Hacker News Reader

Comment by nickpsecurity | Hacker News Reader

The question started with Mac OS X is best as status quo. Then asked about a switch to Windows 10. So, my comparison was initially Win10 vs Mac points.

"These are not Linux concerns because Linux is open source."

A myth repeatedly debunked about Linux and OSS in general. It's the quality of contributions and review that matter. Not whether source is widely available. It's why so many FOSS software has horrible quality or security. Gotta judge case by case basis.

View on HN

Closed source is not more secure and of higher quality than open source.

My point is whether open or closed has nothing to do with security in practice. What does it is (a) effort put in, (b) by who, and (c) how long. There's also a tangent here where it's Cathedral model, which is like closed one, vs the Bazaar model of groups contributing to stuff like typical FOSS. I claim only Cathedral leads to strong security with open or closed mostly irrelevant. Let's test it.

So far, the strongest security ever achieved was by small groups with closed developmemt that were proprietary or later open-sourced (but not developee in FOSS style). Compare assurance of VAX A1-class VMM to any open one, KeyKOS's security + automatic availability vs any BSD or Linux, NonStop's availability vs any OSS cluster scheme, AAMP7G vs any open-developed CPU, defect rate of paid SSL to OpenSSL, djbdns (focused individual) or Secure64 (closed) vs BIND, OpenVMS CVE's & reliability vs other OS's, Google's F0 RDBMS vs any non-cathedral one, AllegroCache vs open ORM & RDBMS, Opa vs common Web stuff, SPARK Ada vs C subsets/tooling, VLISP Scheme vs your favorite LISP, MULTOS cards vs open smartcards, guarantees of Hamilton's 001 toolkit vs UML + C and Java.

There's almost no comparison when you focus on security or quality oriented projects. Open barely has anything in that area, Bazaar has nothing off top of head, and Cathedral has all with highest assurance having more closed products in past & maybe present.

Field evidence shows clearly open model can't or hasn't gotten it done. It's always Cathedral. From there, closed producers both invented high-security & correctness plus demonstrated it more often in defense (eg Rockwell-Collins AAMP7G), private high-security (eg Praxis Correct-by-Construction), private high-safety (eg DO-178B stuff like Esterel SCADE), govt high-safety (eg NASA's guidance/tooling), and academia (eg CheriBSD, Softbound+CETS, GenodeOS, or NaCl). The best stuff with highest assurance or immunity to key issues stays in those with OSS steadily producing nothing or staying close to it. OpenBSD is a semi-exception as it's openly developed with Cathedral model but some outside contributions in TCB. And recently Rust.

So you're wrong. Most trustworthy stuff is usually closed or has central, controlled developmemt. Almost nothing FOSS. They usually fo have shitloads of easily-avoided errors in theirs. Like they barely care. First step toward improving that baseline is recognizing it exists instead of pretending OSS model got anywhere by itself. Nope. Takes specialized talent, applying proven principles, and work. Lots of it.

You seem to have lost focus. Let me remind you what issue I am commenting on is https://news.ycombinator.com/item?id=12148735

The original thread dismissed a switch to Windows from Mac on basis of serious issues with Windows these days. Especially built-in surveillance and intentionally pissing off own user-base. Linux was never considered because, as of 2016, it's still a shitty desktop in all kinds of ways they just avoid fixing or are unable to:

http://linuxfonts.narod.ru/why.linux.is.not.ready.for.the.de...

Whereas Mac and Windows 7 are both great desktops that constantly polished stuff that users found to be a problem, steadily improved security, perform well, and have power-user features. Nowhere near customization or security I can with much effort get out of a Linux box. Yet, Windows (esp Windows Embedded) plus their admin tools show I wouldn't even need it if Linux had similar advantages. So, Linux is crap far as UX is concerned and that's intentional by many of its supporters or developers where UX is intrinsic to Mac and Windows platforms. Amiga, too, as MorphOS illustrates with way less resources than Linux desktops are getting. BeOS derivatives to a degree as the extremely-strapped Haiku is illustrating & its predecessor BeOS illustrated.

So, the baseline was Windows/Mac usability & ecosystem plus specific issues I mentioned in security & corporate character for recent Windows. Your next comment razor focused on open/closed source issue. My reply showed it didn't matter much since QA process and qualified reviews are what really count. Showed with evidence that OSS superiority for security was a myth since you brought that up next. Far as my concern, the lack of integrity of Microsoft or Apple means at least the TCB of system needs to be easy to inspect and enhance. Much of Mac is closed but I thought Darwin core was open and it supported many open-source, secure apps. Stronger position than Windows in this aspect.

So, we have two, usable desktops with one being more open and UNIX-like than the other. Makes little sense too switch away from the better one unless serious changes happen at Microsoft, Apple, or both. Also, one can always leverage secure virtualization or physical separation to get benefits of main OS for untrusted stuff with trusted stuff on FOSS OS. That one could be Linux but quality of most sucks. So, it would have to be one of most stable & reliable ones. I'd lean toward FreeBSD or OpenBSD with simplified, software stack for that, though.

Reply on news.ycombinator.com