That's an interesting opinion... what makes you think it's the easiest OS to target? Do you have any data to back up the claim that a modern Windows OS is less secure than it's major competitors (OSX and, in some circumstances, Linux)

My feeling would be that Microsoft have done a lot in the security line and have also given a lot back to the security community (their SDL documentation which is freely avaiable for example) and that they are one of the better examples of security in the software industry these days

The "security line" is not simply a question of "doing a lot" and "giving a lot back", ex post facto, or setting an "example" in the "security industry".

It also has to do with design goals and priorities. Layer upon layer of cruft, with an OS weighing in at multiple GB, is not a confidence builder in the "security line". It also includes default configurations.

There are reasons that so many Windows instances have been and are now part of botnets. There are reasons why the security updates have increased in quantity and frequency over the years and appear to be neverending.

Some of those reasons have to do with design and priorities. Others with default configurations that Redmond assumes no user will ever change.

No amount of PR can change reality (e.g., massive botnets of Windows users), although it might change people's perception of reality.

Also, I never said "major competitors". I said "other OS". For example, the OS I use is probably not a "major competitor". It is much smaller and open source. That is what is important to me.

Sure design goals, well I'd argue that Windows has had "improving security" as a design goal for some time now, and that this has had measurable impacts on the security of their products.

For example take SQL server as a good example, compare the number of RCE issues that it's had with say.... Oracle's Database server, another well funded company with loads of "PR" money. You'll find the SQL server has many fewer security issues than the competition, and I would suggest this is evidence of Microsofts improved attention to security...

MS default configuration are really very good. I'd compare to your OS of choice, but you don't choose to disclose it :)

So on the server-side I'd say that when I test modern default installs of windows based products they tend to have a good security posture out of the box.

Security Updates, well everyone has a load of those, are you suggesting the MS is worse than their competition? Counting OS vulnerabilities is notoriously difficult to it's hard to get an Apples to Apples comparison here.

Botnets, well there are botnets on linux for sure, and OSX has had it's share of malware to as has Android.

If you like a small open source OS then that's fine, but it doesn't necessarily make another entirely different OS have bad security.

now I know there's a reasonable chance you're thinking I'm an MS "fanboy" or similar at this point, but I'm not. I use OSX/Linux and Windows (as well as some iOS and Android) where they work best for me.

The reason is exactly why MS has improved their security over the years. One of the things they've done is made automatic updating a mandatory feature of the OS. People can't just lazily turn updates off anymore because they can't be hassled for a 45 second break for their computer to maintain itself. Were these people running Linux, a lot of them would be doing the same thing, with the same results. Windows has a lot of botnetted computers because Windows runs the vast majority of computer systems out there.

The neverending security updates is part of the difficult balance MS has to take between compatibility and security. Fixing a security problem that breaks a buggy program written 20 years ago by a company that no longer exists suddenly becomes a support issue, because there are a lot of people who don't want to hear that they have to upgrade their copy of PrintShop.

MS releases security updates in part because they audit their code, and are making strides to get rid of a lot of the cruft. Windows 10 pulled a lot more services out of kernel space and into user space, for example. They're doing so while being conscientious of user needs, instead of telling the user to just code the fix for older programs themselves.

In your small OS, who do you go to for support if something breaks? Who will you go to for support when a program from today breaks ten years from now? These are responsibilities many open source programmers will slough onto the end user, while they're working on the Latest and Greatest PulseConsoleSystemAudioKitD.

>But the fact remains Windows is still the easiest target of any OS.

How is that a fact?

> But the fact^W opinion remains Windows is still the easiest target of any OS.

Windows isn't the easiest to target; but it is the most profitable, simply because it has the highest proportion of users.

OK, I'll bite. What do you think is the easiest?

Keep in mind what I said about configuration. Distinguish configuration from source code. Proper configuration s within the user's control and can be anticipatory and preventative.

Whereas poor quality code in a closed source program is outside the control of the user to fix and usually requires knowledge of someone exploiting it before it will be fixed. This is, unfortunately, after the fact.

Proactive versus reactive.

>How are you ever going to assess the quality of this software in terms of security?

I am not aware of a single third party that has reviewed all of the code that goes into a Linux distribution. Do you know of one?

Not sure what Linux has to do with my comment.

Are you assuming I use a Linux "distribution"?

Sometimes I have done so, but only occasionally when I need to check something on Linux.

Anyway, I am missing your point.

You're not sure what the most popular open-source OS has to do with your comment about open source OSes?

Nope. Maybe you can explain?

My comment was about closed source versus open.

Popularity is only relevant to the extent someone would argue Windows is not the easiest target but rather the most frequent one, due to its popularity, i.e., userbase size.

There's more to open source than just Linux.

Well, I simply highlighted the difference between theory and practice. The average user does not have the money to audit open source software. And even if you get someone to bankroll the cash, you will need to re-do the audit for every single check-in since the audit.

You made a point about Windows being impossible to audit, but in practice you're in pretty much the same boat when it comes to Linux.

Again, you mention Linux. I do not use it. How is it relevant to my comment?

And then there's this mythical "average user". But what does that have to do with me and my own solutions?

I know only one user: myself. I know what works for me. I live in a tty. Do I need a Windows GUI? No.

Finally, I also know that what one can do, another can do. But that is their decision and I am not trying to convince anyone to do what I do.

Windows is a massive, complex truckload of legacy source code that keeps growing with every edition; it has a lot of flaws and the number grows every year; it is not "open source" in the sense of public source code respositories and enabling users to compile from source. This is not opinion. It's fact. These facts do contribute to the state of Windows "security". Bravo for fixing flaws in recent years. But no points for having them to begin with: poor quality control.

>Again, you mention Linux. I do not use it. How is it relevant to my comment?

Um, because you compare like to like. If you are comparing millions of lines of code to 10,000 lines of code, then obviously its easier to audit. Your point about auditing code makes no sense unless you compare the task of auditing equal amounts of source code.

>Windows is a massive, complex truckload of legacy source code that keeps growing with every edition

Please enlighten us how you got access to the source code, which parts you evaluated, what methods you used to evaluate it, and why you think those methods are accurate and scientifically valid.

Unless you do those things, you cannot claim to be fact based. Its fine to have an opinion. Many non technical users who don't understand the NT OS design, confuse the implementation flaws of user mode code, kernel code, third party code, and are unable to differentiate it from NT design flaws. Sure, from a responsibility standpoint, I'm right there with them - If you ship it - you should own up to the flaws regardless of where they come from. I think that MS in the past made some super bone headed decisions (possibly driven by commercial reasons) that screwed them security wise because the 'default install' of Windows was insecure out of the box.

> But no points for having them to begin with: poor quality control.

How do you know this?

As an aside, I find it ironic for you to lament about "complex truckload of legacy source code" while using a TTY which itself is the exact same thing. Ah ! C'est la vie

"How do you know this?"

As a user, I don't. It's closed source. That's the point. What users have is only circumstantial evidence. And then there is the marketing and PR, such as the NYT article.

One of original two comments was "What would we find?" There is nothing to suggest I have read the source code.

Unless and until Windows becomes an open source project, such as the ones that are routinely discussed in this forum, where users can remove code they do not want, then no amount of "updates" or PR by Redmond is going "fix" Windows to my satisfaction. As I said, I am not expecting that to happen, ever.

There is a comment in these threads from a former Microsoft employee that confirms my suspicions about poor quality control. Are you still in disbelief?

As for your aside, I agree. There's legacy code in both. But I suspect it is far less code overall. And, in my opinion, it's in some cases higher quality than what I am getting with Windows (there are certainly exceptions: Dave Cutter's work on the NT kernel being one). Of course, I do not have the Windows source code so I can only speculate what is in there.

More importantly, the size of the software is much smaller and I can modify and recompile it.

I can see to some extent what has been added and changed over the years. I can continue to learn from the source and the people who wrote it, instead of from a marketing department.

Living in a tty is "the exact same thing" as using Windows?

Is that an example of "comparing like to like"?

I am in VGA textmode. I am not using a graphic layer.

The amount of code to implement the tty, which is available to me to read, edit, compile and redistribute, is, I speculate, much smaller and less complex than the amount of code and complexity used to implement the Windows GUI.

Pure speculation of course.

As long as you're claiming that your POV is an opinion, or informed speculation at best, I have absolutely no issues with what you're saying, and do not wish to engage in further argument. We probably agree on most things.

I remember my first experience with Linux back in the early 90's -- once connected to the Internet that Redhat box was rooted almost immediately.

From my perspective, Windows doesn't seem to be less secure but it has a greater share of users who do stupid things.

Maybe Redhat's configuration was at fault?

I have seen popular Linux distributions where interfaces are enabled and have programs listening by default.

I, the user, never asked for that.

This is one reason I do not use Linux distributions.

Too many assumptions about what the user wants.

You have to remember this was the 90's and it was a different time back then. I think there's a tendency to compare Windows in the 90s with how Linux is now. This was the same era as Mac OS 9 where a single application could still crash the entire system.

Exploiting common faults in Linux system software was pretty easy back then too.

> How are you ever going to assess the quality of this software in terms of security?

If it's very important to you, you can obtain a license that includes source code:

https://www.microsoft.com/en-us/sharedsource/

Or I could just use an open source alternative that does not require jumping through such hoops.

One where I can edit and compile the source, run it and redistribute it, too. All for free. But I guess all that is also possible under this shared source program you mention?

I don't think you need to sarcastically explain the benefits of Free Software in this forum.

I agree. Which is why I do not understand how anyone can claim Windows is not "closed source" in the sense of the opposite of "open source", as that term is commonly understood in this forum. Maybe they were being sarcastic?