Windows cheaper to patch than OSS: report

Microsoft has sparked heated debate by claiming that Windows software is cheaper to patch than open-source alternatives.

A Microsoft-commissioned study -- conducted by its business partner Wipro -- outlined the main areas of so-called "cost savings" by using Windows.

A survey of 90 organisations revealed that Windows database servers cost 33 percent less to patch than their OSS counterparts. Respondents said on average, Windows clients are 14 percent cheaper to patch.

The findings were criticised by several quarters, with some critics dubbing them unrealistic and outdated.

These sorts of studies can't be used as a real-world guide to the cost of patching or maintaining applications, said Frost & Sullivan Australia security analyst James Turner. "All organisations have different needs," he added.

"ROI [return on investment] and TCO [total cost of ownership] figures should be taken as a guide -- they are the vendor's estimates," said Turner.

Paul Kangro, Novell solutions manager for Asia Pacific, highlighted several problems in the research.

Although the study was conducted last year, it referred to problems faced by administrators during 2003 -- before significant improvements were made to Linux patching tools, Kangro said. "We didn't have tools like Zen for Linux then. When I patch my Linux box I don't need to bring it up and down any number of times."

There was also no mention of costs associated with rebooting systems after a patch is applied. "If I am patching a Windows box I typically need to find a time where I can bring it offline and reboot it. That is not mentioned anywhere in this report, which I find rather interesting," said Kangro.

However, Sean Moshir, chief executive of application patch specialist PatchLink, said that Microsoft's patches are in fact cheaper to apply than open-source platforms.

"PatchLink's finding is that on a per patch incident basis, the Microsoft patches are cheaper to apply. Testing Microsoft patches for quality assurance and documenting their positive and negative behaviours are also cheaper than open-source software [per incident]. This is mainly due to the fact the open-source software can have a much larger variety of configurations and setup," said Moshir.

Novell's Kangro conceded that "some technical issues in the past meant Linux was 'procedurally' more difficult to cope with" but said: "If I have somebody that is equally skilled on both platforms, I don't believe it is complex.

"Generally the issue is one of familiarity -- people may be able to potentially patch Windows boxes faster because they have had a lot of practice".

The research, entitled The Total Cost of Security Patch Management: A Comparison of Microsoft Windows and Open Source Software , is available free of charge from Microsoft's 'Get The Facts' Web site -- which aims to persuade customers that proprietary software is superior to open-source alternatives. programs.

The Get the Facts campaign -- in existence for a number of years -- has come under heavy fire from open-source advocates over its use of methodologies that generate TCO and ROI statistics which favour Windows.

The open source community has retaliated with its own research showing proprietary software is more expensive to use and maintain.

Wipro is a Certified Gold Support Partner for Microsoft and has forged a strong relationship with the software heavyweight since 1999 across areas such as systems integration and .Net migration.

Survey participants comprised companies in the United States and Western Europe with between 2,500 and 113,000 employees.

Talkback 17 comments

    Yeah, I agree with this study. ...Anonymous -- 20/05/05

    Yeah, I agree with this study. By the time I'm done typing:

    apt-get update
    apt-get upgrade

    my fingers are about ready to fall off! I have to type it like... once! Linux sucks!

    Me too - I've exhausted myself ...Anonymous -- 20/05/05

    Me too - I've exhausted myself AND our entire IT budget for the next 5 years by setting up the command "up2date -u" to run automatically in crontab every night.

    These people are full of it...

    I think there is a misquote in ...Anonymous -- 20/05/05

    I think there is a misquote in here... When Paul Kangro says "We didn't have tools like Xen for Linux then." I believe he is actually talking about Novell's Zenworks for Linux Management(ZLM) - commonly called Zen for Linux.

    Zen for Linux is the latest version of the Ximian Red Carpet patch distribution system, combined with the Novell traditional Zenworks suite. On the other hand, Xen is a virtual machine environment.

    In short, when it comes to patching a Linux box, the only Zen that will do that starts with a "Z".

    Woah, I`m sure that pointing ...Anonymous -- 21/05/05

    Woah,
    I`m sure that pointing and clicking on update is much more convenient than `sudo yum update`..
    however, I`m not ready to switch yet, sorry Bill.

    Patchlink is a company that pr ...Anonymous -- 21/05/05

    Patchlink is a company that provides enterprise wide patching. For them to support LINUX COSTS PATCHLINK MORE, because they must support Red Hat, Suse, Mandrake, Xandros, etc, etc; along with all their versions.

    For an admin of one of these Linux distributions, it costs nothing more than to run the supplied update program (whether its up2date, yum, apt, etc). Most Linux updates do not require rebooting, and it is rare for a resultant problem on a well supported distribution.

    That's priceless. A study com ...Anonymous -- 21/05/05

    That's priceless. A study commissioned by M$. Now that really instills faith in the numbers.

    Since when has anybody who even knows the difference between OSS and the closed shop crap instability that M$ has been flogging on an unsuspecting public as a "solid OS" for over 20 years, taken anything that M$ says seriously? Show me the numbers. I'd love to see it. The real question should be, how much can be lost while waiting for M$ to find a fix, nevermind the time it takes to implement a patch.

    Colour me sick of M$. I've got better things to do, like play golf.

    That's priceless. A study com ...Anonymous -- 21/05/05

    That's priceless. A study commissioned by M$. Now that really instills faith in the numbers.

    Since when has anybody who even knows the difference between OSS and the closed shop crap instability that M$ has been flogging on an unsuspecting public as a "solid OS" for over 20 years, taken anything that M$ says seriously? Show me the numbers. I'd love to see it. The real question should be, how much can be lost while waiting for M$ to find a fix, nevermind the time it takes to implement a patch.

    Colour me sick of M$. I've got better things to do, like play golf.

    Sloppy. Paul is right. Zen f ...Anonymous -- 21/05/05

    Sloppy. Paul is right. Zen for Linux (Red Carpet) handles updates faster than Windows Update with a very easy to use GUI that Windows users are accustomed to seeing. I've been using it for over a year and not having to reboot has been great. I'm surprised they weren't more careful with "study" meant for the public. I'd be embarr****ed to have my name on this one.

    Oh. Dear. God. Worst study, e ...Anonymous -- 21/05/05

    Oh. Dear. God. Worst study, ever.

    Seriously, I can't imagine a CIO reading this and thinking it justifies using Microsoft over open source.

    Here's the gist of their research. Open Source patches come out too often and too quick. Therefore, since your old methodology with MS was to carefully examine each patch with a threat ****essment, testing, preparation for failure resolution, and the preperation and handling of problems introduced by the help desk, you'll still do it the same way with linux. Yep, when that single update to your GAIM client comes in, you'll spend just as much time analyzing and deploying that as you would Service Pack 3 for Wind NT 4 when it came out. And it will eat just as much of your time.

    Junk science. The fact is, it's quite easy to set up a Yum repository, like we have where I work, and then set certain critical packages to NOT update automatically, and all others go through.

    Another problem with their study is that they aren't doing any kind of cost benefits analysis.

    Let's say it really does cost twice as much to patch my Oracle / Linux database server as it does to patch my Win2k/MSSQL Server. So? Compared to the cost of the licensing on each machine, a cost of 80 versus 40 dollars for a patch is, quite literally, lost in the noise. Plus, it's quite likely that a pair of linux boxes running an oracle cluster can easily handle a small to medium sized enterprise with no problem.

    Not so for a windows server.

    The same problem should be apparent for ALL the servers in an organization. At the last company I worked at, they're still replacing the PAIR of linux boxes we ran our intranet portal on with windows boxes. They're up to 34 machines and counting, have about 10% ported, and the windows machines are already bogging down.

    Huh, so it should take about 50 to 250 machines to replace that pair of linux boxes.

    Let's see, ****uming RHEL at $1500 a pop, and 30.00 a patch, and say, 100 patches a year, that would cost about $9,000 a year.

    For the windows machines, we're looking at $1,000 a machine, plus cals for about 3,000 employees, which runs $799 per 20 cals. That's $120,000 or so. Now, let's look at our huge savings at only having to install say, two service packs a year for only $20.00 a machine. That's 50 machines (I'm being nice here, they're gonna need more than that...) times $799 ($39950), plus $120,000 for cals, plus $20 per machine times 2 times a year ($2000)... or $161,950. Wow, can't beat that cost.

    No matter how much cheaper your windows sys-admin web monkeys are, it's gonna cost you more.

    And, to top it all off, you've got a longer period of vulnerability while waiting for the service packs to show up, so there's a greater chance you'll get hacked.

    I would appreciate it if, in the future, the "journalists" at zdnet did more than just read the press release and print a short synopsis and a link to the study. Honestly, if you're gonna write articles for a living on technology, you should at least have some ability to study the numbers and form your own opinion on what they mean, not just mindlessly vomit press releases on the unsuspecting reader.

    We use SUS for our Windows sys ...Anonymous -- 21/05/05

    We use SUS for our Windows systems and Yum with a local repository for our Linux ones. We bought HFnetchkPro because SUS only does Windows patches (not other MS stuff like Office) and we've found Windows Update can wierd out in strange and mysterious ways and patches end up not being applied . Yum on the other hand, just works. About the only problem there is that rsyncing from some of the mirrors can be slow at times.

    There is always some problem M ...Anonymous -- 21/05/05

    There is always some problem Microsoft's paid-for reports, as it seems likely that Microsoft, as puppet-master, can pull subtle strings which influence how an 'independent' report is produced.

    To understand why, consider the famous quip by New York's Boss Tweed, who, over a century ago claimed "I don't care who does the electing as long as I get to do the nominating."

    Here are but two examples.

    The author of Microsoft's paid-for IDC Linux vs Windows TCO comparison, Dan Kusnetzky told BusinessWeek that Microsoft selected scenarios that would inevitably be more costly using Linux.[1]

    Secondly, Microsoft hired Veritest to do a web-server performance comparison between IIS and Apache. Not surprisingly, this 'independent' test showed Microsoft in front. That is, until you read the report in full, to find that Veritest used a now-ancient version of Linux (Red Hat Advanced Server 2.1) which is pushing 5 years old. This version has seen none of the substantial performance improvements that have been bought to Linux since the 2.6 kernel was introduced. Not surprisingly, such information is not shown in the
    marketing literature.

    Finally, even with reports that Microsoft touts which are non-paid-for, like several Yankee reports by Laura DiDio, are also contestable. DiDio has been shown in the past[2] to source her reference material from mailing list groups run by Microsoft partners and housing essentially pro-Microsoft constitents.

    By analysing the patterns in DiDio's comments over many years, you will find that Ms. DiDio, far from being an unbiased observer on topics related to Linux and open source, is essentially anti-Linux. Not what you would want to rely on for an un-biased viewpoint.

    References:
    [1]
    http://www.businessweek.com/magazine/content/03_09/b3822610_tc102.htm

    [2]
    http://www.groklaw.net/article.php?story=20040324085956154&query=sunbelt

    "I`m sure that pointing a ...Anonymous -- 21/05/05

    "I`m sure that pointing and clicking on update is much more convenient than `sudo yum update`.. "

    Actually, no it's not. You only have to set up yum or up2date ONCE in crontab to repeat daily or whatever.

    If you click on windows update, firstly there is considerably more than one click required, most of which are pretty pointless and stupid if you do it every day. Secondly you have to click on windows update EVERY day, or at least for for EVERY update released.

    If you're looking after a number of machines, I know which one I'd prefer...

    Help! I've fallen and I can't ...Anonymous -- 23/05/05

    Help! I've fallen and I can't get up! I'm rolling on the floor, laughing uncontrollably.

    Get the real facts! http://get ...Anonymous -- 23/05/05

    Get the real facts!

    http://getthefacts.nu

    As always, the facts lie somew ...Anonymous -- 25/05/05

    As always, the facts lie somewhere in between the PR based press releases of Microsoft and the fanatical rantings of Linux zealots, looking to convince the world that Microsoft is in fact, the antichrist. I really don't understand how people can become so emotional about an operating system! AN OPERATING SYSTEM.

    Am glad someone has finally ha ...Anonymous -- 28/05/05

    Am glad someone has finally had the balls to say something I've wanted to say for a while now. I have always thought this study to be a load of tripe but without any real background into the RFI I couldn't. I think the whole study reeks of smelly Billy's involvement, or is it his right hand man, the great willy wanka running the company these days. Whatever, I think the whole study was bollocks. They either think we are all stupid or they are themselves. I guess it's money in their back posket & because of that ZDNet don't care what the hell they print.

    Dear Jason Green, Bill isn't t ...Anonymous -- 28/05/05

    Dear Jason Green,

    Bill isn't the antichrist & neither is Microsoft. They just work for George W as does John Howard & Tony Blair.

Add your opinion

Latest Videos

Sponsored content

Power Centre - Content from our premier sponsors

Blogs

Tags

Back to top

Featured