Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list

thenextweb.com

Post reply on HN
Print view View original

101–110 of 137 posts

Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list

#101

Post by jebblue »

jongalloway2 wrote: post #83
jebblue wrote: post #64

Earlier quoted context omitted.

Java is or was until very recently as anyone who has used it since 1995 will know and remember. Recent issue have arisen, hopefully Oracle is going to get its track record up to what Sun's was. Until then, a few bad recent reports for Java 7 will not wipe out decades of countless security reports for all of Windows Operating System and many relied upon Windows applications. Java applets are still far more efficient a…

History and hopefully don't really factor into a thoughtful analysis of current security issues.

Are you saying history in general is not pertinent to analysis? Is your rule only true for security issues or you do you feel that way about everything?

Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list

#102

Post by cgh »

wisty wrote: post #95
elorant wrote: post #92

Earlier quoted context omitted.

Google isn't the first company that would come to my mind. I'd rather go for Apple. Their mobile ecosystem might be a lot more secure than Android's, but the way they acknowledge OSX vulnerabilities and how soon they fix them is a weak spot. Oracle with Java could also get a lot of heat.

Apple regularly loses security shootouts, and is widely derided by security people. Their only advantages are their niche status (which they are losing) and their lack of consideration towards old apps (they can dump old APIs which are hard to secure, and make other backwards-incompatible fixes, because they just don't care that much about backwards compatibility).

This is a rather biased view. Maybe check that top ten list again.

Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list

#103

Post by tptacek »

dllthomas wrote: post #52
tptacek wrote: post #42

Earlier quoted context omitted.

There are more eyes on the code too, though: virtually everything Microsoft ships gets a 3rd party review.

... that still isn't "many eyes" on any particular piece of code, in the sense of the saying, though.

Just because Eric S. Raymond says that's how security bugs should be found doesn't mean that's how security bugs are actually found.

Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list

#104

Post by tptacek »

damncabbage wrote: post #76
tptacek wrote: post #41

Earlier quoted context omitted.

They very much are, and have been, for awhile.

Remember this? http://www.gizmodo.com.au/2012/05/adobes-photoshop-security-... They left Photo CS 5.5 users twisting in the wind, recommending customers pay to upgrade their one-year-old software to CS 6. I don't know if it was the external pressure or a slow in-house process, but it took them a month to release a fix for CS 5.5 users: http://www.adobe.com/support/security/bulletins/apsb12-11.ht...

If you wanted to put Microsoft under a microscope from 2003-2010, during the time where they were actually putting in the work to transition from a 1990's software security practice to a 201x security practice, you'd find plenty of "smoking guns" to win arguments with on message boards.

Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list

#105

Post by tptacek »

Legion wrote: post #29
boyter wrote: post #4

I usually get shouted down when I say this but Microsoft's focus on secure code over the last 10 years has paid off. Not only is the OS too hard a target hence the increase in Java, adobe product exploits, but their software running on their OS has fallen in line too. I know the saying many eyes make bugs shallow, but so does billions of dollars and years of concentrated effort. Kudos to Microsoft for getting their a…

> I know the saying many eyes make bugs shallow, but so does billions of dollars and years of concentrated effort. The saying holds. Billions of dollars buys many eyes.

No, the saying does not hold. Microsoft didn't buy "many eyes"; they bought a relatively small number of very specialized eyes. At any one time in the mid 2000's, something like 4-5 security firms did $1MM or more in a year at Microsoft, and those firms each had between 15-40 people working at them --- and no firm did 100% of its business at MSFT.

What happened at Microsoft may not disprove this folk wisdom about defect detection, but it's evidence against it, not for it.

Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list

#106

Post by tptacek »

cdibona wrote: post #71

This reminds me of the bear joke: They only had to outrun oracle and adobe...

The implication here is that Microsoft didn't actually improve their security so much as Oracle and Adobe failed to keep up with theirs. I don't know whether you intended to say that, but either way, it's a false statement.

Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list

#107

Post by smackfu »

wisty wrote: post #95
elorant wrote: post #92

Earlier quoted context omitted.

Google isn't the first company that would come to my mind. I'd rather go for Apple. Their mobile ecosystem might be a lot more secure than Android's, but the way they acknowledge OSX vulnerabilities and how soon they fix them is a weak spot. Oracle with Java could also get a lot of heat.

Apple regularly loses security shootouts, and is widely derided by security people. Their only advantages are their niche status (which they are losing) and their lack of consideration towards old apps (they can dump old APIs which are hard to secure, and make other backwards-incompatible fixes, because they just don't care that much about backwards compatibility).

The other big advantage on mobile is a closed ecosystem and mandatory sandboxing.

Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list

#108

Post by ujdtyhf »

ajross wrote: post #45
tptacek wrote: post #43

Earlier quoted context omitted.

The problem mostly isn't the runtime itself, but instead the various 3rd party modules (all of which are written in late-90's-era C/C++) that get hooked up to the JVM. For instance, the Quicktime API for Java exposed scalar integers, intended to be "opaque", but in fact raw memory locations. The JVM is good. The Java Applet Plugin, on the other hand, is a problem.

Well, sure. But I think that's maybe missing my point -- a managed runtime needs "holes" in it to do its job, which exposes the security problems of the rest of the system via inevitably leaky abstractions. The point was that the managed runtime does nothing to address this, it has to drill down to a C API at some point (or deeper, consider a similar hole in a shader compiler or video codec accelerator). And contrast…

Yet you are viewing this page a with browser that loads and automatically executes untrusted JavaScript code under managed runtime.

Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list

#109

Post by tptacek »

ujdtyhf wrote: post #108
ajross wrote: post #45

Earlier quoted context omitted.

Well, sure. But I think that's maybe missing my point -- a managed runtime needs "holes" in it to do its job, which exposes the security problems of the rest of the system via inevitably leaky abstractions. The point was that the managed runtime does nothing to address this, it has to drill down to a C API at some point (or deeper, consider a similar hole in a shader compiler or video codec accelerator). And contrast…

Yet you are viewing this page a with browser that loads and automatically executes untrusted JavaScript code under managed runtime.

And for most of the 2000's, browser security was a debacle, too.

Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list

#110

Post by dllthomas »

tptacek wrote: post #103
dllthomas wrote: post #52

Earlier quoted context omitted.

... that still isn't "many eyes" on any particular piece of code, in the sense of the saying, though.

Just because Eric S. Raymond says that's how security bugs should be found doesn't mean that's how security bugs are actually found.

And that is an interesting point; and it is specifically the point the G*P was making, which was obscured by saying, "Oh, but there are still multiple eyes here."
Post reply on HN