Are Unix systems more secure than Windows systems?

[Klaw117]

Lately, I've heard some people say that the Unix code is more secure than the Windows code and that the Windows code has many holes and bugs in it. Before, I always thought Unix systems (for example, Mac) were less likely to get infected by viruses only because they had a lower market share. However, I'm starting to wonder if the Unix code is really more secure than the Windows code. Is this true? Also, does the Windows code really have that many bugs and holes in it?

 

[Dark Nova Gamer]

It is rather debatable, its harder to compare two completely different codes and say one is flawed and one is not.

Though Unix/Linux does appear to be a bit more secure, which is why Apple's OS X (their baby), is based on a unix-code.

 

[logicearth]

Security is only as strong as the one managing the system. Viruses and other malware could just as easily exist for Unix/Linux. In fact some of the very first viruses/malware was for Unix. The difference is market size and the people behind the computers are what mostly contribute to malware infections. Rarely does malware infect a computer via an OS exploit today. Most infections are from willing users and unpatched applications.

All software has bugs, regardless of who is writing it. Without extensive testing bugs will get though. However, it is impossible to think of every possible situation your code might get used. Some would say open source code is less prone to this, but that is not true. Even with a large contributing community behind the project, not all bugs can be found via scanning the source code. Even valid written code could produce a bug. Even then a bug might appear to work correctly for one user, but not another is it then defined as a bug?

To say one operating is more secure then another is impossible to say without extensive testing. Unfortunate, testing that Windows goes thought almost every day by hackers probing its insides. Unix and the other *nixes don't get that kind of daily abuse.

There are other security aspects to talk about as well, malware is just a small piece of the pie.

* A software bug is defined as unexpected behavior.

 

[pparks1]

Generally speaking, all of the Unix/Linux variants were built from the ground up as a multi-user operating system, thus security was always important. Systems like Windows started where the user was an Admin and had full control over the box.

Generally speaking, the 'nix' variants are usually more secure as they are properly setup to run with user accounts that are extremely limited in terms of where they can get to and what they can do. Compared to Windows, people unfortunately usually set up everything and run as the box admin and this allows unfettered access to many other components and hence the reason that so many exploits exist and the reason why the exploit does so much damage.

 

[w7explorer]

Linux is open source - so there are more eyeballs looking at the code.

This is especially true of core (kernel) functionality - therefore there are fewer bugs, therefore there are fewer security holes.

 

[Barman58]

Linux is open source - so there are more eyeballs looking at the code.

This is especially true of core (kernel) functionality - therefore there are fewer bugs, therefore there are fewer security holes.

While I generally accept this statement - we have to remember that the eyes looking at the code are not all doing so with the intent of "Improving" the security.

Basically as stated above the two operating systems are probably approaching equality in this, but the gulf between the security knowledge of those administering the system is still strongly biased in Nix's favour.

If 'nix systems were used in the numbers and by the same users as windows I believe that the security situation would be similar

 

[logicearth]

Linux is open source - so there are more eyeballs looking at the code.

This is especially true of core (kernel) functionality - therefore there are fewer bugs, therefore there are fewer security holes.

Just looking at code is not enough to clear away bugs. Perfectly valid code can still introduce bugs. The more eyes you have do not equal less buggy code. Only though testing are these bugs revealed, well most of them. Since every single computer is unique with a million different variables that could infect the code in some way to produce a rather obscure bug. Finding such a bug would not be possible just by looking at the code.

Open Source is not a fix to software bugs. There is also no proof that Open Source (large/popular projects) has less bugs then Proprietary Source. Just to point out, I get almost well over 200 patches almost every month for the latest version of Ubuntu. So fewer bugs? I think not.

 

[Tews]

The discussion was security, not whether or not there are more bugs in linux vs microsoft. There are currently few or no viruses/trojans in the wild for ubuntu... Those that do exist are proof of concept and are not really of concern for Linux users... Linux is more secure IMO because of its modularity, and to a certain part, its obscurity in the desktop market. Though my linux box is fairly tied down, I still use an A/V ... call it habit... Microsoft has made tremendous strides in improving its security, begining with UAC and other measures.... so the field is not as lopsided as it once was...

All that being said, I left Linux as my main OS for Windows 7..

 

[logicearth]

The discussion was security, not whether or not there are more bugs in linux vs microsoft...

Bugs are what cause security holes, I use the term to cover unexpected behavior which also includes security holes. Virues/Malware are only one part of a much larger pie, concerning security. Malware is nothing more then an application, itself rarely comprises security on its own, most require aid from the user.

 

[Tews]

Your expectation of a bug free operating system is irrational because there will always be bugs ... period ... Your statement re: bugs are what causes security holes.. should be at best.. bugs can cause security holes ... If your position that linux is not any more secure then other operating systems, I would remind you that in the 2008 CanSecWest Security Conference, the Ubuntu box went the distance without being compromised... bugs and all ....

source

 

[logicearth]

Where did I state "[my] expectation of a bug free operating system"? As far as I see I never said such a thing, or even implied it. And where did I state Linux is less or more secure? Are you just putting words in my mouth?

As for the CanSecWest, Flash is what brought down the Windows machine, and that exploit in Flash was also possible in Ubuntu. Flash made sure it had root access to the machines by installing a helper service in the background. The exploit compromised that service, which existed both in Windows and Unix/Linux.

Security is not limited to Operating Systems, most exploits today are at the application level.

 

[Klaw117]

Ok, so I'm guessing that Unix systems were more secure at first, but now Windows is starting to become just as secure.

Now for the second question I mentioned. Does Windows have more holes/bugs in the code than Unix systems? I always hear people say that the Windows code has too many holes in it while Macs or Linux has less.

 

[logicearth]

Now for the second question I mentioned. Does Windows have more holes/bugs in the code than Unix systems? I always hear people say that the Windows code has too many holes in it while Macs or Linux has less.

There is no defiant answer, only speculations, most unfounded speculations.

Second what is being compared, the base kernel or the distribution? The kernel would be Windows NT and Linux while a distribution is Windows 7 and Ubuntu. The kernel is the lowest depths of the base OS while the distribution contains the supporting packages like applications and UI elements. Would need to precisely qualify what is being compared before one can compare.

 

[Tews]

I would agree ... Microsoft has done a tremendous job in cleaning up their code, and it shows with Windows 7.... As logicearth stated, there is no definitive answer, so the best solution is to install it and do your own evaluation... experience wins out over opinion every time...

 

[SquonkSC]

I think we have to make the distinction between Unix and Linux.

The Unix platform is without a doubt the most secure, robust, and stable.
It is mostly used by corporations that have to process huge amounts of data, used by a huge amount of users, like banks, pension funds etc.
Often the users are on NT systems connected to the Unix Mainframes.
I'm not even going into scalability.

Windows security is a joke compared to Unix, but it's comparing apples and pears.
Windows is used for completely different purposes and to make it more usable for everyone, security needs to be compromised.
Users have trouble accepting even a minor restriction like UAC, never mind when they would be confronted with Unix kind of security.

.
Linux although based on Unix is a different ballgame.
It too, like windows is developed more and more with the user in mind.

Comparing Windows and Linux often ends up in dogfights, so I'll refrain from making any comments on either of them.

greetz

 

[Tews]

Comparing Windows and Linux often ends up in dogfights, so I'll refrain from making any comments on either of them.

greetz

Chicken... :roflmao:

 

[SquonkSC]

Comparing Windows and Linux often ends up in dogfights, so I'll refrain from making any comments on either of them.

greetz

Chicken... :roflmao:

, more a rooster I would say, and I have the marks to prove it.

Lets just say I learned my lesson.

 

[pparks1]

Just to point out, I get almost well over 200 patches almost every month for the latest version of Ubuntu. So fewer bugs? I think not.

If you get 200 patches a month for Ubuntu, you must have loaded a ton of additional packages. And in terms of fairness, keep in mind that a lot of these updates are not security it nature, but rather changes in documentation, functionality or additional features being added.

The other issue that I think plagues Windows users more is the that fact that lots of people torrent and steal commercial applications and use keygens and cracks that do who knows what with their systems. In addition, we have all experienced the "free" windows app that you download and install that comes with a handful of other packaged "features" that we didn't either know we were getting or were too careless in our installs and just accepted the defaults and installed them. You typically don't have these things in the Unix/Linux world.

And as Squonksc mentioned, even with simple changes to Windows like UAC...Windows users were so aggravated and annoyed that they simply shut it off in leui of learning to deal with it properly for the added security. And how many users are actually running their Windows box using a standard account....rather than using an account with admin priviledges. And this simple fact is a majority of the reason why so many problems and exploits have proliferated over the years.

 

[logicearth]

If you get 200 patches a month for Ubuntu, you must have loaded a ton of additional packages. And in terms of fairness, keep in mind that a lot of these updates are not security it nature, but rather changes in documentation, functionality or additional features being added.

It was a bit of an exaggeration since I don't often do an update for Ubuntu. And its not documentation that is being updated or a thousand packages installed. I keep Ubuntu Server very lean with only the stuff I need for its task. But sofar there is always some application being updated and patched. But my point was that Open Source does not correlate to less bugs.

 

[SquonkSC]

See, not a dogfight yet, but the signs are already there.

To be fair to both Windows and Linux (as far as you can throw all distro's on to one heap).

Both have their strengths and weaknesses.

Last year I read a very honest post from a Linux lover who actually admitted that most Linux distro's had more (severe) security patches than XP.

He had a list with all the security patches of both the OS's

Where Linux excelled was the speed at which patches were released.
That's the power of open source.

And like PParks and myself already stated, Windows users in general tend to be less occupied with security than Linux users, while they should be more so, since 95% of all exploits are targeted at Windows.

I for one can't understand why W7 still makes our first account admin by default.
Users should be running their daily activities in a standard user account, but then they would have to enter their admin name and password every time they want to change system settings or install apps.

Linux users are accustomed to that kind of security features.

greetz