4 ms·

Clearly they've put a lot of work into this and are willing to pay out for a "3rd party audit" so to speak. But my schadenfreude is hoping for an outcome simil

Clearly they've put a lot of work into this and are willing to pay out for a "3rd party audit" so to speak. But my schadenfreude is hoping for an outcome similar to what happened to an old co-worker of mine back in 2005. He was a Windows nut and we were always in a friendly competition about which ecosystem was the better one. One time he had done a bunch of modifications to his own laptop OS, IDS, and tweaking services to have a slimmed down install with a web server. When he was happy he told me "tell your hacker buddies to try and hack this website hehe" :D He had put up a simple website offering 1000 USD for hacking into the server it was hosted on. His own personal work laptop, with a bunch of other sensitive stuff on it. I said, ok... And posted it on a certain mailing list that I won't mention. We sat opposite each other and within 10 minutes I saw him bend down towards the screen with a worried look on his face. Tapping frantically on the keys. Within another 10 minutes he had disconnected the computer from the internet and said the challenge was off. :D Apparently his IDS had been throwing up warnings about md5 checksums being changed left and right. That's all we figured out about it. I was 16 years younger so he didn't want to share much more with me.

graham_paul 7y ago
Any chance I can get the name of that mailing list via PM?
- irishcoffee 7y ago
  Can I piggy back off this request as well?
  - Alekhine 7y ago
    Me three!
erikbye 7y ago
How about we stop using HN's comment section to tell irrelevant-to-the-story personal anecdotes? This is basically the top/most upvoted comment of every article. Surely I can't be the only one to notice this trend?
- wtetzner 7y ago
  I don’t see why it’s a problem. If it’s the most up-voted, then clearly people find it interesting.
  - erikbye 7y ago
    It's a problem exactly because it's up-voted, it's derailing. Happens on so many articles recently. Either derailing by a personal anecdote, or by the "middlebrow dismissal": https://news.ycombinator.com/item?id=4693920 https://news.ycombinator.com/item?id=4693920 Both are equally derailing. In this case, I would much rather the comments be about the actual OS in question or the trend of big companies crowdsourcing security (penetration testing).
    - WaylonKenning 7y ago
      One man's trash is another man's treasure. Otherwise we'd all be reading a website called Hacker Facts, not Hacker News. These anecdotes provide societal context to the story. Why would Microsoft get the public to harden their product? Surely they have enough resources to do it themselves right? Because many eyes make light work. Some people would obsess over trying to hack this OS, putting in far more effort than someone paid 9-5 to do it.
  - hombre_fatal 7y ago
    Not always what you want. I'm sure many people think the pun that the top 50 comments race to make on Reddit is the most hilarious thing in the world. But it also gets in the way of discussion as you have to scroll/collapse your way past. I think we could do a lot worse than anecdotes, but what I find weird is how the anecdotes on HN are always so smug, like this one. "Heh, my old co-worker thought my 'little hacker buddies' couldn't hack his website ;b Let's just say they put quite a dent in it heh ;b." Bit of an eye roll.
  - duxup 7y ago
    Admittedly I'm prone to posting stories and I'm thinking of not doing so / doing it less. Look at this story. Some guy, who honestly seems to have pretty questionable judgment did a thing and it was a bad idea. What does that really have to do with this challenge from MS about a custom version of Linux? I would say almost nothing.
duxup 7y ago
I feel like his choices by using a device that is for work ... kinda automatically makes me question what if anything we can learn from a technical perspective. If his judgment is that bad on a basic level, how bad must it be on a technical level?
- wahern 7y ago
  Many people confuse absence of evidence (of insecurity) with evidence of absence (of insecurity). Just look at the SARS-CoV-2 reporting in January and February, where every major media outlet copied stories about how the flu is much worse and that we should really be worrying about the flu. It was patently ridiculous to be making such assertions as the only thing certain at the time was the depth of our uncertainty. The dilemma is that equating absence of evidence with evidence of absence is actually a good long-term strategy in our day-to-day lives. Without this strategy we'd be paralyzed by our own ignorance; particularly, paradoxically, those aware of their ignorance. It's a meta-skill to be able to identify when the heuristic should be discarded in favor of more rigorous analytical thinking. A capacity for analytical thinking isn't sufficient by itself, thus making such an error in judgement doesn't necessarily imply an absence of strong analytical thinking skills. (At least, that's what I tell myself ;)
  - duxup 7y ago
    More specifically I'd question the abilities of anyone who thinks they know about security who then exposes actual work material to some sort of uncontrolled test as described and honestly claims to be sure it is secure. Anyone who knows about security understands that on a modern system there are so many layers of software / firmware, you never can be 100% sure (well I guess other than powering it off...).

graham_paul 7y ago

Any chance I can get the name of that mailing list via PM?

irishcoffee 7y ago
Can I piggy back off this request as well?
- Alekhine 7y ago
  Me three!

erikbye 7y ago

How about we stop using HN's comment section to tell irrelevant-to-the-story personal anecdotes? This is basically the top/most upvoted comment of every article. Surely I can't be the only one to notice this trend?

wtetzner 7y ago
I don’t see why it’s a problem. If it’s the most up-voted, then clearly people find it interesting.
- erikbye 7y ago
  It's a problem exactly because it's up-voted, it's derailing. Happens on so many articles recently. Either derailing by a personal anecdote, or by the "middlebrow dismissal": https://news.ycombinator.com/item?id=4693920 https://news.ycombinator.com/item?id=4693920 Both are equally derailing. In this case, I would much rather the comments be about the actual OS in question or the trend of big companies crowdsourcing security (penetration testing).
  - WaylonKenning 7y ago
    One man's trash is another man's treasure. Otherwise we'd all be reading a website called Hacker Facts, not Hacker News. These anecdotes provide societal context to the story. Why would Microsoft get the public to harden their product? Surely they have enough resources to do it themselves right? Because many eyes make light work. Some people would obsess over trying to hack this OS, putting in far more effort than someone paid 9-5 to do it.
- hombre_fatal 7y ago
  Not always what you want. I'm sure many people think the pun that the top 50 comments race to make on Reddit is the most hilarious thing in the world. But it also gets in the way of discussion as you have to scroll/collapse your way past. I think we could do a lot worse than anecdotes, but what I find weird is how the anecdotes on HN are always so smug, like this one. "Heh, my old co-worker thought my 'little hacker buddies' couldn't hack his website ;b Let's just say they put quite a dent in it heh ;b." Bit of an eye roll.
- duxup 7y ago
  Admittedly I'm prone to posting stories and I'm thinking of not doing so / doing it less. Look at this story. Some guy, who honestly seems to have pretty questionable judgment did a thing and it was a bad idea. What does that really have to do with this challenge from MS about a custom version of Linux? I would say almost nothing.

duxup 7y ago

I feel like his choices by using a device that is for work ... kinda automatically makes me question what if anything we can learn from a technical perspective. If his judgment is that bad on a basic level, how bad must it be on a technical level?

wahern 7y ago
Many people confuse absence of evidence (of insecurity) with evidence of absence (of insecurity). Just look at the SARS-CoV-2 reporting in January and February, where every major media outlet copied stories about how the flu is much worse and that we should really be worrying about the flu. It was patently ridiculous to be making such assertions as the only thing certain at the time was the depth of our uncertainty. The dilemma is that equating absence of evidence with evidence of absence is actually a good long-term strategy in our day-to-day lives. Without this strategy we'd be paralyzed by our own ignorance; particularly, paradoxically, those aware of their ignorance. It's a meta-skill to be able to identify when the heuristic should be discarded in favor of more rigorous analytical thinking. A capacity for analytical thinking isn't sufficient by itself, thus making such an error in judgement doesn't necessarily imply an absence of strong analytical thinking skills. (At least, that's what I tell myself ;)
- duxup 7y ago
  More specifically I'd question the abilities of anyone who thinks they know about security who then exposes actual work material to some sort of uncontrolled test as described and honestly claims to be sure it is secure. Anyone who knows about security understands that on a modern system there are so many layers of software / firmware, you never can be 100% sure (well I guess other than powering it off...).