TeamSpy snooped on governments, big biz undetected for 10 years

The problem is the way that it's administered. I maintain that if you take an incompetent admin then it doesn't matter if the machines are running windows or nix. With users running as admins/root and the boxes not getting patched, both are vulnerable to being compromised.

Why do you think trusted computing was invented? people may whine about it, but code signing can stop such software getting modified and executed.

Don't say open source is invulnerable either, there's been a few near misses with that.

Yes, it is a ball ache and stops people writing their own software and running it so easily, but this is an issue of trust. Once dickheads ruin things there's no going back. We used to be able to go online without firewalls once for instance.

EPIC WINDOWS SECURITY FAIL

Yes, I agree. In the same way that this:

http://www.theregister.co.uk/2013/03/19/carna_botnet_ipv4_internet_map/

( Researcher sets up illegal 420,000 node botnet for IPv4 internet map) is an EPIC LINUX SECURITY FAIL. And any mention of CISCO at http://www.theregister.co.uk/security/ is an epic cisco security fail. (Anything with an installed base that big is epic).

Re: or the way in which it is administered?

While I concur that too much of what you've described goes on, some of it still comes back to the software vendors and they way they release their software. Microsoft and Adobe are the big offenders here, with a healthy assist from Autodesk.

Way back when MS released Win2000 we made a serious attempt to secure our network. Systems were only going to be deployed with User rights (not even Power User). And then we ran into the newest release of VB, which required administrative access to run. Not install, run. And since one of the divisions had about half its people using that ....

Currently if you are using the Adobe Creative Suite you have to both have administrative privileges AND do a Run As Administrator for the software to run.

And 2 years ago when I was trying to install the then current version of Autocad on Win7 64-bit system on our network I couldn't get it to work. Died every time at around 98% install, then rolled back everything it had done. Which made it a real PITA to try to troubleshoot. And the Autodesk people were never forthcoming with solutions. Eventually I found a forum posting elsewhere that said "move it off the network and install it on the standalone system." That worked, which meant it was running afoul of GPOs that were put in place to secure the network. At the time I had no clue at what the problem is, but the other day someone was having a problem installing a licensed copy of Google Earth (not the free one). The same solution worked and for Google Earth it was clearly a DRM problem (installer wants to write to the registry which is blocked), so I'm thinking its the same thing on the Autocad.

Seriously though, is the security flaw here to do with Windows, or the way in which it is administered?

Both.

The DLL-dropping vector works in large part because Windows has a broken code-loading model. Using the same list of directories (PATH) for command resolution and dependency resolution was a mistake (one that Windows' direct predecessors in this area, OS/2 and SVR4 UNIX, did not make); searching the current directory before the path was a worse one. Microsoft has only recently partially remedied some of these problems with KnownDLLs, SafeLibrarySearchMode, and other tweaks.

However, DLL-dropping attacks could be made much more difficult by applying better system administration procedures. Restricting administration access is an obvious one; using filesystem privileges in a sensible fashion is another. Intrusion- and malware-detection systems might have helped.

But this is the point security experts have been making for years. Security is not an absolute; there are only degrees of security, represented by work factors associated with various modes of attack. If you want to improve your security, you have to understand what sort of attackers you're likely to face, what modes they're likely to employ, what vulnerabilities in your systems decrease their work factor, and what countermeasures you can use to increase it.

So the only answer to a general question like "is the OS or the administrator to blame?" is "yes".

Lately I've been getting:

The servers don't need patching, they are running Linux!

They continue to say that even after I report that postfix on the DB servers is spewing spam all over the place (we are a sendmail shop, so there is no reason for postfix to even be installed, let alone sending out mail to world+dog)

You seem to think that western governments are your enemy, I disagree, but that's ok. I will say though, that you're enemy's enemy isn't necessarily your friend.