5 ms·
> Microsoft is in fact doing a better job with software security > than any other large company in the industry No. They did some good changes with Vista+,
by alecco 16y ago
> Microsoft is in fact doing a better job with software security
> than any other large company in the industry
No.
They did some good changes with Vista+, sure. But their code base for most of their products is still a huge pile of crap, security-wise. IIS, Exchange, Outlook, and even Windows itself. Not all remote exec bugs are mitigated by the new OS features.
Also, with typical Microsoft attitude, usability is neglected and many users just end up opening security settings permanently after being hassled dozens of times. That's counter-productive.
A great example recently on their legacy of bad code is Hernan Ochoa's vulnerability find:
Vulnerable systems practically every Windows OS including 2000, XP, Vista, and 7.
http://www.hexale.org/advisories/OCHOA-2010-0209.txt http://www.hexale.org/advisories/OCHOA-2010-0209.txt
> Impact: An unauthenticated remote attacker without any kind of
> credentials can access the SMB service under the credentials
> of an authorized user. Depending on the privileges of the authorized
> user, and the configuration of the remote system, an attacker
> can gain read/write access to the remote file system and execute
> arbitrary code by using DCE/RPC over SMB.
EDIT: Formatting.
- alecco 16y agoWould the down-voters at least state why? Is it forbidden to have a different opinion with examples? Sure, the "pile of crap" was a bit juvenile. But that doesn't invalidate my point.
- deleted 16y ago[deleted]
- riffraff 16y agoI didn't downvote, but it could be related to the fact that to an argument 'a> b' you replied "a = X", which while true does not denies the argument.
- alecco 16y agoTrue. But tptacek didn't cite studies or even reason why he thinks that in the first place.
- ErrantX 16y agoWell - as he's a security researcher he can usually be considered authoritive.
- loewenskind 16y ago"Argument from authority". If the point is true, then prove it.
- ErrantX 16y agoHow; normally I would agree but this is not exactly easily cite-able.... (i.e. how good is MS security...) Tom would seem to count as an original/authoritative/primary source :) (when the counter citation is completely off the point I think that says something important)
- alecco 16y agoWell, authority doesn't necessary carry truth value if unfounded. http://en.wikipedia.org/wiki/Argument_from_authority http://en.wikipedia.org/wiki/Argument_from_authority It's a shame HN users end up shooting down any contrarian opinion. In particular a piece of opinion like this one, there isn't an absolute right stance. And don't get me wrong, I've been vocal about Microsoft working harder on security than, say, Apple/Sun/Oracle/Cisco. I just don't think they are "in fact doing a better job with software security than any other large company in the industry." That's a long shot. Google does their homework, to name one.
- ErrantX 16y agoWell, yes, ok the extent to which tptacek backs them up is a bit extreme (Im not unconvinced he is wrong). Also; authority was the wrong word to use - experience is a better one. I'm generally inclined to trust his experience (especially as it partly matches my own observation too) You're citation was not really proving a counter argument (I did downvote - but only after it was +3)
- tptacek 16y ago
- shin_lao 16y agoUnless you have access to the said source code, you don't have a point. I can actually tell you that Windows NT source code is everything but "a pile of crap". I can't tell for exchange or IISS, but I would be very surprised that it's crap. Security is extremely difficult. It's even more difficult for a consumer product. Even OpenBSD had remote exploits in the default install.
- alecco 16y agoReally? I know several guys who did security auditing for Microsoft on-site (a few years ago.) One (famous researcher) said the concepts were very good, but implementation was just terrible. Also they expressed disappointment when their findings mostly fell into deaf ears (another sec audit guy.) Also I happen to know more than one (grey?) hat who makes/sells 0day of Microsoft products. Microsoft opened Pandora's Box pissing off security researchers a few years back, there are many wounds to heal. And on your OpenBSD bashing, they have a very good security record. Sure, Theo had a short temper, but they always worked very hard on security and most of his rants were related to drivers (and IMHO, he was almost always right.) Edit: very minor clarifications.
- shin_lao 16y agoYes, really. -- Please read my statement on OpenBSD again, the keyword is "even" which implies I view the security of this os rather highly.
- alecco 16y agoI'm sorry, I misread that bit.
- tptacek 16y agoHey, alecco? I am one of several people who has done code auditing for Microsoft. I simply do not believe your unattributed story about security advice at Microsoft "falling on deaf ears". For the past several years, a large subset of "famous security experts" have been falling over themselves to present at Microsoft's private internal Blue Hat conference. Incidentally, before you decide to call me a Microsoft apologist, you might be interested to know that I worked on the original OpenBSD security audit (back when the company I worked at, SNI, started the audit), and for several years wrote the OpenBSD security advisories. I also spent 4 years working at Arbor Networks, then largest commercial OpenBSD security product company in the world. Also, if you're wondering why people are downmodding you, start by considering that 'shin_lao didn't bash OpenBSD.
- ErrantX 16y agoYou will find bad code in, say, the Linux Kernel that goes back through the ages. It's somewhat irrelevant. What is important is how the problems are addressed once found. Generally Microsoft are quite quick at it (as are other OS vendors)
- alecco 16y agoNow they're quick. And my point was Microsoft isn't "the best", not yet. Sure, they improved significantly, but the baggage of many years of apathy and maneuvering is still a cost today.
- ErrantX 16y agoIm not sure I disagree. But I still don't see how that relates to the example you cite?
- tptacek 16y agoThe only bit of evidence you have marshalled for this argument is Hernan Ochoa's NTLM challenge advisory, which may be one of the most clever attacks published this year, after Juliano's Java Server Faces CBC padding oracle. But unlike Juliano's attack, which busted up a whole huge class of Java web applications because of a Sun bug, Ochoa's finding required knowledge of a proprietary challenge-response scheme and the reverse-engineering of its implementation. I find that evidence exceedingly weak. Meanwhile: what vendor is doing a better job on security than Microsoft is? That being, you know, my whole argument and all.