Security Isn’t Just Avoiding Microsoft (but it helps ;)

“Security Isn’t Just Avoiding Microsoft”

So says this article. Its true (thought it certainly helps ;) What gets me are comments like this:

How would life without Microsoft be different? It wouldn’t be in any meaningful way for those in charge of network security; there would just be a different vendor peddling the dominant operating system.

Consider that Microsoft is not just the ‘dominant’ OS out there; Windows does not just have a plurality, a majority, 2/3, or even 3/4 of the market; they almost certainly have at least 90% of the market, with the vast majority of that (80~85% of the market) as a single version (XP). That is an effective monopoly, or in biological terms a monoculture. Monocultures are highly susceptible to disease [Update March 9, 2008: e.g. some bad news about bananas]; Windows is highly susceptible to viruses, worms and malware far too numerous to list. This is not a coincidence (though shoddy MS coding practices help :P But we’re talking about the monoculture aspect now). Part of the Windows XP monoculture was IE6 (which, due to practically criminal neglect on the part of Microsoft, was especially vulnerable). Right now Firefox and IE7 are helping restore balance, but soon (except in Europe :) IE7 will be the new monoculture and things will get bad again.

What can be done?

– First, the current monoculture must be destroyed!

If you must use Windows, do it as little as possible; consider dual booting with Linux (e.g. Ubuntu). When you use Windows though, try to avoid using IE: use Firefox, Opera, etc.

When buying a new computer, avoid Windows like the plague (no pun intended :) Buy an Ubuntu system or get a Mac. This will take a while to begin to resolve matters though.

– Second, no new monoculture must be created!

Seriously! :) A Mac monopoly or a Linux monopoly (while almost certainly better than a MS one ;) would still be a dangerous scenario. What is needed is diversity. This is what you see in nature and it works.

In Linux I hope that KDE and Gnome remain separate viable codebase projects for as long as possible; it ensures healthy diversity. Imagine how much better things would be if the OS market were divided up more-or-less evenly between Windows, Mac, KDE Linux (e.g. PCLinuxOS) and Gnome Linux (e.g. Ubuntu) and the Browser market between IE, Firefox, Opera, Safari and Konqueror. More choices would help, though four or five is a reasonable number IMHO. Also if you could have different combos, that would be great (consider that either KDE or Gnome Linux can run pretty much everything except IE and Safari without trouble and IE just needs Wine and a little help).

Diversity will significantly help to reduce the incidence of major outbreaks online. Hopefully its not just a dream and we’ll actually see it in the not too distant future :)

For IT people, “within your own organization” you can help encourage diversity in computing by supporting a good mix of software; it will be more work to maintain, but it will also help make the disasters smaller when they strike ;)

Update May 20, 2008: a very interesting post about South Korea, “the cost of monoculture”

This nation is also a unique monoculture where 99.9% of all the computer users are on Microsoft Windows. This nation is a place where Apple Macintosh users cannot bank online, make any purchases online, or interact with any of the nation’s e-government sites online. In fact, Linux users, Mozilla Firefox users and Opera users are also banned from any of these types of transactions because all encrypted communications online in this nation must be done with Active X controls.