6 ms·

Disagree entirely - for me it hits the nail on the head immediately. And what a timely article given the impact on the NHS today. Are we seeing NSA tools used i

Disagree entirely - for me it hits the nail on the head immediately. And what a timely article given the impact on the NHS today. Are we seeing NSA tools used in the wild? The EU handed Microsoft its biggest fine and still we have this unacceptable state of affairs where we have secret code running public utilities and services, especially of a foreign/extra-judicial entity. Unfortunately getting out of that lock in is going to be tricky.

Osiris 9y ago
You think that if an entire government was running a specific *nix operating system that the NSA couldn't develop an exploit to gain access to the OS? Android phones run Linux and get hacked to get root access. Routers, IoT devices, and lots of other hardware run Linux variants and get hacked all the time. This idea that people hold that if only we didn't run Windows we'd all be more secure is silly and naive.
- smichel17 9y ago
  It would certainly be harder, since they don't have the political option of compelling Microsoft to add a backdoor.
  - skaplun 9y ago
    you're implying that coercing major companies is easier than few hours researching vulnerabilities?
    - sqeaky 9y ago
      I think you are grossly understating the difficulty of penetrating actual defenses. Once a vulnerability is used it is likely to be patched. A group that cannot be coerced to do something for you will close vulnerabilities as it learns of them because they are liabilities. Also, moving away from microsoft will likely lead to the end of software monoculture. You need to research those vulnerabilities for each target. Oh, and it it would be much more than a fewer hours of research.
      - mandevil 9y ago
        Gah, this brings me back to the glory days of slashdot. The software monoculture exists because of USERS. The vast majority of users don't want to have to learn three different OS, look+feel, GUI rules, etc. They just want the goddamn excel file that the CPA sent over that they need for their accounts receivable report to OPEN. Trying to convince governments to go to FOSS doesn't well work because the users slip back to things so that they can do their job the way they know how. See, e.g. the city government of Munich, which after a decade of trying never got above about 60% of their users to switch to Linux, and is considering abandoning the effort.
        sqeaky 9y ago
        For people outside the United States, switching away from microsoft really is a matter of national security (It kind of is inside the US too, but that is a different argument). If leaders of a nation allow their civil servants to be so lazy that they damage national security they deserve whatever results they get. Using new software today isn't like it was in the 90s, the OS is much less important. UIs can be delivered by web and all the user friendly UIs (all mobile OSes, and no desktop OSes) area ll similar enough that many users can't tell the difference. If this is the barrier to someone's national security...
- kevindqc 9y ago
  i.e. http://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-attempt-of-2003/ http://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-a... There's been multiple attempts. Linus has even been directly asked to put backdoors in Linux. There is even a contest to make code look normal, but do something malicious https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest I'm sure the NSA is very good at that.
- nickpsecurity 9y ago
  NSA would find lots of exploits. Many black hats would, too. The key difference I see from high-assurance security is that there will be a diverse array of protections developed that might stop anywhere from some to all attacks. There's a pile of them out there in CompSci, private sector, and so on for Linux, FreeBSD, and Android. Tiny portion of that R&D goes to Windows kernel or privileged userland. Microsoft Research even builds great tools Microsoft themselves won't even use in the general case even though they applied some of them. To put this into perspective, there's CPU modifications that can make a Linux or FreeBSD system mostly safe and secure against known classes of attack instantly just at the compiler and CPU level with a certain performance hit. Anyone wanting improved security could then use Linux with those CPU's probably buying some extra chips, too, to cover performance loss. You don't have that option with Windows. http://www.cl.cam.ac.uk/research/security/ctsrd/cheri.html http://www.cl.cam.ac.uk/research/security/ctsrd/cheri.html http://sva.cs.illinois.edu/pubs/KCoFI-Oakland-2014.pdf http://sva.cs.illinois.edu/pubs/KCoFI-Oakland-2014.pdf https://www.cs.rutgers.edu/~santosh.nagarakatte/softbound/ https://www.cs.rutgers.edu/~santosh.nagarakatte/softbound/

Osiris 9y ago

You think that if an entire government was running a specific *nix operating system that the NSA couldn't develop an exploit to gain access to the OS? Android phones run Linux and get hacked to get root access. Routers, IoT devices, and lots of other hardware run Linux variants and get hacked all the time. This idea that people hold that if only we didn't run Windows we'd all be more secure is silly and naive.

smichel17 9y ago
It would certainly be harder, since they don't have the political option of compelling Microsoft to add a backdoor.
- skaplun 9y ago
  you're implying that coercing major companies is easier than few hours researching vulnerabilities?
  - sqeaky 9y ago
    I think you are grossly understating the difficulty of penetrating actual defenses. Once a vulnerability is used it is likely to be patched. A group that cannot be coerced to do something for you will close vulnerabilities as it learns of them because they are liabilities. Also, moving away from microsoft will likely lead to the end of software monoculture. You need to research those vulnerabilities for each target. Oh, and it it would be much more than a fewer hours of research.
    - mandevil 9y ago
      Gah, this brings me back to the glory days of slashdot. The software monoculture exists because of USERS. The vast majority of users don't want to have to learn three different OS, look+feel, GUI rules, etc. They just want the goddamn excel file that the CPA sent over that they need for their accounts receivable report to OPEN. Trying to convince governments to go to FOSS doesn't well work because the users slip back to things so that they can do their job the way they know how. See, e.g. the city government of Munich, which after a decade of trying never got above about 60% of their users to switch to Linux, and is considering abandoning the effort.
      - sqeaky 9y ago
        For people outside the United States, switching away from microsoft really is a matter of national security (It kind of is inside the US too, but that is a different argument). If leaders of a nation allow their civil servants to be so lazy that they damage national security they deserve whatever results they get. Using new software today isn't like it was in the 90s, the OS is much less important. UIs can be delivered by web and all the user friendly UIs (all mobile OSes, and no desktop OSes) area ll similar enough that many users can't tell the difference. If this is the barrier to someone's national security...
kevindqc 9y ago
i.e. http://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-attempt-of-2003/ http://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-a... There's been multiple attempts. Linus has even been directly asked to put backdoors in Linux. There is even a contest to make code look normal, but do something malicious https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest I'm sure the NSA is very good at that.
nickpsecurity 9y ago
NSA would find lots of exploits. Many black hats would, too. The key difference I see from high-assurance security is that there will be a diverse array of protections developed that might stop anywhere from some to all attacks. There's a pile of them out there in CompSci, private sector, and so on for Linux, FreeBSD, and Android. Tiny portion of that R&D goes to Windows kernel or privileged userland. Microsoft Research even builds great tools Microsoft themselves won't even use in the general case even though they applied some of them. To put this into perspective, there's CPU modifications that can make a Linux or FreeBSD system mostly safe and secure against known classes of attack instantly just at the compiler and CPU level with a certain performance hit. Anyone wanting improved security could then use Linux with those CPU's probably buying some extra chips, too, to cover performance loss. You don't have that option with Windows. http://www.cl.cam.ac.uk/research/security/ctsrd/cheri.html http://www.cl.cam.ac.uk/research/security/ctsrd/cheri.html http://sva.cs.illinois.edu/pubs/KCoFI-Oakland-2014.pdf http://sva.cs.illinois.edu/pubs/KCoFI-Oakland-2014.pdf https://www.cs.rutgers.edu/~santosh.nagarakatte/softbound/ https://www.cs.rutgers.edu/~santosh.nagarakatte/softbound/