The attack surface of Windows is infinite
As one door closes, another opens
"Features"
"Fixes"
Job security
Security holes
The threat model is Microsoft
Microsoft has released software updates to plug at least 570 security holes
111–120 of 132 posts
Re: Microsoft has released software updates to plug at least 570 security holes
#112Earlier quoted context omitted.
There's more direct channels to report security vulnerabilities - which this about.
Perhaps the feedback boxes they put in every app should actually be read. That’s a them problem.
Those boxes are not there to generate feedback. They are there to placate the user by implying that their voice will be heard.
Re: Microsoft has released software updates to plug at least 570 security holes
#113Earlier quoted context omitted.
It was more tested as real testers were testing it. Nowadays, AI just checks the code.
Is that true or an assumption? I don't think Chrome and co would discard their decades worth of automated testing practices in favor of AI. Actually I don't need to think / assume, it's an open source project.
Chrome? That is a younger project and it was much less automated back in the day.
Re: Microsoft has released software updates to plug at least 570 security holes
#114Earlier quoted context omitted.
it's still an opt-in setting though. Windows and OS-components like drivers and Edge do get auto updated yes, but to enable Microsoft Update, you still need to turn on a setting in the Settings app. even setting up a new PC/laptop with windows, this is off by default.
That's likely because of antitrust. If they let their software hook into Windows Update, then they would need to let everybody do the same.
What antitrust? It is a security feature and for regular apps windows has ms store that can do auto updating as well.
Re: Microsoft has released software updates to plug at least 570 security holes
#115Earlier quoted context omitted.
Perhaps the feedback boxes they put in every app should actually be read. That’s a them problem.
Those boxes are not there to generate feedback. They are there to placate the user by implying that their voice will be heard.
I reported 3 errors/feature requests in Oura Ring app. After going through the reporting process I felt much less irritated at the bugs and smiled to myself thinking that must have been the purpose of the reports.
To my astonishment, 3-4 months later they fixed the errors and rolled out the feature I asked about.
WTH, people read those reports?
I know people do, I often get in touch with support for various services, knowing that in the sea of people not giving feedback, your comments mean a lot. But up until recently both the Oura App and their support was very mediocre.
Where's my enshittification?
Re: Microsoft has released software updates to plug at least 570 security holes
#116Earlier quoted context omitted.
Is it worse than what humans were doing on their own anyway?
Well yes if they expect to find and correct more bugs every update which is pretty much what they are saying.
If AI ever manages to make something half as atrocious as Windows XP that would probably be the first proof of AGI.
Re: Microsoft has released software updates to plug at least 570 security holes
#117Earlier quoted context omitted.
How many were introduced by misuse of AI coding/vibe coding though?
highly unlikely for many of them. SharePoint, bitlocker, Active directory, hyper-v, rdp, DHCP and MSMQ are all software/technologies that have decades of history and long pre-dated LLMs. seriously, do people not realise it was entirely possible to write insecure or bad code before LLMs?
It's funny because SharePoint and AD are so god-forsakenly awful you would think they're vibe coded if you didn't know any better
Re: Microsoft has released software updates to plug at least 570 security holes
#118Earlier quoted context omitted.
What would be the point of any of this if the registry is still there? It'd just a particularly shit version of linux window management that happens to run games well
The registry was never an issue tbh, it's just a database that some companies decided to fearmonger about to sell you "registry cleaners". But if I'm wrong, please do point us in the direction of known issues with the registry.
Calling the registry a database makes it seem better engineered than it really is.
Running queries on the registry like SQLite? Nope. The Windows registry internally from what I've been able to read is a weird reimplementation of a file system (a trivial database I guess but a real database lets you index on things other than name). It's compact but as far as I know completely unofficially documented.
(Most data structures with unique names or ids for each data item could trivially be considered databases, but generally if you say something is a database, you typically expect to create queries more sophisticated than "select data where name is X" and also expect to be able to create or use separate indexes to support those queries.)
The reputation of brittleness and danger of the registry is because Windows stores a lot of configuration parameters there that the kernel uses as boot, but because it's not a plain text file, comments explaining what the settings do can't be right there in the same place you're editing.
Re: Microsoft has released software updates to plug at least 570 security holes
#119Earlier quoted context omitted.
20 years ago software wasn't as much battle tested as today, had way less feature set, was less connected to the internet, and etc. 428 CVEs looks small, assuming not all have CVSS 9.8 or something.
20 years ago was 2006, I can assure you we were very consciously aware of things being permanently connected to the internet by then. That said, sure, it had a fraction of the features back then, and only a fraction of the world population was connected to the internet.
>That said, sure, it had a fraction of the features back then, and only a fraction of the world population was connected to the internet.
And the world was better for it. Connectivity and internet are not inherent goods. They can be used for good purposes but it is hard to argue that has been the mean.
Re: Microsoft has released software updates to plug at least 570 security holes
#120It is time to abandon Microsoft.
While I do think it's wise for people to start looking at alternatives, I don't think this specific news should sway one way or another. Windows (like Linux or macos) contains an enormous amount of code, and with large code-bases you're certain to have security issues. Finding these security issues and fixing them seems like a good idea, no matter how much you love or hate Windows.
Code can exist without vulnerabilities. Verifiable proof exists. It is hard, but it is possible.