3 ms·

Would the down-voters at least state why? Is it forbidden to have a different opinion with examples? Sure, the "pile of crap" was a bit juvenile. But that does

by alecco 16y ago

Would the down-voters at least state why? Is it forbidden to have a different opinion with examples? Sure, the "pile of crap" was a bit juvenile. But that doesn't invalidate my point.

deleted 16y ago
[deleted]
riffraff 16y ago
I didn't downvote, but it could be related to the fact that to an argument 'a> b' you replied "a = X", which while true does not denies the argument.
- alecco 16y ago
  True. But tptacek didn't cite studies or even reason why he thinks that in the first place.
  - ErrantX 16y ago
    Well - as he's a security researcher he can usually be considered authoritive.
    - loewenskind 16y ago
      "Argument from authority". If the point is true, then prove it.
      - ErrantX 16y ago
        How; normally I would agree but this is not exactly easily cite-able.... (i.e. how good is MS security...) Tom would seem to count as an original/authoritative/primary source :) (when the counter citation is completely off the point I think that says something important)
    - alecco 16y ago
      Well, authority doesn't necessary carry truth value if unfounded. http://en.wikipedia.org/wiki/Argument_from_authority http://en.wikipedia.org/wiki/Argument_from_authority It's a shame HN users end up shooting down any contrarian opinion. In particular a piece of opinion like this one, there isn't an absolute right stance. And don't get me wrong, I've been vocal about Microsoft working harder on security than, say, Apple/Sun/Oracle/Cisco. I just don't think they are "in fact doing a better job with software security than any other large company in the industry." That's a long shot. Google does their homework, to name one.
      - ErrantX 16y ago
        Well, yes, ok the extent to which tptacek backs them up is a bit extreme (Im not unconvinced he is wrong). Also; authority was the wrong word to use - experience is a better one. I'm generally inclined to trust his experience (especially as it partly matches my own observation too) You're citation was not really proving a counter argument (I did downvote - but only after it was +3)
      - tptacek 16y ago
        Here is evidence that Microsoft takes security seriously: Virtually every product they ship has been tested by iSEC Partners, Leviathan, IOActive, or (in some rare cases) Matasano. For the most part, Microsoft does not get the B-teams from these firms. If you care to check those company names out, just Google [<company> black hat]. Virtually every single developer at Microsoft has been trained in secure software development, and has formal incentives tied in some way to software security. Virtually every Microsoft product has a documented threat model, almost certainly constructed by a third-party assessor. Most Microsoft products have fuzzers (the ones that don't are hard to fuzz). In many cases those fuzzers were written by people like Mike Eddington. Microsoft has delayed major product releases --- like operating systems --- to re-audit after people found bugs that shouldn't have made it to the final stages of QA. I'm somewhat familiar with Google's practices. I invite you to counter my evidence of Microsoft's superiority with specific examples of how Google "does their homework". Google does a fine job, so you should have no problem.
        16y ago
  - tptacek 16y ago
    That's because I've written (according to SearchYC) 51 comments here already explaining in various ways why I think Microsoft is doing an excellent job on software security, and instead of boring everyone by restating my argument, I chose here to key in on the fact that this Microsoft spokesman did a terrible job of communicating with his audience.
    - alecco 16y ago
      They are doing an excellent job. I never questioned that. I questioned your absolute statement about them being better than everybody else in the industry.
shin_lao 16y ago
Unless you have access to the said source code, you don't have a point. I can actually tell you that Windows NT source code is everything but "a pile of crap". I can't tell for exchange or IISS, but I would be very surprised that it's crap. Security is extremely difficult. It's even more difficult for a consumer product. Even OpenBSD had remote exploits in the default install.
- alecco 16y ago
  Really? I know several guys who did security auditing for Microsoft on-site (a few years ago.) One (famous researcher) said the concepts were very good, but implementation was just terrible. Also they expressed disappointment when their findings mostly fell into deaf ears (another sec audit guy.) Also I happen to know more than one (grey?) hat who makes/sells 0day of Microsoft products. Microsoft opened Pandora's Box pissing off security researchers a few years back, there are many wounds to heal. And on your OpenBSD bashing, they have a very good security record. Sure, Theo had a short temper, but they always worked very hard on security and most of his rants were related to drivers (and IMHO, he was almost always right.) Edit: very minor clarifications.
  - shin_lao 16y ago
    Yes, really. -- Please read my statement on OpenBSD again, the keyword is "even" which implies I view the security of this os rather highly.
    - alecco 16y ago
      I'm sorry, I misread that bit.
  - tptacek 16y ago
    Hey, alecco? I am one of several people who has done code auditing for Microsoft. I simply do not believe your unattributed story about security advice at Microsoft "falling on deaf ears". For the past several years, a large subset of "famous security experts" have been falling over themselves to present at Microsoft's private internal Blue Hat conference. Incidentally, before you decide to call me a Microsoft apologist, you might be interested to know that I worked on the original OpenBSD security audit (back when the company I worked at, SNI, started the audit), and for several years wrote the OpenBSD security advisories. I also spent 4 years working at Arbor Networks, then largest commercial OpenBSD security product company in the world. Also, if you're wondering why people are downmodding you, start by considering that 'shin_lao didn't bash OpenBSD.

by alecco 16y ago

Would the down-voters at least state why? Is it forbidden to have a different opinion with examples? Sure, the "pile of crap" was a bit juvenile. But that doesn't invalidate my point.

deleted 16y ago

[deleted]

riffraff 16y ago

I didn't downvote, but it could be related to the fact that to an argument 'a> b' you replied "a = X", which while true does not denies the argument.

alecco 16y ago
True. But tptacek didn't cite studies or even reason why he thinks that in the first place.
- ErrantX 16y ago
  Well - as he's a security researcher he can usually be considered authoritive.
  - loewenskind 16y ago
    "Argument from authority". If the point is true, then prove it.
    - ErrantX 16y ago
      How; normally I would agree but this is not exactly easily cite-able.... (i.e. how good is MS security...) Tom would seem to count as an original/authoritative/primary source :) (when the counter citation is completely off the point I think that says something important)
  - alecco 16y ago
    Well, authority doesn't necessary carry truth value if unfounded. http://en.wikipedia.org/wiki/Argument_from_authority http://en.wikipedia.org/wiki/Argument_from_authority It's a shame HN users end up shooting down any contrarian opinion. In particular a piece of opinion like this one, there isn't an absolute right stance. And don't get me wrong, I've been vocal about Microsoft working harder on security than, say, Apple/Sun/Oracle/Cisco. I just don't think they are "in fact doing a better job with software security than any other large company in the industry." That's a long shot. Google does their homework, to name one.
    - ErrantX 16y ago
      Well, yes, ok the extent to which tptacek backs them up is a bit extreme (Im not unconvinced he is wrong). Also; authority was the wrong word to use - experience is a better one. I'm generally inclined to trust his experience (especially as it partly matches my own observation too) You're citation was not really proving a counter argument (I did downvote - but only after it was +3)
    - tptacek 16y ago
      Here is evidence that Microsoft takes security seriously: Virtually every product they ship has been tested by iSEC Partners, Leviathan, IOActive, or (in some rare cases) Matasano. For the most part, Microsoft does not get the B-teams from these firms. If you care to check those company names out, just Google [<company> black hat]. Virtually every single developer at Microsoft has been trained in secure software development, and has formal incentives tied in some way to software security. Virtually every Microsoft product has a documented threat model, almost certainly constructed by a third-party assessor. Most Microsoft products have fuzzers (the ones that don't are hard to fuzz). In many cases those fuzzers were written by people like Mike Eddington. Microsoft has delayed major product releases --- like operating systems --- to re-audit after people found bugs that shouldn't have made it to the final stages of QA. I'm somewhat familiar with Google's practices. I invite you to counter my evidence of Microsoft's superiority with specific examples of how Google "does their homework". Google does a fine job, so you should have no problem.
      - 16y ago
- tptacek 16y ago
  That's because I've written (according to SearchYC) 51 comments here already explaining in various ways why I think Microsoft is doing an excellent job on software security, and instead of boring everyone by restating my argument, I chose here to key in on the fact that this Microsoft spokesman did a terrible job of communicating with his audience.
  - alecco 16y ago
    They are doing an excellent job. I never questioned that. I questioned your absolute statement about them being better than everybody else in the industry.

shin_lao 16y ago

Unless you have access to the said source code, you don't have a point. I can actually tell you that Windows NT source code is everything but "a pile of crap". I can't tell for exchange or IISS, but I would be very surprised that it's crap. Security is extremely difficult. It's even more difficult for a consumer product. Even OpenBSD had remote exploits in the default install.

alecco 16y ago
Really? I know several guys who did security auditing for Microsoft on-site (a few years ago.) One (famous researcher) said the concepts were very good, but implementation was just terrible. Also they expressed disappointment when their findings mostly fell into deaf ears (another sec audit guy.) Also I happen to know more than one (grey?) hat who makes/sells 0day of Microsoft products. Microsoft opened Pandora's Box pissing off security researchers a few years back, there are many wounds to heal. And on your OpenBSD bashing, they have a very good security record. Sure, Theo had a short temper, but they always worked very hard on security and most of his rants were related to drivers (and IMHO, he was almost always right.) Edit: very minor clarifications.
- shin_lao 16y ago
  Yes, really. -- Please read my statement on OpenBSD again, the keyword is "even" which implies I view the security of this os rather highly.
  - alecco 16y ago
    I'm sorry, I misread that bit.
- tptacek 16y ago
  Hey, alecco? I am one of several people who has done code auditing for Microsoft. I simply do not believe your unattributed story about security advice at Microsoft "falling on deaf ears". For the past several years, a large subset of "famous security experts" have been falling over themselves to present at Microsoft's private internal Blue Hat conference. Incidentally, before you decide to call me a Microsoft apologist, you might be interested to know that I worked on the original OpenBSD security audit (back when the company I worked at, SNI, started the audit), and for several years wrote the OpenBSD security advisories. I also spent 4 years working at Arbor Networks, then largest commercial OpenBSD security product company in the world. Also, if you're wondering why people are downmodding you, start by considering that 'shin_lao didn't bash OpenBSD.