Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows: Insecure by Design

theregister.com

Post reply on HN
Print view View original

11–20 of 37 posts

Re: Windows: Insecure by Design

#11

Post by sdwr »

lisper wrote: post #6

The gulf between what the average person knows and what they would need to know in today's world to live an autonomous self-directed life with full agency, free from covert coercion by large corporate entities, is truly staggering. Every now and then I contemplate writing a book or a series of blog posts with all the things that I wish someone would tell me if I were a young person today, but then I read articles lik…

If the average person was living an "autonomous, self-directed life", I don't think Windows security holes would rate compared with stockpiling enough food to last through winter.

Re: Windows: Insecure by Design

#13

Post by Teckla »

lisper wrote: post #6

The gulf between what the average person knows and what they would need to know in today's world to live an autonomous self-directed life with full agency, free from covert coercion by large corporate entities, is truly staggering. Every now and then I contemplate writing a book or a series of blog posts with all the things that I wish someone would tell me if I were a young person today, but then I read articles lik…

After over 30 years using Windows, I finally gave up on it last year. It was a difficult choice, but clearly, it's just going to keep getting worse.

These days most people should be using Chromebooks and iPads, which are far and away more secure.

Re: Windows: Insecure by Design

#14

Post by itsanaccount »

I remember a few years back AT&T execs/investors talking about HBO when they bought it, that they didn't care what product HBO made, their goal was to capture more of a person's life interacting with media they owned. Like at the highest levels, leadership viewed their lane to extract profits was the entirely of a person's available free time, against hiking or cooking or transit and entertainment just happened to be the vehicle to do it.

When it comes to Microsoft and others, their active business strategy always seems to be overlapping sectors of power and software just happens to be the vehicle to do it. Recall is just the latest tentacle of the strategy.

If a capitalist company with a specific product focus, within a specific market is a healthy cell, I see this type of company as a cancer and think we should treat it just the same. Starve it or destroy it, and if we can't destroy the company then we can imprison investors for this kind of monopolistic behavior.

Knowing hacker news likes myopia and not discussing such concepts as power, my ask to you is how many years do we tolerate this same overreaching behavior from the same places? I'm at 25 now for Microsoft specifically.

Re: Windows: Insecure by Design

#15

Post by pdonis »

cjk2 wrote: post #9

Even as a well known "windows hater", this is hyperbole. It's not insecure by design really. In fact in principle it's a lot better than anything Unix side due to the ACL and security model. It did however exist before anyone gave a crap about security, was implemented in a vastly insecure language and runtime and grew to a huge size and surface area and that is hard to fix retrospectively. I'll give Linux a stab her…

> It's not insecure by design really.

Sure it is. Features like Recall, which the article mentions, are insecure by design.

> the ACL and security model

I'm not sure how this is any more secure than "Unix side". But in any case the security holes in Windows are not problems with its filesystem (at least not now that FAT is no longer used).

> Anything which can read ~ is a problem

Which in a properly configured Unix system is your user and root, and that's it. So don't run things you don't trust as your user or root. Which should be obvious common sense to anyone who uses a computer.

Re: Windows: Insecure by Design

#16

Post by pdonis »

batch12 wrote: post #12

I dont know what the solution is here short of some kind of vulnerability liability legislation...

> I dont know what the solution is here

One obvious thing for the government to do would be to stop buying Microsoft products due to national security concerns. The NSA, AFAIK, already runs Linux.

Re: Windows: Insecure by Design

#17

Post by AtlasBarfed »

It IS a national security concern, one that worsens every year.

The US government should be investing billions in Linux to harden it and make it more usable and appealing.

So should Intel, amd, Qualcomm, because that keeps their processors compatible with a rapidly patched mainstream os.

So should the EU.

But... They won't. Surely as long as 90 year old presidents are what we are stuck with.

Re: Windows: Insecure by Design

#18

Post by philsnow »

finkin1 wrote: post #7
electrodank wrote: post #2

Clickbait titles should be automatically flagged/not even show up on the front page.

What's clickbait about it? It's the title of the article as written by the author. How would one even go about automatically flagging "clickbait" titles? Obviously the term means different things to different people.

Arguably the entire article is clickbait, it's just rant running under the Opinions section.

Re: Windows: Insecure by Design

#19

Post by throw7 »

Well, Windows UAC was the last user facing push for security. It remains to be seen what Satya thinks, especially of the recent security failures on the backend (the windows client vulnerabilities is a constant and has always been).

The recent "insecurity" pushes are more of getting microsoft to "catch up" to google/facebook in terms of making their users a product they can sell. I'm sure they feel left out as chromebooks have eatin' into their market and supply such nice metrics for advertisers.

Re: Windows: Insecure by Design

#20

Post by cjk2 »

pdonis wrote: post #15
cjk2 wrote: post #9

Even as a well known "windows hater", this is hyperbole. It's not insecure by design really. In fact in principle it's a lot better than anything Unix side due to the ACL and security model. It did however exist before anyone gave a crap about security, was implemented in a vastly insecure language and runtime and grew to a huge size and surface area and that is hard to fix retrospectively. I'll give Linux a stab her…

> It's not insecure by design really. Sure it is. Features like Recall, which the article mentions, are insecure by design. > the ACL and security model I'm not sure how this is any more secure than "Unix side". But in any case the security holes in Windows are not problems with its filesystem (at least not now that FAT is no longer used). > Anything which can read ~ is a problem Which in a properly configured Unix s…

> Sure it is. Features like Recall, which the article mentions, are insecure by design.

I'm going to be honest: I'm not bothered about Recall security. It'd be on a single user machine which contains my data anyway. There are many more tasty morsels out there if a keylogger gets on it. Like the contents of my Keepass DB or my online banking PIN, neither of which Recall would be party to but anything that runs as my user shouldn't be able to see. Plus I'd probably turn it off anyway. I mean I do appreciate people kicking them in the balls which is due.

I'm not sure how this is any more secure than "Unix side". But in any case the security holes in Windows are not problems with its filesystem (at least not now that FAT is no longer used).

As for ACLs, check NT kernel architecture, particularly object security descriptors. Particularly Windows 2000 onwards. Quite elegantly put together, but with layers of crap over them.

>Which in a properly configured Unix system is your user and root, and that's it. So don't run things you don't trust as your user or root. Which should be obvious common sense to anyone who uses a computer.

So I'll have to create another user account to run a web browser, my mail client, a software package manager or a compiler?

Post reply on HN