4 ms·

Yes, Microsoft spent a lot of money on security, and this has paid off to some extent (Win7 is much better than, say, 98); but don't you think they still, well,

Yes, Microsoft spent a lot of money on security, and this has paid off to some extent (Win7 is much better than, say, 98); but don't you think they still, well, suck? In at least an absolute sense, if not a relative sense?

tptacek 17y ago
Do I enjoy using Win7? No. Would I trust Win7 code more than... other code? Very yes. This is basically like asking me, "which would you trust more: code that you're reasonably sure Mike Eddington fuzzed, or code that you're pretty confident he hasn't."
- JoachimSchipper 17y ago
  It's not that Microsoft has crappy coders: their programmers are good and motivated. It's not that Microsoft doesn't care about security: they got burnt badly enough that they learned their lesson. It's just that there is so much code. A good OpenBSD install, even one with lots of functionality, just has much less trusted code (i.e. code which absolutely has to be correct). And while I do like OpenBSD, it's not unique: the other BSDs are also solid, and Solaris - despite a somewhat bad reputation in some circles - is also pretty good. I'm sure that there are some very smart people working on Windows security; it's just that engineering everything for security beats "features first". [EDIT: thank you for your reply! I'm happy to learn, even if we're unlikely to convince each other...]
thaumaturgy 17y ago
Hey, cool, I recognize you from the OBSD-Misc list. Anyway: I think they used to suck; I think that a lot of their decisions in things like ActiveX and IE 6 implied that they didn't yet have the kind of focus on security that they have now. But, despite this article, Microsoft has taken a ton of heat from the computer industry for their various security issues, and I do think they've tightened it up a lot. I also think that the quote in the article conjecturing that we wouldn't see Linux botnets is absurd, given the number of Linux rootkits in the wild. The only reason we aren't seeing Linux botnets is because there aren't enough Linux systems to form one. (A joke, but only a little!) And, I don't think you can sit a novice computer user in front of a Linux or BSD system and expect them to get security right. chroot Apache still breaks a lot of stuff, and the first inclination from the user is to change httpd to -u. Microsoft does relatively OK these days.

tptacek 17y ago

Do I enjoy using Win7? No. Would I trust Win7 code more than... other code? Very yes. This is basically like asking me, "which would you trust more: code that you're reasonably sure Mike Eddington fuzzed, or code that you're pretty confident he hasn't."

JoachimSchipper 17y ago
It's not that Microsoft has crappy coders: their programmers are good and motivated. It's not that Microsoft doesn't care about security: they got burnt badly enough that they learned their lesson. It's just that there is so much code. A good OpenBSD install, even one with lots of functionality, just has much less trusted code (i.e. code which absolutely has to be correct). And while I do like OpenBSD, it's not unique: the other BSDs are also solid, and Solaris - despite a somewhat bad reputation in some circles - is also pretty good. I'm sure that there are some very smart people working on Windows security; it's just that engineering everything for security beats "features first". [EDIT: thank you for your reply! I'm happy to learn, even if we're unlikely to convince each other...]

thaumaturgy 17y ago

Hey, cool, I recognize you from the OBSD-Misc list. Anyway: I think they used to suck; I think that a lot of their decisions in things like ActiveX and IE 6 implied that they didn't yet have the kind of focus on security that they have now. But, despite this article, Microsoft has taken a ton of heat from the computer industry for their various security issues, and I do think they've tightened it up a lot. I also think that the quote in the article conjecturing that we wouldn't see Linux botnets is absurd, given the number of Linux rootkits in the wild. The only reason we aren't seeing Linux botnets is because there aren't enough Linux systems to form one. (A joke, but only a little!) And, I don't think you can sit a novice computer user in front of a Linux or BSD system and expect them to get security right. chroot Apache still breaks a lot of stuff, and the first inclination from the user is to change httpd to -u. Microsoft does relatively OK these days.