Vista - 2008 Desktop OS Vendor Report

This report looks at all of the vulnerabilities fixed by Apple, Microsoft, Red Hat and Ubuntu during the first half of 2008. At the vendor level, the report examines all vulnerabilities as well as Days of Risk (DoR) associated with those vulnerabilities. The report further drills down to examine just those issues affecting the commonly installed desktop operating system components.
The key findings for 1H08:

• The four vendors fixed a total 585 vulnerabilities in 1H08. 26.8% affected multiple vendors and of those, only 8 were fixed on the same day – the rest had an average 35 day delay between the first available fix and the last available fix..
• Microsoft had the lowest average Days of Risk for all vulnerabilities fixed at 24.22 days, with the next closest vendor at 72 days.
• For desktop OS vulnerabilities, Windows Vista had the fewest vulnerabilities in 1H08 at 21. The next lowest number was Windows XP SP2 at 26.
• Windows Vista customers experienced full or partial mitigation for 46% of the 26 vulnerabilities affecting Windows XP SP2 in 1H08, but also experienced one additional vulnerability in new code.

In addition to these measurements for the vendors and products, the body of the report also provides weighted analysis which provides a lesser consideration for lower severity issues. Please read the full report for details.

So Vista is a more secure OS. Thought so!

Its not just security but useability and compatibility that are important factors when chosing an OS and at the moment there is only one viable choice.

Helo swarfega, you are right. I was being flippant and I agree there are other considerations that limit one choice.

There's goes Linux's "selling" point....

Glad to see Microsoft have got thier act together.
It would be interesting to see a report on how many attacks the OS have had to compair against how vulnarable the OS is.
I think because Microsoft products are the big sellers, they make for a bigger target.

Considering the source I wouldn't say it's reliable information... I have the word "biased" ringing in my head.

The information they used is from publically available places like SecurityFocus (linux project Changelogs/patch pages, Apple public announcements (legally required in the US for all software security bugs) and timeframes from the report to patch release...

You can do the maths yourself and see the report`s outcome or just believe its biased regardless of the gigabytes of proof available

I'll leave it to militant apple groups and linux communities to find whats left out to make MS look as good as possible...

militant apple skinhead looking to find whats left out