Journalists to Other Journalists: Call Out Windows | Hacker News Reader

Journalists to Other Journalists: Call Out Windows

techrights.org

21 pointsbensummers24 comments

I don't see a reason for news journalists to act as proxies for Apple etc.'s PR departments. News is news because it's new; there's nothing much new about the dominant platform being targeted by malware, and it's not because Windows is intrinsically flawed, but because it's the big target.

Also, the article's site is an amazingly shrill opponent of anything relating to MS or Bill Gates. "Author Calls for Action to Stop Bill Gates' Abduction of US Education", "Microsoft Exploits the Poor", "Gates Foundation (and Microsoft) Take the Libraries Takeover Global", etc. It reads like the author(s) puppies got squished by MS early in life, or something. Definitely personal, not rational.

Since when does calling out Microsoft equal being PR for Apple? Reporters should be attacking bad policies, no matter what the company. And wether the arguments are rational or personal, they make some good points. Some of the articles seem as if the guy is wearing a tin foil hat but then again, it is well documented what Microsoft has done against Linux/Open Source movement.

No company in the industry has spent more to address security than Microsoft, in absolute terms or in figures relative to their size or market penetration. I say this as an inveterate Apple customer who came up using Linux by way of 386bsd.

You see a journalist "calling out" Microsoft for insecurity, and you've got a coin-flip's chance that that reporter has absolutely no idea what he's talking about when it comes to security.

Yes, Microsoft spent a lot of money on security, and this has paid off to some extent (Win7 is much better than, say, 98); but don't you think they still, well, suck? In at least an absolute sense, if not a relative sense?

Do I enjoy using Win7? No.

Would I trust Win7 code more than... other code? Very yes.

This is basically like asking me, "which would you trust more: code that you're reasonably sure Mike Eddington fuzzed, or code that you're pretty confident he hasn't."

It's not that Microsoft has crappy coders: their programmers are good and motivated. It's not that Microsoft doesn't care about security: they got burnt badly enough that they learned their lesson. It's just that there is so much code.

A good OpenBSD install, even one with lots of functionality, just has much less trusted code (i.e. code which absolutely has to be correct). And while I do like OpenBSD, it's not unique: the other BSDs are also solid, and Solaris - despite a somewhat bad reputation in some circles - is also pretty good.

I'm sure that there are some very smart people working on Windows security; it's just that engineering everything for security beats "features first".

[EDIT: thank you for your reply! I'm happy to learn, even if we're unlikely to convince each other...]

Hey, cool, I recognize you from the OBSD-Misc list.

Anyway: I think they used to suck; I think that a lot of their decisions in things like ActiveX and IE 6 implied that they didn't yet have the kind of focus on security that they have now.

But, despite this article, Microsoft has taken a ton of heat from the computer industry for their various security issues, and I do think they've tightened it up a lot. I also think that the quote in the article conjecturing that we wouldn't see Linux botnets is absurd, given the number of Linux rootkits in the wild. The only reason we aren't seeing Linux botnets is because there aren't enough Linux systems to form one. (A joke, but only a little!)

And, I don't think you can sit a novice computer user in front of a Linux or BSD system and expect them to get security right. chroot Apache still breaks a lot of stuff, and the first inclination from the user is to change httpd to -u.

Microsoft does relatively OK these days.

> No company in the industry has spent more to address security than Microsoft

Then they sure did a shitty job.

One thing that comes to my mind ... those obnoxious UAC screens. I've never had problems on Linux or Mac to type my password for escalated privileges ... but UAC I had to turn off because it was too annoying.

Also, until Win XP SP2 no firewall wasn't included in the Windows distribution. Not to mention all kinds of services that are active by default without the user needing any of them.

I'd sure like to know where those money went.

Here, let me help you with that: how about, by spending tens to hundreds of thousands of dollars per release to have 80% of the software security assessment industry test their products on the dot release?

How about, by delaying the release of major revisions of their code, on multiple occasions by multiple months, to re-audit for vulnerabilities when a single instance of them is found during last-minute testing?

How about, by forcing every single developer in the company to be trained in writing secure C code? (Book jacket of very popular secure coding book: "Required reading at Microsoft - Bill Gates". Hacker News comment from former MSFT developer a couple days ago: "That book actually was required reading at Microsoft.") Or by deprecating the worst of the old C string interfaces, then banning them across their code, and then auditing against that?

I can see where the disconnect is between you and me on this issue. I've actually worked with them on some of this stuff. Far less than many other people in my field. But the UAC and firewall stuff isn't even on my radar.

> trained in writing secure C code

The hubris here is astonishing. After this many decades, hasn't the entire industry adequately demonstrated that that almost all programs have mistakes and that most mistakes in C become security flaws? I've contracted there, I've sprinkled some proprietary buffer annotations around their legacy code, and I'm still not convinced that's enough to make unchecked pointers a reasonable way to write apps.

We might just as productively argue about politics or religion, but I'll sum my response up by saying that roughly 60% of the apps we assess (assessing app security being my day job, and what the company I cofounded does) have no C in them, and those apps are not "more secure" than the apps with C code.

Should "you" write C code? No. You don't have to. You will screw it up in amusing and horrible ways. But don't suggest Microsoft should rewrite Office in Haskell. All that would happen if they did is that we'd learn how to exploit insecure Haskell idioms real fast.

I get that I could write my security model incorrectly in any language. My objection to C is that unchecked pointers can be used to arbitrarily corrupt parts of the program that would otherwise work correctly. But it sounds like you've found that removing these infamous classes of vulnerabilities doesn't actually help--can you explain why that is?

Because there are many other infamous classes of vulnerabilities, many of which are abetted by high-level languages. You don't find a lot of "remote file inclusion"-style flaws in C code, for instance.

Would you say they got their money's worth, then? It seems to me they started with more problems than the other systems you mentioned, so they had a need to spend more. My questions are whether they have achieved the same level of absolute security as the other platforms, and whether they could have achieved what they did while spending less money on a more targeted or efficient approach.

Yes, I think they got their money's worth. I think you'd have a hard time finding 5 security reseachers to credibly claim that they aren't the most secure mainstream platform today.

"What would it be like if Linux, or any real multi-user networking operating system with a sane design, were the standard operating system? I bet money we would not have tens of millions of Linux PCs in botnets, even with a large population of unsophisticated users. No botnets pumping out phishes, spam, and malware, no drive-by infections from merely visiting infected Web sites"

I call BS on this quote. I have no reason to believe that, e.g. firefox on linux is any more secure than firefox on windows. There is no reason a botnet needs root access on a linux hosts. The only reason we don't have huge swarms of linux botnets is that hackers get more bang for the buck by targeting windows.

Firefox is just ridiculously insecure all around as a platform for extensions.

Instead of developing a new least-privilege extension API like Chrome did, Mozilla put in an App Store style review process on A.M.O. for real extensions and developed a new API just for lame themes. They have code signing baked in but don't even use it for their own code, so an annoying 'unsigned' warning is the expected default.

Even with all that, the extensions themselves have highly-exploitable vulnerabilities: http://lwn.net/Articles/348769/

It's probably the best means to get remote code execution on Linux, especially since extensions can bundle native NPAPI plugins.

The entire premise is flawed. Microsoft gets called out all the time in the press for bugs and security flaws.

Not very explicitly. When have you heard some journalist write an article about a "Windows Worm"? They're always always always "PC Worms" or "PC Viruses".

Microsoft gets big credit for releasing a patch for many "PC Worms" or "PC vulnerabilities", but the vulnerability in never ever a "Windows" problem.

Because the standard reporter's assumption is that a "PC" is a computer running Windows. Otherwise, it's a Mac.

Not just reporters, everybody except a small group of techies. Just look at the Mac vs. PC ads, which were really Mac vs. Windows.

I have the same impression and I do think that if only Toyotas had frequent and widespread problems with breaking systems, you'd hear stories about "Toyota break failures" rather than "Car break failures."

I tested my impression with data:

Google news searches:

frequency term

--- ---

0 pc worm

5 windows worm

12 computer worm

0 computer vulnerability

2 pc vulnerability

7 windows vulnerability

6 pc virus

35 windows virus

161 computer virus

According to that site, Microsoft and/or Bill Gates personally have editorial control over the New York Times, the Huffington Post, and most other major news outlets (both print and broadcast). They also claim Microsoft has successfully bribed (to the point of being able to dictate government policy) the Obama administration, the French government, the British government, the US DOJ, the EU competition commission, and various others. (I'm not even going to get into their claims that the real purpose of the Gates Foundation is a eugenics program to eliminate minorities and to colonize Africa).

Flawed premises are par for the course there. (For those who don't recognize the site, it's the old boycottnovell site, with a new name to try to dodge their old reputation).

The publications may be worried MS will pull advertising. Sort of like political campaign funding: fund only those who can and will support you. Sun Microsystems got quite a bit of bad PR during dotgone because it wasn't advertising as much, and when it did, the press improved. So it works both ways, need to spend $$ to get good pr, or to just to avoid bad pr.

Reply on news.ycombinator.com