vino makes a good point about 8 and at first I decided against posting in this thread. But I guess I will take a shot at this....

First, The Microsoft world and the Unix world have a different view of what an OS is. When Dan Bernstein announced that he was failing his entire security class because they only found 44 Unix security flaws, quite a few Unix folks called "foul". For example, one bug was in Mplayer, an ASF video player. Unix folks tend to not consider a tool like that to be an OS component. But Microsoft folks do. In both OS's the majority of the security flaws are in applications far above the kernel. Both OS's have rather secure kernels. Microsoft possibly brought this on themselves. For example, they have fought in court to have IE (Internet Explorer) as an OS component. But we do not a level playing field here... an IE bug is considered an XP problem while a Firefox or Opera bug is not charged to Unix.

That aside, there is a fundamental Windows security problem. Most Windows users run all the time with administrator privileges. If you try to run as a non-administrator, many application programs will croak. Microsoft has done little to fight this. In contrast, Unix users are strongly encouraged to operate as root only when needed. Very few Unix or Linux users ever surf the web as root. This really helps security a lot. Meanwhile most IE users happily surf the web in admin mode.

I doubt that anyone from Microsoft is reading this. But the number one suggestion I would make to them is to get users out of Admin mode. Applications that only run in admin mode should be considered unsafe and publicly labelled as such. In fact, IE should refuse to connect to the Internet in Admin mode. Media Player should refuse to run at all in Admin mode. And so on. Some security problems will still exist, but the severity of these problems would be greatly reduced.