Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why We Can No Longer Trust Microsoft

pcmag.com

Post reply on HN
Print view View original

251–260 of 310 posts

Re: Why We Can No Longer Trust Microsoft

#251

Post by flyinRyan »

jrabone wrote: post #86

But WHAT, exactly, can't we trust? I've seen NO technical detail to any of these discussions, yet there are a number of sub-systems that might be compromised: - low-level crypto APIs (the 'DLLs' referred to obliquely in the article); these are more interesting. I imagine they could be compromised for weak session key generation or other leakage of key / plaintext, or generate the session key in such a way that the my…

How do you know Wireshark isn't compromised? Further, MS does phone home all the time to check for updates and so on. If something extra was hidden in there would we know?

Re: Why We Can No Longer Trust Microsoft

#252

Post by mtgx »

Renaud wrote: post #195
cs702 wrote: post #169

GNU/Linux, and Free software and hardware in general, look to be the BIG winners out of the NSA brouhaha, because all non-US governments, businesses, organizations, and individuals around the planet who need to safeguard their private or confidential information now have reason to mistrust proprietary (unauditable) software and hardware. Free, open software and hardware are less likely to have secret 'back doors' ins…

There is always going to be an issue of trust at some point: the linux code base is public, but almost none of us compile linux and the packages we need to build a complete OS from source. We end-up getting pre-built packages from repositories that are often distributed all around the word. How easy/hard would it be to compromise some packages or some repositories if you are determined enough? You certainly could not…

But at least it's harder to hide it, and at some point you know it's going to be found out. If we found out about the proprietary solutions spying on us, I think we'll find out even sooner about the open source ones.

Re: Why We Can No Longer Trust Microsoft

#253

Post by sageikosa »

flexie wrote: post #213
sageikosa wrote: post #201

Earlier quoted context omitted.

Unfortunately, those are real courts, their functions and jurisdictions have been established by the Congress.

If congress can redefine courts into what is basically an administrative panel, then the entire separation of powers can be short-circuited. It's not a court just because congress says so.

I'd like to agree with you. I believe there is a category of societal actions that constitutes a court of justice within the framework of a civil society; secrecy doesn't fall into that category.

Re: Why We Can No Longer Trust Microsoft

#254

Post by radio4fan »

mtgx wrote: post #247
cs702 wrote: post #169

GNU/Linux, and Free software and hardware in general, look to be the BIG winners out of the NSA brouhaha, because all non-US governments, businesses, organizations, and individuals around the planet who need to safeguard their private or confidential information now have reason to mistrust proprietary (unauditable) software and hardware. Free, open software and hardware are less likely to have secret 'back doors' ins…

In times like these I wish Ubuntu wasn't made by a US company. It could've been a huge winner out of this, and they could've played used it to the full extent in their marketing campaigns. I'm not sure they can still do that. At least if the EU countries want to go about "standardizing" around one Linux distro (like China did), they will just pick one, and not have one for each country.

Canonical are a UK company.

Not that that will help much.

Re: Why We Can No Longer Trust Microsoft

#255

Post by ianterrell »

cs702 wrote: post #169

GNU/Linux, and Free software and hardware in general, look to be the BIG winners out of the NSA brouhaha, because all non-US governments, businesses, organizations, and individuals around the planet who need to safeguard their private or confidential information now have reason to mistrust proprietary (unauditable) software and hardware. Free, open software and hardware are less likely to have secret 'back doors' ins…

What we need is a Linux Distro co-maintained by the US, China, Iran, Russia, Israel, ...;

Abundant resources and mutual distrust should ensure a rather secure OS.

Re: Why We Can No Longer Trust Microsoft

#256

Post by rfnslyr »

rorrr2 wrote: post #233
rfnslyr wrote: post #227

Earlier quoted context omitted.

Let's just go back to type writers and sending encrypted letters.

http://www.bbc.co.uk/news/world-europe-23282308

Very smart. We have reached a tipping point. I honestly do not trust any software anymore. :(

Re: Why We Can No Longer Trust Microsoft

#257

Post by marcosdumay »

Renaud wrote: post #195
cs702 wrote: post #169

GNU/Linux, and Free software and hardware in general, look to be the BIG winners out of the NSA brouhaha, because all non-US governments, businesses, organizations, and individuals around the planet who need to safeguard their private or confidential information now have reason to mistrust proprietary (unauditable) software and hardware. Free, open software and hardware are less likely to have secret 'back doors' ins…

There is always going to be an issue of trust at some point: the linux code base is public, but almost none of us compile linux and the packages we need to build a complete OS from source. We end-up getting pre-built packages from repositories that are often distributed all around the word. How easy/hard would it be to compromise some packages or some repositories if you are determined enough? You certainly could not…

If you have some valuable secret to keep (classified documents, trade secrets, whatever), you'd be stupid if you didn't compile all the software that touch it yourself.

"We" get pre-built packages from repositories, but only because "we" don't value our privacy enough.

Re: Why We Can No Longer Trust Microsoft

#258

Post by alecdbrooks »

rwmj wrote: post #107
lukifer wrote: post #61

Earlier quoted context omitted.

It's conjecture, but it's likely. Apple as a company has put a high value on user privacy, which was heavily influenced by Steve. He was also known for maintaining a high degree of personal privacy for such a public figure (for instance, refusing to put plates on his car).

I thought you were joking about the number plates thing, but it's true (and apparently legal) ... http://thenextweb.com/apple/2011/10/27/mystery-solved-why-st... This reminds me of a friend of mine who proxies all his web traffic through something which strips user agents and referrers. It's very easy for me to tell when he visits my website, because the logs show "-" for each of these fields.

>This reminds me of a friend of mine who proxies all his web traffic through something which strips user agents and referrers. It's very easy for me to tell when he visits my website, because the logs show "-" for each of these fields.

I wonder if the best strategy, then, is to figure out a very common user agent string and use that. The EFF's Panopticlick might be a good start: https://panopticlick.eff.org.

Re: Why We Can No Longer Trust Microsoft

#259

Post by marcosdumay »

amanne wrote: post #210
cs702 wrote: post #169

GNU/Linux, and Free software and hardware in general, look to be the BIG winners out of the NSA brouhaha, because all non-US governments, businesses, organizations, and individuals around the planet who need to safeguard their private or confidential information now have reason to mistrust proprietary (unauditable) software and hardware. Free, open software and hardware are less likely to have secret 'back doors' ins…

To me it looks like most of the issue is with storing information in the cloud rather than natively running programs. Is there any indication that software running on the client is at risk? The article goes to great hyperbole but unless you're using Skydrive, I don't see how Office files are at risk with the recent revelations. Not that they aren't, it's just that I didn't see any information that they are. I don't t…

> Is there any indication that software running on the client is at risk?

Yes, Microsoft shares all of Windows vunerability with the NSA long before fixing them.

> I don't think storing information in the cloud using FOSS software is going to magically protect your information.

And you are right, it won't. Anything you send to 3rd party severs is gone.

To keep data private, you must keep it at your computers, run only audited FOSS that you compiled with a trusted compiler, encrypt it all the times it goes into a network (even your LAN), and hope that there isn't a firmware or hardware backdoor in your computer.

Re: Why We Can No Longer Trust Microsoft

#260

Post by jrabone »

flyinRyan wrote: post #251
jrabone wrote: post #86

But WHAT, exactly, can't we trust? I've seen NO technical detail to any of these discussions, yet there are a number of sub-systems that might be compromised: - low-level crypto APIs (the 'DLLs' referred to obliquely in the article); these are more interesting. I imagine they could be compromised for weak session key generation or other leakage of key / plaintext, or generate the session key in such a way that the my…

How do you know Wireshark isn't compromised? Further, MS does phone home all the time to check for updates and so on. If something extra was hidden in there would we know?

Build it from audited source?

As for updates, I imagine if you set up a domain you can run your own WSUS update server, MITM the connection, etc. - and then compare the behaviour with a "regular" home PC.

The problem really is how deep the hole goes - as per Ken Thompson "Reflections on Trusting Trust", 1984.

Post reply on HN