Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kaspersky OS

eugene.kaspersky.com

Post reply on HN
Print view View original

221–230 of 290 posts

Re: Kaspersky OS

#221

Post by gspetr »

alexandr451 wrote: post #9
mablap wrote: post #5

There are no real details about the OS in the article. Did anybody here work on the project?

From what I heard from people that work there, this company mistreats employees and has huge problems with management. I could provide a proof link, but it's in Russian.

I worked there in Moscow HQ. Now it's just a generic BigCo with all it's corresponding problems and Dilbertesque bureaucracy with lots of meetings to get things done.

There is a history of the company suing ex-employees and vice versa. It's pretty ruthless if you break NDA - people get real jail time. I got reminded about that during my exit interview.

I left for financial reasons. They simply refused to give raises to virtually anyone after RUR tanked in 2014, even though 85% of the company's revenues are from foreign sources.

Re: Kaspersky OS

#222

Post by notalaser »

rthomas6 wrote: post #134
vbezhenar wrote: post #63

Earlier quoted context omitted.

Yet it's not widely used as embedded OS. I never saw any router with OpenBSD or web camera. The underlying problem, IMO, is people. They just don't care about security, they want to deliver working device. Also it's not clear how many vulnerabilities, used in real life attacks (like DDOS from IoT devices) are in latest Linux kernel? May be problem not with Linux, but with custom software or lack of updates.

But OSX, Windows, and full-blown Linux aren't used as embedded OSes either. Linux is a bit, but there are a lot of other choices.

"A bit" is an understatement. The vast majority of non-server deployments of Linux are embedded systems, and embedded systems requirements are one of the most important driving factors in its development nowadays.

Re: Kaspersky OS

#223

Post by kbenson »

CaptSpify wrote: post #173
golergka wrote: post #165

Earlier quoted context omitted.

No. Snowden documents didn't show that Larry and Sergei are childhood buddies with FBI, NSA or CIA chiefs. That's the problem with intellectual americans - you guys know how bad things are in your country, but not realize how worse they are everywhere else.

No, I'll concede the specifics, but the impact is the same. They show that Google, FB, etc are all sending their data to the NSA and others. > That's the problem with intellectual americans - you guys know how bad things are in your country, but not realize how worse they are everywhere else. What? Just because some situations are worse in other countries means the US can't be doing anything wrong?

> No, I'll concede the specifics, but the impact is the same. They show that Google, FB, etc are all sending their data to the NSA and others.

Are you talking about National Security Letters? That's a complex topic. I would hope the companies did what they could to fight where they had room, but I also don't necessarily expect companies to break the law.

If you're talking about data, the NSA tapped private datacenter connections, and I'm under the impression that Google at least was working to mitigate this (encrypt all datacenter-to-datacenter traffic) before all this came to light. Or are you referring to something else?

Re: Kaspersky OS

#224

Post by MichaelBurge »

nickpsecurity wrote: post #192
vbezhenar wrote: post #78

Earlier quoted context omitted.

Kaspersky certainly care about security, it's their business. I'm talking about people who build routers or web cameras. I doubt that Kaspersky built OS for internal use, they want to license it to other manufacturers. But I'm not sure that other manufacturers will want to pay for this extra security (if they would want, they already have better options).

"Kaspersky certainly care about security, it's their business." Their business is selling antivirus & other software, not security. They have no history whatsoever of building a piece of software immune to code injection by determined attackers. There are companies and academics that build stuff like that. Some were evaluated by pentesters of third parties. Kaspersky has neither that background nor evaluations by exp…

Can't you sue a company selling security products if it ends up being insecure? This is different from ordinary software, because most ordinary software isn't marketed with security as its primary selling feature. And if they're not getting it tested by independent experts, that could be negligence.

If they're not liable in any way, then I agree it's nothing more than marketing to call it secure.

Re: Kaspersky OS

#225

Post by bonzini »

busterarm wrote: post #167
this-dang-guy wrote: post #127

Earlier quoted context omitted.

Yes, my first thought (after VMS) when he said no popular OS is designed for security. Then of course, I realized that by "Popular" he meant Mac OSX, Windows, and Linux. Linux of course, we all know is a security mess because Torvalds refuses to deal with security issues.

I don't think it's a fair statement to blame Linux's security problems on Linus. Linux provides support for lots of security options, but the project's guiding philosophy is "don't break userland". This is 99% of the time what you see Linus cursing out other kernel contributors for. All of the possible options that Linus could _enforce_ would do just that. Heck, a lot of the security problems and blame have nothing t…

What the hell does systemd have to do with kernel security issues?

Is this Hacker News or slashdot?

Re: Kaspersky OS

#226

Post by nickpsecurity »

MichaelBurge wrote: post #224
nickpsecurity wrote: post #192

Earlier quoted context omitted.

"Kaspersky certainly care about security, it's their business." Their business is selling antivirus & other software, not security. They have no history whatsoever of building a piece of software immune to code injection by determined attackers. There are companies and academics that build stuff like that. Some were evaluated by pentesters of third parties. Kaspersky has neither that background nor evaluations by exp…

Can't you sue a company selling security products if it ends up being insecure? This is different from ordinary software, because most ordinary software isn't marketed with security as its primary selling feature. And if they're not getting it tested by independent experts, that could be negligence. If they're not liable in any way, then I agree it's nothing more than marketing to call it secure.

There's little to no liability in most situations. Security experts have been pushing for liability for a long time as a solution to this. Basically, we want a minimum level of responsibility like what exists in safety-critical industries. Schneier has a brief essay that explains it well:

https://www.schneier.com/blog/archives/2004/11/computer_secu...

Re: Kaspersky OS

#227

Post by nickpsecurity »

grzm wrote: post #213
nickpsecurity wrote: post #206

Earlier quoted context omitted.

Parent might be referring to how they just gobbled it up into Darwin and Mac OS X while contributing about nothing back. At least, I'm aware of them making a bunch of money off Mac OS X and iPhones but not hearing about contributions to FreeBSD at level IBM or Red Hat do to Linux.

Yeah, I was wondering about that, too. Granted, the BSD base is arguably one step removed from Apple (as that was NeXTSTEP, which Apple acquired), and both Darwin and OpenStep are open source. Apple continues to release the source of some of their software.[0] According to the "Myths" page at FreeBSD, "FreeBSD 9.1 and later include a C++ stack and compiler that were originally developed for OS X, with major parts of…

"so it hasn't completely been freeloading."

That's Clang/LLVM compiler that gets them off GCC's GPL codebase. It also allows them to keep more extensions proprietary if they choose. It's been beneficial to the OSS community but I'd say it's barely altruistic. An exception rather than the rule.

" The "how Apple treated BSD" phrasing sounds like there is more active bad treatment rather than not contributing enough"

Helps to remember that it's how a lack of contributions is commonly phrased. Freeloading is probably the dominant model for both users and companies far as FOSS. It's just how they word the gripe. I agree they should probably use clearer phrasing for others not deep into this subject matter.

Re: Kaspersky OS

#228

Post by nickpsecurity »

distances wrote: post #212
nickpsecurity wrote: post #177

Earlier quoted context omitted.

That's why China built their own OS on top of an open-source BSD. :) https://en.wikipedia.org/wiki/Kylin_(operating_system)

Nowadays it's Linux though, according to the article.

Ecosystem effects most likely. Most users prefer new features over stability or security. Theirs must be the same. They've followed in the U.S.'s footsteps it seems where DOD & "Trusted UNIX" vendors started with stronger stuff then gradually moved to weaker ones (esp Linux-based) for kernel features or specific apps.

Re: Kaspersky OS

#229

Post by busterarm »

bonzini wrote: post #225
busterarm wrote: post #167

Earlier quoted context omitted.

I don't think it's a fair statement to blame Linux's security problems on Linus. Linux provides support for lots of security options, but the project's guiding philosophy is "don't break userland". This is 99% of the time what you see Linus cursing out other kernel contributors for. All of the possible options that Linus could _enforce_ would do just that. Heck, a lot of the security problems and blame have nothing t…

What the hell does systemd have to do with kernel security issues? Is this Hacker News or slashdot?

For the most part, they are not kernel security issues.

Those get fixed. There are places where the kernel could be further hardened, but would break software.

Most of the security issues that we talk about have to do with process permissions and runlevel. The runlevel of systemd and it's various components is actually my #1 security concern. Has nothing to do with the kernel.

Re: Kaspersky OS

#230

Post by busterarm »

nickpsecurity wrote: post #193
busterarm wrote: post #184

Earlier quoted context omitted.

Right. I'm saying give up on expecting the project to change. The project isn't for what you want it to be for and never will be. You should be shouting at companies who use it for applications where security is a must. That's where the madness lies. I use OpenBSD and so should you :)

Well that's mostly true. I guess we have to shout at the cloud companies then. ;)

Please do!

It's even possible to do modern web stuff on OpenBSD. Erlang and Elixir run on it, as does Postgres. Phoenix framework pretty much works out of the box.

Post reply on HN