4 ms·
Well - as he's a security researcher he can usually be considered authoritive.
by ErrantX 16y ago
Well - as he's a security researcher he can usually be considered authoritive.
- loewenskind 16y ago"Argument from authority". If the point is true, then prove it.
- ErrantX 16y agoHow; normally I would agree but this is not exactly easily cite-able.... (i.e. how good is MS security...) Tom would seem to count as an original/authoritative/primary source :) (when the counter citation is completely off the point I think that says something important)
- alecco 16y agoWell, authority doesn't necessary carry truth value if unfounded. http://en.wikipedia.org/wiki/Argument_from_authority http://en.wikipedia.org/wiki/Argument_from_authority It's a shame HN users end up shooting down any contrarian opinion. In particular a piece of opinion like this one, there isn't an absolute right stance. And don't get me wrong, I've been vocal about Microsoft working harder on security than, say, Apple/Sun/Oracle/Cisco. I just don't think they are "in fact doing a better job with software security than any other large company in the industry." That's a long shot. Google does their homework, to name one.
- ErrantX 16y agoWell, yes, ok the extent to which tptacek backs them up is a bit extreme (Im not unconvinced he is wrong). Also; authority was the wrong word to use - experience is a better one. I'm generally inclined to trust his experience (especially as it partly matches my own observation too) You're citation was not really proving a counter argument (I did downvote - but only after it was +3)
- tptacek 16y agoHere is evidence that Microsoft takes security seriously: Virtually every product they ship has been tested by iSEC Partners, Leviathan, IOActive, or (in some rare cases) Matasano. For the most part, Microsoft does not get the B-teams from these firms. If you care to check those company names out, just Google [<company> black hat]. Virtually every single developer at Microsoft has been trained in secure software development, and has formal incentives tied in some way to software security. Virtually every Microsoft product has a documented threat model, almost certainly constructed by a third-party assessor. Most Microsoft products have fuzzers (the ones that don't are hard to fuzz). In many cases those fuzzers were written by people like Mike Eddington. Microsoft has delayed major product releases --- like operating systems --- to re-audit after people found bugs that shouldn't have made it to the final stages of QA. I'm somewhat familiar with Google's practices. I invite you to counter my evidence of Microsoft's superiority with specific examples of how Google "does their homework". Google does a fine job, so you should have no problem.
- alecco 16y agoJust one counter-example: IIS runs parts on kernel mode (at least until last year when I last checked.) Parsing HTTP on kernel mode sounds very bad. How many vulnerabilities were last year for IIS alone?
- tptacek 16y ago(a) Funny you should ask. In the past year, there's one published advisory (kingcope's DOS) on IIS7, and 3 on Apache. (b) In neither IIS 6 nor IIS 7 have any of those published advisories granted attackers kernel access of any sort. In fact: find me the last IIS vulnerability that did give up the kernel. I bet you can't.
- deleted 16y ago[deleted]