RSA: Security Experts Debate Linux Vs. Microsoft (ChannelWeb)

"Perhaps, but that's just a consequence of popularity."

This is the traditional easy excuse, but given without justification.  

Surely the quality of the code *must* play a role, as well as the literacy of the users.   So
closer to reality, a combination of factors determines the overall vulnerability of a system. 

The whole article is made of presenting the Linux argument first and then the 
Windows argument to counter that later.

The number of exploits is also closely tied to the efficiency of patching the issues. 

Many copies of Windows are unpatched due to them being illegal. They also typically 
have much more third-party software that does not get updated through the standard 
system update mechanism.

Always look at methodology, in this case Linux vulns and Windows vulns are counted
differently.

Vulnerabilities are typically found in Linux through code audit, so whether or not the
vulnerability allows for an actual exploit is theoretical.  A higher percentage of all the
vulnerabilities are found as well.

Windows has less in the way of theoretical exploits, since the typical way to find one is to
implement it, and more unknown active exploits, because there are always more bad guys looking
for vulnerabilities than good.

Also keep in mind that windows being popular gets the security researchers more interested in
keeping it locked down as well.  If Linux becomes dominant, it gets hold of more of the good
guys too.

There's also the problem of popularity at the individual package level.

If all the Linux admins were diligent about removing unused software, you reduce the effective
exposure of real-world Linux systems below the vendor vulnerability counts, because only
vulnerabilities in the base OS load affect all users, and vulnerabilities in stuff that's not
installed affect only those users who really needed that software enough to install it or
leave it installed.  (How many production servers have you seen running X and portmap?)

Of course, not all Linux admins are willing to click "uninstall" all over the place, and the
modern IT media doesn't advocate strongly enough for a culture of aggressive software removal.

"""
Were the popularity numbers reversed, with Linux at 90% of the market and Windows at 10%
(making up numbers out of thin air, of course, for simplicity's sake), then the black hats
would immediately jump on Linux vulnerabilities
"""

This often voiced view is supremely irrelevant, since the level of dominance which MS holds on
the desktop is clearly a pathological condition.  If Microsoft turned into a pumpkin at
midnight tonight, there is not a chance that *any* one OS would obtain such a level of
dominance and generate another such monoculture.  Not Linux. Not Apple. Not anyone.

"If the situation were reversed" is a fairy tale, and has no bearing on reality.

Microsoft's monoculture is both their goose that lays the golden eggs... and their albatross.
But if their freakishly large bean stalk were chopped down tomorrow, or died more slowly of
root rot, no other would spring up in its place.  That particular bean stalk was nurtured in a
different time, before the internet, when such things were still possible.

And in the absence of the gargantuan vine, and its associated monoculture, no crackers would
then see Linux, or *BSD, or Mac OS, or Solaris, or anything else as the obvious platform to
target.

And, at least in a relative sense, we could all live happily ever after.