IT security question

[achocoolcho]

Hi people, my first post here. Please bear with me. I just wanna know your opinion about this situation
if someone says to you that the security of an operating system is built on the hardware mechanism that separates user mode from kernel mode which means that an attack that succeeds against one operating system must have broken the hardware mechanism, and therefore the same attack will work against any other operating system on the same type of machine. Thus there can't be any reason to believe that one operating system is more secure than any other.

How would you counteract his invalid argument?

[sknake]

Walk away. He's an idiot. Why waste your time?

[achocoolcho]

an argument why he is wrong will be greatly appreciated. :)

[sknake]

You can install openbsd on x86 architectures and sparc. You can use VM to virtualize all hardware away from physical hardware and run any operating system. You can use bootcamp and install windows on macs. But at the end of the day -- a windows service vulnerability affects all versions of windows running the "bugged" version of the service.

Same is true for linux servers running a bad version of BIND, apache, etc. Hardware doesn't have much to do with it -- in most cases. Sometimes software is only exploitable if it is running on a SMP (multi processor) machine due to timing or "race" conditions. But even then -- it is the fact the machine has two CPUs, the model doesn't matter. Furthermore if you have two CPUs and don't enable SMP support in your kernel it won't run as an SMP installation thus the software won't be vulnerable even though you have two processors, because you haven't enabled both of them.

Its a stupid argument.