3 ms·

Unless you have access to the said source code, you don't have a point. I can actually tell you that Windows NT source code is everything but "a pile of crap".

Unless you have access to the said source code, you don't have a point. I can actually tell you that Windows NT source code is everything but "a pile of crap". I can't tell for exchange or IISS, but I would be very surprised that it's crap. Security is extremely difficult. It's even more difficult for a consumer product. Even OpenBSD had remote exploits in the default install.

alecco 16y ago
Really? I know several guys who did security auditing for Microsoft on-site (a few years ago.) One (famous researcher) said the concepts were very good, but implementation was just terrible. Also they expressed disappointment when their findings mostly fell into deaf ears (another sec audit guy.) Also I happen to know more than one (grey?) hat who makes/sells 0day of Microsoft products. Microsoft opened Pandora's Box pissing off security researchers a few years back, there are many wounds to heal. And on your OpenBSD bashing, they have a very good security record. Sure, Theo had a short temper, but they always worked very hard on security and most of his rants were related to drivers (and IMHO, he was almost always right.) Edit: very minor clarifications.
- shin_lao 16y ago
  Yes, really. -- Please read my statement on OpenBSD again, the keyword is "even" which implies I view the security of this os rather highly.
  - alecco 16y ago
    I'm sorry, I misread that bit.
- tptacek 16y ago
  Hey, alecco? I am one of several people who has done code auditing for Microsoft. I simply do not believe your unattributed story about security advice at Microsoft "falling on deaf ears". For the past several years, a large subset of "famous security experts" have been falling over themselves to present at Microsoft's private internal Blue Hat conference. Incidentally, before you decide to call me a Microsoft apologist, you might be interested to know that I worked on the original OpenBSD security audit (back when the company I worked at, SNI, started the audit), and for several years wrote the OpenBSD security advisories. I also spent 4 years working at Arbor Networks, then largest commercial OpenBSD security product company in the world. Also, if you're wondering why people are downmodding you, start by considering that 'shin_lao didn't bash OpenBSD.
  - alecco 16y ago
    This argument is getting ridiculous. I didn't question your credentials. I only questioned your absolute statement. I didn't say you are a "Microsoft apologist", and about shin_lao's OpenBSD statement I probably misread it (it was late last night for me.) > Microsoft is in fact doing a better job with software security > than any other large company in the industry [IMHO] Google does a much better job and Microsoft still needs to rewrite a lot of their code base to be safe. And their bad usability record also counts against them, as stated on my original response. Again, sure, Microsoft beats Apple/Sun/Oracle/Cisco. I agree 100% with you there. (As stated before.)
    - tptacek 16y ago
      You keep saying "Google does a much better job". But I'm specifically rebutting that point. I gave specific reasons why I think that. You keep offering no specific responses. Why do you think this is an effective way to make a point? I'm sorry you feel like this is getting ridiculous, but what I think is happening is that you've once again bumped into someone on Hacker News that isn't simply going to concede the point to the person with the greater zeal for the issue. I get it. You like OpenBSD. You prefer open source. You prefer Google to Microsoft. This is all understandable. Unfortunately, your ideology doesn't change the facts on the ground.
      - alecco 16y ago
        About Google: I really like their security approach for Chrome/V8, and NaCL looks amazing (in particular the upcoming LLVM version.) Chrome OS isn't here yet but the concept looks very interesting for security (not so much for privacy and other aspects, though.) > what I think is happening is that you've once again bumped > into someone on Hacker News that isn't simply going to concede > the point to the person with the greater zeal for the issue. I hold a very slightly different view from yours (e.g. I think Microsoft is doing a lot about security and other giants should take note, as in the original reply.) It is sad people look for absolute right and wrong. Why can't we have both different views and not necessarily be wrong? In particular on a difference in opinion. > I get it. You like OpenBSD. You prefer open source. I like some things about OpenBSD, in particular their code auditing, but of course it's far from perfect. If I remember well, more than once Theo argued against something and later on it became a major feature of the project. About projects, I consider myself a bit of a sad agnostic lately. In particular I haven't used OpenBSD in a long time. > You prefer open source. Yes. But I happen to use closed source everyday and don't have problem with that. I use iWork to create PDFs and slides, sometimes. Hah, I'm even OK with crappy proprietary software (iTues+iPod), nothing I can't handle. Apple, and in particular OS X and Safari, in the security side are a disgrace. But I can live with it (e.g. use Chrome with JS/Flash disabled by default, use TrueCrypt and other encryption software as much as possible, and be very careful where I plug my notebook and what I authorize in it.) > Unfortunately, your ideology doesn't change the facts on the ground. What ideology? You just did a (bad) guess at my stance. And even if you were right, it was just ad-hominem. Counter example: I hate Google's anti-privacy hypocrisy. Same for their server-side services, and [also for] removing power from the users. Microsoft always empowered users with tools, it's their business model. I liked them a lot [back then] when things changed from server-side borderline authoritarian systems [to empowered Wintel PCs]. And now the world is coming back to [centralized systems], sadly.

alecco 16y ago

Really? I know several guys who did security auditing for Microsoft on-site (a few years ago.) One (famous researcher) said the concepts were very good, but implementation was just terrible. Also they expressed disappointment when their findings mostly fell into deaf ears (another sec audit guy.) Also I happen to know more than one (grey?) hat who makes/sells 0day of Microsoft products. Microsoft opened Pandora's Box pissing off security researchers a few years back, there are many wounds to heal. And on your OpenBSD bashing, they have a very good security record. Sure, Theo had a short temper, but they always worked very hard on security and most of his rants were related to drivers (and IMHO, he was almost always right.) Edit: very minor clarifications.

shin_lao 16y ago
Yes, really. -- Please read my statement on OpenBSD again, the keyword is "even" which implies I view the security of this os rather highly.
- alecco 16y ago
  I'm sorry, I misread that bit.
tptacek 16y ago
Hey, alecco? I am one of several people who has done code auditing for Microsoft. I simply do not believe your unattributed story about security advice at Microsoft "falling on deaf ears". For the past several years, a large subset of "famous security experts" have been falling over themselves to present at Microsoft's private internal Blue Hat conference. Incidentally, before you decide to call me a Microsoft apologist, you might be interested to know that I worked on the original OpenBSD security audit (back when the company I worked at, SNI, started the audit), and for several years wrote the OpenBSD security advisories. I also spent 4 years working at Arbor Networks, then largest commercial OpenBSD security product company in the world. Also, if you're wondering why people are downmodding you, start by considering that 'shin_lao didn't bash OpenBSD.
- alecco 16y ago
  This argument is getting ridiculous. I didn't question your credentials. I only questioned your absolute statement. I didn't say you are a "Microsoft apologist", and about shin_lao's OpenBSD statement I probably misread it (it was late last night for me.) > Microsoft is in fact doing a better job with software security > than any other large company in the industry [IMHO] Google does a much better job and Microsoft still needs to rewrite a lot of their code base to be safe. And their bad usability record also counts against them, as stated on my original response. Again, sure, Microsoft beats Apple/Sun/Oracle/Cisco. I agree 100% with you there. (As stated before.)
  - tptacek 16y ago
    You keep saying "Google does a much better job". But I'm specifically rebutting that point. I gave specific reasons why I think that. You keep offering no specific responses. Why do you think this is an effective way to make a point? I'm sorry you feel like this is getting ridiculous, but what I think is happening is that you've once again bumped into someone on Hacker News that isn't simply going to concede the point to the person with the greater zeal for the issue. I get it. You like OpenBSD. You prefer open source. You prefer Google to Microsoft. This is all understandable. Unfortunately, your ideology doesn't change the facts on the ground.
    - alecco 16y ago
      About Google: I really like their security approach for Chrome/V8, and NaCL looks amazing (in particular the upcoming LLVM version.) Chrome OS isn't here yet but the concept looks very interesting for security (not so much for privacy and other aspects, though.) > what I think is happening is that you've once again bumped > into someone on Hacker News that isn't simply going to concede > the point to the person with the greater zeal for the issue. I hold a very slightly different view from yours (e.g. I think Microsoft is doing a lot about security and other giants should take note, as in the original reply.) It is sad people look for absolute right and wrong. Why can't we have both different views and not necessarily be wrong? In particular on a difference in opinion. > I get it. You like OpenBSD. You prefer open source. I like some things about OpenBSD, in particular their code auditing, but of course it's far from perfect. If I remember well, more than once Theo argued against something and later on it became a major feature of the project. About projects, I consider myself a bit of a sad agnostic lately. In particular I haven't used OpenBSD in a long time. > You prefer open source. Yes. But I happen to use closed source everyday and don't have problem with that. I use iWork to create PDFs and slides, sometimes. Hah, I'm even OK with crappy proprietary software (iTues+iPod), nothing I can't handle. Apple, and in particular OS X and Safari, in the security side are a disgrace. But I can live with it (e.g. use Chrome with JS/Flash disabled by default, use TrueCrypt and other encryption software as much as possible, and be very careful where I plug my notebook and what I authorize in it.) > Unfortunately, your ideology doesn't change the facts on the ground. What ideology? You just did a (bad) guess at my stance. And even if you were right, it was just ad-hominem. Counter example: I hate Google's anti-privacy hypocrisy. Same for their server-side services, and [also for] removing power from the users. Microsoft always empowered users with tools, it's their business model. I liked them a lot [back then] when things changed from server-side borderline authoritarian systems [to empowered Wintel PCs]. And now the world is coming back to [centralized systems], sadly.