Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft, Once Infested with Security Flaws, Does an About-Face

nytimes.com

Post reply on HN
Print view View original

51–60 of 185 posts

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#51

Post by joshyeager »

hackuser wrote: post #49
tptacek wrote: post #7

This is a weird story, since professional security people would have told you the same thing back in 2007. Windows wasn't originally designed to be secure. Even NT, which is a serious multi-user kernel, was a product of 1990s C programming style. And while that's true of the Unices of the time as well, none of them had Microsoft's absurd user base, and so none of them had the same terrible malware incentives. This al…

> professional security people would have told you the same thing back in 2007 Did they really turn it around that fast, in one iteration of Windows (XP was released 2001, Vista in 2007)? I would think that fixing bugs would be necessary but not nearly sufficient, and they would have had to re-architect and re-develop major parts of the system. And Microsoft needed to do that while maintaing the backward compatibilit…

Vista was a major security redesign, not just bug fixes. UAC was one of the biggest security improvements in the OS, because it meant that users were no longer running as admin by default.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#52

Post by toyg »

joshyeager wrote: post #51
hackuser wrote: post #49

Earlier quoted context omitted.

> professional security people would have told you the same thing back in 2007 Did they really turn it around that fast, in one iteration of Windows (XP was released 2001, Vista in 2007)? I would think that fixing bugs would be necessary but not nearly sufficient, and they would have had to re-architect and re-develop major parts of the system. And Microsoft needed to do that while maintaing the backward compatibilit…

Vista was a major security redesign, not just bug fixes. UAC was one of the biggest security improvements in the OS, because it meant that users were no longer running as admin by default.

And judging by the pageviews on my blogpost on how to disable it, users didn't really like it very much...

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#53

Post by rstupek »

joshyeager wrote: post #51
hackuser wrote: post #49

Earlier quoted context omitted.

> professional security people would have told you the same thing back in 2007 Did they really turn it around that fast, in one iteration of Windows (XP was released 2001, Vista in 2007)? I would think that fixing bugs would be necessary but not nearly sufficient, and they would have had to re-architect and re-develop major parts of the system. And Microsoft needed to do that while maintaing the backward compatibilit…

Vista was a major security redesign, not just bug fixes. UAC was one of the biggest security improvements in the OS, because it meant that users were no longer running as admin by default.

I'm sure they didn't like it because security is, while necessary, a pita

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#54

Post by wvenable »

loginusername wrote: post #39
wvenable wrote: post #29

Earlier quoted context omitted.

I remember my first experience with Linux back in the early 90's -- once connected to the Internet that Redhat box was rooted almost immediately. From my perspective, Windows doesn't seem to be less secure but it has a greater share of users who do stupid things.

Maybe Redhat's configuration was at fault? I have seen popular Linux distributions where interfaces are enabled and have programs listening by default. I, the user, never asked for that. This is one reason I do not use Linux distributions. Too many assumptions about what the user wants.

You have to remember this was the 90's and it was a different time back then. I think there's a tendency to compare Windows in the 90s with how Linux is now. This was the same era as Mac OS 9 where a single application could still crash the entire system.

Exploiting common faults in Linux system software was pretty easy back then too.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#55

Post by hackuser »

joshyeager wrote: post #51
hackuser wrote: post #49

Earlier quoted context omitted.

> professional security people would have told you the same thing back in 2007 Did they really turn it around that fast, in one iteration of Windows (XP was released 2001, Vista in 2007)? I would think that fixing bugs would be necessary but not nearly sufficient, and they would have had to re-architect and re-develop major parts of the system. And Microsoft needed to do that while maintaing the backward compatibilit…

Vista was a major security redesign, not just bug fixes. UAC was one of the biggest security improvements in the OS, because it meant that users were no longer running as admin by default.

> UAC was one of the biggest security improvements

I assumed it was just an interface stapled onto the old system, and something underneath that allowed changing permissions without logging off.

It might have had a big effect, but it doesn't sound like a significant change in the system. But maybe my assumptions are wrong ...

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#56

Post by blinkingled »

tptacek wrote: post #36
RI_Swamp_Yankee wrote: post #13

Earlier quoted context omitted.

Apple has always been exceptional in this regard as well. It usually drives people up a wall when this is pointed out, as the fanboys like to trumpet it a bit too loudly, but it's true. In-the-wild exploits are rare, and the company moves quickly to squash them and to prevent the entire category of exploit from biting them a second time.

There are a lot of great people at Apple and the security model of iOS is an achievement --- in a lot of practical ways better than that of Android. But I do not know a lot of people who would argue the Apple has a better security program than Google does. Google's team is better funded and better staffed, and has a much broader charter than Apple's.

> in a lot of practical ways better than that of Android.

Umm no - the update situation is better on iOS but fundamentally iOS has bigger problems - https://twit.tv/shows/security-now/episodes/532?autostart=fa... . That problem is unfixable easily due to the way ObjC works. Android gets code access control for free with Java. There have always been Jailbreaks for most iOS versions and it's not like they haven't had other security issues. The ability to fix them quickly is certainly an advantage but there is nothing in iOS that is fundamentally more secure than anything else on the market.

Frankly I think Apple's security is a combination of happenstance and restrictive policies - I don't think they care (yet) about the processes, infrastructure and people required to do what Google and Microsoft do. (No offense to the good security people at Apple - this isn't about them, this is about having organization wide security focus like MS needed to turn around Windows.)

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#57

Post by ChuckMcM »

tptacek wrote: post #7

This is a weird story, since professional security people would have told you the same thing back in 2007. Windows wasn't originally designed to be secure. Even NT, which is a serious multi-user kernel, was a product of 1990s C programming style. And while that's true of the Unices of the time as well, none of them had Microsoft's absurd user base, and so none of them had the same terrible malware incentives. This al…

Not that weird. Illustrative perhaps. So you and I would have agreed in 2007 that Windows was much better at security than they had been, but we are both pretty tightly connected to the technology market.

Today, 8 years later, my Mom and Dad think Windows is a "secure" system as they haven't had any issues for long enough that their opinion of it has changed.

The final leg of this journey will be when Windows + Windows Defender is all you need to keep your system secure. Basically once there isn't a market for add-on security products because the base product is "good enough."

I'm curious why you mention Google though, their security record on Android is a lot worse than either Windows phone or IOS. In many ways I feel like they are exactly Windows in 2003 with regard to "its secure if you use our APIs" kind of security. Would love to hear your thoughts on that.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#58

Post by loginusername »

kabdib wrote: post #42
loginusername wrote: post #25

Would anyone agree that complexity provides a foundation for insecurity while simplicity makes audits easier? Large software with many parts have more potential for flaws. Small software with few parts have less potential for flaws because they are easier to find and fix. Implausible? Well, I happen to believe this. If Microsoft ever released the Windows source code, what would we find? Simplicity? How easy would it…

> If Microsoft ever released the Windows source code, what would we find? Simplicity? Depends on where you look. Much of the NT kernel is "simple", but it's not easy stuff to get right. There's a bunch of legacy code in the Win32 layers, especially dealing with user input, that is just frightening (comments like "This stupid hack makes the utterly broken Compaq XYZ-3000 keyboard not crash the system"). The COM stuff…

If the code were ever released in a form that I could compile myself, and I could omit the parts I did no want... then I might be interested in Windows.

Given that MS is a very successful company that got to where it is today based on closed source and copyright, I am not expecting that to happen, ever.

I appreciate your candor.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#59

Post by grub5000 »

renownedmedia wrote: post #50

> company’s co-founder, Bill Gates, once ordered all of Microsoft engineers to stop writing new code for a month Source?

Man this is a well known and often commented fact, but god damn am I having trouble searching for sources and references on this one. Can anyone help out?

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#60

Post by tootie »

tptacek wrote: post #7

This is a weird story, since professional security people would have told you the same thing back in 2007. Windows wasn't originally designed to be secure. Even NT, which is a serious multi-user kernel, was a product of 1990s C programming style. And while that's true of the Unices of the time as well, none of them had Microsoft's absurd user base, and so none of them had the same terrible malware incentives. This al…

I don't know. My father-in-laws Windows PC is routinely bogged down with malware/adware. It's not the same kind of security holes that used to be rampant, but it's still too easy for malicious software to cause trouble.
Post reply on HN