Battle hardening and Mac OS X

Take two vehicles.

One has seen time in combat. The enemy tried to destroy it, and worked feverishly to figure out its weaknesses. Just as feverishly, the owners of the vehicle have tried to defend against those attacks, both by attempting to predict where flaws will be found, and working to close them once discovered.

The other has seen time on the local police force. It is a strong vehicle, and is widely deemed to be well-defended, but it hasn't faced the same kind of abuse as the other vehicle. Attacks haven't been as intense, and thus, the need to defend against them have not been as dramatic.

In a recent Mac OS X hacking "contest", a system was purportedly infiltrated in under 30 minutes. Many noted that the contest in question granted everyone a local account, making the job of access easier given that they already had the right to be there (albeit not with administrative rights, which was managed through flaws enabling privilege escalation). In fact, another contest conducted by the University of Wisconsin presented a more typical test, one where attackers had to access a system to which they didn't have logon rights.

Even so, the thought experiment outlined at the start of this post occurred to me while reading about the hacking contests, both the initial one and the more Mac-friendly follow-up. The question is whether or not a machine that regularly must endure frequent attacks is more secure than a machine that receives less scrutiny due to its much lower market share. All in all, these tests are interesting, but they hardly simulate the level of scrutiny that Microsoft products must endure on a daily basis.

Which is actually more secure, the vehicle that has endured bullets, bombs and blast-holes, or the one that has endured the "urban battlefield?"