4 ms·

"All software is large." FALSE. But this statement does not surprise me. It is this distorted view of programs that is a large part of the "security" problem

"All software is large." FALSE. But this statement does not surprise me. It is this distorted view of programs that is a large part of the "security" problem, in my opinion.

mejari 11y ago
Saying it is false and calling views "distorted" does nothing to further the conversation. If you're interested in furthering conversation on the subject try providing reasoning behind your statements instead of condescension.
- loginusername 11y ago
  Perhaps you could explain how the statement "All software is large" "furthers the conversation"? How am I supposed to respond to that? You think that false statement is a respectable "response" to a comment on the benefits of small software? Small software exists both in the past (when memory and storage were more limited) and in the present. The very idea of small programs is a foundational one in the field of computing. "All software is large" is not a "view" that is in agreement with reality. As such, it is distorted. I am using small software every day. In fact I am writing this comment with a small program. When I write software, it is small, at least relative to anything from Microsoft. I am too dumb to write large software.
  - wvenable 11y ago
    > In fact I am writing this comment with a small program. Which small program is that?
    - loginusername 11y ago
      Are you saying you are unaware of any program that can post text to a web server that is "small"? If all you are aware of is large software, then your statement that "All software is large" makes more sense. "All software is not as large as Microsoft's software." Would you agree with that?
      - mejari 11y ago
        I'm also interested in the answer to their question instead of these diversions.
        loginusername 11y ago
        And why are you interested? A comment in response to a NYT "article" (=PR piece) on Microsoft's approach to "security" where the comment points out that Windows is an extremely large program with layers upon layers of historical cruft and that it remains closed source. Additionally I suggested Windows is the easiest target for finding security flaws. It is a very large attack surface. Is this really controversial? For better or worse, I am responding to these comments no matter how nonsensical they are. The best comments have actually come from Microsoft employees, past or present.
        wvenable 11y ago
        Windows is actually very modular; even the kernel is designed in a micro-kernel style even though it all runs in ring 0. There are versions of Windows with no GUI. Every other comparable operating system is in the same order of magnitude in the size of the code. The attack surface for any large OS is going to be about the same.
        loginusername 11y ago
        "There are versions of Windows with no GUI." Do they run in VGA textmode? I have used a program called "window" and today I use tmux but neither of those come from Microsoft. How do I obtain one of these versions of Microsoft Windows that runs in VGA textmode? "The attack surface for any large OS..." Well yes, because they are all large. But what if the OS is small? Let me guess, now you are going to tell me that all OS, e.g., kernel plus userland, are the same size?
        wvenable 11y ago
        Of course, not all OS kernel plus userland are the same size. However, we aren't talking about "smaller" we are talking about "small". Small being something you can write and/or fully understand. If you wrote your kernel and userland or at least understand every part of it then, congratulations, you made your point. But if you don't, your OS/userland is smaller but it isn't small. And probably most developers could write an OS/userland by themselves given enough time but it would probably be a long time before it's practically useful or secure.
  - wvenable 11y ago
    The point is small software just does less; when you need to do more you either build large software or you put together a bunch of small software which is effectively, from a security standpoint, the same thing. Small programs that don't do anything are secure but nobody cares. And you've probably written software larger than Notepad; a very popular small Microsoft program.
    - loginusername 11y ago
      In contrast to others, this is a comment that reflects truth. The only points I would contest are 1. that "a bunch" is effectively the "same thing" as large software. A "bunch" can vary in number and quality. My userland is a single "multi-call" binary and quite small. The sum total of source code is not so large that I cannot manage it. It's keeping tabs on the kernel code that presents the challenge; and 2. that "nobody cares". If "nobody" cared, then you would not be seeing a comment such as mine because there would be nobody to author it. Moreover there would be no reasonably small kernel source that users like me could use. Some people care enough to maintain that kernel and to keep it relatively small. Maybe that group of people is like the software: small. Suits me just fine.
dang 11y ago
Since this subthread turned into an off-topic flamewar, we detached it from https://news.ycombinator.com/item?id=10588972 https://news.ycombinator.com/item?id=10588972.
- deleted 11y ago
  [deleted]

"All software is large." FALSE. But this statement does not surprise me. It is this distorted view of programs that is a large part of the "security" problem, in my opinion.

mejari 11y ago

Saying it is false and calling views "distorted" does nothing to further the conversation. If you're interested in furthering conversation on the subject try providing reasoning behind your statements instead of condescension.

loginusername 11y ago
Perhaps you could explain how the statement "All software is large" "furthers the conversation"? How am I supposed to respond to that? You think that false statement is a respectable "response" to a comment on the benefits of small software? Small software exists both in the past (when memory and storage were more limited) and in the present. The very idea of small programs is a foundational one in the field of computing. "All software is large" is not a "view" that is in agreement with reality. As such, it is distorted. I am using small software every day. In fact I am writing this comment with a small program. When I write software, it is small, at least relative to anything from Microsoft. I am too dumb to write large software.
- wvenable 11y ago
  > In fact I am writing this comment with a small program. Which small program is that?
  - loginusername 11y ago
    Are you saying you are unaware of any program that can post text to a web server that is "small"? If all you are aware of is large software, then your statement that "All software is large" makes more sense. "All software is not as large as Microsoft's software." Would you agree with that?
    - mejari 11y ago
      I'm also interested in the answer to their question instead of these diversions.
      - loginusername 11y ago
        And why are you interested? A comment in response to a NYT "article" (=PR piece) on Microsoft's approach to "security" where the comment points out that Windows is an extremely large program with layers upon layers of historical cruft and that it remains closed source. Additionally I suggested Windows is the easiest target for finding security flaws. It is a very large attack surface. Is this really controversial? For better or worse, I am responding to these comments no matter how nonsensical they are. The best comments have actually come from Microsoft employees, past or present.
        wvenable 11y ago
        Windows is actually very modular; even the kernel is designed in a micro-kernel style even though it all runs in ring 0. There are versions of Windows with no GUI. Every other comparable operating system is in the same order of magnitude in the size of the code. The attack surface for any large OS is going to be about the same.
        loginusername 11y ago
        "There are versions of Windows with no GUI." Do they run in VGA textmode? I have used a program called "window" and today I use tmux but neither of those come from Microsoft. How do I obtain one of these versions of Microsoft Windows that runs in VGA textmode? "The attack surface for any large OS..." Well yes, because they are all large. But what if the OS is small? Let me guess, now you are going to tell me that all OS, e.g., kernel plus userland, are the same size?
        wvenable 11y ago
        Of course, not all OS kernel plus userland are the same size. However, we aren't talking about "smaller" we are talking about "small". Small being something you can write and/or fully understand. If you wrote your kernel and userland or at least understand every part of it then, congratulations, you made your point. But if you don't, your OS/userland is smaller but it isn't small. And probably most developers could write an OS/userland by themselves given enough time but it would probably be a long time before it's practically useful or secure.
- wvenable 11y ago
  The point is small software just does less; when you need to do more you either build large software or you put together a bunch of small software which is effectively, from a security standpoint, the same thing. Small programs that don't do anything are secure but nobody cares. And you've probably written software larger than Notepad; a very popular small Microsoft program.
  - loginusername 11y ago
    In contrast to others, this is a comment that reflects truth. The only points I would contest are 1. that "a bunch" is effectively the "same thing" as large software. A "bunch" can vary in number and quality. My userland is a single "multi-call" binary and quite small. The sum total of source code is not so large that I cannot manage it. It's keeping tabs on the kernel code that presents the challenge; and 2. that "nobody cares". If "nobody" cared, then you would not be seeing a comment such as mine because there would be nobody to author it. Moreover there would be no reasonably small kernel source that users like me could use. Some people care enough to maintain that kernel and to keep it relatively small. Maybe that group of people is like the software: small. Suits me just fine.

dang 11y ago

Since this subthread turned into an off-topic flamewar, we detached it from https://news.ycombinator.com/item?id=10588972 https://news.ycombinator.com/item?id=10588972.

deleted 11y ago
[deleted]