On switching platforms

[chipotle]

This is playing off a post from cargoweasel about the newly discovered JPEG vulnerability in Windows. "How many times do you need this hammered into your skulls. Microsoft Windows is A BROKEN OPERATING SYSTEM," he writes. "What price sanity? How much is all that time and aggravation costing you? Is it really worth saving a couple hundred bucks?"

And these are good questions. I started to reply there, but decided I'd muse over here at greater length.

I have a friend who's thought occasionally about getting a Mac instead of his Windows machine -- he doesn't have any problems with Windows (that he's talked about), but he's comfortable with Unix and likes Apple's designs and so on and so on. And we can even set aside the argument about hardware price; if you're buying a new machine from scratch, the difference is pretty sharply reduced, particularly if you're buying a turnkey PC system from a big name vendor.

If he made that switch, though, the hardware cost isn't the issue. He would have to buy new copies of all of his programs. He has Corel Painter. He has Microsoft Office. He has an earlier Adobe bundle which is pretty much what became the Adobe Creative Suite.

So suddenly, that's $1500 more to make the switch, just based on those programs. And that's going for the "standard" version of the suites--tack on another few hundred if you go for the full shebang. And there are probably lots of little other programs he's bought over the years--not games--that add another few hundred. (He also has Maya, which is another $1999, although that's kind of an unusual case!)

This works both ways, of course. PC users can go on all they want about how the new AMD SuperChicken64 will run twice as fast as my G5, let me use ten times the memory and a better video card and do it all for two-thirds the price. And that's all great, but unless the SuperChicken comes with pretty direct equivalents to $1800 worth of software--yes, I just added it up--any theoretical savings switching to it is more than negated.

But what price sanity? is still a good question. Statistically, even Windows gods are increasingly risking being bitch-slapped by viruses, spyware and all sorts of other nasty crawlies. And even if they're not, Windows--both the original line and the NT line--is subject to what I called "creeping crud syndrome"--just through normal use, things subtly get messed up, until eventually you reinstall your operating system in frustration. I know Windows users who never seem to have any serious problems with their OS, but they appear to be in an ever-decreasing minority.

Comments

[pathia.livejournal.com]

My computer is a gaming box that happens to have other purposes. Until Mac's have more games than PC's, I will never even think about owning one.

I've never had any issues with spyware, viruses or anything at all completely against my own will. If I ever had a problem, it was because of me being dumb.

The reason why Windows has so many problems and exploits is because it has such a large base. The only reason hackers spend all their time messing up windows is because they can do the most damage.

If we lived in some freaky world and M$ was 5% of the market and Apple was 95% of the market I am pretty sure everything would be more or less switched completely (Security wise).

[cargoweasel.livejournal.com]

The reason why Windows has so many problems and exploits is because it has such a large base. The only reason hackers spend all their time messing up windows is because they can do the most damage.

If we lived in some freaky world and M$ was 5% of the market and Apple was 95% of the market I am pretty sure everything would be more or less switched completely (Security wise).

But that's the thing, we DON'T live in that freaky world. If people are driven to do bad things to a certain product, doesn't it make sense to avoid that product?
If OS X gets a lot more popular there will be more exploits and spyware for it. I'm not saying its invulnerable, I'm saying it's a good way RIGHT NOW to avoid all that security crap.

Since you are a gamer though the point is moot. Enjoy your system. :)

[chipotle.livejournal.com]

The ecosystem that 99% of Windows worms exist in depend on a specific set of variables--Outlook or Outlook Express, Internet Explorer, Microsoft Office--that aren't present on the Mac. (IE for the Mac is a completely different product, and Microsoft Entourage, the Mac email program that's an Outlook equivalent, doesn't have Outlook's vulnerabilities.) People who don't have that ecosystem on their Windows machine tend to be much less susceptible all around. If you use Windows, just don't use Outlook and don't use IE, and you get rid of 99% of the risk. (One would think this would be more obvious than it apparently is.)

It's an oft-repeated statement that the Mac would get as many viruses as Windows if it had the same market share, but as John Gruber noted (http://daringfireball.net/2004/06/broken_windows), "This argument ignores numerous facts, such as that the Mac’s share of viruses is effectively zero; no matter how you peg the Mac’s overall market share, its share of viruses/worms/Trojans is significantly disproportionate."

Most of Windows' vulnerabilities come from its reliance on descendants of the OLE component architecture, which was really a great technological idea--just one designed for a single-user, non-networked PC. Every attempt to extend it with a security model has been, to be charitable, a highly mixed bag. Unix certainly isn't flawless, either, but it has a fundamental advantage in a networked world: it was being designed for multiuser, multinode networks years before Microsoft itself existed, let alone Windows.

[pathia.livejournal.com]

Well, I don't use any of those products. I use Firefox, Thunderbird and OpenOffice. The OS itself has done me no wrong.

In fact, this current boot of Windows XP is on its 5th week and the only reason it rebooted last was the power went out in a thunderstorm.

[yasha-taur.livejournal.com]

While the apps (Outlook, etc...) are an important part of the malware problem on Windows, it is far from the main reason. The OS itself was written in a VERY un-secured fashion. SP2 is just beginning to close just SOME of the ports and services that have stupidly been wide open for years. People have reported new computers being attacked almost as soon as they have been put online, before the Windows Update has had a chance to finish. SP2 will slow things down for a while, but there are still a lot of vulnerabilities left to be exploited. And they WILL be exploited.

You can make Windows much more secure by adding anti-virus, ad blockers, pop-up blockers, and other programs. But again, these are things that you have to add, and keep up to date.

All OS's have some vulrabilities, and it is only a matter of time before the Mac OS-X gets a virus. But because the Mac was written with security in mind, I expect that it will be much more of a minor issue than many of the recent Windows bugs.

[pathia.livejournal.com]

*shrug*

I've never had any of those issues. I just don't see what the big deal is.

My annecdotal experience is that Mac users and obviously *nix users seem to know more about computing in general and are less likely to do something stupid.

IE doesn't exist on my machine btw, I use XPlite.

[chipotle.livejournal.com]

That's kind of amusing, since it's sort of what Mac uber-partisan John Gruber said later on in his column, in so many words. I think there's something to it, although I do recall a friend who used to like the Mac who hated the fact that under OS X it was possible to get to a command shell, even though it was moderately hidden. To me this was sort of like complaining that your car no longer had the hood welded shut.

I *have* seen people who know what they're doing with Windows still get biffed, but it's much rarer -- and it's often directly or indirectly caused by somebody else opening the barn door.

[tacit.livejournal.com]

"The reason why Windows has so many problems and exploits is because it has such a large base. The only reason hackers spend all their time messing up windows is because they can do the most damage."

That mantra is repeated so often it's become an article of faith among some people in the Windows world, but the fact is, it simply is not true.

Virus writers can and do attack platofrms with vanishingly tiny market shares; look at the Whistler virus, which attacked a specific security vulnerability in a specific product (one particular version of the BlackICE software firewall). The total installed base of the vulnerable product was only 17,000--far fewer than the number of Macs Apple sells every five days--yet the virus writers targeted it nonetheless.

Windows' problems stem from its inherent insecurity, and from the fact that it was never designed as a secure operating system, not from its numbers.

Example: RPC (Remote Procedure Call) is a Windows service which was specifically designed to allow a remote process to start or stop programs running on another computer. RPC can not be disabled, because so many Windows services rely on it, even on a non-networked machine; every Windows box is rnning RPC, and it can't be stopped. This represents a huge security hole. Unix and Mac OS have an equivalent to Windows RPC, but it is not enabled by default, because it is not used by local services.

Example: Internet Explorer is always running on a Windows system; it's a part of the operating system, and its libraries load at system startup. When you double-click the Explorer icon, you are not launching Explorer; it's already running. You're just bringing up an instance of its user interface. because of this, and because it runs at what is effectively root-level access, anyone who can compromise Explorer can effectively gain root access to the target machine. Even if the user is running in a limited context (for example, as a non-administrative user) and can not, say, affect the contents of the Windows directory, Explorer can. And since it's always running, it can sometimes be exploited even if the user is using a different browser!!!. You are not protected by using an alternative browser; just peruse the Microsoft security bulletins, and look at all the bulletins that contain notations such as "This vulnerability can be exploited even if the user is not using Internet Explorer as his Web browser."

Example: Windows has no mechanism for validating process interaction. A process can send a message to anotehr process which masquerades as a message from the operating system, and that message simply gets placed in the process' message queue without problem. This allows one process to hijack another; it's a very useful thing for hackers, and "dropper" programs such as TROJ/Small.EN and TROJ/Small.AN use this to instruct Explorer to download and execute viruses or spyware without the user's knowledge or consent.

These problems are a result of fundamental architectural features of Windows; they make Windows easier to exploit regardless of Windows' market share. Were the market share of Windows and MacOS reversed, we might see more Mac viruses--but not to the same degree or in the same numbers. That's not a consequence of market share alone--it's a consequence of market share and inherently insecure design.