Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft, Once Infested with Security Flaws, Does an About-Face

nytimes.com

Post reply on HN
Print view View original

171–180 of 185 posts

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#171

Post by loginusername »

wvenable wrote: post #169
loginusername wrote: post #162

Earlier quoted context omitted.

Are you saying you are unaware of any program that can post text to a web server that is "small"? If all you are aware of is large software, then your statement that "All software is large" makes more sense. "All software is not as large as Microsoft's software." Would you agree with that?

Why didn't you just answer the question? Which small software are did you use to post your comment? Why be so vague?

What difference does it make what small software program I am using?

You do not believe such a program exists?

Or maybe you want to critique the program? That would be typical commenter behavior, but it is totally irrelevant to the discussion.

The topic is Microsoft software and the relationship between code size and probability of security flaws.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#172

Post by loginusername »

wvenable wrote: post #170
loginusername wrote: post #167

Earlier quoted context omitted.

And why are you interested? A comment in response to a NYT "article" (=PR piece) on Microsoft's approach to "security" where the comment points out that Windows is an extremely large program with layers upon layers of historical cruft and that it remains closed source. Additionally I suggested Windows is the easiest target for finding security flaws. It is a very large attack surface. Is this really controversial? Fo…

Windows is actually very modular; even the kernel is designed in a micro-kernel style even though it all runs in ring 0. There are versions of Windows with no GUI. Every other comparable operating system is in the same order of magnitude in the size of the code. The attack surface for any large OS is going to be about the same.

"There are versions of Windows with no GUI."

Do they run in VGA textmode?

I have used a program called "window" and today I use tmux but neither of those come from Microsoft.

How do I obtain one of these versions of Microsoft Windows that runs in VGA textmode?

"The attack surface for any large OS..."

Well yes, because they are all large. But what if the OS is small?

Let me guess, now you are going to tell me that all OS, e.g., kernel plus userland, are the same size?

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#173

Post by ksk »

loginusername wrote: post #168
ksk wrote: post #165

Earlier quoted context omitted.

>Again, you mention Linux. I do not use it. How is it relevant to my comment? Um, because you compare like to like. If you are comparing millions of lines of code to 10,000 lines of code, then obviously its easier to audit. Your point about auditing code makes no sense unless you compare the task of auditing equal amounts of source code. >Windows is a massive, complex truckload of legacy source code that keeps growin…

"How do you know this?" As a user, I don't. It's closed source. That's the point. What users have is only circumstantial evidence. And then there is the marketing and PR, such as the NYT article. One of original two comments was "What would we find?" There is nothing to suggest I have read the source code. Unless and until Windows becomes an open source project, such as the ones that are routinely discussed in this f…

As long as you're claiming that your POV is an opinion, or informed speculation at best, I have absolutely no issues with what you're saying, and do not wish to engage in further argument. We probably agree on most things.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#174

Post by wvenable »

loginusername wrote: post #171
wvenable wrote: post #169

Earlier quoted context omitted.

Why didn't you just answer the question? Which small software are did you use to post your comment? Why be so vague?

What difference does it make what small software program I am using? You do not believe such a program exists? Or maybe you want to critique the program? That would be typical commenter behavior, but it is totally irrelevant to the discussion. The topic is Microsoft software and the relationship between code size and probability of security flaws.

> What difference does it make what small software program I am using?

You brought it up and now you don't want to say, I find that odd. It's hard to have a conversation if you're going to be so.. cryptic.

> Or maybe you want to critique the program?

Maybe I want a significant example of a "small program". At this point, neither terms have been well defined. You called the program used to make your comment "small" so tell me what it is.

> The topic is Microsoft software and the relationship between code size and probability of security flaws.

The greater the code size the greater the probability of bugs. And security flaws can be exploited utilizing the combined flaws across different independent programs or included libraries.

My point is the only programs so small that security issues are a non-issue are either not interesting or combined with other programs to do something useful.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#175

Post by wvenable »

loginusername wrote: post #172
wvenable wrote: post #170

Earlier quoted context omitted.

Windows is actually very modular; even the kernel is designed in a micro-kernel style even though it all runs in ring 0. There are versions of Windows with no GUI. Every other comparable operating system is in the same order of magnitude in the size of the code. The attack surface for any large OS is going to be about the same.

"There are versions of Windows with no GUI." Do they run in VGA textmode? I have used a program called "window" and today I use tmux but neither of those come from Microsoft. How do I obtain one of these versions of Microsoft Windows that runs in VGA textmode? "The attack surface for any large OS..." Well yes, because they are all large. But what if the OS is small? Let me guess, now you are going to tell me that all…

Of course, not all OS kernel plus userland are the same size. However, we aren't talking about "smaller" we are talking about "small". Small being something you can write and/or fully understand. If you wrote your kernel and userland or at least understand every part of it then, congratulations, you made your point. But if you don't, your OS/userland is smaller but it isn't small.

And probably most developers could write an OS/userland by themselves given enough time but it would probably be a long time before it's practically useful or secure.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#176

Post by dang »

loginusername wrote: post #35

"All software is large." FALSE. But this statement does not surprise me. It is this distorted view of programs that is a large part of the "security" problem, in my opinion.

Since this subthread turned into an off-topic flamewar, we detached it from https://news.ycombinator.com/item?id=10588972.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#177

Post by [deleted] »

dang wrote: post #176
loginusername wrote: post #35

"All software is large." FALSE. But this statement does not surprise me. It is this distorted view of programs that is a large part of the "security" problem, in my opinion.

Since this subthread turned into an off-topic flamewar, we detached it from https://news.ycombinator.com/item?id=10588972 .

[deleted]

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#178

Post by loginusername »

wvenable wrote: post #175
loginusername wrote: post #172

Earlier quoted context omitted.

"There are versions of Windows with no GUI." Do they run in VGA textmode? I have used a program called "window" and today I use tmux but neither of those come from Microsoft. How do I obtain one of these versions of Microsoft Windows that runs in VGA textmode? "The attack surface for any large OS..." Well yes, because they are all large. But what if the OS is small? Let me guess, now you are going to tell me that all…

Of course, not all OS kernel plus userland are the same size. However, we aren't talking about "smaller" we are talking about "small". Small being something you can write and/or fully understand. If you wrote your kernel and userland or at least understand every part of it then, congratulations, you made your point. But if you don't, your OS/userland is smaller but it isn't small. And probably most developers could w…

Alright, I think we have reached agreement.

Software that is "smaller" than Microsoft Windows.

It exists.

I prefer such "smaller" software and use it every day.

For me, it is "practically useful". I regularly see others stating it is useful for them, too.

Have no idea what "secure" means in the abstract, but maybe smaller software and the way it is used can be "more secure" (or less secure) than Windows.

"Fully understand" is a very high watermark to reach with any system. But given the choice between a larger system that is opaque and one that is smaller and open source I believe I can (partially) understand the smaller one better.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#179

Post by loginusername »

wvenable wrote: post #174
loginusername wrote: post #171

Earlier quoted context omitted.

What difference does it make what small software program I am using? You do not believe such a program exists? Or maybe you want to critique the program? That would be typical commenter behavior, but it is totally irrelevant to the discussion. The topic is Microsoft software and the relationship between code size and probability of security flaws.

> What difference does it make what small software program I am using? You brought it up and now you don't want to say, I find that odd. It's hard to have a conversation if you're going to be so.. cryptic. > Or maybe you want to critique the program? Maybe I want a significant example of a "small program". At this point, neither terms have been well defined. You called the program used to make your comment "small" so…

"The greater the code size the greater the probability of bugs."

Right. I think we are done here.

Microsoft Windows is larger than any OS I know of, and only keeps growing.

To answer your question, I am using a text only browser that's based on the links project, with my own minor modifications.

I still have no idea why you and the other commenter are asking. It seems quite clear neither of you have any legitimate interest in such programs. Otherwise you would not be challenging my statement of such a simple fact as the quoted sentence above, as it applies to Microsoft.

I strongly disagree that "small" programs are not useful. As I have previously stated, I use them every day. I use programs such as sed and netcat to interact with the www even more than I use a browser.

Re: Microsoft, Once Infested with Security Flaws, Does an About-Face

#180

Post by wvenable »

loginusername wrote: post #178
wvenable wrote: post #175

Earlier quoted context omitted.

Of course, not all OS kernel plus userland are the same size. However, we aren't talking about "smaller" we are talking about "small". Small being something you can write and/or fully understand. If you wrote your kernel and userland or at least understand every part of it then, congratulations, you made your point. But if you don't, your OS/userland is smaller but it isn't small. And probably most developers could w…

Alright, I think we have reached agreement. Software that is "smaller" than Microsoft Windows. It exists. I prefer such "smaller" software and use it every day. For me, it is "practically useful". I regularly see others stating it is useful for them, too. Have no idea what "secure" means in the abstract, but maybe smaller software and the way it is used can be "more secure" (or less secure) than Windows. "Fully under…

My point is all software is large; even Linux combined with it's user-land is large. Larger than Windows was a while back. What you prefer is pretty immaterial to the discussion; you choice is perfectly valid even though I would personally find it wasteful.
Post reply on HN