Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why We Can No Longer Trust Microsoft

pcmag.com

Post reply on HN
Print view View original

301–310 of 310 posts

Re: Why We Can No Longer Trust Microsoft

#301

Post by phaemon »

vacri wrote: post #288
phaemon wrote: post #166

Earlier quoted context omitted.

It's as though you're being bullied by two people, and when you try to deal with one of them, you're accused of being unfair because you can't deal with both! It sounds very much as though it was the bullies who decided what was "fair" in this instance.

The boycott request was a call to community action. You're reframing it as a single individual's struggle for survival, which isn't the same thing.

I see; you think it's right for the individual but wrong for a group.

Why? What changes?

Re: Why We Can No Longer Trust Microsoft

#302

Post by seunosewa »

el_fuser wrote: post #287
seunosewa wrote: post #283

Earlier quoted context omitted.

I think pushing your suppliers hard to correct a serious flaw in a key product is pragmatic.

"serious flaw" == hyperbole

I think the lesson of Apple's recent success is that such things matter.

Re: Why We Can No Longer Trust Microsoft

#303

Post by vacri »

phaemon wrote: post #301
vacri wrote: post #288

Earlier quoted context omitted.

The boycott request was a call to community action. You're reframing it as a single individual's struggle for survival, which isn't the same thing.

I see; you think it's right for the individual but wrong for a group. Why? What changes?

I didn't say it was right, I said it was different and that your reframing wasn't appropriate.

What changes? For a start, the more people that are involved, the less each knows of the situation. A single individual being bullied is aware of each incidence and what it going on at all times. A group doesn't - witness mob justice as a clear counterpoint. A group is highly susceptible to hearsay and misdirection.

As for why it's unfair - if we expect the judicial system to be fair when it acts on our collective behalves, it is dissonant to not expect other group action to also be fair in how it's meted out.

Re: Why We Can No Longer Trust Microsoft

#304

Post by phaemon »

vacri wrote: post #303
phaemon wrote: post #301

Earlier quoted context omitted.

I see; you think it's right for the individual but wrong for a group. Why? What changes?

I didn't say it was right, I said it was different and that your reframing wasn't appropriate. What changes? For a start, the more people that are involved, the less each knows of the situation. A single individual being bullied is aware of each incidence and what it going on at all times. A group doesn't - witness mob justice as a clear counterpoint. A group is highly susceptible to hearsay and misdirection. As for…

So you don't think it's right for an individual?

I don't see why a group being "susceptible to hearsay and misdirection" is a good reason for their ire to be directed at more companies rather than just one.

I also don't see any reason why a group fighting against the injustices they can tackle, obliges them to take on the ones they can't.

EDIT: To take your example of the justice system - if I steal from someone, it would not be a valid defence to point out that other people had not been successfully convicted of stealing, therefore I should not be prosecuted.

Re: Why We Can No Longer Trust Microsoft

#305

Post by Yetanfou »

aclevernickname wrote: post #289
brudgers wrote: post #214

Earlier quoted context omitted.

It would be grossly unprofessional of the three-letter agencies if they should have failed to run counter-intelligence operations upon the open source communities. Futhermore, given their resources to hire hackers and long history of infiltrating loosely affiliated organizations, it is hard to image that they have struggled to place moles deep within many critical projects. Open source communities have no membership…

When people ask me why I switched to Gentoo, I'm going to borrow liberally from this post as justification. I know the code my system was built on now. It's trivial to do an audit of that code, as well. I didn't have that security with RHEL/Fedora or Ubuntu/Debian If you didn't build your OS, you'd better trust the person/people that did.

I trust you audited your compiler, assembler (et al) as well then? The C library? All device drivers? Your BIOS? Firmware on everything from your mouse and keyboard to that USB stick you just used?

While free software does make it possible to gain some confidence in running TLA-free code it does not make it a simple job. Just stating that you ' know the code my system was built on now' is like stating you 'know what you eat because you read the label on the can'. There might be more in that can than the label tells you...

Re: Why We Can No Longer Trust Microsoft

#306

Post by aclevernickname »

Yetanfou wrote: post #305
aclevernickname wrote: post #289

Earlier quoted context omitted.

When people ask me why I switched to Gentoo, I'm going to borrow liberally from this post as justification. I know the code my system was built on now. It's trivial to do an audit of that code, as well. I didn't have that security with RHEL/Fedora or Ubuntu/Debian If you didn't build your OS, you'd better trust the person/people that did.

I trust you audited your compiler, assembler (et al) as well then? The C library? All device drivers? Your BIOS? Firmware on everything from your mouse and keyboard to that USB stick you just used? While free software does make it possible to gain some confidence in running TLA-free code it does not make it a simple job. Just stating that you ' know the code my system was built on now' is like stating you 'know what…

> I trust you audited your compiler, assembler (et al) as well then? The C library? All device drivers? Your BIOS? Firmware on everything from your mouse and keyboard to that USB stick you just used?

yes. you can very much trust that. I appreciate that you've never decided to do an audit of GCC's, glibc's, or your kernel's source, but understand that others have. I am one of them.

As for any binary blobs/firmware I can't peek into, that's why I have software [1] running on the gateway to see if anything phones home. So far, nothing has. If it's not communicating with anyone, I can be reasonably sure it isn't compromising my security.

Also, your reply was almost entirely an argument from incredulity [2], a logical fallacy.

[1] http://www.opennms.org/ and a strict whitelist. Yes. I've audited the gateway as well.

[2] http://rationalwiki.org/wiki/Argument_from_incredulity

Re: Why We Can No Longer Trust Microsoft

#307

Post by gtirloni »

fixxer wrote: post #241
brudgers wrote: post #214

Earlier quoted context omitted.

It would be grossly unprofessional of the three-letter agencies if they should have failed to run counter-intelligence operations upon the open source communities. Futhermore, given their resources to hire hackers and long history of infiltrating loosely affiliated organizations, it is hard to image that they have struggled to place moles deep within many critical projects. Open source communities have no membership…

I don't think it is wise to trust any system, open or not, so I agree with your thesis. However, the fact that Linux source is available for review does make it more secure on a relative basis. Sure, it is naive to think a zero day couldn't be buried in there, but at least there is the opportunity for review. With a closed-source OS, we don't even have the luxury of a false sense of security. Not to get all tin foily…

When was the last time you reviewed the Linux kernel code looking for possible backdoors, found none and compiled your own kernel? Btw, when was the last time you reviewed the GCC code looking for possible backdoors, found none and built it from scratch? Btw, when was the last time...

Most companies and users get their pre-compiled distros and never bother because it's an impossible task so I don't see how open source is any better in this regard.

Re: Why We Can No Longer Trust Microsoft

#308

Post by gtirloni »

aclevernickname wrote: post #306
Yetanfou wrote: post #305

Earlier quoted context omitted.

I trust you audited your compiler, assembler (et al) as well then? The C library? All device drivers? Your BIOS? Firmware on everything from your mouse and keyboard to that USB stick you just used? While free software does make it possible to gain some confidence in running TLA-free code it does not make it a simple job. Just stating that you ' know the code my system was built on now' is like stating you 'know what…

> I trust you audited your compiler, assembler (et al) as well then? The C library? All device drivers? Your BIOS? Firmware on everything from your mouse and keyboard to that USB stick you just used? yes. you can very much trust that. I appreciate that you've never decided to do an audit of GCC's, glibc's, or your kernel's source, but understand that others have. I am one of them. As for any binary blobs/firmware I c…

That'd be impressive work (auditing all that code in a single lifetime). Could you share your techniques?

Re: Why We Can No Longer Trust Microsoft

#309

Post by jokoon »

acqq wrote: post #194
jokoon wrote: post #189

Earlier quoted context omitted.

> Mistrust of commercial solutions does not translate into trust for open-source ones. Well, how well can you trust the commercial ones ? At least with open source, you can look into it more easily and eventually find security holes. It's a step towards trust. There is no trust to gain with commercial solutions, but at least with open source, it's at least possible. The fact that proprietary agrees with a sound marke…

how well can you trust the commercial ones ? At least with open source, you can look into it more easily and eventually find security holes. It's a step towards trust. There is no trust to gain with commercial solutions, but at least with open source, it's at least possible. Ever heard of reverse engineering? It turns out you'd need even that approach even with open source as soon as you use binaries you haven't comp…

You seem quite paranoid.

Open source was thought to sweep away for hidden code, I really doubt GCC or other compilers has that special code that is reproduced each time you recompile a compiler with it.

If there was such self-reproducing code in a compiled GCC, it would be quite easy to find. There are many eyes looking at a program like GCC.

And even with such a conspiracy theory, which is still possible, open source has better margin than proprietary. It's not perfect, but it's much more transparent if you get what I mean.

Re: Why We Can No Longer Trust Microsoft

#310

Post by Yetanfou »

aclevernickname wrote: post #306
Yetanfou wrote: post #305

Earlier quoted context omitted.

I trust you audited your compiler, assembler (et al) as well then? The C library? All device drivers? Your BIOS? Firmware on everything from your mouse and keyboard to that USB stick you just used? While free software does make it possible to gain some confidence in running TLA-free code it does not make it a simple job. Just stating that you ' know the code my system was built on now' is like stating you 'know what…

> I trust you audited your compiler, assembler (et al) as well then? The C library? All device drivers? Your BIOS? Firmware on everything from your mouse and keyboard to that USB stick you just used? yes. you can very much trust that. I appreciate that you've never decided to do an audit of GCC's, glibc's, or your kernel's source, but understand that others have. I am one of them. As for any binary blobs/firmware I c…

OK, not to be the devil's advocate... but why are you so sure that nothing phones home? The mere fact that nothing on your network connects to https://bigbrother.com/snoop.php?suspectname=aclevernickname... is not solid proof of nothing phoning home. There are many ways of communication over a network, are you sure you check all of them?

If your answer is 'yes'... you should check again :-)

As to you having 'audited' all code running on your network, I can flatly state I don't believe it. I don't doubt you'll have looked over the source for a part of it but there is a difference between 'looking over code' and 'auditing code'. Take the Linux kernel for an example: as of 2013, the Linux 3.10 release had 15,803,499 lines of code (source: Wikipedia:Linux_kernel). Linux for Workgroups has even more. Glibc is good for another 1,188,385 lines of code (source: http://www.ohloh.net/p/glibc). The gcc collection spans 6,242,908 lines (source: http://www.ohloh.net/p/gcc). These are only those projects you mentioned (' I appreciate that you've never decided to do an audit of GCC's, glibc's, or your kernel's source, but understand that others have. I am one of them.').

Understand that an individual who claims to have audited all code on his or her network does not come across like someone who grasps the magnitude of the effort s/he claims to have conquered. This individual either has superhuman powers and unlimited time, or the individual overestimates the efficacy of his or her 'auditing' efforts.

Rationalwiki has just the article to help you decide which of these two is the most likely: http://rationalwiki.org/wiki/Occam%27s_razor

Post reply on HN