8 ms·

I wonder for how long Windows as a software can continue to grow. I looked at the list of services, and its crazy. So much exotic functionality, and so many of

by Arwill 9y ago

I wonder for how long Windows as a software can continue to grow. I looked at the list of services, and its crazy. So much exotic functionality, and so many of what i don't ever need. Then the file system, there are even hidden folders managed by windows itself, that just grow and take up space. All that adds to complexity, and increases the probability for bugs. I wish there was a version of the OS that just shed all that unnecessary functionality and returned to basics. Something like a minimalist Linux distro, but able to run all games and office.

ksk 9y ago
Hmm, but it appears that windows has fewer security bugs than Linux. Is there any data showing otherwise? (TBH, this is already unfair, comparing the kernel with an entire OS) https://www.cvedetails.com/top-50-products.php https://www.cvedetails.com/top-50-products.php https://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33 https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm... https://www.cvedetails.com/product/32238/Microsoft-Windows-10.html?vendor_id=26 https://www.cvedetails.com/product/32238/Microsoft-Windows-1... https://www.cvedetails.com/product/17153/Microsoft-Windows-7.html?vendor_id=26 https://www.cvedetails.com/product/17153/Microsoft-Windows-7... https://www.cvedetails.com/product/22318/Microsoft-Windows-8.html?vendor_id=26 https://www.cvedetails.com/product/22318/Microsoft-Windows-8...
- Erlich_Bachman 9y ago
  Even before that it's already unfair to compare a closed-source product to an open-source system. Bugs are much easier to find in an open-source system. It doesn't even by itself mean that there are more of them. If you look at the big picture, it's not like Windows is known for it's security.
  - ksk 9y ago
    >Even before that it's already unfair to compare a closed-source product to an open-source system. Bugs are much easier to find in an open-source system Ironically, wouldn't that make it even more unfair for Windows? Shouldn't all the 'millions of eyeballs' looking at the linux code be making it more secure? >If you look at the big picture, it's not like Windows is known for it's security. True, but security bugs are easier to reason about, than feelings.
    - whatshisface 9y ago
      We can't measure the number of security bugs, we're measuring how many get fixed. Fewer eyeballs on Windows would imply fewer discoveries, and fewer bugfixes as a result.
      - ksk 9y ago
        >We can't measure the number of security bugs, we're measuring how many get fixed. The number of bugs found should be trending towards zero since millions of people have the opportunity to improve the source code and prevent the bugs from being introduced in the first place. There are ofcourse other advantages to having the source be open, but if there is no security advantage to open source, that's going to put a dent in some of its marketing. >Fewer eyeballs on Windows would imply fewer discoveries, and fewer bugfixes as a result. Why would fewer people be looking at Windows compared to Linux? Security Researchers don't really discriminate. Or did you mean just the MS developers? Hmmm, I don't know how many windows bugs were found through external sources vs internal. Perhaps someone has already done that analysis..
        shakna 9y ago
        > The number of bugs found should be trending towards zero Only if no new features are ever introduced.
        Erlich_Bachman 9y ago
        > Why would fewer people be looking at Windows compared to Linux? As I wrote in the original post, this is because Linux is open-source. There are few people looking at Windows, simply because there is no source to look at, and as a result there are 10 times less people in the world who potentially even can look at it and check for bugs. That's why. With Linux you need basic systems programming skill and ability to code simple exploits. With Windows you either need to be working there (and be assigned to this task) - or reverse-engineer, which is a much rarer and complicated skill.
        ksk 9y ago
- gerdesj 9y ago
  "Hmm, but it appears that windows has fewer security bugs than Linux. Is there any data showing otherwise?" Yes, I think you are being a bit of a noddy comparing a kernel with an entire OS. That said, all software has bugs. Blimey, how on earth can you compare the paltry 3000000000000 odd source files of Windows tucked up in GIT with the gazzilions of source files that comprises a modern Linux based system (let alone the BSDs etc). I will simply mention here that when I update an LTS Ubuntu or Debian box I run "apt update && apt upgrade && reboot" (or use a GUI if I'm bored) and it takes a few seconds to minutes to update the entire system. Everything. That includes Java, Flash, Office suites, graphics drivers, USB drivers, printer drivers, CAD suites, database servers, web servers, PHP, Python, Perl, Rust, Go, ... need I go on. Everything. The same happens when I use pacman or yourt, or emerge, or yum, or rpm or whatever. I'm personally CREST accredited, so have a fair idea about security and prefer to spend my time doing stuff and not waiting for updates to install (if I can even find them) - you?
  - ksk 9y ago
    Sorry, did you have a point? I honestly have no idea what you are saying.
    - gerdesj 9y ago
      Sorry, I did guild the lily somewhat, this was my essential point: "Yes, I think you are being a bit of a noddy comparing a kernel with an entire OS."
  - exikyut 9y ago
    FWIW WinXP is officially quoted as 45 million lines of code (https://www.facebook.com/windows/posts/155741344475532 https://www.facebook.com/windows/posts/155741344475532), everyone's decided Win10 is 5-10 (some say 15-20) million more. I've been meaning to SLOCcount Linux sometime, actually! Having said that, I don't think it'll be 45M LOC. The kernel is 20M LOC (https://www.linuxcounter.net/statistics/kernel https://www.linuxcounter.net/statistics/kernel). Chrome is 18M (excluding blank lines/comments) (https://www.openhub.net/p/chrome/analyses/latest/languages_summary https://www.openhub.net/p/chrome/analyses/latest/languages_s...). LibreOffice is 9M LOC (https://www.openhub.net/p/libreoffice https://www.openhub.net/p/libreoffice). And then I found out that KDE is 60M LOC!! (https://www.openhub.net/p/kde https://www.openhub.net/p/kde) GNOME is 9M (https://www.openhub.net/p/gnome https://www.openhub.net/p/gnome). But I'm guessing those two stats are comparing just the base desktop environment in GNOME's case with all the productivity apps (including KWrite et al) and system libraries (including QtWebKit et al). This must be kept in mind. TL;DR, an incredibly basic system with just a word processor and web browser, and maybe a minimal windowmanager on top, would be 47M. Adding KDE in makes it 107M - but you're almost never going to use all of it (whereas with Chrome and LibreOffice some large proportion of that 18M and 9M is loaded into RAM and potentially targetable).
- sseth 9y ago
  Might be worth reading this article : https://media.blackhat.com/us-13/US-13-Martin-Buying-Into-The-Bias-Why-Vulnerability-Statistics-Suck-WP.pdf https://media.blackhat.com/us-13/US-13-Martin-Buying-Into-Th... It is really pointless using the count of CVEs as a measure of how vulnerable a product is.
  - ksk 9y ago
    AFAIK, every single form of aggregation that reduces variance, biases your data set. >It is really pointless using the count of CVEs as a measure of how vulnerable a product is. I read the article, and that is certainly the opinion of the author here. Security is a large field. You can reduce it to number of bugs. You can reduce it to the development process used to create the product. You can reduce it to methods of defending against future vulnerabilities. You can reduce it to methods of tackling bugs. You can reduce it in along any axis. I don't think using CVEs as a measure is pointless. I find them to be useful.
chris_wot 9y ago
You have no idea of the complexity of things until you delve into Windows Side-by-Side...

by Arwill 9y ago

ksk 9y ago

Hmm, but it appears that windows has fewer security bugs than Linux. Is there any data showing otherwise? (TBH, this is already unfair, comparing the kernel with an entire OS) https://www.cvedetails.com/top-50-products.php https://www.cvedetails.com/top-50-products.php https://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33 https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm... https://www.cvedetails.com/product/32238/Microsoft-Windows-10.html?vendor_id=26 https://www.cvedetails.com/product/32238/Microsoft-Windows-1... https://www.cvedetails.com/product/17153/Microsoft-Windows-7.html?vendor_id=26 https://www.cvedetails.com/product/17153/Microsoft-Windows-7... https://www.cvedetails.com/product/22318/Microsoft-Windows-8.html?vendor_id=26 https://www.cvedetails.com/product/22318/Microsoft-Windows-8...

Erlich_Bachman 9y ago
Even before that it's already unfair to compare a closed-source product to an open-source system. Bugs are much easier to find in an open-source system. It doesn't even by itself mean that there are more of them. If you look at the big picture, it's not like Windows is known for it's security.
- ksk 9y ago
  >Even before that it's already unfair to compare a closed-source product to an open-source system. Bugs are much easier to find in an open-source system Ironically, wouldn't that make it even more unfair for Windows? Shouldn't all the 'millions of eyeballs' looking at the linux code be making it more secure? >If you look at the big picture, it's not like Windows is known for it's security. True, but security bugs are easier to reason about, than feelings.
  - whatshisface 9y ago
    We can't measure the number of security bugs, we're measuring how many get fixed. Fewer eyeballs on Windows would imply fewer discoveries, and fewer bugfixes as a result.
    - ksk 9y ago
      >We can't measure the number of security bugs, we're measuring how many get fixed. The number of bugs found should be trending towards zero since millions of people have the opportunity to improve the source code and prevent the bugs from being introduced in the first place. There are ofcourse other advantages to having the source be open, but if there is no security advantage to open source, that's going to put a dent in some of its marketing. >Fewer eyeballs on Windows would imply fewer discoveries, and fewer bugfixes as a result. Why would fewer people be looking at Windows compared to Linux? Security Researchers don't really discriminate. Or did you mean just the MS developers? Hmmm, I don't know how many windows bugs were found through external sources vs internal. Perhaps someone has already done that analysis..
      - shakna 9y ago
        > The number of bugs found should be trending towards zero Only if no new features are ever introduced.
      - Erlich_Bachman 9y ago
        > Why would fewer people be looking at Windows compared to Linux? As I wrote in the original post, this is because Linux is open-source. There are few people looking at Windows, simply because there is no source to look at, and as a result there are 10 times less people in the world who potentially even can look at it and check for bugs. That's why. With Linux you need basic systems programming skill and ability to code simple exploits. With Windows you either need to be working there (and be assigned to this task) - or reverse-engineer, which is a much rarer and complicated skill.
        ksk 9y ago
gerdesj 9y ago
"Hmm, but it appears that windows has fewer security bugs than Linux. Is there any data showing otherwise?" Yes, I think you are being a bit of a noddy comparing a kernel with an entire OS. That said, all software has bugs. Blimey, how on earth can you compare the paltry 3000000000000 odd source files of Windows tucked up in GIT with the gazzilions of source files that comprises a modern Linux based system (let alone the BSDs etc). I will simply mention here that when I update an LTS Ubuntu or Debian box I run "apt update && apt upgrade && reboot" (or use a GUI if I'm bored) and it takes a few seconds to minutes to update the entire system. Everything. That includes Java, Flash, Office suites, graphics drivers, USB drivers, printer drivers, CAD suites, database servers, web servers, PHP, Python, Perl, Rust, Go, ... need I go on. Everything. The same happens when I use pacman or yourt, or emerge, or yum, or rpm or whatever. I'm personally CREST accredited, so have a fair idea about security and prefer to spend my time doing stuff and not waiting for updates to install (if I can even find them) - you?
- ksk 9y ago
  Sorry, did you have a point? I honestly have no idea what you are saying.
  - gerdesj 9y ago
    Sorry, I did guild the lily somewhat, this was my essential point: "Yes, I think you are being a bit of a noddy comparing a kernel with an entire OS."
- exikyut 9y ago
  FWIW WinXP is officially quoted as 45 million lines of code (https://www.facebook.com/windows/posts/155741344475532 https://www.facebook.com/windows/posts/155741344475532), everyone's decided Win10 is 5-10 (some say 15-20) million more. I've been meaning to SLOCcount Linux sometime, actually! Having said that, I don't think it'll be 45M LOC. The kernel is 20M LOC (https://www.linuxcounter.net/statistics/kernel https://www.linuxcounter.net/statistics/kernel). Chrome is 18M (excluding blank lines/comments) (https://www.openhub.net/p/chrome/analyses/latest/languages_summary https://www.openhub.net/p/chrome/analyses/latest/languages_s...). LibreOffice is 9M LOC (https://www.openhub.net/p/libreoffice https://www.openhub.net/p/libreoffice). And then I found out that KDE is 60M LOC!! (https://www.openhub.net/p/kde https://www.openhub.net/p/kde) GNOME is 9M (https://www.openhub.net/p/gnome https://www.openhub.net/p/gnome). But I'm guessing those two stats are comparing just the base desktop environment in GNOME's case with all the productivity apps (including KWrite et al) and system libraries (including QtWebKit et al). This must be kept in mind. TL;DR, an incredibly basic system with just a word processor and web browser, and maybe a minimal windowmanager on top, would be 47M. Adding KDE in makes it 107M - but you're almost never going to use all of it (whereas with Chrome and LibreOffice some large proportion of that 18M and 9M is loaded into RAM and potentially targetable).
sseth 9y ago
Might be worth reading this article : https://media.blackhat.com/us-13/US-13-Martin-Buying-Into-The-Bias-Why-Vulnerability-Statistics-Suck-WP.pdf https://media.blackhat.com/us-13/US-13-Martin-Buying-Into-Th... It is really pointless using the count of CVEs as a measure of how vulnerable a product is.
- ksk 9y ago
  AFAIK, every single form of aggregation that reduces variance, biases your data set. >It is really pointless using the count of CVEs as a measure of how vulnerable a product is. I read the article, and that is certainly the opinion of the author here. Security is a large field. You can reduce it to number of bugs. You can reduce it to the development process used to create the product. You can reduce it to methods of defending against future vulnerabilities. You can reduce it to methods of tackling bugs. You can reduce it in along any axis. I don't think using CVEs as a measure is pointless. I find them to be useful.

chris_wot 9y ago

You have no idea of the complexity of things until you delve into Windows Side-by-Side...