Re:Was Mac OS X really the most vulnerable in 2015?
by rdtsc on Saturday January 09, 2016 @12:56PM
(#10872135)
Mac CVE numbers are not as discretized by type of component as Microsoft or Linux are. For Windows for example it is Windows 8, Windows 8.1, Windows 7, Windows 10, Windows RT, Internet Explorer. Google is Android, Chrome etc. Adobe is a large suite of products as well.
The goal of CVEs is not to point fingers to companies and compile statistics based on ownernship. I don't see any value or helpful outcome from these these "research" security firms (and the tech blogs) treating it like such and creating FUD.
Re:Was Mac OS X really the most vulnerable in 2015?
by vetinari on Saturday January 09, 2016 @03:43PM
(#10872792)
On the other hand, the Linux CVEs count each bug several times - e.g. kernel exploit will be counted against Linux Kernel AND each distribution. I assume something similar for Windows too.
Re:Was Mac OS X really the most vulnerable in 2015?
by brudgers on Saturday January 09, 2016 @02:31PM
(#10872486)
There is probably greater variation in security mechanisms among versions of Windows than OSX due to OSX's remaining close to its *nix heritage. For better or worse, Microsoft has been rolling (or not rolling) its own security architecture for several decades.
Re:Was Mac OS X really the most vulnerable in 2015?
by Terretta on Saturday January 09, 2016 @12:32PM
(#10872035)
“Apple, it turns out, had 91 vulnerabilities of this [very severe] severity in 2015, a mere 14 percent of their total vulnerabilities. Microsoft, however, had 332 very severe vulnerabilities, at 58 percent of their total. Adobe leads both with a whopping 389 very severe vulnerabilities, almost 85 percent of their total.”
“This tells us more clearly about the severity of the vulnerabilities in the data, which is a more important metric than just how many total vulnerabilities there are.”
Secondly, we know nothing about exposure, because we don't know how the relative levels of attention or how quickly the vulnerabilities are patched.
A high discovery rate is as indicative of the attention given to the platform as it is to the underlying number of vulnerabilities. A high discovery rate plus relatively high rate of distribution of patches could means a system is less vulnerable.
I'm not saying this is the case - just that the data presented are simply useless for ranking software vulnerability levels.
Re:Was Mac OS X really the most vulnerable in 2015?
by awakeasleep on Saturday January 09, 2016 @01:24PM
(#10872240)
Another thing that would add more information to the picture is something like "percent of installbase running vulnerable version."
If, for example, researchers found 10k vulnerabilities in windows 3.1, it wouldn't make sense to ding microsoft for an insecure operating system, because no one runs that and it's not reasonable to expect support.
Re:Was Mac OS X really the most vulnerable in 2015?
by krylon on Saturday January 09, 2016 @03:11PM
(#10872679)
> because no one runs that and it's not reasonable to expect support.
I would not be overly surprised if it turned out somebody was still using Windows 3.1 - I know of at least one company still running NT 4 on at least a few select machines. (This does not invalidate your point, though.)
Re:Was Mac OS X really the most vulnerable in 2015?
by Amorymeltzer on Saturday January 09, 2016 @04:11PM
(#10872901)
>Comparing them is like comparing the number of hits made by two different baseball teams in a season without considering how many of those hits were foul balls, grounders, home runs, etc. One team may have a higher number of hits than another, but if they hit a lot more foul balls, while the team with fewer hits had a higher proportion of home runs and RBIs (runs batted in), the higher number of hits is revealed as a misleading statistic.
For what it's worth, in baseball, a foul ball or grounding into an out do not count as hits; a hit means a batter successfully reached first base without a fielder's choice. Number of hits is still not very meaningful — something like slugging, on-base percentage, or OPS is more instructive — but it's not as bad as this example is making out.
Re:Was Mac OS X really the most vulnerable in 2015?
by btgeekboy on Saturday January 09, 2016 @04:54PM
(#10873044)
Agree - to that extent, while I do care about raw number of vulnerabilities, I care more about the percentage of which were resolved, and how long it took for an issue to be patched.
Re:Was Mac OS X really the most vulnerable in 2015?
by michaelmrose on Saturday January 09, 2016 @12:55PM
(#10872125)
I would tend to wonder if there was a connection between how many Mac users who don't buy or need malwarebytes or for that matter any 3rd party security software and them wanting to scare people into buying their product.
Re:Was Mac OS X really the most vulnerable in 2015?
by tetrep on Saturday January 09, 2016 @01:51PM
(#10872360)
>I would tend to wonder if there was a connection between how many Mac users who don't buy or need malwarebytes
but this article is critcal of the FUD that is being spread from poorly drawn conclusions about CVE statistics. they're not trying to sell you anything.
Re:Was Mac OS X really the most vulnerable in 2015?
by erdevs on Saturday January 09, 2016 @05:14PM
(#10873107)
Are you sure? This company sells Windows-based security software. While we can't speak definitively to their intent, it is possible to objectively observe that they stand to gain from the impression that Windows is less secure (and more in need of security software like theirs).
Re:Was Mac OS X really the most vulnerable in 2015?
by brudgers on Saturday January 09, 2016 @02:28PM
(#10872478)
There's nothing in the article that suggests a smaller OSX attack surface and that there might be unlisted vulnerabilities in Windows Phone doesn't make OSX more secure. Beyond security by obscurity, vulnerabilities are absolute.
Re:Was Mac OS X really the most vulnerable in 2015?
by satuim on Saturday January 09, 2016 @09:41PM
(#10873897)
The data is presented very poorly. Mac OS X is all in one where as Windows is separated into different versions and just to screw with us more there is simply just a "Windows" entry further down.
Anyway the article is just about the amount of vulnerabilitys discovered it doesn't mention how fast it was patched or how serious they were.
Re:Was Mac OS X really the most vulnerable in 2015?
by tptacek on Saturday January 09, 2016 @03:49PM
(#10872817)
That's not at all the intention behind CVE numbers, so people trying to "add the numbers up" are demonstrating a lack of understanding of CVE, not a problem with it.
Re:Was Mac OS X really the most vulnerable in 2015?
by jcbeard on Sunday January 10, 2016 @06:42PM
(#10877802)
true...just playing on words. simply adding up CVE stats silly. actually any of these "top 10" vulnerability lists are idiotic. theres a hell of a lot of layers involved in any system from dozens (perhaps hundreds) of sources that lead to errors (undefined behavior). from the hardware, all the way up through the software stack.
The goal of CVEs is not to point fingers to companies and compile statistics based on ownernship. I don't see any value or helpful outcome from these these "research" security firms (and the tech blogs) treating it like such and creating FUD.
“This tells us more clearly about the severity of the vulnerabilities in the data, which is a more important metric than just how many total vulnerabilities there are.”
And if you even ignore type of product, then Adobe goes first, but this has no impact on "which OS was the most vulnerable".
Firstly the data aren't usable for this kind of analysis even if you bucket them differently: https://www.cvedetails.com/how-does-it-work.php
Secondly, we know nothing about exposure, because we don't know how the relative levels of attention or how quickly the vulnerabilities are patched.
A high discovery rate is as indicative of the attention given to the platform as it is to the underlying number of vulnerabilities. A high discovery rate plus relatively high rate of distribution of patches could means a system is less vulnerable.
I'm not saying this is the case - just that the data presented are simply useless for ranking software vulnerability levels.
If, for example, researchers found 10k vulnerabilities in windows 3.1, it wouldn't make sense to ding microsoft for an insecure operating system, because no one runs that and it's not reasonable to expect support.
I would not be overly surprised if it turned out somebody was still using Windows 3.1 - I know of at least one company still running NT 4 on at least a few select machines. (This does not invalidate your point, though.)
For what it's worth, in baseball, a foul ball or grounding into an out do not count as hits; a hit means a batter successfully reached first base without a fielder's choice. Number of hits is still not very meaningful — something like slugging, on-base percentage, or OPS is more instructive — but it's not as bad as this example is making out.
but this article is critcal of the FUD that is being spread from poorly drawn conclusions about CVE statistics. they're not trying to sell you anything.
http://www.imore.com/os-x-and-ios-security-vulnerabilities-a...