Microsoft: Vista has fewer first-year vulnerabilities than any modern OS

He we go again. Like an evil pope preparing to recapture the Holy Land, Jeff Jones, Microsoft's self-proclaimed "Security Guy" (and Microsoft Director) just published the Vista One Year Vulnerability Report. As you can see from the graph above, JJ's methodology concludes that Microsoft's Vista easily bests the first year vulnerabilities found in XP, Red Hat Enterprise Linux, Ubuntu, and Apple's own OS X. As contentious as the report is, is anyone else reflecting on the fact that Vista is more than a year old for businesses (almost exactly one for consumers) yet XP continues to ship standard on many PCs?

[Via Slashdot]

[Superprime @ Jan 24th 2008 7:38AM]

Now if only manufacturers would release drivers for it.

[Brendan @ Jan 24th 2008 10:08AM]

I only had that problem at the very beginning of Vista's release (I started using it a month or so after Businesses got copies).

The one thing I do know is that it is resistant to OS crappage. What I mean is... every 3 to 6 months I *needed* to reformat XP because either the registry was fucked... or some random program FUBARed my system.

Haven't had the same problem with Vista and have yet to need to format it (and I play games).


But first year vulnerabilities? Maybe they're so low because hackers don't feel like learning the new ways around windows security when there are still tons of XP machines to make into zombies.

[Andrew @ Jan 24th 2008 10:36AM]

No joke. I ran Vista, but couldn't get my pdf maker to work (Adobe's fault). I have since switched back to a free copy of XP. I will admit, Vista was secure as hell. I didn't even install antivirus software on it.

[Ty @ Jan 24th 2008 10:46AM]

I really wish people who don't run Vista would stop fucking writing misinformation. I haven't had any issues with Vista drivers since two months after release, when nVidia finally got the 8800 drivers out. I'd like to point out that Mac Pro users running OS X are having the very same issues one year later.

I wish Apple would allow manufacturers to write drivers for OS X, presenting game developers with incentive to write games for OS X. Anyway, fanboi's continue to harp on M$ problems that don't actually exist anymore. The world is listening...

[Jeff @ Jan 24th 2008 11:35AM]

@ Ty

"[Apple users don't understand drivers] Like, how operating systems that support third party hardware require drivers"

trolling? or are you really that out of touch?

That's like saying "yeah, it's like how Apple users don't understand .dll files scattered all over their hard drive, you know, like when an OS supports third party software."

there's a better way, Ty.

[Tom @ Jan 24th 2008 12:34PM]

@Ty

A bit off topic for this discussion, but to continue your point:

I really wish people who don't run OS X would stop fucking writing misinformation. 3rd parties are more then free to write drivers for their hardware on OS X, and ATI does this for their graphics cards. You can go to ATI.com right now and download graphics drivers for their retail products. For now, the listing only goes up to 10.4 as 10.5 includes a newer driver already, but ATI will likely have a 10.5 section up when the built in stuff is outdated.

And what issues are the Mac Pros having with drivers? The 8800GT in the second gen Mac Pro and sold as an upgrade kit doesn't work due to a firmware incompatibility, one that is being addressed by NVidia. It's not a driver issue. And any PC that decided to also adopt EFI would be in a similar situation.

[ericisshort @ Jan 24th 2008 12:38PM]

I had problems with my intel integrated graphics drivers while using dual monitors up until about a month and a half ago, when intel finally fixed it. I love vista, always have. Hated XP

[Ty @ Jan 24th 2008 12:57PM]

Okay so the driver comment was a low blow intended for Apple user's who don't realize that OS X is deigned to run on a narrow set of Apple-chosen hardware, not all modern PC hardware. It wasn't intended for you guys, who obviously realize this fact.

That said, I wasn't referring to video cards specifically when I was mentioning manufacturer's not having drivers for OS X. I was alluding to the fact that you can't pop an eVGA mainboard, turtle beach sound card, Areca RAID controller, etc. in your Mac Pro and expect it to work, or build a box and expect OS X to run on it flawlessly. You're saying that all these companies are free to write OS X drivers and release them? And the hardware would presumably work perfectly fine?

[Tom Cramer @ Jan 24th 2008 2:21PM]

@Ty

Yes, thats exactly what I'm saying. Why? Because many Mac users do this all the time. I bought an eSATA expresscard for my Macbook Pro, and OS X didn't have a built in driver for it. So I went to the manufacturers web site, downloaded the OS X driver, and the card works fine. VPN clients often install their own driver. There are several networking cards that can be added to a Mac Pro with OS X drivers. Same for storage cards, and so on. Apple even provides all the tools to do it for free. Install XCode off the Leopard DVD, or download it free from developer.apple.com and you can write your own driver.

Apple doesn't restrict hardware companies any more then Microsoft does. Both companies have certification processes to gain official logo support "Designed for OS X or Designed for Vista, etc" and processes for including the drivers in the base OS install, but neither side mandates such programs.

You get irritated when people spout inaccuracies about Vista, but yet turn around and do the same for OS X. I'd recommend in the future taking your own advice on such things. Yes, fanboys of any color are annoying, but doing the same thing as them doesn't help any.

[Carlos @ Jan 24th 2008 4:23PM]

I would like to see -for each OS- how many new installations are we talking about. If this is just a simple count or a percentage of all the new installations in the first year. If Vista was installed on 5,000 PCs and XP on 50,000... how many bugs/failures will be exposed to the public? Also I would like to see how different is Vista than its predecessor XP. If Vista uses the same core than XP than obviously it will have less vulnerablities...

[Daza @ Jan 28th 2008 9:25AM]

Totally agree with Brendan, I've been on the same Vista install for over 1 year and it runs just as fast as it did on the first day. With XP I would find things with collapse quite often, particularly with boot issues. Vista is running flawlessly and handles anything I throw at it exceptionally well. So well in fact I currently have it installed on 3 desktop PCs, 2 notebooks and 1 HTPC. And they're all licensed copies too! :)

[James Ollier @ Jan 24th 2008 7:39AM]

Shame its slow, sluggish and bloated.
Also almost every os task in Vista takes at least one extra mouse click compared to XP.

[shaliron @ Jan 24th 2008 7:56AM]

You're comment is so troll-like, it's not funny.

[Scooby Doo @ Jan 24th 2008 7:59AM]

If people believe Vista is bad because of shotty journalism and biased blogs then they will believe it's true. If this site would get its nose out of Steve Jobs ass maybe we might have some proper perspective around here.

[Grizz @ Jan 24th 2008 8:08AM]

Stop being a sheep. Look at the benchmarks, Vista is only 2-5% slower than xp in gaming. Honestly you wouldn't know this unless you were told.

And this is from year-old data. imagine how much better it would do now with current drivers.

[w00t @ Jan 24th 2008 8:18AM]

You know, when Mac Os X first came out pretty much everybody hated it.

It was REALLY slow compared to classic, it was buggy, it didn't have enough drivers or native software.... yet it turned out to be a great OS eventually :)

I'm not saying vista will turn out the same way, but a slow start does not mean it won't eventually be very popular!

[Kogmo @ Jan 24th 2008 8:18AM]

Got to admit my first install of Vista did not go well. Everything take minutes longer to run. Turned out it was just a freaking video card driver.

Now all of my 3 computers are happily running Vista. But then again this was months ago when Vista first came out, drivers were rare and online help are hard to find.

[James Ollier @ Jan 24th 2008 8:21AM]

I don't think Vista is crap because of shoddy journalism, I have it on my PC, and use it every day. 1st hand experiance taught me it was crap

[Blake Bowen @ Jan 24th 2008 8:32AM]

Vista came with my new gaming laptop. Performance sucked, as well as just about everything else about it. When I tried to open "My Music" it told me access denied. That's when I almost broke out the hammer. I payed extra on my next laptop just to get XP.

[andrew @ Jan 24th 2008 9:42AM]

i'm actually very impressed by vista

sure 8 months ago there were a few driver issues and it does occasionally lock up sometimes but since i've done a repair install months ago the only driver that has ever stopped working is the crappy one hauppauge won't update for my tv card

now that i've basically got it to the same software spec as I had on XP there's very little difference, and startups and shutdowns are much faster and more reliable. I've also never had one single virus with Kaspersky 7 running in the background, and like i said the only driver problem i've had since the repair install 2 months after i got it (i don't htink it upgraded properly) has been the hauppauge one

[dan2600 @ Jan 24th 2008 9:11AM]

it seems no one remembers when windows XP came out and people were opting to keep windows 98 over upgrading beacuse there was no drivers...oh wait...is thats whats happening again? At least Vista uses the same kernel as XP...seems like everyone forgot the hard switch from the Monolith to NT Kernel. Vista isn't working very good yet...but give it time and it might change...YES the UAC is annoying as hell..but my OSX machine pops up and asks for my damn password every time i try and install something so ummm whats harder, clicking continue or typing a password...also you have an option in vista to turn it off...which I can say is the same for the Mac. Vista has potential...and its forcing computer companies to actually start putting out some beefed up hardware rather then still ridding on technology that's years old.

[mattclarkie @ Jan 24th 2008 9:53AM]

The performance of Vista depends on the Hardware. My PC I built running Ultimate 64 performs fast, stable, and basically better than any box I have used before. My Acer Lappie however crashes regularly, and is apparantly because ATI graphics drivers for the x2500 are badly, well just bad. If you have trouble with Vista it is likely the hardware and not the OS itself.

[Dale @ Jan 24th 2008 12:38PM]

I own and use Microsoft Vista. I too believe it is bloated (my install of Home Premium somehow runs around 16GB); and until you turn off that over-protective UAC rubbish, everything *does* incur at least one more click than XP.

It's not terrible by any means - other than the struggle to find drivers for certain pieces of hardware, I don't think it's any worse than XP - but after using it side by side with Mac OS X, it does nothing to justify costing up to three times as much. Nothing.

Wait, I'm just saying those things because I am a media-deluded sheep with my nose up Steve Jobs' arse.

[Ty @ Jan 24th 2008 10:50AM]

I guess Apple users don't understand the concept of drivers. Like, how operating systems that support third party hardware require drivers, and the quality of these drivers (which are developed by the manufacturers of said hardware) is directly proportional to the performance of the operating system.

[Scott @ Jan 24th 2008 5:26PM]

People keep saying that "Vista is not bad at all" as if that is some kind of lavish praise. Why the hell would I pay HUNDREDS OF DOLLARS for an OS that is "not that bad at all"? For that price it better freaking knock my socks of compared to XP or I'm going to stay with XP! Given that I'm using both Vista and XP this very moment (I'm at work on two desktop machines), I feel qualified to comment on the comparison.

So what is so much better than XP to make it worth the hassels and extreme cost of upgrading?

[JLTate @ Jan 25th 2008 3:04AM]

Apple OS X 10.5: $109.99 on Newegg.com.
Windows Vista Home Premium OEM: $109.99 on Newegg.com.

Except... In the span of time since Microsoft released a new operating system, (XP in October 2001) Apple has released 4.

OS X 10.2 "Jaguar" released August 2002 at $129
OS X 10.3 "Panther" released October 2003 at $129
OS X 10.4 "Tiger" released April 2005 at $129
OS X 10.5 "Leopard" released October 2007 at $109

Enjoy your iTax!

[Totalfixation @ Jan 24th 2008 7:39AM]

So i guess this isn't a sinking ship like most have though.

[josh @ Jan 24th 2008 12:08PM]

Considering that it sold 20 million copies in a month (it took 3 for Leopard to reach 5 million) and is now well above 100 million sales, it is only sensationalist (read: irresponsible) journalism that has suggested otherwise. You can see that in the little stab at Vista with the insinuation that the fact that XP is still being sold indicates poor market acceptance on Vista's part. How long was Win2k & Me still on computers after XP came out; a couple years. Was it because XP sucked, naturally not. It was because XP was a departure from the norm so some consumers were resistant to the change, but more importantly, some businesses are *very* slow to adopt a new OS (I know the company i work for just finished a 1 year trial of vista and is just beginning large scale rollouts in february, which is what they do with *every* new OS). The numbers show that market adoption for Vista is faster than any other OS in history.

As for the actual story, Jeff may be biased, but his numbers aren't. They match the National Vulnerability Database numbers, which is in turn pretty accurate. Leopard has already had 14 vulnerabilities since October, Vista only has 21 since November of 2006, and those vulnerability numbers are gathered independently rather than from the vendor (and for those who cry "silent fixes" towards MS, there is no such thing. Even if MS didn't disclose a fix the people who reverse engineer patches to find vulnerabilities, the primary way malware authors do find vulnerabilities, would notice the fix. Since malware authors do so, so do researchers, and those numbers would be reported to the NVD)

[Fred @ Jan 24th 2008 7:39AM]

Bitter much, Thomas?

[fred @ Jan 24th 2008 8:30AM]

Reall!

I guess he hopes that enough Microsoft bashers will show, spread enough FUD, and somehow twist the whole thing as being a bad thing, or that Microsoft is lying, or to redefine "vulnerabilities" so that it makes Vista look bad.

Hey, if the talking points dont fit anymore, move the bar and make it fit.

[Ty @ Jan 24th 2008 10:52AM]

Haha yeah, I had to scroll up and re-check the author. Could've sworn it was Ryan Block.

[Wwhat @ Jan 24th 2008 7:40AM]

MS spokesperson "yeah you see we count that as an XP vulnerability that happens to also work in vista, oh and that one we count as IE vulnerability and that's crossplatform so not a vista one"

[EMoShunz @ Jan 24th 2008 7:51AM]

you kid, but it's true.

[Stephen @ Jan 24th 2008 7:40AM]

That's because no one is using Vista; can't find what you can't see. How about a chart of vulnerabilities vs. units in service?

Notice how non-Microsoft products have a higher percentage of fixed vs unfixed? There may be fewer but they stay around forever.

[dj-kenpo @ Jan 24th 2008 7:53AM]

ya, they keep saying they've sold so many copies. unfortunetly most of that is due to inclusions in new systems, and many of those have been wiped clean with xp.

my 3 friends that have recently got vista have all asked for an xp disc. they'd rather have a cracked copy of xp then a slow, cumbersome legal vista.

that's gotta say something about it..
I'm all for the vista 'look', ... that's why I skinned xp though. that's as far as it'll go.

[Travis @ Jan 24th 2008 11:46AM]

It's funny, I'd like to see that same comparison for Macs as well...

Yes, they absolutely more secure, but if you're going to do a "per units sold" type thing how much better would they make out then?

[Garst @ Jan 26th 2008 4:26AM]

The number of copies sold has no barings on the number of vulnerablities the systems has. Only the number of people who are affected by the vulnerablities.

[mattbrown @ Jan 24th 2008 7:41AM]

Of course this can't be true, since Vista is a horrible OS. At least that's what all the people who have never used Vista say.

[carl @ Jan 24th 2008 8:00AM]

Why don't you try it yourself instead of relying on other peoples opinions?

[dj-kenpo @ Jan 24th 2008 7:55AM]

the "if you hate it it's becuase you're naiive and have never used it" arguement is getting a little old.

I used it. and got rid of it. some of need our system resources for pro apps.

I'm sure vista is great for surfing pr0n and checking email though where it doesn't matter your OS just ate 3gb of ram.

[Danbo Daxter @ Jan 24th 2008 8:11AM]

dj-kenpo :

Vista's using that RAM to cache your commonly used applications and documents for fast access and deallocates that memory when requested by another application. Fair enough, "vista haters have never used vista" is a poor argument, but you should get your facts right before complaining about vista eating resources that you need for whatever "pro apps" you are using all the time.

[John B @ Jan 24th 2008 8:16AM]

You're an ass.

Fine, then. You apparently need to hear from someone who HAS used Vista and still thinks it sucks.

I got Vista Home Premium when I got a new PC and I really tried to give it a chance to prove itself. I let it go for about three months until such time as it was clear to me that it sucks and is still in beta. A lot of Vista is pretty slick, but the vast majority of that is just eye candy.

Looking Glass ... er ... Aero is a big-time resource hog; the annoyance of having the verify every f**king action that you want to take cannot possibly be understated; and the major video editing applications that I use regularly do not work on Vista because of the changes to the hardware layer of the operating system. Capturing over firewire, previewing while editing using hardware overlay, audio previewing, and other such functions -- none of them worked. One of the applications finally released a Vista-compatible upgrade that I could download, but it's more of an entry-level application that I cannot use for serious video editing. (And, no, I neither want a Mac nor do I have the desire to pay twice as much as a PC for the "privilege" of owning a Mac.)

After three months of fighting with Vista and having to shut off most of the "features" just to get it to run smoothly, I finally upgraded my system back to XP. It's not given me any problems since and all of my applications run just fine.

So, do you have any more self-righteous, pointless platitudes that you care to throw at us?

[mattbrown @ Jan 24th 2008 8:19AM]

Let's see, I've istalled Vista on two machines, both of which had XP on them. One of them is a Gateway laptop that still does not have third party support from Gateway for Vista, and one that I built myself. Vista works great on both for some odd reason. So forgive me for liking a well built OS.

[John B @ Jan 24th 2008 9:00AM]

If you like it, that's fine. I don't have a problem with that, nor did I state otherwise. I have need for specific types of applications that not everyone uses and they don't work with Vista. My issue was with your correlation that those who criticize Vista are those who have not used it. I have used it, I tried by best to give it a chance to prove itself, and it failed; but I never said that because it failed me that it would fail everyone.

[Andrew @ Jan 24th 2008 9:26AM]

John_B:

So in other words, Vista sucks because the you use software from companies that are too lazy to update their software to run correctly on Vista?

Yes, Vista added updates to their system to ensure more stability and security, this broke a lot of things that needed direct hardware access, however, the fix is as easy as the companies getting off their asses, making new drivers, and resubmitting them.

So, without Vista people bitch and moan about how it crashes and is insecure, with Vista, people bitch and moan about how their software sucks and somehow that's Microsoft's fault. Bottom line, people just like to complain.

[Ty @ Jan 24th 2008 11:02AM]

JohnB - I hear you on application support, but honestly dude you sound like someone who screams that OS X "sucks" because you can't run games on it. Developers write software for operating systems. Not the other way around. Operating systems change and this causes compatibility issues.

You should be mad at the developers of whatever software you use for not writing a Vista version. It's painful that they work in XP and not Vista, I know, but change is painful.

dj-kempo... considering that I have two gigs of RAM in the rig I built that runs Vista, I'm pretty sure it doesn't eat three gigs of RAM. In fact, I'm pretty sure it uses less than 512 megs of RAM most of the time.

[Dave @ Jan 24th 2008 12:03PM]

Unfortunately all my classic apps worked just fine in osx and all my old osx apps worked flawless on x86 mac. So I'd say it is possible to make an app that worked on a previous OS still work in the current one. Rosetta is a prime example of forward thinking.

[Jeff @ Jan 24th 2008 7:45AM]

Too bad that, despite your claim that XP ships standard on many PC's, the article you linked to only proclaims that people can choose XP if they want to. And hey, a quick glance on the Dell site clearly shows that Vista is shipped by default on PC's, while users have to explicitly choose XP.

Maybe next time you'd like to research your stuff a bit more before writing an angry news post?

[Kurtis @ Jan 24th 2008 8:56AM]

"yet XP continues to ship standard on many PCs?"

That's what the article says. Note: many; not all; not most; just many.

[Jeff @ Jan 24th 2008 9:03AM]

Define 'many' and show me these many retailers that ship XP by default. Also, what was that link to the Dell article supposed to prove?

In case you didn't get it: it's FUD. And it has absolutely nothing to do with the article, but apparently Thomas couldn't live with himself if he had to write a Vista article with only positive news. Even if he has to make the bad news up.