Here’s another person that wants to debate, without putting anything on the table to debate with.  His argument, since Black Hat says that Windows is More Secure Than OS X, it must be so.

Well, here is my reply.

Reality obviously disagrees with you.  First of all, you show absolutely no evidence to back up your article.  A link to Black Hat doesn’t cover it.  Quite Simply, an article written over an year ago, easily counters your opinion piece ( http://www.schollnick.net/wordpress/2010/04/the-mac-os-isnt-really-virus-proof/ ).

Second, even so, the Black Hat article was discussing MOSX SERVER, not the MOSX Client.  Even so, the claim applies to either Leopard or Snow Leopard, and not the current MOSX Lion.

Why have we not seen any real world evidence of Virii infections on the Mac?  We have seen plenty of Trojans, but no real cases of virii reproducing in the wild, and automatically infecting systems.  Trojans are an issue due to user education, and users being gullible, it doesn’t match which platform there will always been trojan success stories due to this simple fact.

But the simple fact is that whoever can successfully make a virius that can will reproduce and infection other systems automatically on the Mac will be famous.  If not the person, than the virus itself.

Remember the “I Love You”, and Melissa Viruses?  What about the Morris Worm, that brought down the internet…. Heck, I will even ignore the Active X worms, virus, and trojans…The fact is that the underpinings of Mac OS X is basically BSD Unix.  Compare that to Windows, fairly, and you will see a marked difference in security design.

Does it make MOSX invulnerable to Viruses and other nasties, absolutely not.  But it does give MOSX an edge, and a more stable environment to base it’s security model on.  After all, BSD Unix’s development history goes back to 1977…   And I think we can also agree that the Unix security model is a fairly robust, and stable security model.

The number of vulnerabilities really is meaningless, since they will count a vulnerability multiple times, in different software packages…  Even after the vulnerability is patched.  Even so, they are potential vulnerabilities, what you really would need to measure is actual infections or computer break ins.

After all, I will counter Black Hat, and raise you a Trend Micro’s David Perry:

For a few days in late January, the Netsky.p worm was infecting about 2,500 PCs a day. Meanwhile the MySQL bot infected approximately 100 systems a minute (albeit not necessarily desktop PCs). As David Perry, global director of education for security software provider Trend Micro, puts it, “an unprotected [Windows] computer will become owned by a bot within 14 minutes.” [http://www.pcworld.com/article/119624/caught_a_virus.html]

Yes, it’s historical, but it makes the point.  Why is one of the first things we have to do to secure a Windows box is either install the Microsoft Defender Suite, or install some other antivirus package? Why is it, that we don’t have to do that on the Macintosh?  The fact is, an unprotected Windows box  will be infected by something.  It is not a matter of how, it is a matter of when.  Even protected Windows systems get infected by Zero-Day exploits. It happens.  It may eventually happen on the Mac as well.  But, at this point, without using a trojan, there is no evidence of a virus being able to reliably infect a Macintosh running Snow Leopard or Lion.

This doesn’t mean that Microsoft hasn’t improved Windows, it has, but the basic security model for Windows is not yet as robust as on the Mac.