4 ms·

I'm really not sure this is right, it just doesn't ring true to me. Yes, in the bad old days, we had dozens or hundreds of different drivers for specific netwo

I'm really not sure this is right, it just doesn't ring true to me. Yes, in the bad old days, we had dozens or hundreds of different drivers for specific network cards, serial cards, parallel port chips, audio cards, floppy controllers, disk drivers, etc., plus the tangled mess of scsi and ata/sata/pata storage stacks, tcp/ip/tokenring/ethernet/netbios/smb/appletalk network stacks, tty/vtty/serial terminals, and so on. Bugs in the higher-level stacks, like sata, would be impact very broadly. But a bug in one specific network card driver would, generally, only affect the subset of people who actually had that specific network card. And many of those old drivers were not really all that complicated, because they were specific and narrowly tailored. Buggy as anything too, of course, and didn't get much scrutiny due to the huge variation in software. Now everything is subsumed under a massive IO controller-hub chip driver. At least the last time I checked, all those tangled upper-level stacks are still there, but they are just entwined with a hugely complex mess of usb/thunderbolt/usb-c mess. So you'd still have all the complexity of a sata stack, but that's nested on top of a scsi stack, sitting on a PCI stack, all nested inside a USB-C stack.

erikpukinskis 9y ago
I guess the question to ask is: Medium sized company. It's your job to pick a stack. Your performance will be evaluated on whether a team of security consultants can hack you. Your stock grant will either multiply 100x or divide 10x depending on whether you get hacked. You get 1 month of unfettered access to all employee workstations. The consultants get one week to try to break in. Do you want a modern OS with its USB stack and whatever high level drivers, or do you want to put everyone on old school machines with bare metal drivers? Assume the attackers get to know which choice you made.

erikpukinskis 9y ago

I guess the question to ask is: Medium sized company. It's your job to pick a stack. Your performance will be evaluated on whether a team of security consultants can hack you. Your stock grant will either multiply 100x or divide 10x depending on whether you get hacked. You get 1 month of unfettered access to all employee workstations. The consultants get one week to try to break in. Do you want a modern OS with its USB stack and whatever high level drivers, or do you want to put everyone on old school machines with bare metal drivers? Assume the attackers get to know which choice you made.