After toting up the vulnerabilities in Windows XP Service Pack 2, Red Hat Desktop 3 and Red Hat Desktop 4, Microsoft’s Jeff Jones concluded:

Whether you look at the all up total vulnerabilities, look at high severity vulnerabilities, or look at the weighted Workload Vulnerability Index, it is hard to argue against the fact that Red Hat 3 required less vulnerability-driven work than Red Hat 4, and Windows XP SP2 required less than either.

Jones’ conclusion is indisputable, as long as you play by his rules. Here are three of them:

  1. Jones’ Rule for Vendor-Defined Product
    Vendor-defined products are any apps included on the CD. Flaws in each product accrue to the vendor’s negative tally.
  2. Jones’ Rule for Role-Based Products
    A webserver is a role-based product. Same goes for a fileserver or database server. A role-based comparison includes the apps required to fulfill the assigned role, as defined by Microsoft and its partner, Security Innovation. An example: Steps for “hardening” the role products, which would substantially reduce vulnerability, are not implemented. Thus, while the packet filtering abilities of iptables are at a Linux admin’s fingertips, they are apparently out of bounds. [pdf]
  3. Jones’ Rule for Fixes
    A vulnerability in an application isn’t fixed until the vendor who stamped the CD distributes it.

Within these proscribed rules, the outcome is inevitable, even admirable.
But a Linux CD is a convenient store-on-a-disk. You can choose Red Hat, SuSE, Ubuntu, etc. for installation conformity and ease of updates. And you needn’t wait for distributor fixes. You can often get them from the original authors.

How do Linux admins find out about problems and updates? By monitoring the appropriate outlets, like CERT, SANS, SecurityFocus, and many others.

I expect little more from a CD distributor than I expect from a convenience store. I’m perfectly comfortable using search engines and forums.

It’s not the same with Windows boxes. As Microsoft is the only source for Windows, the company can be a huge, single point of failure.

Case in point: Remember when the world stood still during the WMF Exploit fiasco that took out XP SP2, circa New Year’s 2006? Ilfak Guilfanov delivered a patch while Microsoft dithered.

I expect more from Microsoft, because I must. Everything on the disk came from Redmond.

In the end, it will always be impossible to squarely compare Windows with Linux. Each fulfills different needs and expectations.

But as even Jeff Jones would tell you (I hope), the guy who makes the rules always wins.