3 ms·

Maybe they should make an OS that doesn't get pwned if you connect it to the internet when it's two weeks behind on updates. Linux and BSD machines manage it. R

by dTal 5y ago

Maybe they should make an OS that doesn't get pwned if you connect it to the internet when it's two weeks behind on updates. Linux and BSD machines manage it. Remote 0-days don't come by that often.

tored 5y ago
cough Heartbleed cough
naikrovek 5y ago
> Maybe they should make an OS that doesn't get pwned if you connect it to the internet when it's two weeks behind on updates. do you really believe that they AREN'T working on this? of course they are. the field of software development is extraordinarily young. we still don't know how to do things very well, and we're still discovering new ways to know we aren't doing things well. > Linux and BSD machines manage it. it's a matter of target value, and the number of people who would be inconvenienced enough to pay a random to unlock their files on Linux is FAR smaller than for Windows. So attackers go where the money is. Governments overwhelmingly use Windows as a desktop OS as well. Attackers go where the secrets are. etc. And when you count remote exploits capable of remote code execution, last I read there had been slightly more of those on Linux than Windows. don't quote me on that until I find a source. > Remote 0-days don't come by that often. yes they do. not all of them get media attention, though. the most recent monthly patch from MS for Windows 10 included fixes for six of them. All were actively being exploited. SIX.
- dTal 5y ago
  If we're talking target value, I rather think that servers are higher value than people's desktops - they have lots more juicy info, and richer owners.
  - tored 5y ago
    I think there is mismatch in publicly here. When private consumer's computers gets hijacked, those kind of stories can show up in normal non-technical newspapers, as a warning or a horror story for other consumers. But does hijacking of servers create that kind of publicity? Sometimes companies have to admit that they have been hacked because of data leak. But do they publicly admit for every breach? Is it in private companies interest to go public with that kind of information? And if they do, does it reach non-technical newspapers? There was a good thread about Linux kernel security today, a slideshow and video. TLDR; many unsafe practices because of C, bad project management to track bugs, triage bugs, correctly applying patches, correctly map patches with CVEs https://news.ycombinator.com/item?id=27513149 https://news.ycombinator.com/item?id=27513149

by dTal 5y ago

Maybe they should make an OS that doesn't get pwned if you connect it to the internet when it's two weeks behind on updates. Linux and BSD machines manage it. Remote 0-days don't come by that often.

tored 5y ago

cough Heartbleed cough

naikrovek 5y ago

> Maybe they should make an OS that doesn't get pwned if you connect it to the internet when it's two weeks behind on updates. do you really believe that they AREN'T working on this? of course they are. the field of software development is extraordinarily young. we still don't know how to do things very well, and we're still discovering new ways to know we aren't doing things well. > Linux and BSD machines manage it. it's a matter of target value, and the number of people who would be inconvenienced enough to pay a random to unlock their files on Linux is FAR smaller than for Windows. So attackers go where the money is. Governments overwhelmingly use Windows as a desktop OS as well. Attackers go where the secrets are. etc. And when you count remote exploits capable of remote code execution, last I read there had been slightly more of those on Linux than Windows. don't quote me on that until I find a source. > Remote 0-days don't come by that often. yes they do. not all of them get media attention, though. the most recent monthly patch from MS for Windows 10 included fixes for six of them. All were actively being exploited. SIX.

dTal 5y ago
If we're talking target value, I rather think that servers are higher value than people's desktops - they have lots more juicy info, and richer owners.
- tored 5y ago
  I think there is mismatch in publicly here. When private consumer's computers gets hijacked, those kind of stories can show up in normal non-technical newspapers, as a warning or a horror story for other consumers. But does hijacking of servers create that kind of publicity? Sometimes companies have to admit that they have been hacked because of data leak. But do they publicly admit for every breach? Is it in private companies interest to go public with that kind of information? And if they do, does it reach non-technical newspapers? There was a good thread about Linux kernel security today, a slideshow and video. TLDR; many unsafe practices because of C, bad project management to track bugs, triage bugs, correctly applying patches, correctly map patches with CVEs https://news.ycombinator.com/item?id=27513149 https://news.ycombinator.com/item?id=27513149