6 ms·

Microsoft is trying to unify as many devices as possible, in an effort to secure Windows around the world. Too many people are running insecure versions of Win

by dimino 10y ago

Microsoft is trying to unify as many devices as possible, in an effort to secure Windows around the world. Too many people are running insecure versions of Windows, and frankly I'd rather break them (the small percentage that they are) than have that many botnets out there, sending spam, breaking bitcoin consensus, and all kinds of other nefarious things.

0x0 10y ago
What's insecure about Windows 7? It still receives security updates? In 5 years time, will you consider a fully patched Windows 10 to be an "insecure version of Windows" too? Why not? Did you consider Windows 7 insecure when it was first released?
- dimino 10y ago
  This is a shortsighted way of thinking. The goal is to move beyond "releases", and to a continuously upgrading OS, like OS X. Sure, OS X has new releases, but adoption rate is high, and Apple is quick to cut support for legacy versions. Microsoft is working towards that. The visceral reaction towards Microsoft for trying this is just a general "I want to be in control for the sake of being in control" reaction that carries no legitimate value.
  - wolfgke 10y ago
    > The visceral reaction towards Microsoft for trying this is just a general "I want to be in control for the sake of being in control" reaction that carries no legitimate value. Since Windows 10 brings built-in surveillance functions to the table and will be the first version to support the dubious Intel SGX (Software Guard Extensions), it is much better to be safe than sorry or in your words: better to be in control for the sake of being in control than in no control.
    - dimino 10y ago
      Windows 10 doesn't have built-in "surveillance functions". Your cell phone is much worse, from a "surveillance functions" point of view. It's got GPS in it, they know where you are all the time!!! Give me a break...
      - wolfgke 10y ago
        > Your cell phone is much worse, from a "surveillance functions" point of view. It's got GPS in it, they know where you are all the time!!! That is one of the many reasons why I don't have a cell phone.
        dimino 10y ago
        You don't have a cell phone but for you the Windows breaking point was when Win10 came out? I think you're either not being very honest, or you don't know about the myriad of privacy issues Microsoft has had over its entire lifetime...
        wolfgke 10y ago
        I know that I tolerated some things that Microsoft did for too long. I'm far from perfect here. What Microsoft did in Windows 10 was rather the final straw. I nevertheless still stand by my thesis that the privacy issues that Windows introduced in the past have been far less severe than the privacy issues cell phones introduce (let alone for the fact that one can be geolocated for the whole time). By the way: I know quite some people who don't have a cell phone for similar reasons.
        dimino 10y ago
        > By the way: I know quite some people who don't have a cell phone for similar reasons. Please, I beg of you -- don't even pretend like this view holds a significant percentage of the greater population's mind.
        internaut 10y ago
  - 0x0 10y ago
    I think it is more a reaction that Microsoft is suddenly "changing the deal" and forcing users to get something that was never part of the bargain. People are feeling cheated and tricked and lose all trust in Microsoft. Heck, people are getting interrupted with a forced upgrade when they livestream games or present the weather on TV. Who knows if there's more surprises in the windows 10 pipeline?
    - dimino 10y ago
      I hope there are many more "surprises" in store for the luddites who refuse to install a modern operating system on their computers. This actively harmful view of how computer security works needs to be swiftly punished.
      - 0x0 10y ago
        What's insecure about Windows 7? It still receives security updates?
        dimino 10y ago
        This is a shortsighted way of thinking. The goal is to move beyond "releases", and to a continuously upgrading OS, like OS X.
        detaro 10y ago
        Why is "I have a secure OS that still is supported and will be for quite a while, I'll upgrade when I replace this computer/have to reinstall the OS anyways" shortsighted?
        dimino 10y ago
        Because the people providing support would rather not. They're the ones telling you to upgrade.
        10y ago
  - 5ilv3r 10y ago
    Well, hopefully this becomes a nice driver for the homebrew computer scene. It's quite possible to assemble an internet capable (not web) computer from discrete chips on a breadboard now. Perhaps the users need some more choices.
  - detaro 10y ago
    And they can totally move to that scheme with windows 10. People (including me) paid for non-upgrading versions and the promise to get upgrades up to point X. I didn't pay for Microsoft to randomly break my workflow and push attention challenges on me before point X. Advertising for Windows 10 is fine, I didn't mind the initial "you can download windows 10 right now for free" reminders particularly much and did upgrade one of my systems quite quickly. I do not appreciate having to jump to hoops to keep other machines (running an OS that is still in support, and will be for quite some time) working as I need them right now.
    - dimino 10y ago
      I don't honestly care what you pictured in your head you were paying for, because it clearly was different from what you got. Your unhappiness as a customer of Microsoft is completely worth it for me, as someone who would eventually otherwise get spammed by the botnet on your computer, not to mention the Iranian citizen who thanks you for not participating, unwittingly, in a TOR identification network. I don't know how to put this in a way that will break through your selfishness, but being on the Internet is not just a "you" thing. You're participating in the worlds largest network of computers, and if you get to pick and choose, manually, when you update your computer, then you're going to be a bad actor. Your "kid" and my "kid" are in the same "classroom", so I'd like for you to keep up with modern "medicine", even if it's temporarily inconvenient to you.
      - detaro 10y ago
        What essential security flaws do current Windows versions have that justify to force an upgrade right now, or what reasons do you have to believe they will have them soon? You are talking in a lot of hypotheticals.
        dimino 10y ago
        Like I said elsewhere, this is a shortsighted view. Windows version fragmentation is a security problem, in general, just like any other software fragmentation. There isn't a specific unsupported thing that's currently out there, but only because Microsoft has committed to supporting legacy versions of Windows. There is a fundamentally superior solution to fixing bugs in many places, and that solution is to only have one place to fix a bug. This isn't hypothetical, look at OS X. There have already been a number of vulnerabilities they've simply refused to fix in relatively recent legacy versions of their OS, because of the cost in doing so. From a "how does this personally help me?" standpoint, if Microsoft can cut legacy teams, the people on those teams get to work on new cool things that make your investment in their latest OS more valuable. By forcing them to support legacy versions, you're holding them back, and therefore holding yourself back (since you bought their product).
arm 10y ago
“Too many people are running insecure versions of Windows, and frankly I'd rather break them” Seriously? I think this old Hacker News comment thread¹ does a good job of covering all the points outlining why that’s a bad idea. Also, do you seriously think that upgrading their OS will stop users from continuing to download and install malware? ―――――― ¹ — https://news.ycombinator.com/item?id=11638048 https://news.ycombinator.com/item?id=11638048
- dimino 10y ago
  > Also, do you seriously think that upgrading their OS will stop users from continuing to download and install malware? Yes, I do. An operating system without a particular vulnerability cannot be infected by malware that exploits said vulnerability. As for that thread, you're going to have to be more specific, nothing I read in there is much more than what I said earlier, control for it's own sake. This is tantamount to the antivax movement.
  - 5ilv3r 10y ago
    Downgrading the component to before the introduction of the flaw would be safer by far.
    - dimino 10y ago
      That is an interesting idea, and on first blush I do think it'd be safer, but it does rely on figuring out exactly when the flaw was introduced, and will result in the "YoYoing" of features, which is confusing from a consumer standpoint.
      - 5ilv3r 10y ago
        POCs are a part of any good bug disclosure. It should be easy to test that one is no longer affected. Besides, trying older versions to undo problems is a very old and reliable technique.
        10y ago

by dimino 10y ago

0x0 10y ago

What's insecure about Windows 7? It still receives security updates? In 5 years time, will you consider a fully patched Windows 10 to be an "insecure version of Windows" too? Why not? Did you consider Windows 7 insecure when it was first released?

dimino 10y ago
This is a shortsighted way of thinking. The goal is to move beyond "releases", and to a continuously upgrading OS, like OS X. Sure, OS X has new releases, but adoption rate is high, and Apple is quick to cut support for legacy versions. Microsoft is working towards that. The visceral reaction towards Microsoft for trying this is just a general "I want to be in control for the sake of being in control" reaction that carries no legitimate value.
- wolfgke 10y ago
  > The visceral reaction towards Microsoft for trying this is just a general "I want to be in control for the sake of being in control" reaction that carries no legitimate value. Since Windows 10 brings built-in surveillance functions to the table and will be the first version to support the dubious Intel SGX (Software Guard Extensions), it is much better to be safe than sorry or in your words: better to be in control for the sake of being in control than in no control.
  - dimino 10y ago
    Windows 10 doesn't have built-in "surveillance functions". Your cell phone is much worse, from a "surveillance functions" point of view. It's got GPS in it, they know where you are all the time!!! Give me a break...
    - wolfgke 10y ago
      > Your cell phone is much worse, from a "surveillance functions" point of view. It's got GPS in it, they know where you are all the time!!! That is one of the many reasons why I don't have a cell phone.
      - dimino 10y ago
        You don't have a cell phone but for you the Windows breaking point was when Win10 came out? I think you're either not being very honest, or you don't know about the myriad of privacy issues Microsoft has had over its entire lifetime...
        wolfgke 10y ago
        I know that I tolerated some things that Microsoft did for too long. I'm far from perfect here. What Microsoft did in Windows 10 was rather the final straw. I nevertheless still stand by my thesis that the privacy issues that Windows introduced in the past have been far less severe than the privacy issues cell phones introduce (let alone for the fact that one can be geolocated for the whole time). By the way: I know quite some people who don't have a cell phone for similar reasons.
        dimino 10y ago
        > By the way: I know quite some people who don't have a cell phone for similar reasons. Please, I beg of you -- don't even pretend like this view holds a significant percentage of the greater population's mind.
        internaut 10y ago
- 0x0 10y ago
  I think it is more a reaction that Microsoft is suddenly "changing the deal" and forcing users to get something that was never part of the bargain. People are feeling cheated and tricked and lose all trust in Microsoft. Heck, people are getting interrupted with a forced upgrade when they livestream games or present the weather on TV. Who knows if there's more surprises in the windows 10 pipeline?
  - dimino 10y ago
    I hope there are many more "surprises" in store for the luddites who refuse to install a modern operating system on their computers. This actively harmful view of how computer security works needs to be swiftly punished.
    - 0x0 10y ago
      What's insecure about Windows 7? It still receives security updates?
      - dimino 10y ago
        This is a shortsighted way of thinking. The goal is to move beyond "releases", and to a continuously upgrading OS, like OS X.
        detaro 10y ago
        Why is "I have a secure OS that still is supported and will be for quite a while, I'll upgrade when I replace this computer/have to reinstall the OS anyways" shortsighted?
        dimino 10y ago
        Because the people providing support would rather not. They're the ones telling you to upgrade.
        10y ago
- 5ilv3r 10y ago
  Well, hopefully this becomes a nice driver for the homebrew computer scene. It's quite possible to assemble an internet capable (not web) computer from discrete chips on a breadboard now. Perhaps the users need some more choices.
- detaro 10y ago
  And they can totally move to that scheme with windows 10. People (including me) paid for non-upgrading versions and the promise to get upgrades up to point X. I didn't pay for Microsoft to randomly break my workflow and push attention challenges on me before point X. Advertising for Windows 10 is fine, I didn't mind the initial "you can download windows 10 right now for free" reminders particularly much and did upgrade one of my systems quite quickly. I do not appreciate having to jump to hoops to keep other machines (running an OS that is still in support, and will be for quite some time) working as I need them right now.
  - dimino 10y ago
    I don't honestly care what you pictured in your head you were paying for, because it clearly was different from what you got. Your unhappiness as a customer of Microsoft is completely worth it for me, as someone who would eventually otherwise get spammed by the botnet on your computer, not to mention the Iranian citizen who thanks you for not participating, unwittingly, in a TOR identification network. I don't know how to put this in a way that will break through your selfishness, but being on the Internet is not just a "you" thing. You're participating in the worlds largest network of computers, and if you get to pick and choose, manually, when you update your computer, then you're going to be a bad actor. Your "kid" and my "kid" are in the same "classroom", so I'd like for you to keep up with modern "medicine", even if it's temporarily inconvenient to you.
    - detaro 10y ago
      What essential security flaws do current Windows versions have that justify to force an upgrade right now, or what reasons do you have to believe they will have them soon? You are talking in a lot of hypotheticals.
      - dimino 10y ago
        Like I said elsewhere, this is a shortsighted view. Windows version fragmentation is a security problem, in general, just like any other software fragmentation. There isn't a specific unsupported thing that's currently out there, but only because Microsoft has committed to supporting legacy versions of Windows. There is a fundamentally superior solution to fixing bugs in many places, and that solution is to only have one place to fix a bug. This isn't hypothetical, look at OS X. There have already been a number of vulnerabilities they've simply refused to fix in relatively recent legacy versions of their OS, because of the cost in doing so. From a "how does this personally help me?" standpoint, if Microsoft can cut legacy teams, the people on those teams get to work on new cool things that make your investment in their latest OS more valuable. By forcing them to support legacy versions, you're holding them back, and therefore holding yourself back (since you bought their product).

arm 10y ago

“Too many people are running insecure versions of Windows, and frankly I'd rather break them” Seriously? I think this old Hacker News comment thread¹ does a good job of covering all the points outlining why that’s a bad idea. Also, do you seriously think that upgrading their OS will stop users from continuing to download and install malware? ―――――― ¹ — https://news.ycombinator.com/item?id=11638048 https://news.ycombinator.com/item?id=11638048

dimino 10y ago
> Also, do you seriously think that upgrading their OS will stop users from continuing to download and install malware? Yes, I do. An operating system without a particular vulnerability cannot be infected by malware that exploits said vulnerability. As for that thread, you're going to have to be more specific, nothing I read in there is much more than what I said earlier, control for it's own sake. This is tantamount to the antivax movement.
- 5ilv3r 10y ago
  Downgrading the component to before the introduction of the flaw would be safer by far.
  - dimino 10y ago
    That is an interesting idea, and on first blush I do think it'd be safer, but it does rely on figuring out exactly when the flaw was introduced, and will result in the "YoYoing" of features, which is confusing from a consumer standpoint.
    - 5ilv3r 10y ago
      POCs are a part of any good bug disclosure. It should be easy to test that one is no longer affected. Besides, trying older versions to undo problems is a very old and reliable technique.
      - 10y ago