Hacker News Reader

From a security angle, every vendor you use will have a security incident at some point in time given enough time. The real question is how the incident is handled. My issue with the “Microsoft had a security incident obviously you should Migrate away” mentality is that this could be any one of your vendors and if your philosophy/strategy is to ditch your vendors whenever a security incident happens you’re not going to get very far. Anything else like ditching Microsoft but not vendor X or using this to justify no more MS is inconsistent logic.

Edit:

Adding a quote from the OP’s linked blog on the subject:

> There is this well cited argument that cloud companies like Google, Apple, Amazon, Facebook, and you-name-it are able to protect your personal data much better than you are able to. They have military grade security restrictions, better backup methods, and are able to do this much cheaper.

> While this argument being absolutely true, people seem to forget that giving away your data to any third party is the root of many problems in the first place. It is not relevant to whom you are giving your data to.

>Let me explain…

So OP is arguing that this is why you can’t trust anybody not just MS. That’s a stance too, and perhaps for an incredibly security sensitive product the correct one, but definitely an impractical one for probably 98% of software products.

This would sound like ChatGPT if I didn't know better...

All of your arguments are "made up" arguments, they contradict themselves or each other or assume some very unlikely situations, especially on behalf of what the post you replied to wanted to say, where it's clear it's not what it wanted to say.

Let's dive in!

> So are you suggesting that the most practicable alternative is to be a slave

Clearly, the post you replied to doesn't suggest that. (But you went on arguing as if it did).

> a trillion dollar technology vendor is a bit bananas to me.

Nobody's killing Microsoft. But even if they were, maybe that's the right thing? You make no arguments not to.

> If you are trying to run a business, I think you are completely fucking yourself over with this sort of attitude.

The company I work for runs on Linux. The company I worked for before this runs on Linux. The company I worked for before the last one also runs on Linux. And the one before those two -- yes, you guessed it, also runs on Linux. The operating system chosen to run a business was never a serious factor in terms of whether the company succeeded or failed. By and large, it's not important.

Are there specific technologies / products only available on Windows? -- You bet! What should be done about those? -- find a way asap to not make them exclusive to that platform. One of the most tragic situations in this respect is in medicine. Windows is ubiquitous in this field. To the point that I'd say that governments should step in and invest into the healthcare they control to change the situation. I.e. to do the complete opposite of what you are suggesting.

> Microsoft is a big place.

All under the same roof, with the same objectives and strategy, which are to screw you (the "Microsoft shop") in particular, but also, if possible even those who managed to stay away from them. The problems Microsoft creates for the world aren't somehow local to one or two departments of the company. The company, no matter how big is responsible for its policies.

You said it best yourself: The operating system chosen to run a business was never a serious factor in terms of whether the company succeeded or failed.

While I don’t think that statement is universally true because for certain products OS matters, but generally, why would anybody migrate away from windows just because of a security incident? Linux has had its fair share of RCEs and 0-day exploits. Are you saying Linux is intrinsically better?

Yes. In every possible way, yes.

> Are you saying Linux is intrinsically better?

Can we say that the market has spoken?

https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...

I look forward to the day that windows is mostly a UI over WSL and things like the regsitry become a distant memory.

> Can we say that the market has spoken?

Microsoft aggressively abused its monopoly position in order to make sure that Linux would never win in the desktop market, and then inertia took over, so no we can't say that the market has said anything useful

The market is an illusion. Until recently I had no means to buy Linux, I was forced to buy Windows (and it is illegal here, but all you get for going to a trial is not even the price of a licence). Even today the options are very few.

The idea of a market works if it costs ~0 to enter a market, consumers have an infinite access to knowledge and infinite time to make a decision BUT make it in 1s when at the store, and also enough money so as to not be a problem. Basically, consumers have all the power and vendors have none.

Nothing is really a market, and operating systems definitely shows it.

>Until recently I had no means to buy Linux, I was forced to buy Windows

Huh, why not?

Because no computer was sold with Linux in it. There wasn't even an offer, let alone a market.

You can just install it after the fact. Do you lack internet?

Are you serioulsy implying that everyone had hundreds of MB to spare, the knowledge, the material and the time to do it ? I'm talking about the beginning of the century when the only connection was through 56k. I'm talking about being an underage kid who discovers computing, through whatever exists in the store, and you think downloading an iso is straightforward ?

You said 'until recently' but you're describing a situation from the 90s.

It's still true today, machines with Linux can barely be found in stores. You can find them online but that's not always easier for people who are not knowledgeable

It's not true today at all lol. You talked about not having access to Linux and only having dial up speed - that's strictly a 90s problem.

You don't see them in stores because there is not enough demand for them, and because stores are dying anyway. Very easy to find them online to buy.

> only having dial up speed - that's strictly a 90s problem.

Dial up was widespread well into the early 2000's, and even then ADSL started to spread slowly.

> You don't see them in stores because there is not enough demand for them

There is no demand because, again, the market is a lie. One OS is forced to consumers, on the computers they buy in the stores, they use at school, they use at work. That's exactly what I'm saying.

> Very easy to find them online to buy.

Computer literacy of the population is not comparable to the one of people on HN, so no, I wouldn't say it is as easy as buying a linux computer online than buying any computer offline.

Bro you are really arguing for the sake of arguing now.

> Dial up was widespread well into the early 2000's, and even then ADSL started to spread slowly.

Cable became common in the early 2000s, and even if you couldn't get it at home you could go somewhere that had decent speed, certainly to download a 600mb ISO.

Not bothering to address the rest of your contrarian points.

> The idea of a market works if it costs ~0 to enter a market, consumers have an infinite access to knowledge and infinite time to make a decision BUT make it in 1s when at the store, and also enough money so as to not be a problem. Basically, consumers have all the power and vendors have none.

I keep trying to communicate this whenever people are attempting to manifest an Invisible Hand to control bad behavior. More people need to be aware of this.

I like your succinct point. I wish there was something so short and understandable for an even fuller picture. Like including that for a marked to price things in a way that works for societies, consumers need to choose long term over short term gains and that the price needs to not make economic externalities of human rights or destroying the climate.

The thing is: Windows and Office is insecure by default. Admins react by sprinkling anti-virus on top of it, but that doesn't help any.

It still enables users to open random mail attachments in Office or similar. And Office doesn't have any sandboxing or other mitigation in place, again it's insecure by default. If you enable users to do stuff like this, you have noone to blame if you get owned.

Are the usual Linux distro's better? Hell no! They have the same flawed security architecture as Windows, only without any motivated attackers (yet).

But there are actually secure alternatives: QubesOS and ChromeOS.

QubesOS is probably not that suitable to end-users, they can do too much wrong to twart it's security (using the "financial" qube to browse p0rn... etc.).

ChromeOS is a reasonably secure OS: It's root filesystem is read-only with tamper-proof authentication, user's home directory is encrypted. Chrome runs with the usual privilege separation in multiple processes each in it's own tight sandbox. There is no way to autostart anything.

Even in the nuclear case of a 0-day RCE + chained sandbox breakout + privilege escalation to root, the threat can not persist itself... you just reboot the device and are save again.

And Google has lot's of experience in security, they one of the few who build their own browser, the most hostile environment. They are clearly thinking about security front and center and not as an afterthought (like Microsoft).

If those are your criteria, macOS is the better choice for businesses. Certainly not qubesos lol

I didn't argue for moving to Linux. My argument is that we need redundancy. If one system has a huge failure like this one -- we shouldn't find ourselves being hostages of this system.

Similarly, I'm not against Microsoft products being used in hospitals. I'm for transparency of standards, rules used by hospitals to acquire and maintain software, public interfaces, reporting...

If such rules are created and Microsoft is playing by the rules -- then I have no problem with it, but having Microsoft decide what the rules are is a disaster.

You run your own mail?

Ha.

What do principles have to do with ANY of this? Microsoft promised a level of security and didn't deliver, and is now covering up, BADLY.

The only logical solution is to start looking elsewhere, even if you can't switch right now.

YOUR cope appears absolutely delusional.

> How much business convenience are you willing to squander over these principles

I haven't seen such a clear statement of this idea in a very long time[1].

The "principles" you are trading for convenience include control of your network.

[1] Last time was a talk by Bruce Schneier, a long time back. He famously declared if you give people a choice between security and dancing pigs, they'll take the pigs every time.

If only there were an alternative software development modality in which development is distributed, source available, and modification permitted to any party, with open review and analysis for vulnerabilities, and far less capacity for lock-in.

What you're arguing is essentially the Too Big to Fail proposition. The solution of which is to Not Let Things Get That Way.

<https://en.wikipedia.org/wiki/Too_big_to_fail>

> You may be leaving a lot of upside on the table by never considering them as an option.

Maybe, but you're also avoiding a whole lot of downside. I don't think it's unreasonable to avoid Microsoft products, either as a business or as a person.

Whether or not it makes business sense to depends on your business, of course, but there are plenty of successful businesses who avoid Microsoft.