5 ms·

“Too many people are running insecure versions of Windows, and frankly I'd rather break them” Seriously? I think this old Hacker News comment thread¹ does a go

by arm 10y ago

“Too many people are running insecure versions of Windows, and frankly I'd rather break them” Seriously? I think this old Hacker News comment thread¹ does a good job of covering all the points outlining why that’s a bad idea. Also, do you seriously think that upgrading their OS will stop users from continuing to download and install malware? ―――――― ¹ — https://news.ycombinator.com/item?id=11638048 https://news.ycombinator.com/item?id=11638048

dimino 10y ago
> Also, do you seriously think that upgrading their OS will stop users from continuing to download and install malware? Yes, I do. An operating system without a particular vulnerability cannot be infected by malware that exploits said vulnerability. As for that thread, you're going to have to be more specific, nothing I read in there is much more than what I said earlier, control for it's own sake. This is tantamount to the antivax movement.
- 5ilv3r 10y ago
  Downgrading the component to before the introduction of the flaw would be safer by far.
  - dimino 10y ago
    That is an interesting idea, and on first blush I do think it'd be safer, but it does rely on figuring out exactly when the flaw was introduced, and will result in the "YoYoing" of features, which is confusing from a consumer standpoint.
    - 5ilv3r 10y ago
      POCs are a part of any good bug disclosure. It should be easy to test that one is no longer affected. Besides, trying older versions to undo problems is a very old and reliable technique.
      - dimino 10y ago
        I get that, but when you roll back, you don't really control what else you're removing, and you're implying that a roll back wouldn't break other parts of the system, or that it even makes sense, given the state of the system (it could be years before a vuln is noticed). Imagine waking up one morning and realizing you can't use uppercase on your file names anymore because of a rolled back vulnerability.
- pritambaral 10y ago
  > This is tantamount to the antivax movement Could you please not be offensive. Vaccines don't have keyloggers or forced-adware.
  - dimino 10y ago
    Neither does Windows 10, but the fact that this comment actually "offends" you tells me we're not playing on a level field.
    - pritambaral 10y ago
      > Neither does Windows 10 It did. There have been documented cases, and I have discussed this in the past. ---- > but the fact that this comment actually "offends" you It does. In another comment, you call people refusing to be force updated from a perfectly working (and security-supported) OS (in the name of "security") "luddites". In this comment, you generalize and compare us with a movement that can only be characterized as "willfuly ignorant", to say the least. That is offensive. I do get the parallels you were trying to point to: people running insecure OSes are detrimental to the rest of the internet community at large. But you get carried away and set up a far too extreme comparison. The people/kids that need vaccines are those that don't have security against pathogens (you wouldn't give someone a second dose/shot of a vaccine, when they've already been vaccinated and it's not even close to time for a booster dose, would you?), but Windows 7 is a perfectly secure OS (at least against non-Microsoft-affiliated agents). One has to be careful when setting up analogies, for while one may see only the similarities, others will see the differences also. > tells me we're not playing on a level field So what? Are you claiming I unleveled the field? The field was already unleveled, especially when you begin with a view that all those who disagree with you are "luddites" "as wrong as the antivaxxers". You made some claims from a certain level, and I made counter-arguments from a certain level. If the field needed to be level in order to "play", I wouldn't even have presented any counter-arguments from the very beginning.
      - dimino 10y ago
        Breaking up a comment into isolated parts removes context and is intellectually dishonest, please don't do it. What you're doing now is invoking moral outrage, which is completely useless in any real conversation, so what you're signaling is that you've completed being useful to talk to, and are now commencing your own justifications for continuing to believe as you do, despite a well-reasoned argument to the contrary. You've unleveled the playing field by removing rationality from this conversation, but by continuing to use terms from the world of rationality (evidence, claims), you try to mask that fact. Do you realize that when you do this, you isolate yourself and alienate the person you're talking to? I don't want to talk to you anymore, regardless of the validity of your other points, simply because of how... annoyingly self righteous you're being. It's like a religious conversation now, and why would I engage someone on the Internet in something like that?

by arm 10y ago

dimino 10y ago

> Also, do you seriously think that upgrading their OS will stop users from continuing to download and install malware? Yes, I do. An operating system without a particular vulnerability cannot be infected by malware that exploits said vulnerability. As for that thread, you're going to have to be more specific, nothing I read in there is much more than what I said earlier, control for it's own sake. This is tantamount to the antivax movement.

5ilv3r 10y ago
Downgrading the component to before the introduction of the flaw would be safer by far.
- dimino 10y ago
  That is an interesting idea, and on first blush I do think it'd be safer, but it does rely on figuring out exactly when the flaw was introduced, and will result in the "YoYoing" of features, which is confusing from a consumer standpoint.
  - 5ilv3r 10y ago
    POCs are a part of any good bug disclosure. It should be easy to test that one is no longer affected. Besides, trying older versions to undo problems is a very old and reliable technique.
    - dimino 10y ago
      I get that, but when you roll back, you don't really control what else you're removing, and you're implying that a roll back wouldn't break other parts of the system, or that it even makes sense, given the state of the system (it could be years before a vuln is noticed). Imagine waking up one morning and realizing you can't use uppercase on your file names anymore because of a rolled back vulnerability.
pritambaral 10y ago
> This is tantamount to the antivax movement Could you please not be offensive. Vaccines don't have keyloggers or forced-adware.
- dimino 10y ago
  Neither does Windows 10, but the fact that this comment actually "offends" you tells me we're not playing on a level field.
  - pritambaral 10y ago
    > Neither does Windows 10 It did. There have been documented cases, and I have discussed this in the past. ---- > but the fact that this comment actually "offends" you It does. In another comment, you call people refusing to be force updated from a perfectly working (and security-supported) OS (in the name of "security") "luddites". In this comment, you generalize and compare us with a movement that can only be characterized as "willfuly ignorant", to say the least. That is offensive. I do get the parallels you were trying to point to: people running insecure OSes are detrimental to the rest of the internet community at large. But you get carried away and set up a far too extreme comparison. The people/kids that need vaccines are those that don't have security against pathogens (you wouldn't give someone a second dose/shot of a vaccine, when they've already been vaccinated and it's not even close to time for a booster dose, would you?), but Windows 7 is a perfectly secure OS (at least against non-Microsoft-affiliated agents). One has to be careful when setting up analogies, for while one may see only the similarities, others will see the differences also. > tells me we're not playing on a level field So what? Are you claiming I unleveled the field? The field was already unleveled, especially when you begin with a view that all those who disagree with you are "luddites" "as wrong as the antivaxxers". You made some claims from a certain level, and I made counter-arguments from a certain level. If the field needed to be level in order to "play", I wouldn't even have presented any counter-arguments from the very beginning.
    - dimino 10y ago
      Breaking up a comment into isolated parts removes context and is intellectually dishonest, please don't do it. What you're doing now is invoking moral outrage, which is completely useless in any real conversation, so what you're signaling is that you've completed being useful to talk to, and are now commencing your own justifications for continuing to believe as you do, despite a well-reasoned argument to the contrary. You've unleveled the playing field by removing rationality from this conversation, but by continuing to use terms from the world of rationality (evidence, claims), you try to mask that fact. Do you realize that when you do this, you isolate yourself and alienate the person you're talking to? I don't want to talk to you anymore, regardless of the validity of your other points, simply because of how... annoyingly self righteous you're being. It's like a religious conversation now, and why would I engage someone on the Internet in something like that?