Hacker News Reader

Comment by Endy | Hacker News Reader

And this kind of crap is why I use Windows.

Microsoft brings its own problems in. While it's true that NT's security model is much stronger than the Unix style (no ACLs on anything??), MS has really gone overboard recently. Install IIS and see the myriad things to check off. Dynamic compression is separate from static compression and you must install them apart from IIS alone.

The absolute best example: You cannot listen to HTTP without extra permissions. You can bind to port 80 and parse HTTP yourself. But if you ask Windows to do that for you, it's access denied. This is entirely illegitimate and many people just deal with it by running with admin permissions, rather than screw around trying to setup ACLs on HTTP prefixes. (The only context in which it makes sense is port sharing, so as to register certain prefixes. But in that case the port'll already be in use.)

Depending on OS flavor UNIX has had ACLs piled on top of the classic owner-group-other security model for decades.

SELinux in particular has decent ACL capabilities. By default Apache's policy allows listening on port 80 and a few other well known ports - you can configure the app to listen on $RANDOM_PORT but all that'll get you is an error in a logfile until you use semanage to fix it.

Or did I misunderstand your statement about no ACLs on anything?

I mean the default Unix model, like filesystem permissions, just have the very limited owner-group-everyone bits, nothing serious. SELinux does add a lot in but it's more of a bolt-on right? Compared to Windows where every thing, even an individual thread or other objects, come with ACLs.

Linux supports POSIX ACLs, which I would classify as "default Unix" since it's POSIX, and also supports some extended non-portable ACLs:

http://linux.die.net/man/5/acl

http://www.vanemery.com/Linux/ACL/POSIX_ACL_on_Linux.html

Ah yes, Windows, where you wake up one day and have a completely different OS.

That whole one time leading into 95 (b.")b

I detest Windows and touch it as rarely as possible, but this week I had to make an emergency trip to a client's office to re-share a folder after a server had "upgraded" itself from 7 to 10.

Funny, I'm still on Windows 7 - I know which "updates" are related to the Win10 upgrade thanks to the well-written Microsoft kdb articles (not sarcasm), and I disable them. No problem here.

Really hoping that was sarcasm.

Nope. I'm greatly discomfited that my computer browses a UNIX/Linux backed internet - I'd rather stick to those sites backed by Windows.

Reply on news.ycombinator.com