3 ms·

I am convinced that the only thing that approaches the designed security level of an operating system is to buy a machine, completely wipe it and install your o

by a3n 11y ago

I am convinced that the only thing that approaches the designed security level of an operating system is to buy a machine, completely wipe it and install your own paid for copy. It appears that hardware vendors cannot make enough money merely selling hardware, and so they sell access, data and advertising to third parties (at least Superfish was in that area). Being able to mod the software on your car is (I think) recently allowed (by the Librarian of Congress?). But it can be taken away at any revisiting event. I can see the day coming when it will be illegal to wipe a machine, because circumventing.

JoshTriplett 11y ago
> I am convinced that the only thing that approaches the designed security level of an operating system is to buy a machine, completely wipe it and install your own paid for copy. Of something other than Windows, since Windows will automatically run binaries provided by the firmware in the "Windows Platform Binary Table", which hardware vendors now use to reinstall their malware into a fresh Windows install. (Of course, if you don't trust the firmware, it can do any number of other terrible things to you as well. And firmware from major hardware vendors has messed with Windows partitions to reinstall malware even without the WPBT.)
robszumski 11y ago
For what it's worth, Apple machines come secure out of the box, without any of this BS. They even prompt you to set up full disk encryption, and because it's well designed, almost anyone can figure it out.
- tomschlick 11y ago
  This is one of the best things about the Apple eco system. Apple exists to sell you the hardware. All the software is designed to get you to love the experience so much that you will buy more hardware. They don't let anyone fuck with that.
- SixSigma 11y ago
  Except they too have a mechanism for post install infection built in. http://www.extremetech.com/mobile/197005-new-apple-malware-is-undetectable-unstoppable-and-can-infect-any-thunderbolt-equipped-device http://www.extremetech.com/mobile/197005-new-apple-malware-i...
acdha 11y ago
Unfortunately, even that complete wipe is no longer adequate if you run Windows 10, which added a way to silently execute code stored in firmware: http://arstechnica.com/information-technology/2015/08/lenovo-used-windows-anti-theft-feature-to-install-persistent-crapware/ http://arstechnica.com/information-technology/2015/08/lenovo... This isn't an inherently bad idea – it works to provide critical drivers which you might need to get online, for example – but it really underscores how much depends on the OEM being more diligent than they've been in the past.
- lawnchair_larry 11y ago
  That was added in Windows 8. I disagree that it isn't an inherently bad idea.
  - acdha 11y ago
    > I disagree that it isn't an inherently bad idea. How else do you provide any drivers needed to get online? If you store them on the disk, malware or hardware failure will break it. If you use external media, it's an expense to OEMs and something the user will lose before they need it, not to mention the growing number of tablets & other devices which have very limited connectivity options. I would be the first to say that Lenovo abused this and deserves all of the backlash they got but Microsoft created this mechanism to solve a real problem (“Get closer to an Apple-level experience”) which millions of people encounter at some point. Unfortunately, when you cannot trust the hardware vendor the only answer is not to buy from them. There is no level of making the user experience worse or removing features which will prevent them from causing problems if they choose.

by a3n 11y ago

JoshTriplett 11y ago

> I am convinced that the only thing that approaches the designed security level of an operating system is to buy a machine, completely wipe it and install your own paid for copy. Of something other than Windows, since Windows will automatically run binaries provided by the firmware in the "Windows Platform Binary Table", which hardware vendors now use to reinstall their malware into a fresh Windows install. (Of course, if you don't trust the firmware, it can do any number of other terrible things to you as well. And firmware from major hardware vendors has messed with Windows partitions to reinstall malware even without the WPBT.)

robszumski 11y ago

For what it's worth, Apple machines come secure out of the box, without any of this BS. They even prompt you to set up full disk encryption, and because it's well designed, almost anyone can figure it out.

tomschlick 11y ago
This is one of the best things about the Apple eco system. Apple exists to sell you the hardware. All the software is designed to get you to love the experience so much that you will buy more hardware. They don't let anyone fuck with that.
SixSigma 11y ago
Except they too have a mechanism for post install infection built in. http://www.extremetech.com/mobile/197005-new-apple-malware-is-undetectable-unstoppable-and-can-infect-any-thunderbolt-equipped-device http://www.extremetech.com/mobile/197005-new-apple-malware-i...

acdha 11y ago

Unfortunately, even that complete wipe is no longer adequate if you run Windows 10, which added a way to silently execute code stored in firmware: http://arstechnica.com/information-technology/2015/08/lenovo-used-windows-anti-theft-feature-to-install-persistent-crapware/ http://arstechnica.com/information-technology/2015/08/lenovo... This isn't an inherently bad idea – it works to provide critical drivers which you might need to get online, for example – but it really underscores how much depends on the OEM being more diligent than they've been in the past.

lawnchair_larry 11y ago
That was added in Windows 8. I disagree that it isn't an inherently bad idea.
- acdha 11y ago
  > I disagree that it isn't an inherently bad idea. How else do you provide any drivers needed to get online? If you store them on the disk, malware or hardware failure will break it. If you use external media, it's an expense to OEMs and something the user will lose before they need it, not to mention the growing number of tablets & other devices which have very limited connectivity options. I would be the first to say that Lenovo abused this and deserves all of the backlash they got but Microsoft created this mechanism to solve a real problem (“Get closer to an Apple-level experience”) which millions of people encounter at some point. Unfortunately, when you cannot trust the hardware vendor the only answer is not to buy from them. There is no level of making the user experience worse or removing features which will prevent them from causing problems if they choose.