4 ms·

I am pointing the finger at Microsoft for allowing bad security practice in windows kernel, architecture and other aspects of the Windows operating system. I am

I am pointing the finger at Microsoft for allowing bad security practice in windows kernel, architecture and other aspects of the Windows operating system. I am have to hand it to Microsoft for the good job security. However without knowing the extent of the incident, and going off of this part: "At this point, the investigation has found that the malware has been isolated to business networks only..." It is more than likely this news story is overblown.

google234123 6y ago
Yeah, and if MS tries and change this and make the kernel more secure I would expect huge outrage on HN from people complaining about MS restricting their freedom.
- mindslight 6y ago
  Having the police put a lock on your front door that you don't have the key to will technically make your home "more secure", but not in any way that's useful. Locking down devices is actually just giving up on security. Trusted code and centralized review don't scale. Real security implies effectively mediating between many different interacting parties, not simply reducing the number of them.
- gnramires 6y ago
  UAC (User Account Control) is some of the best thing Microsoft ever did for their security (and it might have inspired android permission system), probably following the Unix. I feel my naivete of complaining at the time I had to click a security prompt. It's still sorely missing fine-grained control like network access (perhaps even fine-grained network access control), and access to various devices and folder locations; within reason, the more controlled and restricted the better. Linux ought to make a move in this front and gain ground on security advantage: shouldn't we be able to give access to specific processes (say an installed game or text application) to specific folders and devices? Why should a game be able to read all my files (and not just its own folder), and why should any of those be able to use the network?
ineedasername 6y ago
They said "business network" so MS is a likely suspect. Then again the full extent of SolarWind's contracts with the government, and the impact of their own hack, aren't completely clear and it would be a decent sized coincidence if multiple nation-state hacks around the same time we're unrelated.
darksaints 6y ago
I'm not a fan of Windows in the slightest, but it should be noted that the Linux kernel has been moving in that direction for the better part of 2 decades now. The amount of privileged code running in the kernel now is absolutely mind boggling. I'm really hoping to see an industrial-scale push to develop a solid headless unix-y userland for SeL4.
- pas 6y ago
  Do you mean eBPF? Or what kind of privileged code is the problem? Regarding security. I think the problem is simply that neither Linux nor Windows is the right tool for this job. They are secure, but not nuclear arsenal secure. And there is where SeL4 and other formally verified components should come in.
randmeerkat 6y ago
If you were a government agency responsible for a deterrent that has held the peace since WW2 and that deterrent had just been compromised would you tell the public?
_hyn3 6y ago
Microsoft moved the GDI into the (formerly) NT microkernel back in the switch from NT 3.51 to NT 4.0, for performance reasons -- and it was needed back then. If the Linux kernel is getting too heavy for you (there really is a lot going on in there now), you can always switch to FreeBSD or OpenBSD. (no snark intended, this is actually quite a viable option for many workloads.)
- rurban 6y ago
  No, we are talking about security here. FreeBSD is even worse than Linux, and OpenBSD is not much better, just slower. Microkernels with capabilities are the only way to go. L4, Fiasco, Genode, ...
deleted 6y ago
[deleted]
aerostable_slug 6y ago
>overblown I'm not sure about that. For example, FERC doesn't have a non-business network — they aren't a system operator. They do have all kinds of juicy data though, including details of various high voltage interconnects and the like that would be good stuff for an infrastructure attacker.

google234123 6y ago

Yeah, and if MS tries and change this and make the kernel more secure I would expect huge outrage on HN from people complaining about MS restricting their freedom.

mindslight 6y ago
Having the police put a lock on your front door that you don't have the key to will technically make your home "more secure", but not in any way that's useful. Locking down devices is actually just giving up on security. Trusted code and centralized review don't scale. Real security implies effectively mediating between many different interacting parties, not simply reducing the number of them.
gnramires 6y ago
UAC (User Account Control) is some of the best thing Microsoft ever did for their security (and it might have inspired android permission system), probably following the Unix. I feel my naivete of complaining at the time I had to click a security prompt. It's still sorely missing fine-grained control like network access (perhaps even fine-grained network access control), and access to various devices and folder locations; within reason, the more controlled and restricted the better. Linux ought to make a move in this front and gain ground on security advantage: shouldn't we be able to give access to specific processes (say an installed game or text application) to specific folders and devices? Why should a game be able to read all my files (and not just its own folder), and why should any of those be able to use the network?

ineedasername 6y ago

They said "business network" so MS is a likely suspect. Then again the full extent of SolarWind's contracts with the government, and the impact of their own hack, aren't completely clear and it would be a decent sized coincidence if multiple nation-state hacks around the same time we're unrelated.

darksaints 6y ago

I'm not a fan of Windows in the slightest, but it should be noted that the Linux kernel has been moving in that direction for the better part of 2 decades now. The amount of privileged code running in the kernel now is absolutely mind boggling. I'm really hoping to see an industrial-scale push to develop a solid headless unix-y userland for SeL4.

pas 6y ago
Do you mean eBPF? Or what kind of privileged code is the problem? Regarding security. I think the problem is simply that neither Linux nor Windows is the right tool for this job. They are secure, but not nuclear arsenal secure. And there is where SeL4 and other formally verified components should come in.

randmeerkat 6y ago

If you were a government agency responsible for a deterrent that has held the peace since WW2 and that deterrent had just been compromised would you tell the public?

_hyn3 6y ago

Microsoft moved the GDI into the (formerly) NT microkernel back in the switch from NT 3.51 to NT 4.0, for performance reasons -- and it was needed back then. If the Linux kernel is getting too heavy for you (there really is a lot going on in there now), you can always switch to FreeBSD or OpenBSD. (no snark intended, this is actually quite a viable option for many workloads.)

rurban 6y ago
No, we are talking about security here. FreeBSD is even worse than Linux, and OpenBSD is not much better, just slower. Microkernels with capabilities are the only way to go. L4, Fiasco, Genode, ...

deleted 6y ago

[deleted]

aerostable_slug 6y ago

>overblown I'm not sure about that. For example, FERC doesn't have a non-business network — they aren't a system operator. They do have all kinds of juicy data though, including details of various high voltage interconnects and the like that would be good stuff for an infrastructure attacker.