4 ms·

I agree the privacy and cripple ware issues are bad, but to me that pales in comparison to the decade-plus of shipping vulnerable code that allowed anyone to ro

I agree the privacy and cripple ware issues are bad, but to me that pales in comparison to the decade-plus of shipping vulnerable code that allowed anyone to root your system by serving one bad ad or emailing you one jpeg. I can't fathom how many families lost their photos, or paid hundreds of dollars for a tech to run mbam. How many identities were stolen, how many small businesses lost money, how much productivity lost. All because of the license agreement absolving them of ALL liability and product guarantees. This is grave, it had a substantial negative impact,spanning over 10 years, and nothing was done about it. If there ever were an unforgivable offense, this was it.

Aldo_MX 10y ago
So... you're also going to hate Linux since they left Dirty Cow unpatched for 9 years? Get real, perfect and secure code doesn't exist.
- digler999 10y ago
  Then what are their customers paying for? You are aware that paying for something is a contract, presumably for a product or service of value. So effectively you consider the malware a value to the customer ? . You think ignoring security is acceptable?
  - Aldo_MX 10y ago
    An EULA is displayed the first time you turn your PC on (or during the Windows setup), if you had read it you would probably know what are you paying for. Anyway, I suggest you to read the Open Source licenses before hating on Windows about malware, all of them basically say: "If you break your computer it's not our fault", like the following excerpt from the GPL: This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. I don't condone malware, but it is pretty obvious that the most popular platform will be the most targeted by malware authors. Too many people fall for the "I don't need AV, I don't use Windows" fallacy, but every software is vulnerable. The best advice I can give you is the following one: Don't run untrusted code.
    - digler999 10y ago
      So because FOSS has bugs it's OK for a multi-billion dollar corporation to have wanton disregard for quality? It's "pretty obvious to me" that the biggest software vendor on earth would be aware that their product would be targeted as you say and provide adequate or even reasonable protection for their customers. Not hide behind their EULA as their product was being used in organized crime. This is the "unforgivable offense" I mentioned.
      - Aldo_MX 10y ago
        Have you ever heard of "Windows Defender"? They got more than 96.2% of detection rate according to AV Comparatives in September 2016[1]. Have you ever heard of "Windows 10"? They got less CVE vulnerabilities reported in 2016 than Android, Debian, Ubuntu, Flash Player, Adobe Reader, Mac OS X, The Linux Kernel, iOS, even Chrome and Firefox[2]. If these are not examples of "adequate or even reasonable protection", then you got really unrealistic expectations or you're simply hating Microsoft for the sake of hating them. As I said, it is not possible to deliver bug-free code, and you learn to live with it or you die hating every software vendor in the world. Just remember, falling in the "I don't need AV, I don't use Windows" fallacy will bite you, and will bite you hard[3]. [1] https://chart.av-comparatives.org/chart1.php https://chart.av-comparatives.org/chart1.php [2] https://www.cvedetails.com/top-50-products.php?year=2016 https://www.cvedetails.com/top-50-products.php?year=2016 [3] https://scalibq.wordpress.com/2011/09/02/the-kernel-org-hack/ https://scalibq.wordpress.com/2011/09/02/the-kernel-org-hack...
        digler999 10y ago
        Have you heard of System Restore? You know, the utility that was supposed to put things back the way they were should the system ever get messed up? Oh but it doesn't work against malware. Security is more than being impervious to every conceivable attack. Just being able to restore an infected system would have made their platform "reasonable". But they didn't. Also, windows defender was YEARS too late. Which was why I specified the 10 year window.
      - Analemma_ 10y ago
- rbanffy 10y ago
  Yeah! Give them back their money! Oh... Wait...
- mikestew 10y ago
  There's insecure code, and then there's a company that will threaten to fire you if you don't run insecure internal code on their corpnet. Hacked-together internal test app running on an alpha version of .NET that was expected to run on my machine 24x7 that (as one example) wrote to %PROGRAM_FILES, requiring that it be run as admin. Told my manager, "I'm not running that, it's a threat to my machine and the corpnet." "Run it or else", I was told. Not that it mattered, I was probably one of only three people in Visual Studio that didn't run their machines as admin. This was after the Gates and Valentine emails on how MSFT was going to start taking security seriously. The point is not that I had an asshole for a manager, but that even though MSFT said "security", the boots on the ground often took as just another barrier to their greatest that was to be ignored as much as possible, and implemented just enough to shut up the gatekeepers.

Aldo_MX 10y ago

So... you're also going to hate Linux since they left Dirty Cow unpatched for 9 years? Get real, perfect and secure code doesn't exist.

digler999 10y ago
Then what are their customers paying for? You are aware that paying for something is a contract, presumably for a product or service of value. So effectively you consider the malware a value to the customer ? . You think ignoring security is acceptable?
- Aldo_MX 10y ago
  An EULA is displayed the first time you turn your PC on (or during the Windows setup), if you had read it you would probably know what are you paying for. Anyway, I suggest you to read the Open Source licenses before hating on Windows about malware, all of them basically say: "If you break your computer it's not our fault", like the following excerpt from the GPL: This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. I don't condone malware, but it is pretty obvious that the most popular platform will be the most targeted by malware authors. Too many people fall for the "I don't need AV, I don't use Windows" fallacy, but every software is vulnerable. The best advice I can give you is the following one: Don't run untrusted code.
  - digler999 10y ago
    So because FOSS has bugs it's OK for a multi-billion dollar corporation to have wanton disregard for quality? It's "pretty obvious to me" that the biggest software vendor on earth would be aware that their product would be targeted as you say and provide adequate or even reasonable protection for their customers. Not hide behind their EULA as their product was being used in organized crime. This is the "unforgivable offense" I mentioned.
    - Aldo_MX 10y ago
      Have you ever heard of "Windows Defender"? They got more than 96.2% of detection rate according to AV Comparatives in September 2016[1]. Have you ever heard of "Windows 10"? They got less CVE vulnerabilities reported in 2016 than Android, Debian, Ubuntu, Flash Player, Adobe Reader, Mac OS X, The Linux Kernel, iOS, even Chrome and Firefox[2]. If these are not examples of "adequate or even reasonable protection", then you got really unrealistic expectations or you're simply hating Microsoft for the sake of hating them. As I said, it is not possible to deliver bug-free code, and you learn to live with it or you die hating every software vendor in the world. Just remember, falling in the "I don't need AV, I don't use Windows" fallacy will bite you, and will bite you hard[3]. [1] https://chart.av-comparatives.org/chart1.php https://chart.av-comparatives.org/chart1.php [2] https://www.cvedetails.com/top-50-products.php?year=2016 https://www.cvedetails.com/top-50-products.php?year=2016 [3] https://scalibq.wordpress.com/2011/09/02/the-kernel-org-hack/ https://scalibq.wordpress.com/2011/09/02/the-kernel-org-hack...
      - digler999 10y ago
        Have you heard of System Restore? You know, the utility that was supposed to put things back the way they were should the system ever get messed up? Oh but it doesn't work against malware. Security is more than being impervious to every conceivable attack. Just being able to restore an infected system would have made their platform "reasonable". But they didn't. Also, windows defender was YEARS too late. Which was why I specified the 10 year window.
    - Analemma_ 10y ago
rbanffy 10y ago
Yeah! Give them back their money! Oh... Wait...
mikestew 10y ago
There's insecure code, and then there's a company that will threaten to fire you if you don't run insecure internal code on their corpnet. Hacked-together internal test app running on an alpha version of .NET that was expected to run on my machine 24x7 that (as one example) wrote to %PROGRAM_FILES, requiring that it be run as admin. Told my manager, "I'm not running that, it's a threat to my machine and the corpnet." "Run it or else", I was told. Not that it mattered, I was probably one of only three people in Visual Studio that didn't run their machines as admin. This was after the Gates and Valentine emails on how MSFT was going to start taking security seriously. The point is not that I had an asshole for a manager, but that even though MSFT said "security", the boots on the ground often took as just another barrier to their greatest that was to be ignored as much as possible, and implemented just enough to shut up the gatekeepers.