Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lessons from last week’s cyberattack

blogs.microsoft.com

Post reply on HN
Print view View original

171–180 of 304 posts

Re: Lessons from last week’s cyberattack

#171

Post by microtonal »

kijin wrote: post #151
pier25 wrote: post #78

Earlier quoted context omitted.

True, but I'm sure there are a lot of cases where the OS wasn't updated because of the necessary investment to jump to a new Windows version.

There are very few free/open-source operating systems that get security patches for as long as Windows does. Major versions of OpenBSD are only supported for 5-6 years. Most Linux distributions only get 3-5 years. Red Hat promises 10 years of support, the same as Windows 7/8/10. None comes close to the 13 years that Windows XP was supported for. So you're gonna have to update anyway, at roughly the same interval if n…

Major versions of OpenBSD are only supported for 5-6 years.

I thought that security updates are only made for -current, the current stable release, and the previous stable release. So, 1 year of support, not 5-6.

A cursory look at the errata seems to confirm this.

Re: Lessons from last week’s cyberattack

#173

Post by flukus »

dotancohen wrote: post #169
21 wrote: post #88

Earlier quoted context omitted.

I know more times when updating Ubuntu made the machine unbootable than for Windows.

I'm a CentOS desktop user at work and Ubuntu at home. I love my Linux. Objectively, the parent poster is correct. For all MS's faults, I've had no less problems updating Ubuntu systems than I've had or seen with MS systems. That said, CentOS is _rock solid_. The packages are old, but maintained by Redhat upstream and do not break on updates. The only thing I recall seeing break on a CentOS update, including point rel…

What type of update? Dist upgrades can be broken, but I've never had issues with general updates.

Re: Lessons from last week’s cyberattack

#174

Post by setq »

codedokode wrote: post #64
whitefish wrote: post #15

Should hospitals such as UK's NHS and other such organizations use dumb terminals (or chromebooks) instead of Windows? That way data is centralized on servers where it is easy to backup and harder for hackers to hold to ransom.

Maybe they should not have connected all of the computers across the country into a single network.

It's not actually like that. They have a heavily restricted backbone and lots of little isolated networks hanging off it. This is lots of independent cases of idiocy causing infection.

Policy controls, poor patching and user education are the root cause of the NHS problems.

Re: Lessons from last week’s cyberattack

#175

Post by Consultant32452 »

nevir wrote: post #60
ouid wrote: post #46

Earlier quoted context omitted.

how much do you think it would cost Microsoft to support XP forever?

There's a big argument for only releasing evergreen style software, and giving the middle finger to IT orgs that want more control

What does "evergreen style software" mean? A quick search didn't return an obvious answer.

Re: Lessons from last week’s cyberattack

#176

Post by setq »

driverdan wrote: post #73
codedokode wrote: post #64

Earlier quoted context omitted.

Maybe they should not have connected all of the computers across the country into a single network.

Maybe they should have kept their systems up to date instead of running XP.

This affected all versions of windows, not just XP. You're right about the updates though.

Re: Lessons from last week’s cyberattack

#177

Post by edejong »

EvanAnderson wrote: post #146
vel0city wrote: post #143

Earlier quoted context omitted.

My car will break down at some point due to imperfect engineering and the realities of physics. Is Ford required to repair my car indefinitely or allow a refund on a car with 250k miles? No, when I bought the car, it came with a warranty stating if they messed up they would fix it within a certain period of time or miles. When I buy Windows, I agree to a warranty of sorts. They agree to supply updates to the software…

The car analogy a very poor one. Software doesn't wear out-- physical stuff does. Defects in software are present when it's created. It doesn't "age" or "break down". (I am making no comment on the issue being discussed-- simply that this is a very poor analogy.)

As opposed to others, I would like to agree with you. One can make design decisions which allow for maintenance over a very long, or indefinite period. This would require using formal methods and a different hardware architecture. Unfortunately, in today's world, we are stuck with mantras like "move fast and break things", which entails running away from, instead of fixing, the complexity we leave behind.

Re: Lessons from last week’s cyberattack

#178

Post by pksadiq »

pjmlp wrote: post #168
thomastjeffery wrote: post #118

Earlier quoted context omitted.

This is why free software is necessary. Proprietary software makes you rely on a company to fix everything . It's like driving a car without being able to replace a flat tire.

The CVE database or Open SSL, are good examples how much safer open source actually is.

> ... are good examples how much safer open source actually is.

Sorry, open source never equals free software (most of the time). Though what you said may be true for both.

And some day, we will surely know why free software is better than open source. It's only a matter of time. But by the time, it will be late, and out of control.

Re: Lessons from last week’s cyberattack

#179

Post by setq »

DanBC wrote: post #12

No one in the UK seems to be tying this attack to the Conservative Party's desire for backdoors everywhere, which is a shame because it's a nice example for the public of how the government have got this very wrong.

Reddit is all over it although it has turned into something suitably reminiscent of Alex Jones' material. Jeremy Hunt is apparently directly responsible for running XP on all NHS equipment and pulling the plug on the support contract for post-extended-support causing the deaths of thousands of people while he rolls around in the dust of the crushed skulls of all his victims.

I would rather see it used to leverage an opinion against back doors and surveillance culture but alas this is merely administrative incompetence and failure to either upgrade or airgap systems which have had a clock ticking on them and plenty of notice from the vendor to sort. The buck should stop at the trust IT directors as this was entirely avoidable with a properly managed estate.

Re: Lessons from last week’s cyberattack

#180

Post by dotancohen »

asdfgadsfgasfdg wrote: post #138
alex_anglin wrote: post #126

Earlier quoted context omitted.

True, but FreeBSD can't guarantee perpetual security for releases. It also doesn't provide warranties, like the majority of software out there. FWIW, I do hold FreeBSD in high regard. It's just that expecting perfection security-wise from complex systems is a fools errand.

> It's just that expecting perfection security-wise from complex systems is a fools errand. I think that may have been the OP's point. Bash is more complex than sh has to be hence because FreeBSD choose the simpler option they avoid the inherent security implications of complex systems. (I use bash myself and don't use FreeBSD.)

Exactly, FreeBSD uses the simplest solution for the task, in the name of security. FreeBSD isn't "secure from Heartbleed because they don't use Bash" but rather, FreeBSD is "secure because by default only the most basic, necessary software is installed" which happened to be sh instead of bash.
Post reply on HN