Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why We Can No Longer Trust Microsoft

pcmag.com

Post reply on HN
Print view View original

271–280 of 310 posts

Re: Why We Can No Longer Trust Microsoft

#271

Post by kayoone »

flyinRyan wrote: post #246
kayoone wrote: post #36

Earlier quoted context omitted.

A couple of years ago some microsoft sales employee probably didnt know about any of this. Also he is talking about mostly self-hosted MS services and i doubt the NSA really has access to that. Also found your conversation style to be quite cocky.

Keep in mind this was in Germany and it doesn't read like native English. I.e. you're almost certainly reading a translation.

Actually im german myself and by reading the translation i immediatly realized it was someone from germany translating that ;) But its more about the general tone that comes across a bit rude..Anyway OP clarified so its fine!

Re: Why We Can No Longer Trust Microsoft

#272

Post by dllthomas »

puetzk wrote: post #270
dllthomas wrote: post #244

Earlier quoted context omitted.

I don't know enough about the details of the build dependencies for any of these projects to give exact steps. To get a known-clean build (that is, a build guaranteed to match the source) of GCC 4.8.1, plug the GCC 4.8.1 into the procedure I gave above: In case it wasn't clear, k is used for indexing, and I use "function application" f(x) to mean compilation of x by compiler f. "Take one compiler source (GCC 4.8.1),…

One of the most useful forms of diversity is the "my opponent does not have access to time machine" defense. e.g. use some C compiler for amiga, or 1980's DEC unix, or whatever to bootstrap gcc3 for windows, and use that to bootstrap clang for linux, etc. The odds that hardware and binaries you've had for 30 years could carry a trojan that successfully applies to a compiler that was not written yet, for an architectu…

I mostly agree, although careful about cross contamination if you're intending to actually use DDC - clang bootstrapped by gcc3 is not going to be independent of gcc3.

Re: Why We Can No Longer Trust Microsoft

#273

Post by acqq »

dllthomas wrote: post #244
acqq wrote: post #236

Earlier quoted context omitted.

Please explain which exact steps and which assumptions would be needed to have a trusted GCC 4.8.1, both gcc and g++ and then keeping it trusted as the new releases appear. Then the same for LLVM.

I don't know enough about the details of the build dependencies for any of these projects to give exact steps. To get a known-clean build (that is, a build guaranteed to match the source) of GCC 4.8.1, plug the GCC 4.8.1 into the procedure I gave above: In case it wasn't clear, k is used for indexing, and I use "function application" f(x) to mean compilation of x by compiler f. "Take one compiler source (GCC 4.8.1),…

You're not giving a useful procedure for me. Let's say that only Gcc can compile itself and its own libraries (e.g version n-1 can compile version n). How can I make trusted GCC 4.8.1 if other compilers won't compile the sources of GCC? Do you agree that I have to implement all the features of GCC used in the sources of GCC in one or more other compilers? If not, don't I have to have a trusted GCC from the start? And if I have such GCC, then I don't need other implementations anyway?

Re: Why We Can No Longer Trust Microsoft

#275

Post by MSvsGOOG »

marcosdumay wrote: post #264
MSvsGOOG wrote: post #94

Earlier quoted context omitted.

>Nor is exchange BCC a copy to the NSA - again someone would have noticed. True, but what about Windows Phone vs. Android (with Google's apps, not just a FOSS build like Replicant) vs. Apple? Which is the lesser evil for your privacy?

> Which is the lesser evil for your privacy? Cyanogen.

With Google's apps? I've already mentioned Replicant (http://replicant.us/) in my original post. Replicant is a fully-FOSS Android distribution based on CyanogenMod.

Re: Why We Can No Longer Trust Microsoft

#276

Post by dllthomas »

acqq wrote: post #273
dllthomas wrote: post #244

Earlier quoted context omitted.

I don't know enough about the details of the build dependencies for any of these projects to give exact steps. To get a known-clean build (that is, a build guaranteed to match the source) of GCC 4.8.1, plug the GCC 4.8.1 into the procedure I gave above: In case it wasn't clear, k is used for indexing, and I use "function application" f(x) to mean compilation of x by compiler f. "Take one compiler source (GCC 4.8.1),…

You're not giving a useful procedure for me. Let's say that only Gcc can compile itself and its own libraries (e.g version n-1 can compile version n). How can I make trusted GCC 4.8.1 if other compilers won't compile the sources of GCC? Do you agree that I have to implement all the features of GCC used in the sources of GCC in one or more other compilers? If not, don't I have to have a trusted GCC from the start? And…

You do need other compilers that can compile the GCC source. These do not need to be trusted, just diverse in origin so that they are unlikely to contain the same attacks.

If GCC is in fact the only thing that can compile GCC, then you cannot use DDC to get a trusted version of GCC.

Re: Why We Can No Longer Trust Microsoft

#277

Post by dllthomas »

astrodust wrote: post #171
cs702 wrote: post #169

GNU/Linux, and Free software and hardware in general, look to be the BIG winners out of the NSA brouhaha, because all non-US governments, businesses, organizations, and individuals around the planet who need to safeguard their private or confidential information now have reason to mistrust proprietary (unauditable) software and hardware. Free, open software and hardware are less likely to have secret 'back doors' ins…

Mistrust of commercial solutions does not translate into trust for open-source ones. Have you audited the crypto code of all your packages? Would you even know how?

Paying someone to audit source I have available to me is going to be cheaper / easier than paying 1) the one group that has access to the source to audit it (in which case I still have to trust them), or 2) paying someone to audit binaries through disassembly.

Re: Why We Can No Longer Trust Microsoft

#278

Post by jiggy2011 »

mtgx wrote: post #252
Renaud wrote: post #195

Earlier quoted context omitted.

There is always going to be an issue of trust at some point: the linux code base is public, but almost none of us compile linux and the packages we need to build a complete OS from source. We end-up getting pre-built packages from repositories that are often distributed all around the word. How easy/hard would it be to compromise some packages or some repositories if you are determined enough? You certainly could not…

But at least it's harder to hide it, and at some point you know it's going to be found out. If we found out about the proprietary solutions spying on us, I think we'll find out even sooner about the open source ones.

Security vulnerabilities are found in OSS programs all the time, how do you tell the difference between negligence/incompetence/mistakes and malicious activity?

Re: Why We Can No Longer Trust Microsoft

#279

Post by genwin »

JohnLBevan wrote: post #115

When a company does what's asked of it by a government and people are upset with the company something's seriously wrong. A company's main priority is typically to make money within the bounds of the law. A government's should be to improve the quality of life and uphold the moral values of its citizens. I have a feeling had Apple been first on board rather than last the journalist would argue that Microsoft were evi…

Hopefully in your thinking there's some limits to what the company would do when asked of it by the gov't. For me it would be anything obviously against the spirit of the Constitution.

Re: Why We Can No Longer Trust Microsoft

#280

Post by talmand »

el_fuser wrote: post #222
talmand wrote: post #209

Earlier quoted context omitted.

Principles must have come to him later in life because I'm sure his first daughter would have something to say about that.

Being principled does not necessarily mean they are principles you agree with!

I suppose that's true.
Post reply on HN