4 ms·

I wish: (1) Microsoft would actually document clearly how its security works. (2) Solve these security problems. E.g., decades ago we had time sharing system

I wish: (1) Microsoft would actually document clearly how its security works. (2) Solve these security problems. E.g., decades ago we had time sharing systems where rarely or never did the work of one user cause security problems for another user. One partial approach is to run a program in a particular file system directory and arrange that the program the program has very limited access to anything outside that directory and possibly limited access to what is in that directory. Then ransom ware? Okay, such a program might make a mess but only within some one directory. In that case, junk the program and delete the directory. Or a program gets its own access control list with its own capabilities for whatever resources are or might be on the computer. A clear goal is for Windows to be able to run any software, including malicious software, safely. Why not?

contextfree 9y ago
What you describe is roughly how the AppContainer used by modern apps on Windows works. Windows RT could only install apps based on this system. The problem is that Windows RT was perceived to have failed for lack of compability. So they introduced Centennial which brings back compatibility with some legacy Windows apps, but also brings back most of the same problems that drove them to want to move away from legacy Windows apps in the first place
- graycat 9y ago
  Yes, when heard about containers, with no details, and I still have yet to read any details, on either containers or how Windows security really works, then just from the word containers I guessed something like what I wrote and you confirmed. Sure, I have some legacy Windows apps. I'd be glad to log in with Administrator capabilities and, then, put those safe as a stuffed Teddy bear apps on a list of permitted apps. I'm sure there are a lot of details. One solution is just to be running a time sharing system with lots of users, each with rigidly delineated capabilities. Then do all Web browsing as just such a user. If the Web browsing lets in ransom ware, fine with me: The damage will be only for that user, and fine with me: I just delete that user. And there are virtual machine solutions. IMHO Microsoft should have gotten a good solution long ago.
DuskStar 9y ago
>decades ago we had time sharing systems where rarely or never did the work of one user cause security problems for another user. How much of that was due to people not trying to cause those problems, though?
- graycat 9y ago
  Well, they wrote and ran a lot of software with outrageous bugs, especially writing out of array bounds. But likely a biggie difference is that the attack surface was smaller. Also it may be that some of what Microsoft is still struggling with is being able still to have Windows run old software that thinks it's just fine to read files from nearly anywhere, write lots of files it should have no business writing, run other programs, etc. E.g., on Windows, I can download and install software, e.g., a new version of Firefox. That writes to my boot drive. What the heck security door did that software pass through? I'd like to know the details of Windows security, but so far I've never seen any good descriptions or documentation. I'm interested in Windows security because Windows is the source of the computing for my startup. Otherwise, and in general, I hope that Microsoft gets the security problems fixed.

contextfree 9y ago

What you describe is roughly how the AppContainer used by modern apps on Windows works. Windows RT could only install apps based on this system. The problem is that Windows RT was perceived to have failed for lack of compability. So they introduced Centennial which brings back compatibility with some legacy Windows apps, but also brings back most of the same problems that drove them to want to move away from legacy Windows apps in the first place

graycat 9y ago
Yes, when heard about containers, with no details, and I still have yet to read any details, on either containers or how Windows security really works, then just from the word containers I guessed something like what I wrote and you confirmed. Sure, I have some legacy Windows apps. I'd be glad to log in with Administrator capabilities and, then, put those safe as a stuffed Teddy bear apps on a list of permitted apps. I'm sure there are a lot of details. One solution is just to be running a time sharing system with lots of users, each with rigidly delineated capabilities. Then do all Web browsing as just such a user. If the Web browsing lets in ransom ware, fine with me: The damage will be only for that user, and fine with me: I just delete that user. And there are virtual machine solutions. IMHO Microsoft should have gotten a good solution long ago.

DuskStar 9y ago

>decades ago we had time sharing systems where rarely or never did the work of one user cause security problems for another user. How much of that was due to people not trying to cause those problems, though?

graycat 9y ago
Well, they wrote and ran a lot of software with outrageous bugs, especially writing out of array bounds. But likely a biggie difference is that the attack surface was smaller. Also it may be that some of what Microsoft is still struggling with is being able still to have Windows run old software that thinks it's just fine to read files from nearly anywhere, write lots of files it should have no business writing, run other programs, etc. E.g., on Windows, I can download and install software, e.g., a new version of Firefox. That writes to my boot drive. What the heck security door did that software pass through? I'd like to know the details of Windows security, but so far I've never seen any good descriptions or documentation. I'm interested in Windows security because Windows is the source of the computing for my startup. Otherwise, and in general, I hope that Microsoft gets the security problems fixed.