3 ms·

I think it's unfair to say those didn't consider security. Security was one of the big features of the Windows NT familiy in its early days, and Linux also obvi

I think it's unfair to say those didn't consider security. Security was one of the big features of the Windows NT familiy in its early days, and Linux also obviously has a lot of security in its design. Their problem is that the threat model completely changed since their design. Windows and Linux were written with the assumption that a computer has multiple users, most of them without admin privileges. The threat model includes things like account security, processes from one user influencing processes of other users, (at least on Windows) users viewing files of other users, non-admins modifying the computer configuration, one user taking all resources, etc. They mostly solve these problems well, but some of these problems are now much less relevant, some of the core assumptions have become less valid over time (the admin/non-admin split), and many new considerations are now part of the threat model, such as protecting against rouge applications run by the same user, untrustworthy peripherals, etc. This is one of the issues with security-by-design: your definition of security will change over time, in ways your design can't easily accomodate

Veserv 4y ago
It is absolutely fair to say they did not consider security (at least to a level that can be considered real security). They targeted a Orange Book Level C2/Common Criteria EAL4 level of security (at best) which is a level that was not even really intended to indicate there exists any security at all, and, as a result, were permanently unable to retrofit beyond that. They attempted to many times and failed every single time despite decades of effort. There are multiple systems designed both before and after that were designed to achieve the higher levels of security and succeeded. The security designed in was incompetent at the time and incompetent now and, as history has shown us, unfixable. To then address your second point indirectly, I agree that there are systems, such as Windows, that have "security" designed for systems where all agents are inherently trusted. These systems are not inherently worthless as it is perfectly fine to use in situations where security is unnecessary such as children's toys or running a disconnected device. It is, however, unacceptable to use such systems in contexts that require a minimal level of security such as banks and hospitals like how they are used now. Using systems designed only to protect against casual and inadvertent attacks in critical systems is engineering malpractice.
- weirdman 4y ago
  You seem to be from a bizarro world where these certifications are the be-all/end-all. No major advance in security was ever achieved by trying to follow some standard written by a bunch of people who haven’t themselves solved any of the engineering challenges.
amluto 4y ago
Windows NT was designed as a multi-user system in which everything [0] lived in one of a small handful of global namespaces. They built an unbelievably complex ACL and “privilege” system for it. And they allowed remote systems to connect over various Ethernet protocols and interact directly with those global namespaces. And they did the latter with cryptosystems that were obviously terrible even at the time. Of course it didn’t work. Linux is modeled after Unix, and I don’t think security was a serious initial goal. Heck, Unix has setuid, of which nothing good can be said. Most of Linux’s security advantages were due to: 1. The lack of the aforementioned global namespaces in such an egregious way. The main global namespaces is the filesystem, and that one stares you in the face. The object manager hierarchy in Windows was basically invisible until Sysinternals figured out how to enumerate it and stuck a UI on it. 2. A lack of all the Microsoft RPC crap. Your files and processes on Linux were not all visible from outside. You only had an SMB server if you chose to run one. 3. A much less complex syscall interface. Seccomp on Linux is fairly straightforward. Windows had to come up with a complex “integrity level” scheme. (Windows is full of nasty complex things like restricted jobs that seem unlikely to be used correctly by anyone.) But at least Windows has a sensible process model and does not have privilege increases when CreateProcess is called. Security systems that actually work are simple. At least they had a SAK, which everyone seems to have given up on these days.

Veserv 4y ago

It is absolutely fair to say they did not consider security (at least to a level that can be considered real security). They targeted a Orange Book Level C2/Common Criteria EAL4 level of security (at best) which is a level that was not even really intended to indicate there exists any security at all, and, as a result, were permanently unable to retrofit beyond that. They attempted to many times and failed every single time despite decades of effort. There are multiple systems designed both before and after that were designed to achieve the higher levels of security and succeeded. The security designed in was incompetent at the time and incompetent now and, as history has shown us, unfixable. To then address your second point indirectly, I agree that there are systems, such as Windows, that have "security" designed for systems where all agents are inherently trusted. These systems are not inherently worthless as it is perfectly fine to use in situations where security is unnecessary such as children's toys or running a disconnected device. It is, however, unacceptable to use such systems in contexts that require a minimal level of security such as banks and hospitals like how they are used now. Using systems designed only to protect against casual and inadvertent attacks in critical systems is engineering malpractice.

weirdman 4y ago
You seem to be from a bizarro world where these certifications are the be-all/end-all. No major advance in security was ever achieved by trying to follow some standard written by a bunch of people who haven’t themselves solved any of the engineering challenges.

amluto 4y ago

Windows NT was designed as a multi-user system in which everything [0] lived in one of a small handful of global namespaces. They built an unbelievably complex ACL and “privilege” system for it. And they allowed remote systems to connect over various Ethernet protocols and interact directly with those global namespaces. And they did the latter with cryptosystems that were obviously terrible even at the time. Of course it didn’t work. Linux is modeled after Unix, and I don’t think security was a serious initial goal. Heck, Unix has setuid, of which nothing good can be said. Most of Linux’s security advantages were due to: 1. The lack of the aforementioned global namespaces in such an egregious way. The main global namespaces is the filesystem, and that one stares you in the face. The object manager hierarchy in Windows was basically invisible until Sysinternals figured out how to enumerate it and stuck a UI on it. 2. A lack of all the Microsoft RPC crap. Your files and processes on Linux were not all visible from outside. You only had an SMB server if you chose to run one. 3. A much less complex syscall interface. Seccomp on Linux is fairly straightforward. Windows had to come up with a complex “integrity level” scheme. (Windows is full of nasty complex things like restricted jobs that seem unlikely to be used correctly by anyone.) But at least Windows has a sensible process model and does not have privilege increases when CreateProcess is called. Security systems that actually work are simple. At least they had a SAK, which everyone seems to have given up on these days.