At security conferences and events, I have noticed that the distribution of operating systems seems to differ somewhat from what I read in the papers. As my last post showed, the Internet Identity Workshop skewed decidedly in the Mac direction.

I thought it would be fun to put together a quick poll asking the members of the securitymetrics.org mailing what operating systems they used. I sent out a note asking the membership to respond to two simple questions:

• What is the operating system and e-mail client you use at work?
• What is the operating system and e-mail client you use at home (or for personal activities)?

I've compiled some preliminary statistics for your reading pleasure. Thanks to the 27 people who responded out of a total membership of about 300. That's nearly a 10% response rate in less than a day — not bad at all!

Objectives and Methodology

I've compiled operating system and e-mail statistics from three related sources:

• Responses to my previous e-mail (27 replies) — what is your operating system and e-mail client at work and at home?
• Analysis of e-mail "X-Mailer" and related headers from the securitymetrics.org mailing list (20 June 2006 to present)
• Analysis of same from metricon@securitymetrics.org traffic (i.e., paper submissions) (31 March 2006 to present)

In total, I identified 170 people who have contributed to this mailing list or sent submissions to Metricon 1.0 and 2.0. Of those, 27 provided OS/email information to me directly; I relied on header analysis for the remaining 143.

In total, I was able to identify a "preferred" operating system (either the one specified as the 'home' OS in a direct e-mail to me, or the one identified in the header) for 93 people. I identified e-mail programs for 131 people.

Operating Systems

For home (n=28), the results are quite different:

Of the 27 respondents, 14 (55%) reported using a different OS at home compared to work. After taking into account X-Mailer headers, I've concluded that for members of this list ("security conscious people"), we can conclude that when they have a choice, our members slightly prefer Macs. Amazingly enough, this suggests that Windows is a minority operating system, at least on this list. Results (n=92):

E-Mail Clients

For home (n=28), the results are, once again, quite different — and quite diverse:

Of the 28 respondents, nearly 2/3 (17 or 63%) specified a different home e-mail client compared to the one they used at work. After analysis of X-Mailer headers is taken into account (n=131), I conclude that our members prefer webmail overall, and prefer free (and non-Microsoft) native clients.

Interesting, no? Statistically relevant — maybe not! Let the debates begin in earnest!

• # attendees at Internet Identity Workshop: 150
• # attendees from US Department of Defense: 1
• # conference sessions on identity: about 40
• # conference sessions explicitly devoted to identity theft and fraud: 1
• # personal computers observed at general session, 10:10 AM today: 46
• % of general session computers that were Macs: 55% (25/46)
• % of Macs that were MacBook Pros (that is, less than a year old): 90%
• # OpenID replying parties in November 2006: 550
• # OpenID RPs today: 2500
• # personal computers observed at Microsoft-sponsored working session on CardSpace: 14
• % of Macs at Microsoft session: 42% (6/14)

This is essentially a forward reference to a comment I made to another blog, but as it is related to the nature of reporting for vulnerabilities and quantitative progress against them, perhaps it is relevant here.

The topic is the "Microsoft Security Intelligence Report 2H06" and the comments follow the initial discussion.

http://blogs.csoonline.com/microsoft_security_intelligence_report_2h06