It does help, but it's partly a PR thing. Look at OpenBSD. They claim "no security holes in the default install since (insert date here)." But no one runs a default install of OpenBSD, because a default install is useless. What matters is how secure the OS is once it's had useful services turned on. This will let Microsoft push some of the responsibility back onto the user: "Well, the OS shipped secure, but then you went and turned on the web server. It's your fault."

Still, this is a big step forward and I applaud Microsoft for it, just like I applauded RedHat when they started shipping with a firewall and most services turned off a couple years ago. I don't expect Windows 2003 to be free of security holes, but I expect it to be a lot better than any version to date.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/157/19671#19671