5 ms·

How is Microsoft's track record on security generally these days?

by rattray 10y ago

mtgx 10y ago
> Windows 10 was found to have the highest proportion of vulnerabilities of any OS (395), 46% more than Windows 8 and Windows 8.1 (265 each). https://www.avecto.com/news-and-events/news/94-of-critical-microsoft-vulnerabilities-mitigated-by-removing-admin-rights/ https://www.avecto.com/news-and-events/news/94-of-critical-m... Umm, not that great. Whatever security features they are adding to Windows 10, they seem to be overshadowed by all the other crap they're putting in Windows 10.
- SomeStupidPoint 10y ago
  That's for vulnerabilities found in 2016 though, right? It would make sense that more are found in W10 (which was 5-17mos in 2016) than W8 (which was 40-52mos in 2016), because of their relative time on the market. To answer the question, we'd have to look at W10 at this point in its life-cycle compared to W8 at a similar point (and control for things like more active vuln researchers).
  - rattray 10y ago
    (I think you meant to reply to the parent)
- ksk 10y ago
  Whether or not Windows 10 is secure, I don't consider that report to be representative of the OS itself. Literally the first 5 "windows" bugs I clicked on were adobe vulnerabilities.
  - rickycook 10y ago
    not that i'm saying that this is the case for the adobe vulnerabilities, but in practical terms the ecosystem is pretty tightly coupled to "the OS" when it comes to security. if your OS needs a ton of cruft bolted onto it to make it useful, and that cruft has security issues then compare that to an OS that doesn't need that cruft, or has a more security software ecosystem. for example, adobe reader vs macos preview. ecosystem is hard to change, and not entirely the fault of the owners/developers/etc of the software, but it's still important
tptacek 10y ago
Quite good, comparable with that of Google and Apple. Each of those three companies are good at different things. No big tech firm is as good at vulnerability research as Google; none is better at hardware security than Apple; none is better at security architecture and design than Microsoft. Google and Microsoft have the two largest, most ambitious security programs in technology. You should be wary of anyone who casually tells you that Microsoft is bad at security. There are things Microsoft might not be great at, but it's complicated.
- rattray 10y ago
  Interesting. Does that imply security-conscious tech companies would be better off running .NET services on Windows Server on Azure than a typical FOSS stack?
  - tptacek 10y ago
    I don't think security is a good reason to pick between Linux and Windows, or between Java and .NET.
- jimrandomh 10y ago
  > None is better at security architecture and design than Microsoft This is an interesting claim; most of what I (and probably most people) think about Microsoft software security is informed by its earlier history, where it was doing pretty badly overall. What has Microsoft been up to lately that's impressed you with their security architecture/design?
  - tptacek 10y ago
    When Microsoft's platform code was notably weak, pretty much everyone else's was too. There was a time when they were maybe 2-3 years behind the state of the art on Unix servers, but the state of the art at the time wasn't good, and that time is mostly past. For something like 10 years, Microsoft's been punching their weight with secure runtimes in particular, especially given the handicap they work with due to compatibility requirements. They're not perfect. But nobody is. Here's a good recent example: https://medium.com/@justin.schuh/securing-browsers-through-isolation-versus-mitigation-15f0baced2c2#.24fivh6ht https://medium.com/@justin.schuh/securing-browsers-through-i...

How is Microsoft's track record on security generally these days?

by rattray 10y ago

How is Microsoft's track record on security generally these days?

mtgx 10y ago

> Windows 10 was found to have the highest proportion of vulnerabilities of any OS (395), 46% more than Windows 8 and Windows 8.1 (265 each). https://www.avecto.com/news-and-events/news/94-of-critical-microsoft-vulnerabilities-mitigated-by-removing-admin-rights/ https://www.avecto.com/news-and-events/news/94-of-critical-m... Umm, not that great. Whatever security features they are adding to Windows 10, they seem to be overshadowed by all the other crap they're putting in Windows 10.

SomeStupidPoint 10y ago
That's for vulnerabilities found in 2016 though, right? It would make sense that more are found in W10 (which was 5-17mos in 2016) than W8 (which was 40-52mos in 2016), because of their relative time on the market. To answer the question, we'd have to look at W10 at this point in its life-cycle compared to W8 at a similar point (and control for things like more active vuln researchers).
- rattray 10y ago
  (I think you meant to reply to the parent)
ksk 10y ago
Whether or not Windows 10 is secure, I don't consider that report to be representative of the OS itself. Literally the first 5 "windows" bugs I clicked on were adobe vulnerabilities.
- rickycook 10y ago
  not that i'm saying that this is the case for the adobe vulnerabilities, but in practical terms the ecosystem is pretty tightly coupled to "the OS" when it comes to security. if your OS needs a ton of cruft bolted onto it to make it useful, and that cruft has security issues then compare that to an OS that doesn't need that cruft, or has a more security software ecosystem. for example, adobe reader vs macos preview. ecosystem is hard to change, and not entirely the fault of the owners/developers/etc of the software, but it's still important

tptacek 10y ago

Quite good, comparable with that of Google and Apple. Each of those three companies are good at different things. No big tech firm is as good at vulnerability research as Google; none is better at hardware security than Apple; none is better at security architecture and design than Microsoft. Google and Microsoft have the two largest, most ambitious security programs in technology. You should be wary of anyone who casually tells you that Microsoft is bad at security. There are things Microsoft might not be great at, but it's complicated.

rattray 10y ago
Interesting. Does that imply security-conscious tech companies would be better off running .NET services on Windows Server on Azure than a typical FOSS stack?
- tptacek 10y ago
  I don't think security is a good reason to pick between Linux and Windows, or between Java and .NET.
jimrandomh 10y ago
> None is better at security architecture and design than Microsoft This is an interesting claim; most of what I (and probably most people) think about Microsoft software security is informed by its earlier history, where it was doing pretty badly overall. What has Microsoft been up to lately that's impressed you with their security architecture/design?
- tptacek 10y ago
  When Microsoft's platform code was notably weak, pretty much everyone else's was too. There was a time when they were maybe 2-3 years behind the state of the art on Unix servers, but the state of the art at the time wasn't good, and that time is mostly past. For something like 10 years, Microsoft's been punching their weight with secure runtimes in particular, especially given the handicap they work with due to compatibility requirements. They're not perfect. But nobody is. Here's a good recent example: https://medium.com/@justin.schuh/securing-browsers-through-isolation-versus-mitigation-15f0baced2c2#.24fivh6ht https://medium.com/@justin.schuh/securing-browsers-through-i...