Replies

True. Running as root is a big no-no. So system configuration is a big player in its security. A poorly configured open source system is less secure than a properly configured closed source system. So if security is the issue, the source model is orthogonal.

Your ideas about market share being such a large factor has been debunked so many times, I think a few FR posters have macros for it.

What is an alternative explanation for Android being a bigger target than iOS? If its not market share related, then what? Is Android inferior to iOS?

And if the market share aspect is not a part of why hackers target a given platform, why do so many former hackers who have gone public say it was? Many relish the notoriety they recieved by making the news. None of them got famous hacking Symbian or OS/2.

I'd say it's largely the implementation. Any system can be hacked if basic design decisions are mishandled. There have been hacks launched against platforms that had installed bases of 15,000 total hosts, (google: witty worm) so market share doesn't seem to be an impediment to dedicated hackers. Apparently, being closed source hasn't help Microsoft avoid being a target at all.

Some types of software such as crypto systems shouldn't be even considered by professionals because the devil of such things is in small niggling details that needs lots of eyes to locate potential vulnerabilities.

Security needs to be designed in from the ground up, and then implemented correctly in order to work. I am constantly amazed at how poorly even large companies that should know better implement security. Here's a great example. Cicso makes a VPN client for windows. Many companies deploy it with a group-level password set that isn't disclosed to the users so they can't set it up themselves on non-company approved devices. Unfortunately, the configuration file contains a 'encrypted' copy of the password. The 'crypto' used for this purpose is so laughably weak that a python script can break it trivially in so little time, that there is not a noticeable delay. Granted, their stupidity made my life easier, but it is criminally dumb IMO for them to actually depend upon such stuff.