Hacker News Reader

Comment by rossdavidh | Hacker News Reader

While it is no doubt true that there are likely some vulnerabilities in AMD's chips that don't exist in Intel's, it is also true that because Intel has a larger market share, that's where most of the work is going to be done to find vulnerabilities, by the bad guys as well as security researchers. Much like how Microsoft Windows used to have a lot more security problems than any other OS, because they had >90% market share, so no one bothered to develop malware for anything else.

Monocultures invite epidemics.

View on HN

In this particular area though, it works both ways. Intel has so many researchers and resources, they are able to pursue tons of speculative execution / CPU doing something you wouldn't imagine it normally does experiments, and many of these find their way into their CPUs. A company with less resources might have less vulnerabilities of this nature simply because they don't have the resources to focus on that stuff in the first place. Just a theory.

I'm not exactly sure the monoculture argument is valid for Windows vs. Linux though; Linux still dominated server usage while Windows was attacked more often, despite the fact that you could potentially reap a much greater reward infecting a server. Unix-based OSs were just inherently more secure for the most part.

While it's certainly true that Linux does much better on servers than laptop/desktops, I don't think it ever got to the >90% market share that Windows had on laptop/desktop (although admittedly that depends on whose estimates you look at). But servers certainly do differ in regards monoculture in important ways, relative to laptop/desktop.

It's also possibly significant that Linux on servers is split between Redhat and Ubuntu and others, who have some non-trivial differences in regards to security updates, etc.

None of which means that Unix-based OS's don't have inherent advantages in regards to security, just that not having a monoculture target on their forehead also helps.

Reply on news.ycombinator.com