileges of the user running the vulnerable script.

Solution:
Grant only trusted users access to affected systems.



pretty freakin decent track history...

 

[stash]

I'd say that a track record of 3 total advisories in the same period, none higher than moderate, is even more decent.

 

[n0cmonkey]

Originally posted by: Smilin
See that?s EXACTLY what I?m talking about when I say ?people bashing MS on security get a free pass and are never required to back it up.?. Thanks for completely proving my point.

Let?s shove the FUD to the side and get to some facts:

We?ll take a look at the latest and greatest from Apache and MS and instead of quoting your article which gets its information from Apacheweek.com let?s use some REAL information from Secunia.

IIS 6.0 came out three years ago. In all those years IIS 6.0 has had three total security advisories. None allow a full system compromise (as your article said), none are rated beyond moderate. None remain unpatched today!

Source: http://secunia.com/product/1438/?task=advisories

By contrast Apache 2.0.x has had 33 security advisories. Including several rated highly critical. Of these 33, three remain unpatched today!

Source: http://secunia.com/product/73/?task=advisories



I?m not going to sit here and say IIS, Windows, or any other MS product is the holy grail of security. I?m also not going to say Apache sucks. But it?s an absolute crock that people use some 1995 mentality to go busting on MS about security today when the facts just don?t support it. People will just say, ?MS isn?t secure? and everyone will nod their head like a bunch of brainwashed zombies. The topic of this thread is another example.

Apache 2.2 only appears to have 1 unpatched vulnerability. For what that's worth.

 

[gwag]

Cause this will never happen on a mac, unless of course its a new mac running windows or a mac running virtual PC or maybe a mac running parallels desktop and some form of windows.

 

[Smilin]

nweaver:
Yes, honestly Apache 1.3 (or any version) has been great.

stash:
Yes, for being 3 years old, IIS 6.0 has a stunning track record.

n0cmonkey:
Yeah, I looked at 2.2 as a possible comparison to the 'latest from ms' but it's been out for such a short period it's track record ends up looking poor when perhaps it should not. Yes it's only got 1 unpatched, but that's a 33% unpatched rate!. It just hasn't been out long enough to get a fair shake (IMHO) and it wasn't my intention to bash Apache at all.


My real point in all this wasn't to bash Apache, or even compare Apache and IIS. It was this: People who say "MS is insecure" are never challenged and never have to provide facts. They get to spread FUD without providing any proof whatsoever. When you take a hard look at MS *today* the "MS is insecure" nonsense just doesn't fly. The Mac commercials in the OP are a perfect example.

 

[Nothinman]

Cause this will never happen on a mac

You can't guarantee that.

 

[Robor]

Originally posted by: gwag
Cause this will never happen on a mac, unless of course its a new mac running windows or a mac running virtual PC or maybe a mac running parallels desktop and some form of windows.

And it wouldn't happen on my Windows box either because it's properly patched and protected. And there's plenty of things I can do on my Windows boxes that I can't (or at least don't know how to) do on a Mac. Can you do this on a Mac...???

1. Use Yahoo Messenger with voice chat
2. Use Skype with voice/video without restarting in between sessions to fix 30 second voice delays on the Mac side
3. Use a quality Usenet news browser (like Newsbin)
4. Use a program like Dameware to remote into other (Windows) systems
5. Use a program like 'Float's Remote Agent' to manage your cell phone

I can't think of more right now but I'm sure I could extend this list.

 

[Smilin]

Originally posted by: gwag
Cause this will never happen on a mac, unless of course its a new mac running windows or a mac running virtual PC or maybe a mac running parallels desktop and some form of windows.

It will never happen on a PC either :roll:

The video was faked dummy. There were Win 9x errors in there mixed in with NOP errors which are from XP/2003.

 

[n0cmonkey]

Originally posted by: Robor
And it wouldn't happen on my Windows box either because it's properly patched and protected.

Fix all of the broken Windows machines out there.

And there's plenty of things I can do on my Windows boxes that I can't (or at least don't know how to) do on a Mac. Can you do this on a Mac...???

1. Use Yahoo Messenger with voice chat

Who cares? It's junk.

2. Use Skype with voice/video without restarting in between sessions to fix 30 second voice delays on the Mac side

Skype is teh evil.

3. Use a quality Usenet news browser (like Newsbin)

Does one exist for any platform?

4. Use a program like Dameware to remote into other (Windows) systems

Why not use Remote Admin or whatever Microsoft calls it? Or how about VNC? Or SSH (with or without X)?

5. Use a program like 'Float's Remote Agent' to manage your cell phone

Manage it how? Like how iSync does?

 

[nweaver]

Originally posted by: Smilin
nweaver:
Yes, honestly Apache 1.3 (or any version) has been great.

stash:
Yes, for being 3 years old, IIS 6.0 has a stunning track record.

n0cmonkey:
Yeah, I looked at 2.2 as a possible comparison to the 'latest from ms' but it's been out for such a short period it's track record ends up looking poor when perhaps it should not. Yes it's only got 1 unpatched, but that's a 33% unpatched rate!. It just hasn't been out long enough to get a fair shake (IMHO) and it wasn't my intention to bash Apache at all.


My real point in all this wasn't to bash Apache, or even compare Apache and IIS. It was this: People who say "MS is insecure" are never challenged and never have to provide facts. They get to spread FUD without providing any proof whatsoever. When you take a hard look at MS *today* the "MS is insecure" nonsense just doesn't fly. The Mac commercials in the OP are a perfect example.

Yes...

Point being, BOTH apache (1.3 and even 2) and IIS 6 have been pretty secure over the last few years, and that high marketshare != less secure/more targeted.

Now, I could really be ornary and bring IIS5 in, but IIS6 shows that MS has learned from mistakes.

 

[stash]

high marketshare != less secure/more targeted

I would agree that high marketshare doesn't necessarily equal less secure, but it definitely == more targeted. Apache is the most targeted web server, simply because of the number of extremely high value targets. There are hundreds of Apache sites out there that, if brought down, would cost their owners millions.

Targeting by 'hackers' is simple economics. You go after what will cause the most monetary damage. For the OS, that's clearly Windows, with its 90% marketshare. In the web server arena, that's Apache.

 

[Robor]

And it wouldn't happen on my Windows box either because it's properly patched and protected.

Fix all of the broken Windows machines out there.

I'm not worried about all of the Windows boxes - I'm just worried about mine.

And there's plenty of things I can do on my Windows boxes that I can't (or at least don't know how to) do on a Mac. Can you do this on a Mac...???

1. Use Yahoo Messenger with voice chat

Who cares? It's junk.

I would disagree... I've used YahooIM for years and for me it's very stable and has nice features. The voice/video chat works excellent as well.

2. Use Skype with voice/video without restarting in between sessions to fix 30 second voice delays on the Mac side

Skype is teh evil.

Skype isn't evil when it costs ~ $.15/minute to call my fiancee in the Philippines.

3. Use a quality Usenet news browser (like Newsbin)

Does one exist for any platform?

Forte Agent is good - NewsBin is great.

4. Use a program like Dameware to remote into other (Windows) systems

Why not use Remote Admin or whatever Microsoft calls it? Or how about VNC? Or SSH (with or without X)?

Dameware doesn't require terminal services or a client installed on the remote system.

5. Use a program like 'Float's Remote Agent' to manage your cell phone

Manage it how? Like how iSync does?

I have never used iSync. Will it manage a 'non-smart' phone? Can it be used to export SMS messages? I use Float's Mobile Agent to export my SMS messages to an html file for my records.

EDIT: I SUCK AT REPLYING TO QUOTED REPLIES!

 

[n0cmonkey]

Originally posted by: Robor
I'm not worried about all of the Windows boxes - I'm just worried about mine.

A lot of those windows machines are what cause a lot of the worry.

Forte Agent is good - NewsBin is great.

Forte is fine for downloading binaries, except those binaries posted by idiots that use yenc.

Dameware doesn't require terminal services or a client installed on the remote system.

Doesn't XP come with Remote Desktop now?

How does dameware connect to a machine if it doesn't have an agent installed on it?

I have never used iSync. Will it manage a 'non-smart' phone? Can it be used to export SMS messages? I use Float's Mobile Agent to export my SMS messages to an html file for my records.

I don't think it backs up SMS, but can't you just get those through the bluetooth connection?

I've used it with my sony ericsson phones (until I got a new one which isn't supported... yet).

You're a special case, I'm guessing most of us trash SMS messages.

 

[Robor]

Originally posted by: n0cmonkey

Originally posted by: Robor
I'm not worried about all of the Windows boxes - I'm just worried about mine.

A lot of those windows machines are what cause a lot of the worry.

Forte Agent is good - NewsBin is great.

Forte is fine for downloading binaries, except those binaries posted by idiots that use yenc.

Dameware doesn't require terminal services or a client installed on the remote system.

Doesn't XP come with Remote Desktop now?

How does dameware connect to a machine if it doesn't have an agent installed on it?

I have never used iSync. Will it manage a 'non-smart' phone? Can it be used to export SMS messages? I use Float's Mobile Agent to export my SMS messages to an html file for my records.

I don't think it backs up SMS, but can't you just get those through the bluetooth connection?

I've used it with my sony ericsson phones (until I got a new one which isn't supported... yet).

You're a special case, I'm guessing most of us trash SMS messages.

You're right on the infected machines causing worry... I didn't think of that point.

I prefer NewsBin to Agent. It's a bit more complex but it's got a ton of features that I didn't see in Agent. I haven't used Agent in a while though so maybe it's better now. I must say I wasn't impressed with PAN in Linux though.

Dameware 'pushes installs' a service on the remote system. You do need admin access to the box but as long as you have that you're good to go. And you log in 'real time' rather than like in Terminal Services so you see what's happening on the desktop. You can even lock the keyboard/mouse from the user if you want.

I tried using bluetooth and I didn't see a way I could send my SMS messages from my phone to my laptop with it. I can transfer pics, vids, etc that way but no-go on SMS messages. I use Floats Mobile Agent and the infrared port (couldn't get bluetooth working with it). My phone is a Sony Ericcson Z520a.

Yeah, I wish I didn't need to save my SMS messages but I need to for now. As you know, I'm looking forward to not having to do that!

 

[Nothinman]

Dameware 'pushes installs' a service on the remote system.

And you can do the same thing with VNC or just remotely start the Remote Desktop service if it's XP or higher.

 

[Robor]

Originally posted by: Nothinman

Dameware 'pushes installs' a service on the remote system.

And you can do the same thing with VNC or just remotely start the Remote Desktop service if it's XP or higher.

VNC can manage a remote host without the VNC client installed? And Dameware can get into a 2000 box or 2003 server that doesn't have terminal services installed/running. There's a bunch of other things Dameware can do remotely as well. I'm not sure if those tools are available in VNC or not. I haven't used VNC in a long while.