Let's not forget Windows' awful default policy of giving user administrative rights. It basically drops down non-reactive defense from malware to zero.
And even restricted user account is able to create folders and files in the root directory under Vista. So this restriction is still quite relative and flawed (though of course Vista is a big step in that direction related to XP).
*NIX from the other side encourages or even enforces by default usage of truly restricted accounts with write permission to user's home directory only.
This way chance that some malware is able to both run arbitrary code through some app buffer overflow and elevate it's privileges to root this way overcoming *NIX permission system is pretty low.
Throw SELinux in the equation and that chance gets close to negligible.
And this defense is not reactive, so you don't care if malware is known or just barely in the wild.
And even restricted user account is able to create folders and files in the root directory under Vista. So this restriction is still quite relative and flawed (though of course Vista is a big step in that direction related to XP).
*NIX from the other side encourages or even enforces by default usage of truly restricted accounts with write permission to user's home directory only.
This way chance that some malware is able to both run arbitrary code through some app buffer overflow and elevate it's privileges to root this way overcoming *NIX permission system is pretty low.
Throw SELinux in the equation and that chance gets close to negligible.
And this defense is not reactive, so you don't care if malware is known or just barely in the wild.
