Good argument.. except blackhats aren't targeting thier own boxen. Blackhats at least used to target servers much more than home machines. The prize is much bigger. You get a lot more when you crack a server. Look at the latest Netcraft survey:

Developer March 2002 Percent April 2002 Percent Change
Apache 9522954 64.37 10509138 64.38 0.01
Microsoft 3966743 26.81 4431875 27.15 0.34
iPlanet 265826 1.80 278775 1.71 -0.09
Zeus 170023 1.15 182918 1.12 -0.03

So, Apache has almost 2.5 times the installed base of IIS, and yet which is considered vastly more secure?
It's not just the number of targets. In fact it's easier for a blackhat to get and install Apache on his/her home system than to pirate IIS. So there are more Apache targets and it's easier to test out attacks against Apache. I'm sorry, I really am, but the truth of the matter is that MS has a very poor track record of secure

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/82/12664#12664