Microsoft, Once Infested with Security Flaws, Does an About-Face

Post by pjmlp » Thu, Nov 19, 2015, 7:39 AM UTC

tptacek wrote: post #36

RI_Swamp_Yankee wrote: post #13

Earlier quoted context omitted.

Apple has always been exceptional in this regard as well. It usually drives people up a wall when this is pointed out, as the fanboys like to trumpet it a bit too loudly, but it's true. In-the-wild exploits are rare, and the company moves quickly to squash them and to prevent the entire category of exploit from biting them a second time.

There are a lot of great people at Apple and the security model of iOS is an achievement --- in a lot of practical ways better than that of Android. But I do not know a lot of people who would argue the Apple has a better security program than Google does. Google's team is better funded and better staffed, and has a much broader charter than Apple's.

Post by toyg » Thu, Nov 19, 2015, 10:01 AM UTC

TeMPOraL wrote: post #83

Rafert wrote: post #63

Earlier quoted context omitted.

Which was caused in part by badly behaving programs (writing user data to the Program Files directory) that triggered the UAC prompt, if I'm not mistaken.

They improved the system in the next release, and since Win7 UAC generally works perfectly even with the "badly behaving" software. Sensitive directories are now mirrored elsewhere in the filesystem, so that when your program wants to read from, say, Program Files directly, what it really reads is C:/Users/[username]/AppData/Local/VirtualStore/...

Post by tptacek » Thu, Nov 19, 2015, 2:26 PM UTC

lern_too_spel wrote: post #138

tptacek wrote: post #126

Earlier quoted context omitted.

Android's system security design is inferior to that of iOS. But, iOS's superiority (a) derives in significant part from Apple's total control over the hardware platform†, and (b) comes at the cost of a lot of user control tradeoffs that nerds like us tend to hate. Really, to suggest that Android's security is at parity with Apple's, you'd have to be arguing that Apple does a terrible job at exploiting their inherent…

On the other hand, I'm unaware of any automated analysis of applications on the iTunes App Store, dynamic or static. Doing this properly isn't in Apple's DNA. For example, when XcodeGhost apps infected some hundreds of millions of users, it took Apple days to take down the affected apps, seemingly waiting for third party reports instead of simply scanning the entire store for the XcodeGhost signature themselves.

Post by chadzawistowski » Thu, Nov 19, 2015, 6:11 PM UTC

loginusername wrote: post #143

chadzawistowski wrote: post #47

Earlier quoted context omitted.

If you like small code, simplicity, and a code-audit culture, look no further than OpenBSD.

A well-deserved endorsement from a Microsoft employee. (Assuming your HN profile is up-to-date.) The kernel I start with is indeed derived from the same one that project started with.

Post by loginusername » Fri, Nov 20, 2015, 3:49 AM UTC

wvenable wrote: post #148

loginusername wrote: post #141

Earlier quoted context omitted.

Perhaps you could explain how the statement "All software is large" "furthers the conversation"? How am I supposed to respond to that? You think that false statement is a respectable "response" to a comment on the benefits of small software? Small software exists both in the past (when memory and storage were more limited) and in the present. The very idea of small programs is a foundational one in the field of compu…

The point is small software just does less; when you need to do more you either build large software or you put together a bunch of small software which is effectively, from a security standpoint, the same thing. Small programs that don't do anything are secure but nobody cares. And you've probably written software larger than Notepad; a very popular small Microsoft program.