4 ms·

>How are you ever going to assess the quality of this software in terms of security? I am not aware of a single third party that has reviewed all of the code t

by ksk 11y ago

>How are you ever going to assess the quality of this software in terms of security? I am not aware of a single third party that has reviewed all of the code that goes into a Linux distribution. Do you know of one?

loginusername 11y ago
Not sure what Linux has to do with my comment. Are you assuming I use a Linux "distribution"? Sometimes I have done so, but only occasionally when I need to check something on Linux. Anyway, I am missing your point.
- neckro23 11y ago
  You're not sure what the most popular open-source OS has to do with your comment about open source OSes?
  - loginusername 11y ago
    Nope. Maybe you can explain? My comment was about closed source versus open. Popularity is only relevant to the extent someone would argue Windows is not the easiest target but rather the most frequent one, due to its popularity, i.e., userbase size. There's more to open source than just Linux.
- ksk 11y ago
  Well, I simply highlighted the difference between theory and practice. The average user does not have the money to audit open source software. And even if you get someone to bankroll the cash, you will need to re-do the audit for every single check-in since the audit. You made a point about Windows being impossible to audit, but in practice you're in pretty much the same boat when it comes to Linux.
  - loginusername 11y ago
    Again, you mention Linux. I do not use it. How is it relevant to my comment? And then there's this mythical "average user". But what does that have to do with me and my own solutions? I know only one user: myself. I know what works for me. I live in a tty. Do I need a Windows GUI? No. Finally, I also know that what one can do, another can do. But that is their decision and I am not trying to convince anyone to do what I do. Windows is a massive, complex truckload of legacy source code that keeps growing with every edition; it has a lot of flaws and the number grows every year; it is not "open source" in the sense of public source code respositories and enabling users to compile from source. This is not opinion. It's fact. These facts do contribute to the state of Windows "security". Bravo for fixing flaws in recent years. But no points for having them to begin with: poor quality control.
    - ksk 11y ago
      >Again, you mention Linux. I do not use it. How is it relevant to my comment? Um, because you compare like to like. If you are comparing millions of lines of code to 10,000 lines of code, then obviously its easier to audit. Your point about auditing code makes no sense unless you compare the task of auditing equal amounts of source code. >Windows is a massive, complex truckload of legacy source code that keeps growing with every edition Please enlighten us how you got access to the source code, which parts you evaluated, what methods you used to evaluate it, and why you think those methods are accurate and scientifically valid. Unless you do those things, you cannot claim to be fact based. Its fine to have an opinion. Many non technical users who don't understand the NT OS design, confuse the implementation flaws of user mode code, kernel code, third party code, and are unable to differentiate it from NT design flaws. Sure, from a responsibility standpoint, I'm right there with them - If you ship it - you should own up to the flaws regardless of where they come from. I think that MS in the past made some super bone headed decisions (possibly driven by commercial reasons) that screwed them security wise because the 'default install' of Windows was insecure out of the box. > But no points for having them to begin with: poor quality control. How do you know this? As an aside, I find it ironic for you to lament about "complex truckload of legacy source code" while using a TTY which itself is the exact same thing. Ah ! C'est la vie

by ksk 11y ago

loginusername 11y ago

Not sure what Linux has to do with my comment. Are you assuming I use a Linux "distribution"? Sometimes I have done so, but only occasionally when I need to check something on Linux. Anyway, I am missing your point.

neckro23 11y ago
You're not sure what the most popular open-source OS has to do with your comment about open source OSes?
- loginusername 11y ago
  Nope. Maybe you can explain? My comment was about closed source versus open. Popularity is only relevant to the extent someone would argue Windows is not the easiest target but rather the most frequent one, due to its popularity, i.e., userbase size. There's more to open source than just Linux.
ksk 11y ago
Well, I simply highlighted the difference between theory and practice. The average user does not have the money to audit open source software. And even if you get someone to bankroll the cash, you will need to re-do the audit for every single check-in since the audit. You made a point about Windows being impossible to audit, but in practice you're in pretty much the same boat when it comes to Linux.
- loginusername 11y ago
  Again, you mention Linux. I do not use it. How is it relevant to my comment? And then there's this mythical "average user". But what does that have to do with me and my own solutions? I know only one user: myself. I know what works for me. I live in a tty. Do I need a Windows GUI? No. Finally, I also know that what one can do, another can do. But that is their decision and I am not trying to convince anyone to do what I do. Windows is a massive, complex truckload of legacy source code that keeps growing with every edition; it has a lot of flaws and the number grows every year; it is not "open source" in the sense of public source code respositories and enabling users to compile from source. This is not opinion. It's fact. These facts do contribute to the state of Windows "security". Bravo for fixing flaws in recent years. But no points for having them to begin with: poor quality control.
  - ksk 11y ago
    >Again, you mention Linux. I do not use it. How is it relevant to my comment? Um, because you compare like to like. If you are comparing millions of lines of code to 10,000 lines of code, then obviously its easier to audit. Your point about auditing code makes no sense unless you compare the task of auditing equal amounts of source code. >Windows is a massive, complex truckload of legacy source code that keeps growing with every edition Please enlighten us how you got access to the source code, which parts you evaluated, what methods you used to evaluate it, and why you think those methods are accurate and scientifically valid. Unless you do those things, you cannot claim to be fact based. Its fine to have an opinion. Many non technical users who don't understand the NT OS design, confuse the implementation flaws of user mode code, kernel code, third party code, and are unable to differentiate it from NT design flaws. Sure, from a responsibility standpoint, I'm right there with them - If you ship it - you should own up to the flaws regardless of where they come from. I think that MS in the past made some super bone headed decisions (possibly driven by commercial reasons) that screwed them security wise because the 'default install' of Windows was insecure out of the box. > But no points for having them to begin with: poor quality control. How do you know this? As an aside, I find it ironic for you to lament about "complex truckload of legacy source code" while using a TTY which itself is the exact same thing. Ah ! C'est la vie