3 ms·

So... you're also going to hate Linux since they left Dirty Cow unpatched for 9 years? Get real, perfect and secure code doesn't exist.

by Aldo_MX 10y ago

digler999 10y ago
Then what are their customers paying for? You are aware that paying for something is a contract, presumably for a product or service of value. So effectively you consider the malware a value to the customer ? . You think ignoring security is acceptable?
- Aldo_MX 10y ago
  An EULA is displayed the first time you turn your PC on (or during the Windows setup), if you had read it you would probably know what are you paying for. Anyway, I suggest you to read the Open Source licenses before hating on Windows about malware, all of them basically say: "If you break your computer it's not our fault", like the following excerpt from the GPL: This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. I don't condone malware, but it is pretty obvious that the most popular platform will be the most targeted by malware authors. Too many people fall for the "I don't need AV, I don't use Windows" fallacy, but every software is vulnerable. The best advice I can give you is the following one: Don't run untrusted code.
  - digler999 10y ago
    So because FOSS has bugs it's OK for a multi-billion dollar corporation to have wanton disregard for quality? It's "pretty obvious to me" that the biggest software vendor on earth would be aware that their product would be targeted as you say and provide adequate or even reasonable protection for their customers. Not hide behind their EULA as their product was being used in organized crime. This is the "unforgivable offense" I mentioned.
    - Aldo_MX 10y ago
      Have you ever heard of "Windows Defender"? They got more than 96.2% of detection rate according to AV Comparatives in September 2016[1]. Have you ever heard of "Windows 10"? They got less CVE vulnerabilities reported in 2016 than Android, Debian, Ubuntu, Flash Player, Adobe Reader, Mac OS X, The Linux Kernel, iOS, even Chrome and Firefox[2]. If these are not examples of "adequate or even reasonable protection", then you got really unrealistic expectations or you're simply hating Microsoft for the sake of hating them. As I said, it is not possible to deliver bug-free code, and you learn to live with it or you die hating every software vendor in the world. Just remember, falling in the "I don't need AV, I don't use Windows" fallacy will bite you, and will bite you hard[3]. [1] https://chart.av-comparatives.org/chart1.php https://chart.av-comparatives.org/chart1.php [2] https://www.cvedetails.com/top-50-products.php?year=2016 https://www.cvedetails.com/top-50-products.php?year=2016 [3] https://scalibq.wordpress.com/2011/09/02/the-kernel-org-hack/ https://scalibq.wordpress.com/2011/09/02/the-kernel-org-hack...
      - digler999 10y ago
        Have you heard of System Restore? You know, the utility that was supposed to put things back the way they were should the system ever get messed up? Oh but it doesn't work against malware. Security is more than being impervious to every conceivable attack. Just being able to restore an infected system would have made their platform "reasonable". But they didn't. Also, windows defender was YEARS too late. Which was why I specified the 10 year window.
    - Analemma_ 10y ago
      > So because FOSS has bugs it's OK for a multi-billion dollar corporation to have wanton disregard for quality? That's not what he said. You said you hated Windows because of its vulnerabilities, and he was asking you if you apply that same standard to FOSS, and if not, why not.
      - type0 10y ago
        I don't think it's healthy to hate Windows or Microsoft, but every reasonable person should at least dislike them with passion for antifeatures, dark patterns and their other stunts, as well as for their lack of respect to customers. Few years ago I had to call Microsoft as a business customer and it was one of the worst companies I ever dealt with. I would never run Windows or Micrapsoft anything in any business setting, even for non critical stuff.
  - type0 10y ago
    What's your point here? I'm pretty sure companies paying for RHEL or SUSE are happier than they ever could be with Windoze
rbanffy 10y ago
Yeah! Give them back their money! Oh... Wait...
mikestew 10y ago
There's insecure code, and then there's a company that will threaten to fire you if you don't run insecure internal code on their corpnet. Hacked-together internal test app running on an alpha version of .NET that was expected to run on my machine 24x7 that (as one example) wrote to %PROGRAM_FILES, requiring that it be run as admin. Told my manager, "I'm not running that, it's a threat to my machine and the corpnet." "Run it or else", I was told. Not that it mattered, I was probably one of only three people in Visual Studio that didn't run their machines as admin. This was after the Gates and Valentine emails on how MSFT was going to start taking security seriously. The point is not that I had an asshole for a manager, but that even though MSFT said "security", the boots on the ground often took as just another barrier to their greatest that was to be ignored as much as possible, and implemented just enough to shut up the gatekeepers.

So... you're also going to hate Linux since they left Dirty Cow unpatched for 9 years? Get real, perfect and secure code doesn't exist.

by Aldo_MX 10y ago

So... you're also going to hate Linux since they left Dirty Cow unpatched for 9 years? Get real, perfect and secure code doesn't exist.

digler999 10y ago

Then what are their customers paying for? You are aware that paying for something is a contract, presumably for a product or service of value. So effectively you consider the malware a value to the customer ? . You think ignoring security is acceptable?

Aldo_MX 10y ago
An EULA is displayed the first time you turn your PC on (or during the Windows setup), if you had read it you would probably know what are you paying for. Anyway, I suggest you to read the Open Source licenses before hating on Windows about malware, all of them basically say: "If you break your computer it's not our fault", like the following excerpt from the GPL: This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. I don't condone malware, but it is pretty obvious that the most popular platform will be the most targeted by malware authors. Too many people fall for the "I don't need AV, I don't use Windows" fallacy, but every software is vulnerable. The best advice I can give you is the following one: Don't run untrusted code.
- digler999 10y ago
  So because FOSS has bugs it's OK for a multi-billion dollar corporation to have wanton disregard for quality? It's "pretty obvious to me" that the biggest software vendor on earth would be aware that their product would be targeted as you say and provide adequate or even reasonable protection for their customers. Not hide behind their EULA as their product was being used in organized crime. This is the "unforgivable offense" I mentioned.
  - Aldo_MX 10y ago
    Have you ever heard of "Windows Defender"? They got more than 96.2% of detection rate according to AV Comparatives in September 2016[1]. Have you ever heard of "Windows 10"? They got less CVE vulnerabilities reported in 2016 than Android, Debian, Ubuntu, Flash Player, Adobe Reader, Mac OS X, The Linux Kernel, iOS, even Chrome and Firefox[2]. If these are not examples of "adequate or even reasonable protection", then you got really unrealistic expectations or you're simply hating Microsoft for the sake of hating them. As I said, it is not possible to deliver bug-free code, and you learn to live with it or you die hating every software vendor in the world. Just remember, falling in the "I don't need AV, I don't use Windows" fallacy will bite you, and will bite you hard[3]. [1] https://chart.av-comparatives.org/chart1.php https://chart.av-comparatives.org/chart1.php [2] https://www.cvedetails.com/top-50-products.php?year=2016 https://www.cvedetails.com/top-50-products.php?year=2016 [3] https://scalibq.wordpress.com/2011/09/02/the-kernel-org-hack/ https://scalibq.wordpress.com/2011/09/02/the-kernel-org-hack...
    - digler999 10y ago
      Have you heard of System Restore? You know, the utility that was supposed to put things back the way they were should the system ever get messed up? Oh but it doesn't work against malware. Security is more than being impervious to every conceivable attack. Just being able to restore an infected system would have made their platform "reasonable". But they didn't. Also, windows defender was YEARS too late. Which was why I specified the 10 year window.
  - Analemma_ 10y ago
    > So because FOSS has bugs it's OK for a multi-billion dollar corporation to have wanton disregard for quality? That's not what he said. You said you hated Windows because of its vulnerabilities, and he was asking you if you apply that same standard to FOSS, and if not, why not.
    - type0 10y ago
      I don't think it's healthy to hate Windows or Microsoft, but every reasonable person should at least dislike them with passion for antifeatures, dark patterns and their other stunts, as well as for their lack of respect to customers. Few years ago I had to call Microsoft as a business customer and it was one of the worst companies I ever dealt with. I would never run Windows or Micrapsoft anything in any business setting, even for non critical stuff.
- type0 10y ago
  What's your point here? I'm pretty sure companies paying for RHEL or SUSE are happier than they ever could be with Windoze

rbanffy 10y ago

Yeah! Give them back their money! Oh... Wait...

mikestew 10y ago

There's insecure code, and then there's a company that will threaten to fire you if you don't run insecure internal code on their corpnet. Hacked-together internal test app running on an alpha version of .NET that was expected to run on my machine 24x7 that (as one example) wrote to %PROGRAM_FILES, requiring that it be run as admin. Told my manager, "I'm not running that, it's a threat to my machine and the corpnet." "Run it or else", I was told. Not that it mattered, I was probably one of only three people in Visual Studio that didn't run their machines as admin. This was after the Gates and Valentine emails on how MSFT was going to start taking security seriously. The point is not that I had an asshole for a manager, but that even though MSFT said "security", the boots on the ground often took as just another barrier to their greatest that was to be ignored as much as possible, and implemented just enough to shut up the gatekeepers.