Reality Check

[VVanks]

Security through obscurity? Yeah. You ain’t kidding. I can’t believe people still argue which is more secure.

[wabbitslayer]

ha, Windows ME continues to blow everything else away...

[Pr3tty F1y]

Originally Posted by VVanks

Security through obscurity? Yeah. You ain’t kidding. I can’t believe people still argue which is more secure.

I'm not sure what that image has to do with security, but I'll be doing my part to boost Win7 market share

[Greasy]

So true, but you'll never convince them of that.

[-n7-]

Over 70% still stuck on XP?

Wow, sux for them.
Cannot believe so many...

[moshpit]

Originally Posted by VVanks

Security through obscurity?

Better watch it. That phrase always seems to get me in ALOT of trouble

Edit: I think they should have left out the ME and 98 numbers OR added in System 9 numbers as well. The 9x kernel OS's were almost not even the same architecture as the NT OS's, more like System 9 compared to OSX, IMO.

[erek]

Originally Posted by VVanks

Security through obscurity? Yeah. You ain’t kidding. I can’t believe people still argue which is more secure.

so what? it's still secure even impart due to some obscurity... security is security regardless of it's means, bro

are you jealous because windows is such a big target?

[VVanks]

Originally Posted by erek

so what? it's still secure even impart due to some obscurity... security is security regardless of it's means, bro

are you jealous because windows is such a big target?

You're just those trolls that always join security discussions aren't you.

I'm aiming at those who say OS X is more secure than Windows. I say that's only because of its small market share. Most people refute me on that... and I can't believe the do. If I was a virus, do I target 95% of the population or target 5%?

Exactly.

A safe that has have 1 break ins out of 10,000 attempts and still stands up is something I'd trust more to a safe that has 1 break in and only 5 attempts.

[erek]

Originally Posted by VVanks

You're just those trolls that always join security discussions aren't you.

I'm aiming at those who say OS X is more secure than Windows. I say that's only because of its small market share. Most people refute me on that... and I can't believe the do. If I was a virus, do I target 95% of the population or target 5%?

Exactly.

A safe that has have 1 break ins out of 10,000 attempts and still stands up is something I'd trust more to a safe that has 1 break in and only 5 attempts.

still seems more secure and your subordinating statements seem to support the claim that security through obscurity is security, so why not accept that its more secure ?

[Ibis]

How about Linux, FreeBSD and such, are those even less secure than OS X because their market share is smaller? Are you really serious?

[Pr3tty F1y]

Originally Posted by Ibis

How about Linux, FreeBSD and such, are those even less secure than OS X because their market share is smaller? Are you really serious?

While this is really either hear nor there related to the topic, 'nix and 'bsd installations are ran by people who actually know what they are doing about computer security and generally locked down for a particular purpose in business environments, which is where I'd wager you'd see the most of these installations. I'm not saying people don't use them as home OSes, but I would have to say it that it proportionally much, much less.

It's really comparing apples and oranges (no pun intended )

[HAL10000]

Originally Posted by VVanks

If I was a virus, do I target 95% of the population or target 5%?

If you were a virus, you target the system easiest to subvert and spread by, not one that is part of the largest marketshare. You go after systems you have a reasonable chance of success gaining access to, and traditionally, that has been Windows XP, an OS that coincidentally has the largest marketshare.

Again, even with the same single-digit marketshare that Apple today had with System 7 and 9, the malware problem was akin to that on Windows/DOS. From that historical quirk alone, the idea that virus writers target by marketshare falls flat on its face.

And yet the myth of marketshare continues...

[moshpit]

Originally Posted by HAL10000

And yet the myth of marketshare continues...

And yet your denial of reality continues as well...

[HAL10000]

Originally Posted by moshpit

And yet your denial of reality continues as well...

Clearly, once again, you failure to read my posts in their entirety shines through.

Since you are to prove something exists, it's incumbent upon you to provide proof of your proposition. So, prove that marketshare is the defining problem for Windows security issues instead of poor decisions historically made by Microsoft with regards to Windows XP.

If there were parity between marketshare and known vulnerabilities, then there should be at least 40 exploits on Mac OSX since Apple has just over the same marketshare it had at the time of all these exploits with System 9. Are there? Not even close.

I can even use Windows. If marketshare were truly the defining factor behind exploits, then why are there so few Vista exploits out there? Surely, at ~30% of the marketshare of WinXP, there should be about ~30% the number of exploits for it, should there not?

And yet you try to claim I'm the one denying reality.

[moshpit]

It's not my place to eat you for breakfast this time. I didn't post this bait so I'll leave it to the one who wanted to play

[caveman-jim]

In specific terms when talking about risk of compromise the 'security through obscurity' guideline adjusts the numbers. In real terms, the user is the most vulnerable piece of the puzzle.

Security is not a product you can buy off the shelf.

You can have vulnerable, insecure application instances on any platform. What is relevant to businesses is the cost to secure them to a reasonable degree. And for each business that degree is different, and the cost is different.

As exploits and attacks move more and more to exploit end-user behaviour (phishing, man in the middle attacks) and away from system exploits (browser vulnerabilities, remote attacks) then the platform becomes less relevant.

If all you are concerned about is becoming part of a botnet, then security through obscurity is fine. If you are concerned about more than that, you will see a bigger picture for end-user training, regardless of host hardware, OS and software, but not neglecting those same aspects entirely.

[HAL10000]

Originally Posted by moshpit

It's not my place to eat you for breakfast this time. I didn't post this bait so I'll leave it to the one who wanted to play

I knew you weren't up to defend your position and instead are relying on false bravado in the hopes to save face.

[HAL10000]

Originally Posted by caveman-jim

In real terms, the user is the most vulnerable piece of the puzzle.

I've been saying that for a while now. Someone much more clever than I said that the biggest security hole lies between the keyboard and the chair and there really is only so much providers can do to protect people from themselves.

The future of malware is social engineering attacks, not reliance on increasingly obscure and specialized knowledge. Path of least resistance comes to mind yet again...

[moshpit]

Originally Posted by HAL10000

I knew you weren't up to defend your position and instead are relying on false bravado in the hopes to save face.

No, I'm just not up to going round and round the SAME old arguement yet again. We rehash the same thing over and over and over. I didn't bait you out this time, VVanks did. And you bit, of course. And don't even see it. It's amusing actually

[HAL10000]

Originally Posted by moshpit

No, I'm just not up to going round and round the SAME old arguement yet again. We rehash the same thing over and over and over. I didn't bait you out this time, VVanks did. And you bit, of course. And don't even see it. It's amusing actually

Is that the best you can do?

[caveman-jim]

Originally Posted by HAL10000

I've been saying that for a while now. Someone much more clever than I said that the biggest security hole lies between the keyboard and the chair and there really is only so much providers can do to protect people from themselves.

The future of malware is social engineering attacks, not reliance on increasingly obscure and specialized knowledge. Path of least resistance comes to mind yet again...

Very true. In that respect I sometimes think phrases like 'security through obscurity' and the Mac Ad's (claiming to be virus free etc.) are going to create a problem in future, whereby users inherently believe because it's a Mac they are immune to DNS redirection or social engineering scams. Hopefully the two issues can be separated so that platform vulnerabilities can be continued to be addressed and user education may be addressed for all platforms.

[moshpit]

Originally Posted by HAL10000

Is that the best you can do?

How can you ask that after me eating you up on this one so many times in the past? I've blown you out of the water on this subject more times then I can count now. No, I'm just not playing this time is all.

I'm trying to be nice and leave it to the one who WANTS a flame war with an closed mind. Apparently, VVanks is in that kind of mood or wouldn't have posted such obvious flame bait for YOU. Personally, I'm totally happy at the moment and enjoying the kind of PC power Apple will NEVER allow you to enjoy

[Android1]

HAL and moshpit, stay on topic please.

[moshpit]

Originally Posted by Android1

HAL and moshpit, stay on topic please.

No prob! I was trying to bow out anyway, not my flamebait

[HAL10000]

Originally Posted by caveman-jim

Very true. In that respect I sometimes think phrases like 'security through obscurity' and the Mac Ad's (claiming to be virus free etc.) are going to create a problem in future, whereby users inherently believe because it's a Mac they are immune to DNS redirection or social engineering scams. Hopefully the two issues can be separated so that platform vulnerabilities can be continued to be addressed and user education may be addressed for all platforms.

Yes and no.

Most people don't even understand things like "man in the middle" so it could be a problem. Then again, if trends continue along social engineering (which I think they will, the skill level required for exploits is quickly leaving the script kiddle realm) it's not really going to matter what one runs.

Scary part is that most social engineering attacks aren't even illegal.

[HAL10000]

Originally Posted by Android1

HAL and moshpit, stay on topic please.

I requested simply for Moshpit to tell me why the hypothesis that marketshare and insecurity are directly related and he is clearly unable to. The theory was put forward and I pointed out in two simple ways how it was demonstrably untrue. One was a direct historical comparison (a sort-of before and after) while the other was a simple extrapolation of the current Windows submarket, if you can call it that.

Best he could do is say that I was living in an alternate reality and hiding behind bravado.

[moshpit]

Edit: Unlike Hal, I can abide by moderators request...

[HAL10000]

Originally Posted by moshpit

Edit: Unlike Hal, I can abide by moderators request...

How is asking for a little elaboration on the central premise of the thread off-topic? Since you were one of those who believes in this theory of marketshare leads to a dramatic increase in the number of security incidences, it is incumbent upon you to provide justification for it.

I provided two uncontroversial examples of how the underlying premise was flawed. All you could do was to claim I was in an alternate reality, yourself obviously trying to dismiss "reality" when presented with it.

Repeat after me. Windows XP (NT in general) had security flaws because it was an insecure product designed for a pre-Internet age. System 7 had security flaws because it was an insecure product designed for a pre-Internet age.

They went after Windows XP boxes because they could, not because of the numbers of them out there. If there were a correlation between marketshare and vulnerabilties, you would have seen much higher incidents in the Vista space, which we haven't.

There are other factors that dwarf marketshare. Availability of tools, documentation, but more importantly, the bar set by the provider to keep people out. Apple set the bar high when it transitioned away from Sys9 to OSX. Microsoft followed suit years later with Vista. Apple, Microsoft, the FOSS community have all been regularly lifting this bar higher and higher, resulting in fewer people with adequate skills to deliver successful malware. The result was predictable with the recent rise of social engineering attacks.

This is where me and caveman-jim see eye-to-eye. Security incidents may soon become the result of user error, and likely people will prefer to blame Apple or Microsoft for their own dumb mistakes.

Edit: I just realized what's the point of responding to Moshpit. He won't read this.

[VW_Factor]

Originally Posted by moshpit

And yet your denial of reality continues as well...

+1

[moshpit]

Originally Posted by HAL10000

How is asking for a little elaboration on the central premise of the thread off-topic?

How is "this isn't my flamebait" unclear to you?