Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why We Can No Longer Trust Microsoft

pcmag.com

Post reply on HN
Print view View original

201–210 of 310 posts

Re: Why We Can No Longer Trust Microsoft

#201

Post by sageikosa »

flexie wrote: post #180
rst wrote: post #146

Earlier quoted context omitted.

Correction: Yahoo did fight, and lost. The details aren't all released, but here's a precis of what's public: http://www.wired.com/threatlevel/2013/06/yahoo-failed-fisa-f... It's possible that there's as-yet undisclosed legal action with some of the others; the secrecy around just about any proceeding in the FISC makes it very hard to tell.

Fighting unconstitutional laws in the phony secret "court" set up by the same laws is not really fighting, is it? It's sort of accepting the terms. Take the battle to the real courts and ask them to decide on the matter.

Unfortunately, those are real courts, their functions and jurisdictions have been established by the Congress.

Re: Why We Can No Longer Trust Microsoft

#202

Post by dllthomas »

acqq wrote: post #179
astrodust wrote: post #171

Earlier quoted context omitted.

Mistrust of commercial solutions does not translate into trust for open-source ones. Have you audited the crypto code of all your packages? Would you even know how?

Exactly. Even more interesting, all of the source code can be OK and just some subtle configuration tweaks can be enough to compromise you. Or just some build flag that you don't even see in sources. Often you don't know the build flags of every binary as soon as you use binaries. You also don't know if the compiler is tweaked to do some preprocessing you don't know about (see Reflections on Trusting Trust by Ken Tho…

You can (which is not, necessarily, to say do) know if the compiler is tweaked: http://www.dwheeler.com/trusting-trust

This only works if you are building things yourself or trust the group building things, of course, but it's way easier than audit by disassembling binaries.

Re: Why We Can No Longer Trust Microsoft

#203

Post by talmand »

flexie wrote: post #180
rst wrote: post #146

Earlier quoted context omitted.

Correction: Yahoo did fight, and lost. The details aren't all released, but here's a precis of what's public: http://www.wired.com/threatlevel/2013/06/yahoo-failed-fisa-f... It's possible that there's as-yet undisclosed legal action with some of the others; the secrecy around just about any proceeding in the FISC makes it very hard to tell.

Fighting unconstitutional laws in the phony secret "court" set up by the same laws is not really fighting, is it? It's sort of accepting the terms. Take the battle to the real courts and ask them to decide on the matter.

Exactly how do you get standing to sue the government for something they are not doing with something that does not exist?

Re: Why We Can No Longer Trust Microsoft

#204

Post by snambi »

Renaud wrote: post #195
cs702 wrote: post #169

GNU/Linux, and Free software and hardware in general, look to be the BIG winners out of the NSA brouhaha, because all non-US governments, businesses, organizations, and individuals around the planet who need to safeguard their private or confidential information now have reason to mistrust proprietary (unauditable) software and hardware. Free, open software and hardware are less likely to have secret 'back doors' ins…

There is always going to be an issue of trust at some point: the linux code base is public, but almost none of us compile linux and the packages we need to build a complete OS from source. We end-up getting pre-built packages from repositories that are often distributed all around the word. How easy/hard would it be to compromise some packages or some repositories if you are determined enough? You certainly could not…

Sure, it is possible. But it is harder, and the possibility of those "patches" getting discovered some randome users are much higher. It is much easier to use proprietary tool like microsoft to spy others.

Re: Why We Can No Longer Trust Microsoft

#205

Post by specialist »

snowwrestler wrote: post #167
sillysaurus wrote: post #130

Earlier quoted context omitted.

Not in the wildest scenario would the US government have jailed the leaders of Apple, Google or Microsoft. That may be naive. Most people have skeletons in their closets. The government would use these to pressure those leaders to acquiesce. I suspect the most dangerous skeletons are ones which seem harmless to you, but cast in the proper light they can be used as a justification for punishment. E.g. Something which…

I can see two sides to this. On one hand, the CEO of Qwest was convicted of insider trading, and he claims it was retaliation by the NSA because Qwest would not participate in warrantless wiretapping. On the other hand, the federal government had a perfect excuse to prosecute Steve Jobs in 2006 with the options backdating scandal, but chose not to. Those would not have been baseless charges--Apple really did backdate…

I remain astonished that Martha Stewart was targeted, convicted, and jailed. I don't care either way if she did some thing wrong. I care about the unequal application of justice.

In contrast, I can't imagine anyone targeting Oprah. She'd destroy (PR-wise) anyone challenging her. Recall that beef lobby's attacks.

Jobs is like Silicon Valley's Oprah.

Re: Why We Can No Longer Trust Microsoft

#206

Post by dllthomas »

acqq wrote: post #194
jokoon wrote: post #189

Earlier quoted context omitted.

> Mistrust of commercial solutions does not translate into trust for open-source ones. Well, how well can you trust the commercial ones ? At least with open source, you can look into it more easily and eventually find security holes. It's a step towards trust. There is no trust to gain with commercial solutions, but at least with open source, it's at least possible. The fact that proprietary agrees with a sound marke…

how well can you trust the commercial ones ? At least with open source, you can look into it more easily and eventually find security holes. It's a step towards trust. There is no trust to gain with commercial solutions, but at least with open source, it's at least possible. Ever heard of reverse engineering? It turns out you'd need even that approach even with open source as soon as you use binaries you haven't comp…

"Ever heard of reverse engineering? It turns out you'd need even that approach even with open source as soon as you use binaries you haven't compiled yourself."

This is true: reverse engineering can be used for verification, but it's a whole lot more work than inspecting source.

"And you'd have to verify the compiler and your disassembler that way too."

This is false. You can verify the compiler with diverse double compiling: http://www.dwheeler.com/trusting-trust

Re: Why We Can No Longer Trust Microsoft

#207

Post by snambi »

astrodust wrote: post #171
cs702 wrote: post #169

GNU/Linux, and Free software and hardware in general, look to be the BIG winners out of the NSA brouhaha, because all non-US governments, businesses, organizations, and individuals around the planet who need to safeguard their private or confidential information now have reason to mistrust proprietary (unauditable) software and hardware. Free, open software and hardware are less likely to have secret 'back doors' ins…

Mistrust of commercial solutions does not translate into trust for open-source ones. Have you audited the crypto code of all your packages? Would you even know how?

Most people don't. But if the need the need comes, it can be done. It may need some effort, but can be done. Can you audit microsoft code?

Re: Why We Can No Longer Trust Microsoft

#208

Post by dllthomas »

acqq wrote: post #196
oceanstone wrote: post #181

Earlier quoted context omitted.

There are many developers who like audit small pieces, and then share their findings.

Just believing "somebody would see it" is provably not enough. http://www.schneier.com/blog/archives/2008/05/random_number_... The bug was introduced in September 2006. Discovery published May 2008. Affected: the most popular Linux distribution, all the keys generated on it in that period. Scary. Moreover, the bug was not found by reading the source code. The keys generated by all the existing system were analyzed. I…

But the odds it will be found (and publicly acknowledged) is higher than with closed-source software. Availability of the source is not a substitute for audit and care, but is helpful and you're not guaranteed audit or care with closed solutions.

Re: Why We Can No Longer Trust Microsoft

#209

Post by talmand »

el_fuser wrote: post #162
JonFish85 wrote: post #140

Earlier quoted context omitted.

"And can you just imagine how much more sales Apple would get now for not being on that list?" Barely any change at all, I'd bet. And not worth the legal hassle they could have been up against if it came to a knock-down, drag-out battle with the US Government over .

not worth the legal hassle That's not the Steve Jobs I read about. Like him or not, he was a man of principle.

Principles must have come to him later in life because I'm sure his first daughter would have something to say about that.

Re: Why We Can No Longer Trust Microsoft

#210

Post by amanne »

cs702 wrote: post #169

GNU/Linux, and Free software and hardware in general, look to be the BIG winners out of the NSA brouhaha, because all non-US governments, businesses, organizations, and individuals around the planet who need to safeguard their private or confidential information now have reason to mistrust proprietary (unauditable) software and hardware. Free, open software and hardware are less likely to have secret 'back doors' ins…

To me it looks like most of the issue is with storing information in the cloud rather than natively running programs.

Is there any indication that software running on the client is at risk? The article goes to great hyperbole but unless you're using Skydrive, I don't see how Office files are at risk with the recent revelations.

Not that they aren't, it's just that I didn't see any information that they are.

I don't think storing information in the cloud using FOSS software is going to magically protect your information.

E.g. How does using Thunderbird to access Gmail afford greater protection than using Outlook to access Gmail?

Post reply on HN