Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why We Can No Longer Trust Microsoft

pcmag.com

Post reply on HN
Print view View original

261–270 of 310 posts

Re: Why We Can No Longer Trust Microsoft

#261

Post by [deleted] »

fixxer wrote: post #243
brudgers wrote: post #230

Earlier quoted context omitted.

It's not the Lone Ranger. It's a business. Think of Federal employees at Fort Meade, who were hired to do the sort of work I am describing. Think of defense contractors with nondescript offices in Fairfax who hire those same employees after they leave the government and whose employees spend their days writing and pulling and pushing and merging open-source software. Think of $200,000 a year. Think of Edward Snowden.…

> It's asymmetric warfare. But the side without the money is disorganized and open and trusting. The Snowden leak happened (as did Manning), so the Government is not as organized as optics would suggest. They are drowning in the data deluge just like everybody else.

[deleted]

Re: Why We Can No Longer Trust Microsoft

#262

Post by metatation »

Renaud wrote: post #195
cs702 wrote: post #169

GNU/Linux, and Free software and hardware in general, look to be the BIG winners out of the NSA brouhaha, because all non-US governments, businesses, organizations, and individuals around the planet who need to safeguard their private or confidential information now have reason to mistrust proprietary (unauditable) software and hardware. Free, open software and hardware are less likely to have secret 'back doors' ins…

There is always going to be an issue of trust at some point: the linux code base is public, but almost none of us compile linux and the packages we need to build a complete OS from source. We end-up getting pre-built packages from repositories that are often distributed all around the word. How easy/hard would it be to compromise some packages or some repositories if you are determined enough? You certainly could not…

This made me think of Ken Thompson's Turing Award Lecture: http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomps...

Re: Why We Can No Longer Trust Microsoft

#263

Post by marcosdumay »

nivla wrote: post #136
belorn wrote: post #117

Earlier quoted context omitted.

Windows natively has several data collecting operations on any machine with Windows installed. Each time you visting a page, IE sends the URL over to be "checked" by Microsoft. Each update, a summery of all installed packages are collected and sent to Microsoft in order to "improve the experience". WAT collects your hardware specification, including the serial number of your hard drive. Each time you connect your ope…

>Each time you visting a page, IE sends the URL over to be "checked" by Microsoft. Huh? Are you talking about hashes being sent for malware check similar to the ones in Chrome or Firefox? If not its a serious privacy issue. The ones you mentioned about Updates is also true for Chrome updates. [1] >Microsoft can forceable push new executable code as updates, regardless if settings has turn of updates. Any source on th…

> Huh? Are you talking about hashes being sent for malware check similar to the ones in Chrome or Firefox? If not its a serious privacy issue.

Hashing the URLs won't give you any privacy, because the set of used URLs is public and relatively small. Also, I'm not aware of Firefox doing that, are you sure about it?

At IE and Chrome, sending that data is optional. It's neither opt-in nor opt-out. The browser makes a question at the first use, and you must select one option. IE's question is a bit biased toward a "opt-in or you'll get phished", but there is no reason to think that wording is malicious - one can even claim it's true.

Besides all that, MS sends all known vunerabilities of it's products to the NSA long before either publishing or fixing them. That's enough to give the NSA administrative priviledges on Windows machines.

Re: Why We Can No Longer Trust Microsoft

#264

Post by marcosdumay »

MSvsGOOG wrote: post #94
69_years_and wrote: post #79

I don't think native MS apps running on a local machine are a risk, I imagine (with a little nieviety) that if MS apps/OS were phoning home on a regular basis with the content of ones documents - someone would have noticed and raised a flag (or did I miss it). Nor is exchange BCC a copy to the NSA - again someone would have noticed. Cloud services excluded. PS. It's *buntu that spins my propeller. PPS. I'd be interes…

>Nor is exchange BCC a copy to the NSA - again someone would have noticed. True, but what about Windows Phone vs. Android (with Google's apps, not just a FOSS build like Replicant) vs. Apple? Which is the lesser evil for your privacy?

> Which is the lesser evil for your privacy?

Cyanogen.

Re: Why We Can No Longer Trust Microsoft

#265

Post by [deleted] »

acqq wrote: post #3

This is a financial disaster waiting to happen. Microsoft is oblivious if it is not doing something to divorce itself from the NSA. Apple, on the other hand, could have come out smelling like a rose, but following the death of Steve Jobs, who apparently refused to play ball with the NSA, it stupidly jumped on board to join the PRISM club. According to the Prism slides, it really looks so: "Dates when Prism collection…

[deleted]

Re: Why We Can No Longer Trust Microsoft

#266

Post by gutnor »

fixxer wrote: post #241
brudgers wrote: post #214

Earlier quoted context omitted.

It would be grossly unprofessional of the three-letter agencies if they should have failed to run counter-intelligence operations upon the open source communities. Futhermore, given their resources to hire hackers and long history of infiltrating loosely affiliated organizations, it is hard to image that they have struggled to place moles deep within many critical projects. Open source communities have no membership…

I don't think it is wise to trust any system, open or not, so I agree with your thesis. However, the fact that Linux source is available for review does make it more secure on a relative basis. Sure, it is naive to think a zero day couldn't be buried in there, but at least there is the opportunity for review. With a closed-source OS, we don't even have the luxury of a false sense of security. Not to get all tin foily…

And that's what those 3 letters agencies do or at least should do. In addition of planting backdoors their job is also to make sure that their system are backdoor free.

In any case, the Microsoft is providing government with the source code of at least Windows (not sure about Office), so from a source code point of view, that is somewhat ok (minus finding people experienced enough to digest an enormous code base)

The main problem that is common with both Microsoft and OSS is actually checking the binaries. Except for China (to some extend), there is no government that is actually forking the project they use in order to create custom, controlled distro. So they are always going to have to trust their binary source. And that is the weak link.

Re: Why We Can No Longer Trust Microsoft

#267

Post by domdelimar »

chii wrote: post #103
Fuxy wrote: post #51

Windows should be banned in all countries except America. Open source OS is the only way to go. I'm not saying Linux since it's not exactly the most non technical friendly OS for people requiring more than basic usage but windows definitely isn't the OS for the future and it needs to die.

unfortunately, the inertia is too big for any single organization to stop. If you have a business selling software, it would be borderline insane to not target windows as a platform. You may target others, but you _must_ target windows, or basically, get no business. If, or when your resources are limited, you only target windows. So the problem is perpetuated - windows is the only platform that is basically guarente…

If you upload a .zip file (don't know about the other formats) to Google Docs, it can access its content.

There are probably other services/tools, because technically, there's nothing stopping you from unzipping files in the cloud, or in web based software. It's just the matter of uploading something and then downloading the content after it's been unzipped on the remote server. So it's just more expensive in terms of network traffic.

The availability of the tools that do that, other than Google Docs, is another thing. Honestly wouldn't know, don't recall ever needing it before.

Re: Why We Can No Longer Trust Microsoft

#268

Post by [deleted] »

[deleted] wrote: post #261
fixxer wrote: post #243

Earlier quoted context omitted.

> It's asymmetric warfare. But the side without the money is disorganized and open and trusting. The Snowden leak happened (as did Manning), so the Government is not as organized as optics would suggest. They are drowning in the data deluge just like everybody else.

[deleted]

[deleted]

Re: Why We Can No Longer Trust Microsoft

#269

Post by simplyinfinity »

marcosdumay wrote: post #257
Renaud wrote: post #195

Earlier quoted context omitted.

There is always going to be an issue of trust at some point: the linux code base is public, but almost none of us compile linux and the packages we need to build a complete OS from source. We end-up getting pre-built packages from repositories that are often distributed all around the word. How easy/hard would it be to compromise some packages or some repositories if you are determined enough? You certainly could not…

If you have some valuable secret to keep (classified documents, trade secrets, whatever), you'd be stupid if you didn't compile all the software that touch it yourself. "We" get pre-built packages from repositories, but only because "we" don't value our privacy enough.

okay you will compile it ... but will you read all of the 10 million (or whatever the number is) lines of code that will compile to your OS and every package that you need to use ?

Re: Why We Can No Longer Trust Microsoft

#270

Post by puetzk »

dllthomas wrote: post #244
acqq wrote: post #236

Earlier quoted context omitted.

Please explain which exact steps and which assumptions would be needed to have a trusted GCC 4.8.1, both gcc and g++ and then keeping it trusted as the new releases appear. Then the same for LLVM.

I don't know enough about the details of the build dependencies for any of these projects to give exact steps. To get a known-clean build (that is, a build guaranteed to match the source) of GCC 4.8.1, plug the GCC 4.8.1 into the procedure I gave above: In case it wasn't clear, k is used for indexing, and I use "function application" f(x) to mean compilation of x by compiler f. "Take one compiler source (GCC 4.8.1),…

One of the most useful forms of diversity is the "my opponent does not have access to time machine" defense. e.g. use some C compiler for amiga, or 1980's DEC unix, or whatever to bootstrap gcc3 for windows, and use that to bootstrap clang for linux, etc. The odds that hardware and binaries you've had for 30 years could carry a trojan that successfully applies to a compiler that was not written yet, for an architecture that was not designed yet, inserting a trojan for yet another such pair, seem low. Feel free to follow more than one such path if paranoia dictates. When you arrive at the end (some compiler, built with itself), the binaries should all match however you got there, presuming no undefined behavior in the compiler itself. If there is something, fix it.

And better yet if this chosen starting point(s), being old, are also small and simple.

Post reply on HN