Originally posted by AbecX
No question about that, but if you had your own company, would you go for a platform with proven stabilty and security, or with proven security flaws? Its similar to buying a old ass fairmont v6 with 200k miles for a daily driver, its just not smart.
SCREW YOU My fairmont is cool! and other than one minor starter problem it has been perfect as a daily driver. whats up with your no working window, no windshield wiper, leaking rearend, no idling, door handles falling off Z28
I've never once said that it had no exploits, my argument was at least they come out with patches in ample time where as in windows world you get a single patch a month while exploits stay out in the open. For example, they didnt release a patch this month but had 6 known security holes that they couldnt fix. Those get put off for another month, leaving a open exploit out for 2 months which is just not acceptable. When was the last time there was a proven exploit out for linux that went unpatched for months?.
Uhhh linux went all the way till this new kernel with a root exploit
(but yeah they had a patch out for it in a few months, but why the hell did they wait a whole release to actually fix it???)
Beside that, most of the linux exploits that I see out arent related to any recent kernels, most of them are local exploitable where you have an account on the box. Most of the other ones are FTP or sendmail exploits, and I dont see many apache, mysql, or qmail exploits.
Not related to any recent kernels?!?!?! are you feeling alright tonight? 2.4.* they JUST made a 2.6 test kernel. 2.2 had holes also. so where do you not see the recentness?
I had to re-read this and what you said dosent make alot of sense... "most of the linux exploits that I see out arent related to any recent kernels, most of them are local exploitable where you have an account on the box" this is just stupid, can you say PTRACE? and most kernel exploits are ones that you have to be local...(for that matter name a exploit that was out that you could remotely exploit a kernel...)
Perhaps you didnt hear the news about single monthly patches out for windows now. Its not the updating part thats the problem, its the lack of reliable fixes coming from the vendor. You also have to factor in downtime from reboots that you have to do to finish install said patch, and then the 'service pack' factor that could really fuck up a production box. .
I updated my windows machines when I installed them and havent had any problems "yet". of course it took me a couple times to actually get them updated because I kept getting a virus when I connected to update
Anyone who runs RH62 or something thats more that 3 years old for their server OS needs to be shot anyway. IMHO, redhat doesn't really belong on a server with all the crap they put in it from the factory. I'm not sure how the enterprise version runs so I cant talk about that, but I hope its good seeing as its pay software.
Im not saying people run it now. but back around 6.2 times(you might not have started using linux that early, you might have been because I remember busting root on your box quite a few times) the exploits were rampant. for months. bind, ftp, kernel, they might have had holes for about 6 or 7 months.