Live data from Hacker News

Google ditches Windows on security concerns

ft.com

141–150 of 158 posts

Re: Google ditches Windows on security concerns

#141
post #140

Earlier quoted context omitted.

I would like to hear the specific ways in which you think that Apache was designed for security in ways that IIS wasn't, and how those things persist into modern IIS.

Not a serious reply: Well, for one, IIS was designed to run on Windows servers rather than *nix.

Rejoinder in equivalent tone: you mean, the servers that ran rexd, the "run any command for me without credentials" RPC service? Or the servers that had remote calendar managers that would run commands for anyone who knew what the semicolon character meant to the shell? Or the ones that got confused if you sent FTP commands in the wrong order and too fast and would accidentally upgrade you to root instead of logging you off?

Re: Google ditches Windows on security concerns

#142
post #85

Earlier quoted context omitted.

I, for one, am pretty bored by the market share defense. There are millions of macs out there, owned by people who could drop a little coin on their hardware, and that make them less of a target? There's not one virus writer out there who doesn't want the cred and the potential gain of a new audience of victims, many of whom are probably pretty complacent about security because they've never had to worry about it? Th…

While you might liken the rarity and the glamour of owning a Mac to that of owning a mansion, a thief has much more to gain by targeting a large house that's more likely to be filled with expensive electronics and jewels. On the other hand, I doubt that Macs are significantly more likely to contain data that a hacker would be looking for.

It depends what you're up to, I suppose. If you were seeking to install keyloggers to record financial authentication details, why not target people whose choice of computer hardware indicates they have more money than average?

Re: Google ditches Windows on security concerns

#143
post #85

Earlier quoted context omitted.

While you might liken the rarity and the glamour of owning a Mac to that of owning a mansion, a thief has much more to gain by targeting a large house that's more likely to be filled with expensive electronics and jewels. On the other hand, I doubt that Macs are significantly more likely to contain data that a hacker would be looking for.

It depends what you're up to, I suppose. If you were seeking to install keyloggers to record financial authentication details, why not target people whose choice of computer hardware indicates they have more money than average?

Because Windows vs. Mac is an exceedingly weak financial signal, and because no matter what the signal is, having 20-30 accounts is better than having just 1 account?

Re: Google ditches Windows on security concerns

#144

"Many people have been moved away from [Windows] PCs, mostly towards Mac OS, following the China hacking attacks" Wait, so they're phasing out Windows for security reasons, and moving to Mac instead? It at least made sense when they were moving to Linux or ChromeOS, but OS X's security track record as of late is far worse than Windows.

This was done by two company vips in direct opposition to the very vocal recommendation of the security team.

Re: Google ditches Windows on security concerns

#145
post #36
post #19

Earlier quoted context omitted.

I would agree. Windows has the largest population of non-computer literate people worldwide so hackers get the bigest bang for their buck and windows gets a bad rap. If everyone jumps to another OS so will the security problems.

Bad logic. Popularity is unrelated to quality of code. While it is true that popularity = bigger target = more incentive to attack the platform's security, it is also often used as an excuse to try to hand-wave away bad, insecure code. Another platform becoming more popular would indeed mean that it would have more people targeting it. But it does not , in any way, mean that the people would have the same level of su…

No. In fact, the incentive for attackers is exactly the inverse of what you claim it is. The author of WinAPI malware can expect multiple tens of conversions for every one obtained by Mac malware. That's because, breathless accounts in the media aside, malware infections don't compete in any practical sense. You would need to deliberately eschew all financial incentives to target OSX. The logic here is exactly the same and exactly as simple as Joel Spolsky's article about investing in OSX dev from 2002.

As for the rest of your comment: both Windows and OS X are conventional monolithic operating systems written in C with core facilities designed and built in the '90s. Both are multiuser operating systems repurposed for single-user deployments. Both have strong kernel/userland barriers with well-defined interfaces. In fact, if you've done systems programming on both, they simply aren't all that different, even to a software developer.

But: for the past 10 years, Microsoft has been getting hammered by attackers, and has the benefit of a decade-long trial by fire. So when Microsoft randomizes library offsets, they don't (for instance) miss the entire runtime loading subsystem.

Also: most of Microsoft's most sensitive application code is written in C for WinAPI on x86, which is one of the best-understood application runtimes in the world. Much of OS X runs on cross-platform Objective C, which has received nowhere nearly as much research. Put simply: nobody knows how to write exploit countermeasures for OS X. I think mostly because nobody cares.

(Again: I say this as a Unix dev from '93 at a company standardized on Macs).

Re: Google ditches Windows on security concerns

#147
There are a lot of great comments in here.

I also see another possible angle on this.

What is the actual windows system usage at google currently? It might already be low enough to represent a serious time-sink for IT/security because it's already a serious minority?

It makes a lot of sense to maintain somewhat complex policies and management for a vast network of Windows based systems and servers. It is entirely different when you're looking at trying to keep a handful of systems in-line when they are not your primary focus.

Obviously this is purely speculative but trying to look at it from another perspective.

Re: Google ditches Windows on security concerns

#148

Earlier quoted context omitted.

It depends what you're up to, I suppose. If you were seeking to install keyloggers to record financial authentication details, why not target people whose choice of computer hardware indicates they have more money than average?

Because Windows vs. Mac is an exceedingly weak financial signal, and because no matter what the signal is, having 20-30 accounts is better than having just 1 account?

Sure, but there are several other factors to take into consideration.

1> Very few Macs are running anti virus/spyware software, as the users generally believe their systems to be immune to malware

2> The malware authors are probably already targeting Windows, why not do Macs as well? The sites I work with are up to 25% Mac usage now. That is significant.

3> As Mac browsers have not been attacked as often and scrutinized as carefully by attackers, it appears Apple and other browser vendors have not taken as much care to harden the Mac browsers and OS.

4> Is having a Mac a weak financial signal? I wonder what data is there is out there about the affluence of the Mac-owning audience. Apple isn't targeting the low end of the market, that's for sure.

So, in summary: it might be relatively easy, plus, why not.

Re: Google ditches Windows on security concerns

#149

Earlier quoted context omitted.

Because Windows vs. Mac is an exceedingly weak financial signal, and because no matter what the signal is, having 20-30 accounts is better than having just 1 account?

Sure, but there are several other factors to take into consideration. 1> Very few Macs are running anti virus/spyware software, as the users generally believe their systems to be immune to malware 2> The malware authors are probably already targeting Windows, why not do Macs as well? The sites I work with are up to 25% Mac usage now. That is significant. 3> As Mac browsers have not been attacked as often and scrutini…

You ask: So, in summary: it might be relatively easy, plus, why not.

I answer: Because for the same amount of effort you can make an order of magnitude more money.

Re: Google ditches Windows on security concerns

#150
post #114

Earlier quoted context omitted.

> The main reason a Mac user is more secure than a Windows one is because a Mac system is running on a sounder security architecture (not administrator by default, etc.) In specific ways, how is OS X's security architecture more sound than Vista or Windows 7?

To us - IT guys - they look alike, and we can stay away from dangers quite easily. To an average user - and I know what I'm talking about, since I've taught IT security to those average users - Windows' security architecture - UAC, applications (badly) designed to run as Administrator, ecc.- is full of pitfalls. I guess not everybody at Google is an hacker.

Badly designed applications have nothing to do with Vista or greater's "security architecture", so that leaves UAC.

Do you feel UAC has a worse security design than the privilege escalation mechanism on OS X?

Or - since you mention teaching end users - are you talking about a user education issue?

Post reply on HN