21 ms·

“Computer security 80% solved if we deprecate technology shown in this graphic”

358 points by mariuz 3y ago

radicalbyte 3y ago
Windows 11 literally comes with OS level malware, they've turned the OS into an advertising platform. Them having actual backwards compatibility (unlike the fruity side) is the least of our problems.
Pannoniae 3y ago
As long as some platform is capable and powerful for many things, there will be malware. The reason why most (consumer-facing at least) malware isn't targeting Linux is because its desktop market share is like 3%. It's way better to target Windows on desktop since you can reach way more users that way. The only other alternative is turning your computer into a glorified phone (a.k.a. a locked-down media consumption device) where everything is nicely sandboxed and nothing has any kind of permission to do "bad" things. (Except tracking. Because guess what, the company who makes the OS also sells ads.)
- howinteresting 3y ago
  Heterogeneity is an important part of defense in depth. Monocultures are more likely to be attacked.
- dacryn 3y ago
  I don't fully agree on this one. Linux has a wider attack vector since there are tons of packages out there. Yet the core has a lot of attention and many eyes on it, just because it is so open. Vulnerabilities get patched rather sooner than later. Linux versions and gnu packages are running basically the entire internet, so there is definitely incentive to break into into it. It's also a lot clearer in linux when a process is doing something it shouldn't, since it's a lot easier to probe into it to check what's going on.
  - nradov 3y ago
    Is there any evidence that security vulnerabilities are on average fixed faster in the major Linux distributions than in Windows?
    - chmod775 3y ago
      Some. Here's for the Linux Kernel: https://googleprojectzero.blogspot.com/2022/02/a-walk-through-project-zero-metrics.html https://googleprojectzero.blogspot.com/2022/02/a-walk-throug... The dataset is quite small, but on average it took Linux 25 days to fix a 0-day while it took Microsoft 83 days.
      - schemescape 3y ago
        Does that metric include the delay if fixes getting incorporated into Linux distributions (and pushed out, assuming automatic updates—maybe not a good assumption) or Windows fixes getting deployed via Windows Update? Edit: I don’t know much about this topic, but thought “time to deployment of a fix” might be more useful. Edit again: also unclear if the comparison is “apples to apples”.
        RunSet 3y ago
        I doubt it, any more than it includes the time it takes procrastinating users to actually update their systems.
      - de-moray 3y ago
        The dataset does not appear to discuss the lifecycle of Linux distributions taking the security patches from upstream, nor the update process for all of the downstream distributions. Something that's been widely discussed elsewhere is how often security issues are silently fixed in Linus's repo and therefore not picked up by distributions for their stable/LTS releases. I buy the immediacy of patches if you compile your own kernel from the latest kernel.org sources, not if you're relying on distributions.
  - SoftTalker 3y ago
- jolux 3y ago
  > The only other alternative is turning your computer into a glorified phone (a.k.a. a locked-down media consumption device) There’s a third alternative: keep the platform powerful but increase the default isolation level for third-party software and let the user choose what permissions it has. macOS is headed in this direction. Qubes is a more radical example and I think probably the future of desktop computing: everything will run in its own virtual machine.
  - delfinom 3y ago
    >There’s a third alternative: keep the platform powerful but increase the default isolation level for third-party software and let the user choose what permissions it has. That's the direction Windows is going as well with the MS-Store and appx/msix bundles. There's also Process Memory protection by using virtualization https://support.microsoft.com/en-us/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78 https://support.microsoft.com/en-us/windows/core-isolation-e...
  - FireInsight 3y ago
    This is where Linux is going as well. I believe that in the future most peoples base systems will contain only necessary packages and other software will be run out of Flatpaks or a comparable technology separate from the host.
    - nickstinemates 3y ago
      This is how I run everything outside of coreutils in Linux. Either with VM isolation or packed away in a container. Host is basically a hypervisor with external monitoring and logging.
    - jchw 3y ago
      Flatpak right now isn't really a security boundary. That said, I don't think there's any particular reason it couldn't or shouldn't be in the future. The model seems amenable to it, and maybe it was at one point the intent even.
  - vorpalhex 3y ago
- Retric 3y ago
  Sandboxing isn’t incompatible with a highly customizable OS. Malware is really more a question of being able to install software without the users control and the inability to remove such installations after the fact. Windows suffers from Malware in no small part due to the systems design rather than simply being common. Plenty of alternatives have more users than windows did back in the late 90’s when it was a huge target.
  - s1gsegv 3y ago
    I think the crux of the issue is that making a system that's customizable AND sandboxing AND user friendly multiplies together to create development and testing effort that's not palatable for most right now. Even the open source offerings that add sandboxing often drop either the customizability or the user friendliness.
  - zzo38computer 3y ago
    > Sandboxing isn’t incompatible with a highly customizable OS. This is true, but there is much badly designed sandboxing. Many of the sandbox systems on Linux will have some problems, including too broad permissions, assuming text (including file names) is Unicode, failure to consider permissions that differ by command-line switches and other configuration files, failing to consider other things that the user might want to connect access to devices by files and other programs, and in case it prompts the user (at run time) for the name of another program to run by using popen or something like that and that program should run using its own permissions instead, etc. (Many of my programs that have an interactive mode do run other programs with popen, which prompt the user at run time to specify what command to run, so it can vary.) I had my own ideas of operating system design, which is different from POSIX (although there is a POSIX compatibility layer available as a C library; the kernel need not know anything about it). One of its major ideas is that it uses capability-based security with proxy capabilities; these can be used for sandboxing and other high-level features implemented in terms of proxy capabilities. All I/O (except the Yield and Quit syscalls) requires capabilities; capabilities (as well as links) can also be passed in messages through other capabilities, including the initial message. There are many other ideas too, including ways for programs to be connected together and with user codes by user specifications. These ideas can allow working without dropping customizability, etc (in fact, the way I thought to do, would actually improve customizability, even for programs that do not normally have this feature).
- everdrive 3y ago
  This is definitely true, and I think there are at least two points worth considering here. - Part of what makes the mainstream OS terrible is the mere fact that it is mainstream. If Linux hit 60-70% adoption, a plague of terrible software, adware, malware, and more would start degrading its quality. - Despite the points above, it would be really nice if some of the lousy things pointed out the in the graphic were deprecated.
  - bee_rider 3y ago
    Free Software licenses typically say basically “I’m giving you this for free, so you take it as it is, no promises.” You get the guarantees that you pay for. But nobody would write some of the absolute schlock they get over in proprietary-land if they didn’t think they could dupe unwitting consumers into paying for it.
- mcpackieh 3y ago
  Popularity was the canned cope for why Windows 95 through XP were riddled with so much malware. But then Microsoft started taking security more seriously with Vista and onwards. The situation didn't turn into sunshine and roses, but it did improve dramatically. It turns out that popularity wasn't the problem, the problem was the insecure nature of the software. There is of course still a lot of room for improvement.
  - phendrenad2 3y ago
    The possibility of there being a confluence of problems is one that's hard to grok, but doing so is ultimately fruitful.
  - dj_mc_merlin 3y ago
    As opposed to the Linux security best practices of curl | bash? I have no choice but to set up my computer to run untrusted code, on a CPU which itself might be spying on me -- I don't feel like my environment is inherently more secure than Windows at all. Just less popular.
    - pxc 3y ago
      > the Linux security best practices of curl | bash? You do realize that even this is the same as downloading and running an executable from a website, which is still the norm on Windows, right?
      - xigoi 3y ago
        In fact, curl | bash is safer, because you can replace "| bash" with "| less" and inspect the script.
        xmodem 3y ago
        I would argue that Windows checking certificate signatures provides a lot more safety to the vast majority of users than manually inspecting a bash script.
- soraminazuki 3y ago
  Wait, you say malware don't target Linux because it has no market share? The OS that is ubiquitous on servers and mobile?
  - vuln 3y ago
    Typically there aren’t users on the servers. The servers aren’t used for browsing the internet or checking emails.
    - lelanthran 3y ago
      The rewards are greater on the server. If you pwn just one server you can attack thousands of people, their data, their credentials, etc. Saying that there's no malware for Linux because there's no reawrd is myopic - the payoff is potentially larger.
      - vuln 3y ago
        > Saying that there's no malware for Linux because there's no reawrd is myopic - the payoff is potentially larger. I didn’t say that. My comment was really just commenting on the fact that most attacks (mal/ransomware/phishing/exploits) very frequently need some sort of user interaction. Without users or users doing user stuff it makes it harder to get things to execute on the machine/server. Sure if the server is in the DMZ and unpatched then yes it will be hammered by scanners and automated exploiters. With proper security hygiene and a proper patch cadence servers are usually more protected through defense in depth and lack of human.
        lelanthran 3y ago
        You are correct, you most certainly did not say that, and I apologise for implying that you did. Mea culpa.
      - sanitycheck 3y ago
        They're configured and administered by professionals though, not your grandma (probably).
- lofatdairy 3y ago
  I think there's a unique element to Windows with it's attempt to be extremely backwards compatible. This can be a tremendous boon when, say, running older software targeting a previous OS, but introduces vulnerabilities since your dependency tree has such deep roots. It's definitely a good target because god knows how many banks/hospitals/etc are running windows and have critical business data in Excel sheets or Power BI or whatever, but it doesn't help that Windows itself is constructed of layers and layers of older code that can't be sacrificed without wrecking some client workflow. I mean that screenshot of 10 different design styles in Windows 11 kinda goes to show how much of it is just ported over kinda arbitrarily.
- Beached 3y ago
  Linux has both a huge stack surface and a huge focus on the malware and TA sphere. I worry about my Linux environment far more than my Windows environment. properly securing, monitoring and responding in a Linux environment is much harder than a windows environment for a SOC. the enterprise tool set lags in this space by a lot, and the TAs targeting Linux are generally FAR more sophisticated.
- cogman10 3y ago
  It seems like your thesis is disproved in your own examples. Linux is hugely popular on phones (android), which are every bit as juicy (if not more so at this point) than a desktop target. There is mobile malware but it's far more rare and harder to come by. But then there's just the fact that the way software is installed on a linux machine is wildly different from how you'd install it on windows. Just getting that binary blob to run requires some heroic efforts (To the point where we've pretty much decided it's easier to distribute via containers rather than compiled binaries for a given desktop). And if we expand beyond the desktop, we find linux everywhere in the server world. Easily the most popular OS to run server software. Which makes it a hugely valuable target for hackers. They'd love nothing more than to compromise a bank server. To say there's nothing about linux that makes it inherently more secure than windows seems just unreal. Because nix was designed around multiple users from the ground up, user permissions have been baked into the common flow for decades. That alone creates a huge layer of security that makes things like root kits or worms running at root super hard to pull off. The old windows (9->XP) pretty much gave everyone running admin permissions. Writing or changing a system32 dll was child's play. To exploit linux, you have to either trick a user to run something with elevated permissions or find a vulnerability in software running with root permissions. To exploit windows (particularly older windows) you have to trick a user to run your software.
  - gochi 3y ago
    Android malware isn't rare or harder to come by at all. Every so often even Google has to remove a whole lot of apps from the store due to malware and these are apps that went live and were downloaded. Some of this being even more intense malware than on desktop, as people rarely store contacts or SMS on a desktop (Joker malware for example). You've negated your entire point.
    - bscphil 3y ago
      The vast majority of "malware" on phones isn't software that exploits security bugs in the system software. Instead it's software that effectively asks the user nicely to give up their information, using mechanisms provided by the system software to do just that. This isn't something you can trivially prevent, as some software really does need access to your location, contacts, SMS, etc. The response to true malware on Android isn't looking for and removing APKs from compromised devices after the fact, it's patching the vulnerabilities in system APIs.
- charcircuit 3y ago
  You are underestimating the amount of IOT botnets that run on Linux and the amount of Android malware.
- throw47474777j 3y ago
  This argument is very unpopular when it’s used to explain why iOS is locked down. Usually there is a lot of pushback along the lines that APIs should simply be made secure.
- 666satanhimself 3y ago
  [dead]
- jrm4 3y ago
  This is such crap. A very long time ago, Windows normalized the absolute worst security practices ever. This was never meaningfully addressed/punished publicly and we just kind of drifted to today -- where we're stuck with absurdities like the fact that you can't use a USB key literally as intended. No other product is this bad in terms of security; bread will not destroy your toaster the way a USB key can your computer. You can't JUST put this on market share.
  - mrguyorama 3y ago
    Windows being inherently insecure hasn't been the issue since at least mid-XP. It's also a completely moot point, because nearly any security breach since then could have been conducted over snail mail, because it has nothing to do with how computers are programmed. While everyone was complaining about windows security, stuff like shellshock sat in the open for decades, including on all the servers that were supposedly so secure. Every organization that does internal phishing testing still fails every time. Any modern discussion about information security that doesn't deal with that is a red herring, and provides zero utility to anyone who isn't the enemy of a nation-state. Focusing on the remaining few buffer-overflows that take a chain of ten other exploits to even reach in the first place while everyone's data and info is leaked daily because the CEO clicks everything in an email is a dereliction of duty. It's like investing in StarWars and magic lasers that can't work while placing nukes on Moscow's door step. "Security Researches" keep looking for the buffer overflows because that's fun and they don't want to admit that the real problem is a social one because that's hard and boring and doesn't let them play with the newest fuzzer or get them a $100k bounty.
    - jrm4 3y ago
      I get what you mean here, but I still can't help but think that the Windows "make everything run really easy" mentality still crept in and stuck around,and to this day prevents software from implementing better ideas of "who or what really needs to run executable code?" Like Javascript? Sure, it's VERY versatile, but "just download arbitrary code and run it in the browser?" That should have never happened in the way it has.
- trelane 3y ago
  > The reason why most (consumer-facing at least) malware isn't targeting Linux is because its desktop market share is like 3%. This is also why there's not as much software in general. So if a (lack of) regular software is a valid reason to not use linux, a lack of malware is also a valid reason to use it.
- mdgrech23 3y ago
  Would argue 95+% of people would find w/ this kind of setup on their desktop.
- failuser 3y ago
  Proper sandboxing in Unix was a missing feature forever since SUID bit was introduced and was slowly mitigated by adding layers of virtualization instead of OS-level controls.
- marcodiego 3y ago
  > The reason why most (consumer-facing at least) malware isn't targeting Linux is because its desktop market share is like 3%. I don't eat that argument anymore. In the mobile space, Android (Linux) is the biggest player. It is even bigger than windows if both are considered among end-users[1] and I don't see as many people complaining about malware on Android as people complain about it on windows. Of course, I don't think ms is incompetent with regards to windows security. But there are design decisions that make it historically problematic. The fact that win9x had zero process isolation (although with was possible since i386) and people expect program to continue working on winxp (NT kernel), the fact that centralized software distribution is a relatively novelty on windows (compared to apt which exists since 1998) and many other minor things, like extension hiding, make it an easier target than ChromeOS, iOS, Android, MacOS and GNU/Linux. I remember people saying "when Linux become as popular as windows, you'll see it being target by malware devs". Well, consider smartvs, infotainment, servers, supercomputers, embedded systems, mobile (specially Android). Linux is bigger than windows for a long time. I don't think its lower desktop market share is the main reason for its lack of malware. [1] https://gs.statcounter.com/os-market-share#monthly-202206-202307 https://gs.statcounter.com/os-market-share#monthly-202206-20...
  - dartharva 3y ago
    > I don't see as many people complaining about malware on Android as people complain about it on windows. Can't believe I'm seeing such a statement on HN. Android phones are arguably worse on malware-related threat vectors, especially when most OEMs themselves package in the majority of malware on consumer phones to begin with. Even assuming less dumb users, at its best it is an unholy combination of adware mixed with spyware, ridiculous amounts of tracking in the name of "telemetry" and consumer-hostile design choices often literally designed to make the user choose the wrong option. Combine that with how ridiculously easy it is to get malware installed on Android (the most popular apps and games on the Play Store are all adware, installing compromised "modded" apks that "unlock premium features" is just one tap away) and you get a platform that would make any infosec manager cry. At least Windows PCs are controllable by the organization's administrator, how are you going to control people's phones unless you start issuing company phones as well?
- orbital-decay 3y ago
  > As long as some platform is capable and powerful for many things, there will be malware. This is true but there are also degrees of that. Windows in particular is a graveyard of discarded tech waiting to be galvanized by malware, because of the backwards compatibility and because of the Microsoft's habit of abandoning the half-done frameworks and APIs. Apple's stuff is much tidier just because they regularly deprecate and compress their fully owned stack (although they also have their turds of course). In Linux, there's terrible fragmentation and a lot of ancient and barely maintained stuff, but at the same time it can be customized to only include the best practices and omit a lot of dead weight.
- INTPenis 3y ago
  >As long as some platform is capable and powerful for many things, there will be malware. Might want to rephrase that, uhm, Linux? Windows is a platform that is accessible to the most dumb (and disinterested) users in the world. No offense, but phishers, malware authors and spammers all rely on a sucker buying OEM every minute.
- eikenberry 3y ago
  You can lock down your computer and keep it a computer. For an example look at the work going on with Fedora Silverblue [1] where you have an immutable OS install and use containers and flatpaks for everything. It is coming along nicely with side projects to allow for customization via Dockerfiles [2]. [1] https://fedoraproject.org/silverblue/ https://fedoraproject.org/silverblue/ [2] https://github.com/ublue-os https://github.com/ublue-os
  - rcarr 3y ago
    Steam OS also works this way.
- CyberRage 3y ago
  I see a ton of linux malware as part of my job but it's a different kind to windows malware(which I also reverse/research) in Linux the focus is on server/enterprise so things like webshells, miners, data scraping are very common
- kazinator 3y ago
  Apple Macs had like single digit percentage market share in the 1980's, yet were havens for viruses.
- xorcist 3y ago
  It's not just the kernel, it's the whole ecosystem. How does Linux have anything resembling OLE? SMB? Sharepoint paths on the public Internet? It's an operating system that automatically executes code found on USB sticks. How is this even a discussion?
- abrookewood 3y ago
  I'm far from a security expert, but this article (or a related one) was posted recently on HN and it covers some fairly technical reasons why Linux isn't as secure as commonly believe [0]. While that may be true, I think in practical terms you are less likely to encounter malware etc on Linux than Windows, but that could very well be because it is a smaller target as you mention. https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html
- georgeplusplus 3y ago
  I thought PIP and apt upgrade/update were found to have really malicious packages you could easily pull and install.
- throw10920 3y ago
  > The only other alternative is turning your computer into a glorified phone (a.k.a. a locked-down media consumption device) where everything is nicely sandboxed and nothing has any kind of permission to do "bad" things. Your understanding of security research is badly out of date. Turns out that, since the 80's, we've found a lot of ways to make computing platforms much more secure while sacrificing little flexibility. For instance: capabilities. Apps working under a capability model get denied access to resources by default. If you later determine that yes, you want a program to be able to access the internet, then you can grant it that capability...but, say, only while the program is running, and you can revoke it at any time. The dichotomy of "either malware or a locked down media-consumption device" is completely false.
- ensocode 3y ago
  This and I think Linux desktop is way less attractive as a target as not used on corporate machines so often. Corporate Windows desktops might be more much more interesting data-wise.
deleted 3y ago
[deleted]
delfinom 3y ago
I wish they would eliminate being able to execute .scr files which were used to share screensavers...back when anyone cared or windows even bothered to use them since its all lock screens. Now they are nothing but guaranteed malware and pretty common for that purpose. There's absolutely no negative impact disabling the support other than someone still using Windows XP with custom screensavers saying "SEE MICROSOFT IS EVIL!!!"
- londons_explore 3y ago
  I was surprised to find screensaver support still in Windows. And they still have a bunch of screensavers like "3D Text" which appears to still be using the same code from its first release in 1998. They also seem to have isolated them onto their own desktop, meaning that if a screensaver crashes then the users desktop won't be shown. That broke the official 'Bubbles' screensaver in Windows 11 - and they clearly don't test that stuff, because they released it anyway, broken.
  - ripdog 3y ago
    Hmm, I just tried the Bubbles preview on Win11, and it worked fine. Is it different when it's running 'for real'?
    - londons_explore 3y ago
      When running for real the background ends up black. (unlike the preview, which works properly)
- fredoralive 3y ago
  PIF files are perhaps madder. They're configuration files for MS-DOS programmes running under Windows. But you can rename an .exe to .pif and it'll still work as an .exe as the same internal function to start an executable also handles PIF file parsing. But Windows Explorer considers PIF files "shortcuts", and so like .lnk files the file extension is always hidden even if visibility is requested. This included 64 bit Windows (at least for 10), which can't actually run MS-DOS programmes, and has no real reason to actually try and do anything for PIF files anyway.
CrampusDestrus 3y ago
backwards compatibility is the cause for all of this, and it's a bitch to deal with in an ideal world every time you need to break compatibility you would provide extensive documentation and make migration as painless as possible. this might work if it wasn't for the tiny little problem of abandonware. the amount of critical tasks for which a piece of software that nobody knows how it works anymore is required is astounding. should it be illegal for businesses and public-adjacent entities to operate proprietary software that is not actively maintained by anyone and has zero support contracts attached?
- o1y32 3y ago
  ...good luck asking companies that are no longer in business to maintain their software
  - CrampusDestrus 3y ago
    If we fined businesses that use unsupported proprietary software they would either have to move to something proprietary and actively maintained or collectively crowdfund an open source alternative.
    - throw47474777j 3y ago
      That would make it infeasible to buy software from any company except the most stable mega-corporations and immediately destroy all independent software businesses.
    - Mountain_Skies 3y ago
      Too much of the FOSS community has gone ideological looney toons lately to assume that software from that environment is inherently stable. We've already seen maintainers try to pull code or insert license terms that demand conformity to certain ideological beliefs in order to continue using their code.
- mcpackieh 3y ago
  We shouldn't need backwards compatibility built into the OS when we have perfectly functional compatibility shims that can be isolated from the rest of the system or run with reduced/user privileges. VMs, DOSBox, Wine, etc.
johnea 3y ago
Windows has been king of malware for decades, only in the last decade has it seen this dominace challenged, by android. While windows evolved into a data exfiltration and malware distribution platform, android was designed for the task from the beginning.
- kernal 3y ago
  Windows didn't need to evolve into being the king of malware. It was insecure by design. Whenever you hear a ransomware or virus story on the news you can rest assured that Windows was involved. It's malware superstar.
mrkramer 3y ago
As Linux, Android, iOS and MacOS are as well.
- fsflover 3y ago
  Linux has no malware included by default.
donatj 3y ago
The single largest outstanding security problem with Windows is the one-two punch combo of hiding file extensions by default + not having an executable bit. This makes it insanely easy for an attacker to simply create a malicious executable that has the icon of a word document or other recognizable type. There is literally no way for a lay person to detect the danger there. If there were an executable bit, exe’s from strange places wouldn’t just run without being granted permission. If extensions were visible by default, the very slightly savvy could SEE the danger. The combo lack-thereof is the danger. With how many notifications Windows gives you already, it really seems like at the very least just warning you when you double click something the first time “this is an executable, use caution” would go a long way. Binaries downloaded from browsers get stapled with a “potentially unsafe” extended attribute that pops a warning the first time you try to open it. This helps but is backwards. It should go the other direction and every binary should warn you until stapled with a “user has acknowledged the danger” attribute.
- FireInsight 3y ago
  A common technique is exploiting macros in real word documents, which would still work with the added protection of an executable bit and being able to see file extensions.
  - nicce 3y ago
    There is protection and that is why macros are mainly used. https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/ https://learn.microsoft.com/en-us/windows/security/operating...
  - ectospheno 3y ago
    No human would assume he was providing a solution to every attack. Not doing something because it doesn’t solve every problem is a great way to never fix anything. Not brushing your teeth because you ran out of dental floss is dumb.
- nicce 3y ago
  > If there were an executable bit, exe’s from strange places wouldn’t just run without being granted permission. If extensions were visible by default, the very slightly savvy could SEE the danger. The combo lack-thereof is the danger. By default Windows does not run anything which does not have valid signature, unless you give the permission. Maybe you have disabled this feature? Many do it, because it is annoying, as you need to give permission almost for anything you download from the internet.
TazeTSchnitzel 3y ago
Vulnerability chains on iOS (and presumably macOS) also rely on various complex 90's/late-80's legacy technologies at the heart of the OS. But I can only assume that such complexity would exist somewhere even in a clean-slate OS.
Run_DOS_Run 3y ago
>Computer security would be about 80% solved Hmm, no. You'd use other attack vectors and once you've closed most of the attack avenues you'd find yourself on a smartphone OS with no permissions and mass tracking... and there would still be malware galore. https://www.bleepingcomputer.com/news/security/apps-with-15m-installs-on-google-play-send-your-data-to-china/ https://www.bleepingcomputer.com/news/security/apps-with-15m...
meitros 3y ago
I like those icons - wonder what he used to create that chart
intsunny 3y ago
I hate how a twitter link only shows the exact tweet and not the replies/context/etc. Not even when the person has multiple tweets about a subject. (I forget what this is called.) I have mostly stopped clicking on twitter links these days.
nimbius 3y ago
Malware isnt even the worst part about windows by far these days. Windows is essentially a downloadable telemetry engine; a spyware go-kart with a login screen. When its not cosplaying a mall kiosk barker, flogging various wares and useless dreck its curated through your complacent surveillance, its gaslighting you like a toxic ex into thinking you dont "need" a new browser because this ones better and good and okay. When its time for an upgrade, you'd better hope you have hardware for it because Redmond will expend the same tireless energy gaslighting you about your 'obsolete' 5 year old PC thats performing just fine as it spends reminding you to check out its ghost town app-store and microtransaction rodeo. Oh and did you somehow manage to install chrome? sorry but most of your apps wont remember that preference for longer than it takes Microsoft to find out you had an opinion that wasnt approved by the marketing department. Windows is like a zombie clown at a haunted carnival, shambling from booth to booth just long enough to offend by its very presence before it shuffles off back to big top corporate america, arguably the only place it still exists to an audience of appreciative patrons at all.
- revscat 3y ago
  This was beautifully written.
- koromak 3y ago
  I bootcamped Windows for the first time since 8, its unimaginable how miserable the experience is. Its genuinely disgusting, my desktop feels like a Subway station with shitty ambulance chaser ads and Graffiti spread all over it. Its remarkable how many button combinations lead to a popup telling you to use a different Microsoft product you don't need. I can't believe its gotten this bad. We need a Windows alternative for the average consumer.
- throw10920 3y ago
  > Eschew flamebait. Avoid generic tangents. Omit internet tropes. This is a generic tangent. The article is about computer security - nothing to do with Windows' user-hostile experience.
  - Solvency 3y ago
bb88 3y ago
Archive for those that have hit the api limit. https://archive.fo/2MIuC https://archive.fo/2MIuC
adamc 3y ago
Isn't that a lot like saying "if we just deprecated history, there would be a lot fewer issues"? But history is a thing. Also, every time I click on a twitter link, I seem to get "something went wrong" and have to reload. Is that the modern twitter?
- chungy 3y ago
  That's been my Twitter experience for many years now. So, yes or no. Depending on your idea of modern.
tester756 3y ago
Ain't gonna lie I thought this tweet >Computer security would be about 80% solved if we just deprecated every technology shown in this graphic. is going to be about memory unsafe languages like C, C++ and JIT compilers (web browser) since >Around 70% of our high severity security bugs are memory unsafety problems (that is, mistakes with C/C++ pointers). Half of those are use-after-free bugs. https://www.chromium.org/Home/chromium-security/memory-safety/ https://www.chromium.org/Home/chromium-security/memory-safet... >Figure 1: ~70% of the vulnerabilities Microsoft assigns a CVE each year continue to be memory safety issues https://msrc.microsoft.com/blog/2019/07/a-proactive-approach-to-more-secure-code/ https://msrc.microsoft.com/blog/2019/07/a-proactive-approach... Also HN title is editorialized.
- tracker1 3y ago
  Large reason why MS has been embracing Rust recently... IIRC, they have their first rust based dll replacement in testing now. May take a while to see even half of it shift over though.
  - sedatk 3y ago
    Yes, Rust has finally made it to Windows kernel: https://twitter.com/esesci/status/1679215711183605760 https://twitter.com/esesci/status/1679215711183605760
- CyberRage 3y ago
  Vast majority of malware doesn't use any exploits, let alone something like a zero-day Most of malware, logically, abuse common features within the operating system
_trampeltier 3y ago
I think most problem could be solved, if VBA would not have any access outside of the document.
PeterStuer 3y ago
The most popular stack will always be the preferred target of malware. Seriously, if another platform would hold 90% of the juice, you realy think it would not be the victim of malware by a long shot? FwIW, I used to be a front line malware eradicater in the 80's , the prime target back then were Apple Mac's on uni computer classrooms.
- halkony 3y ago
  That's a pretty cool job. What's the most clever malware you eradicated back then?
- fsflover 3y ago
  Where is the widespread malware on Linux servers?
  - scrollaway 3y ago
    Ransomware targeting server data, primarily.
  - peppermint_gum 3y ago
    Servers have much fewer attack vectors. Do you really think that a typical scenario of Windows infection is some kind of RCE in the OS? No, that's extremely rare. Most of malware doesn't exploit any vulnerabilities in the OS. Either a user downloads and runs an infected executable, or they get infected through a bug somewhere in userland (e.g. web browser or image viewer).
  - p_l 3y ago
    Linux server malware is common, mainly targeting naive owners for misconfiguration (SSH password guessing), or targeting remote shell exploits in various popular packages (personally had it happen with Gitlab, for example). The opportunistic attackers like that mainly go for dropping some blockchain mining software (monero is popular payload) and sometimes go for deploying botnet agents for things like DDoS ransoming and similar. Low success rate, but low effort on attacker's side, who often buys a premade tool on a forum.
user6723 3y ago
Imagine being dumb enough to run Windows. Running a copy of Windows in a throwaway VM is the only acceptable place to run Windows.
- dgellow 3y ago
  Please don’t insult people based on something as subjective as the OS they decide to use. That’s completely unnecessary to make your point regarding VMs and doesn’t have that place on HN.
  - user6723 3y ago
    [flagged]
- jeroenhd 3y ago
  I know hating on Windows is popular and I myself detest what Microsoft is doing to their operating system, but Windows is still a better OS than its competition for most people. This is reflected in its worldwide market share. Windows can actually be managed by am IT department and has a massive security ecosystem. If a corporation with more than ten people has to deal with my data, I'd much rather see them use Windows than anything else.
  - user6723 3y ago
    >> and has a massive security ecosystem. lol and we all know why
    - anthk 3y ago
      And yet useless because 90% of compability modes will send such security to /dev/null. Office macros, OCX, Active X compat plugins for IE11 (they still are), VBA, VBScript executions, screensavers as they stated, drop-in replacement DLL's, security overrides because that w9x doesn't work with admin rights... And so on. WinNT would be secure if MS ditched Office Macros (or at least hard-sandboxed them) and ran all w9x software on seamless VM's.
tjpnz 3y ago
And ads are the delivery mechanism.
LinuxBender 3y ago
Windows is the malware compatibility layer for everything Windows NT and all versions of Windows after NT have more security controls than just about any other operating system as those controls came right out of VMS. They are mostly all disabled or weakened to lower friction and increase adoption. The controls are also weakened by default on Linux but it was late to the party and was not as happy-clicky as Windows thus more friction for less technical people at first. It isn't just security controls. Both Windows and Linux allow memory over-commit by default which can affect stability but improves adoption by developers. All of these things can be hardened at the risk of breaking applications that were coded to the default behavior so to speak. As others mentioned Windows has the highest adoption and usage so it will be the default target. Should Linux take the lead some day it would gain more attention by malware authors. There are plenty of unexplored attack vectors in udev, binfmt mount, eBPF, systemd and how some of those things are glued together currently for a lack of better terminology. This may happen sooner than later if Linux gaming continues to improve at it's current rate. Gaming platforms often code to default behavior or expect elevated privileges thus rendering OS-hardening not an option and not many people will buy a separate gaming machine to keep this isolated from the machine they do taxes, banking, emails, social media, etc...
- onlyrealcuzzo 3y ago
  > Should Linux take the lead some day it would gain more attention by malware authors. Android by itself has 50% more devices than Windows.
  - richardjam73 3y ago
    GNU/Linux versus Android/Linux
  - Bender 3y ago
    I think a key difference is that Android for most people is a mostly-closed ecosystem. Most people can only install that which has been added to the small selection of app stores and the OS configuration is at least partially locked down. There have been an uptick in malware targeting Android [1] just one recent example but people are not installing as many random applications and vulnerable frameworks such as Wordpress or random apps that lack GPG verification, curl | sudo bash. This puts the onus on Google and wireless vendors to manage the security of these devices and most applications. If some day there is a truly open Linux distro on fully unlocked-by-default phones that come with root access enabled and said phones are adopted by the masses and people can tweak the OS however they wish without using debugging tools or installing custom images then I think the phones will almost be on equal footing to Linux desktops, gaming and graphics power aside. They key part being adopted by the masses. Even Android is not a majority market share [2] so people would have to target apps that Android, Apple and others share. [1] - https://www.scmagazine.com/news/malware/letscall-vishing-malware-android https://www.scmagazine.com/news/malware/letscall-vishing-mal... [2] - https://www.bankmycell.com/blog/us-smartphone-market-share https://www.bankmycell.com/blog/us-smartphone-market-share
dekhn 3y ago
Frequency bias- Windows is the most commonly used OS, but has a similar security posture and implementation quality to the alternatives.
whalesalad 3y ago
There are two reasons to use Windows: you are building software for Windows, or you are a gamer.
- Aleklart 3y ago
  3 You are manager with 240 Mb Excel file with macros and very important 40 gb pst of Outlook mail. You relax by playing solitaire. Your time is important so your PC is managed by IT departments SCCM along with same 10k+ managers and 100k corporate drones PCs. 4 You work in Microsoft
_gabe_ 3y ago
> Computer security would be about 80% solved if we just deprecated every technology shown in this graphic. Computer security would be 100% solved if we just got rid of computers. It's impossible to break into something if it doesn't exist. I wonder why we haven't tried this strategy yet?
- Supermancho 3y ago
  Abolishing a number of these technologies means that new technologies will be developed to do the same tasks, with similar (and probably some novel) new vulnerabilities. Overall, I do feel like new technologies are being scrutinized more than in the past. Especially when those implementations were done in a corporate vacuum and released as a canned solution.
motohagiography 3y ago
Ransomware exists mainly to persuade us that apps and commercial software are somehow benign and work in our interests.
lucb1e 3y ago
https://nitter.net/matthew_d_green/status/1679135426806784004 https://nitter.net/matthew_d_green/status/167913542680678400...
mikewarot 3y ago
Windows isn't unique, it shares the same design flaw as Linux and MacOs, etc. Ambient Authority is an incredibly bad design choice for an operating system. Until capability based security[1] becomes widely deployed, we'll keep blaming the wrong things, instead of Ambient Authority. This is not permission management as practiced on smartphones and tablets. [1] https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security
somsak2 3y ago
it's even simpler: stop using C/C++. responsible for 70% of CVEs. https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se...
- lionkor 3y ago
  > Stop using C/C++ The result of which is what, no new CVEs related to memory security? Rewriting everything in Rust? There need to be more tools to detect and prevent memory issues in current C/C++ codebases - and C++ specifically has a lot of tools like this already.
Pxtl 3y ago
Yes, I agree we should deprecate html
at_a_remove 3y ago
I don't see PDFs in this. Did I miss something?
- timbit42 3y ago
  PDFs are in the other 20%.
  - anthk 3y ago
    DJVU was better. No, please, not PostScript until you like running a Game Boy emulator in Ghost Script or a ZMachine playing Zork. And you can actually do that with Zork/Anchorhead or whatever IF Z-code game up to v3 version. PS can be crazy for security. It might be good on plan9/9front where you can isolate namespaces and filesystems for free, but not on the rest of the OSes.
Aaronmacaron 3y ago
Off topic: why can i read this tweet? I don't have an account. Didn't they recently put all tweets behind a login?
- sumtechguy 3y ago
  they did
- mminer237 3y ago
  They reversed that change after a few days: https://techcrunch.com/2023/07/05/twitter-silently-removes-login-requirement-for-viewing-tweets/ https://techcrunch.com/2023/07/05/twitter-silently-removes-l...
exabrial 3y ago
So basically as long as Windows is still a thing
1970-01-01 3y ago
Nah. I'm going with a modified Yogi-ism: "Computer security 80% solved if we deprecate technology shown in this graphic. The other half is software."
more_corn 3y ago
Cool, I’ll put on my Q3 roadmap “deprecate html”
1vuio0pswjnm7 3y ago
If computer security is "80% solved" then "computer security researchers" also lose 80% of their "work". There is an argument to be made that these researchers work for "developers", i.e., the people who create and perpetuate the stuff in the graphic, more than they work for "users", i.e., the people suffer as a result of its continued usage. Here the security researcher does not tell users, most of whom do not read Twitter, to stop using software that utilises the stuff in the graphic. Instead he communicates with computer security researchers, developers and other Twitter users apparently hoping that developers will deprecate such usage. (But knowing this will never happen.) Note this comment does not argue that this state of affairs is good or bad. Only a reader can make that so. The comment only makes some observations.
- deleted 3y ago
  [deleted]
mrguyorama 3y ago
Computer security is 95% solved if we turn off the powerplants. Human sustenance is solved if we choose to let everyone die. These statements have equal utility.
giantg2 3y ago
"Solved"? Lol that's the wrong mindset for someone in security.
fnordpiglet 3y ago
Computer security would be 75% solved if we deprecated technology shown in this graphic: C
PlunderBunny 3y ago
Just reading the headline, I expected solely a picture of a human being (although that's not strictly 'technology' I guess).
Incipient 3y ago
He's clearly making a joke. As much as it would be hilarious, deprecating html would be a bit restrictive.
rc5150 3y ago
I suppose the remaining 20% is the end user.
_8j50 3y ago
Ahh twitter infosec people. They say shit like this for rage/doom baiting but soon enough they buy their own spiel. I had one person tell me switching to macs should be a priority because it will extinguish most security issues. As a regular mac user, couldn't help facepalming at that.
hoistbypetard 3y ago
This (from a self-reply) was gold: " Windows is the malware compatibility layer for everything."
rajnathani 3y ago
Also iMessage.
hot_gril 3y ago
"How to solve computer security? Get rid of computer" is the kind of argument here.

358 points by mariuz 3y ago

Windows 11 literally comes with OS level malware, they've turned the OS into an advertising platform. Them having actual backwards compatibility (unlike the fruity side) is the least of our problems.

Pannoniae 3y ago

As long as some platform is capable and powerful for many things, there will be malware. The reason why most (consumer-facing at least) malware isn't targeting Linux is because its desktop market share is like 3%. It's way better to target Windows on desktop since you can reach way more users that way. The only other alternative is turning your computer into a glorified phone (a.k.a. a locked-down media consumption device) where everything is nicely sandboxed and nothing has any kind of permission to do "bad" things. (Except tracking. Because guess what, the company who makes the OS also sells ads.)

howinteresting 3y ago
Heterogeneity is an important part of defense in depth. Monocultures are more likely to be attacked.
dacryn 3y ago
I don't fully agree on this one. Linux has a wider attack vector since there are tons of packages out there. Yet the core has a lot of attention and many eyes on it, just because it is so open. Vulnerabilities get patched rather sooner than later. Linux versions and gnu packages are running basically the entire internet, so there is definitely incentive to break into into it. It's also a lot clearer in linux when a process is doing something it shouldn't, since it's a lot easier to probe into it to check what's going on.
- nradov 3y ago
  Is there any evidence that security vulnerabilities are on average fixed faster in the major Linux distributions than in Windows?
  - chmod775 3y ago
    Some. Here's for the Linux Kernel: https://googleprojectzero.blogspot.com/2022/02/a-walk-through-project-zero-metrics.html https://googleprojectzero.blogspot.com/2022/02/a-walk-throug... The dataset is quite small, but on average it took Linux 25 days to fix a 0-day while it took Microsoft 83 days.
    - schemescape 3y ago
      Does that metric include the delay if fixes getting incorporated into Linux distributions (and pushed out, assuming automatic updates—maybe not a good assumption) or Windows fixes getting deployed via Windows Update? Edit: I don’t know much about this topic, but thought “time to deployment of a fix” might be more useful. Edit again: also unclear if the comparison is “apples to apples”.
      - RunSet 3y ago
        I doubt it, any more than it includes the time it takes procrastinating users to actually update their systems.
    - de-moray 3y ago
      The dataset does not appear to discuss the lifecycle of Linux distributions taking the security patches from upstream, nor the update process for all of the downstream distributions. Something that's been widely discussed elsewhere is how often security issues are silently fixed in Linus's repo and therefore not picked up by distributions for their stable/LTS releases. I buy the immediacy of patches if you compile your own kernel from the latest kernel.org sources, not if you're relying on distributions.
- SoftTalker 3y ago
jolux 3y ago
> The only other alternative is turning your computer into a glorified phone (a.k.a. a locked-down media consumption device) There’s a third alternative: keep the platform powerful but increase the default isolation level for third-party software and let the user choose what permissions it has. macOS is headed in this direction. Qubes is a more radical example and I think probably the future of desktop computing: everything will run in its own virtual machine.
- delfinom 3y ago
  >There’s a third alternative: keep the platform powerful but increase the default isolation level for third-party software and let the user choose what permissions it has. That's the direction Windows is going as well with the MS-Store and appx/msix bundles. There's also Process Memory protection by using virtualization https://support.microsoft.com/en-us/windows/core-isolation-e30ed737-17d8-42f3-a2a9-87521df09b78 https://support.microsoft.com/en-us/windows/core-isolation-e...
- FireInsight 3y ago
  This is where Linux is going as well. I believe that in the future most peoples base systems will contain only necessary packages and other software will be run out of Flatpaks or a comparable technology separate from the host.
  - nickstinemates 3y ago
    This is how I run everything outside of coreutils in Linux. Either with VM isolation or packed away in a container. Host is basically a hypervisor with external monitoring and logging.
  - jchw 3y ago
    Flatpak right now isn't really a security boundary. That said, I don't think there's any particular reason it couldn't or shouldn't be in the future. The model seems amenable to it, and maybe it was at one point the intent even.
- vorpalhex 3y ago
Retric 3y ago
Sandboxing isn’t incompatible with a highly customizable OS. Malware is really more a question of being able to install software without the users control and the inability to remove such installations after the fact. Windows suffers from Malware in no small part due to the systems design rather than simply being common. Plenty of alternatives have more users than windows did back in the late 90’s when it was a huge target.
- s1gsegv 3y ago
  I think the crux of the issue is that making a system that's customizable AND sandboxing AND user friendly multiplies together to create development and testing effort that's not palatable for most right now. Even the open source offerings that add sandboxing often drop either the customizability or the user friendliness.
- zzo38computer 3y ago
  > Sandboxing isn’t incompatible with a highly customizable OS. This is true, but there is much badly designed sandboxing. Many of the sandbox systems on Linux will have some problems, including too broad permissions, assuming text (including file names) is Unicode, failure to consider permissions that differ by command-line switches and other configuration files, failing to consider other things that the user might want to connect access to devices by files and other programs, and in case it prompts the user (at run time) for the name of another program to run by using popen or something like that and that program should run using its own permissions instead, etc. (Many of my programs that have an interactive mode do run other programs with popen, which prompt the user at run time to specify what command to run, so it can vary.) I had my own ideas of operating system design, which is different from POSIX (although there is a POSIX compatibility layer available as a C library; the kernel need not know anything about it). One of its major ideas is that it uses capability-based security with proxy capabilities; these can be used for sandboxing and other high-level features implemented in terms of proxy capabilities. All I/O (except the Yield and Quit syscalls) requires capabilities; capabilities (as well as links) can also be passed in messages through other capabilities, including the initial message. There are many other ideas too, including ways for programs to be connected together and with user codes by user specifications. These ideas can allow working without dropping customizability, etc (in fact, the way I thought to do, would actually improve customizability, even for programs that do not normally have this feature).
everdrive 3y ago
This is definitely true, and I think there are at least two points worth considering here. - Part of what makes the mainstream OS terrible is the mere fact that it is mainstream. If Linux hit 60-70% adoption, a plague of terrible software, adware, malware, and more would start degrading its quality. - Despite the points above, it would be really nice if some of the lousy things pointed out the in the graphic were deprecated.
- bee_rider 3y ago
  Free Software licenses typically say basically “I’m giving you this for free, so you take it as it is, no promises.” You get the guarantees that you pay for. But nobody would write some of the absolute schlock they get over in proprietary-land if they didn’t think they could dupe unwitting consumers into paying for it.
mcpackieh 3y ago
Popularity was the canned cope for why Windows 95 through XP were riddled with so much malware. But then Microsoft started taking security more seriously with Vista and onwards. The situation didn't turn into sunshine and roses, but it did improve dramatically. It turns out that popularity wasn't the problem, the problem was the insecure nature of the software. There is of course still a lot of room for improvement.
- phendrenad2 3y ago
  The possibility of there being a confluence of problems is one that's hard to grok, but doing so is ultimately fruitful.
- dj_mc_merlin 3y ago
  As opposed to the Linux security best practices of curl | bash? I have no choice but to set up my computer to run untrusted code, on a CPU which itself might be spying on me -- I don't feel like my environment is inherently more secure than Windows at all. Just less popular.
  - pxc 3y ago
    > the Linux security best practices of curl | bash? You do realize that even this is the same as downloading and running an executable from a website, which is still the norm on Windows, right?
    - xigoi 3y ago
      In fact, curl | bash is safer, because you can replace "| bash" with "| less" and inspect the script.
      - xmodem 3y ago
        I would argue that Windows checking certificate signatures provides a lot more safety to the vast majority of users than manually inspecting a bash script.
soraminazuki 3y ago
Wait, you say malware don't target Linux because it has no market share? The OS that is ubiquitous on servers and mobile?
- vuln 3y ago
  Typically there aren’t users on the servers. The servers aren’t used for browsing the internet or checking emails.
  - lelanthran 3y ago
    The rewards are greater on the server. If you pwn just one server you can attack thousands of people, their data, their credentials, etc. Saying that there's no malware for Linux because there's no reawrd is myopic - the payoff is potentially larger.
    - vuln 3y ago
      > Saying that there's no malware for Linux because there's no reawrd is myopic - the payoff is potentially larger. I didn’t say that. My comment was really just commenting on the fact that most attacks (mal/ransomware/phishing/exploits) very frequently need some sort of user interaction. Without users or users doing user stuff it makes it harder to get things to execute on the machine/server. Sure if the server is in the DMZ and unpatched then yes it will be hammered by scanners and automated exploiters. With proper security hygiene and a proper patch cadence servers are usually more protected through defense in depth and lack of human.
      - lelanthran 3y ago
        You are correct, you most certainly did not say that, and I apologise for implying that you did. Mea culpa.
    - sanitycheck 3y ago
      They're configured and administered by professionals though, not your grandma (probably).
lofatdairy 3y ago
I think there's a unique element to Windows with it's attempt to be extremely backwards compatible. This can be a tremendous boon when, say, running older software targeting a previous OS, but introduces vulnerabilities since your dependency tree has such deep roots. It's definitely a good target because god knows how many banks/hospitals/etc are running windows and have critical business data in Excel sheets or Power BI or whatever, but it doesn't help that Windows itself is constructed of layers and layers of older code that can't be sacrificed without wrecking some client workflow. I mean that screenshot of 10 different design styles in Windows 11 kinda goes to show how much of it is just ported over kinda arbitrarily.
Beached 3y ago
Linux has both a huge stack surface and a huge focus on the malware and TA sphere. I worry about my Linux environment far more than my Windows environment. properly securing, monitoring and responding in a Linux environment is much harder than a windows environment for a SOC. the enterprise tool set lags in this space by a lot, and the TAs targeting Linux are generally FAR more sophisticated.
cogman10 3y ago
It seems like your thesis is disproved in your own examples. Linux is hugely popular on phones (android), which are every bit as juicy (if not more so at this point) than a desktop target. There is mobile malware but it's far more rare and harder to come by. But then there's just the fact that the way software is installed on a linux machine is wildly different from how you'd install it on windows. Just getting that binary blob to run requires some heroic efforts (To the point where we've pretty much decided it's easier to distribute via containers rather than compiled binaries for a given desktop). And if we expand beyond the desktop, we find linux everywhere in the server world. Easily the most popular OS to run server software. Which makes it a hugely valuable target for hackers. They'd love nothing more than to compromise a bank server. To say there's nothing about linux that makes it inherently more secure than windows seems just unreal. Because nix was designed around multiple users from the ground up, user permissions have been baked into the common flow for decades. That alone creates a huge layer of security that makes things like root kits or worms running at root super hard to pull off. The old windows (9->XP) pretty much gave everyone running admin permissions. Writing or changing a system32 dll was child's play. To exploit linux, you have to either trick a user to run something with elevated permissions or find a vulnerability in software running with root permissions. To exploit windows (particularly older windows) you have to trick a user to run your software.
- gochi 3y ago
  Android malware isn't rare or harder to come by at all. Every so often even Google has to remove a whole lot of apps from the store due to malware and these are apps that went live and were downloaded. Some of this being even more intense malware than on desktop, as people rarely store contacts or SMS on a desktop (Joker malware for example). You've negated your entire point.
  - bscphil 3y ago
    The vast majority of "malware" on phones isn't software that exploits security bugs in the system software. Instead it's software that effectively asks the user nicely to give up their information, using mechanisms provided by the system software to do just that. This isn't something you can trivially prevent, as some software really does need access to your location, contacts, SMS, etc. The response to true malware on Android isn't looking for and removing APKs from compromised devices after the fact, it's patching the vulnerabilities in system APIs.
charcircuit 3y ago
You are underestimating the amount of IOT botnets that run on Linux and the amount of Android malware.
throw47474777j 3y ago
This argument is very unpopular when it’s used to explain why iOS is locked down. Usually there is a lot of pushback along the lines that APIs should simply be made secure.
666satanhimself 3y ago
[dead]
jrm4 3y ago
This is such crap. A very long time ago, Windows normalized the absolute worst security practices ever. This was never meaningfully addressed/punished publicly and we just kind of drifted to today -- where we're stuck with absurdities like the fact that you can't use a USB key literally as intended. No other product is this bad in terms of security; bread will not destroy your toaster the way a USB key can your computer. You can't JUST put this on market share.
- mrguyorama 3y ago
  Windows being inherently insecure hasn't been the issue since at least mid-XP. It's also a completely moot point, because nearly any security breach since then could have been conducted over snail mail, because it has nothing to do with how computers are programmed. While everyone was complaining about windows security, stuff like shellshock sat in the open for decades, including on all the servers that were supposedly so secure. Every organization that does internal phishing testing still fails every time. Any modern discussion about information security that doesn't deal with that is a red herring, and provides zero utility to anyone who isn't the enemy of a nation-state. Focusing on the remaining few buffer-overflows that take a chain of ten other exploits to even reach in the first place while everyone's data and info is leaked daily because the CEO clicks everything in an email is a dereliction of duty. It's like investing in StarWars and magic lasers that can't work while placing nukes on Moscow's door step. "Security Researches" keep looking for the buffer overflows because that's fun and they don't want to admit that the real problem is a social one because that's hard and boring and doesn't let them play with the newest fuzzer or get them a $100k bounty.
  - jrm4 3y ago
    I get what you mean here, but I still can't help but think that the Windows "make everything run really easy" mentality still crept in and stuck around,and to this day prevents software from implementing better ideas of "who or what really needs to run executable code?" Like Javascript? Sure, it's VERY versatile, but "just download arbitrary code and run it in the browser?" That should have never happened in the way it has.
trelane 3y ago
> The reason why most (consumer-facing at least) malware isn't targeting Linux is because its desktop market share is like 3%. This is also why there's not as much software in general. So if a (lack of) regular software is a valid reason to not use linux, a lack of malware is also a valid reason to use it.
mdgrech23 3y ago
Would argue 95+% of people would find w/ this kind of setup on their desktop.
failuser 3y ago
Proper sandboxing in Unix was a missing feature forever since SUID bit was introduced and was slowly mitigated by adding layers of virtualization instead of OS-level controls.
marcodiego 3y ago
> The reason why most (consumer-facing at least) malware isn't targeting Linux is because its desktop market share is like 3%. I don't eat that argument anymore. In the mobile space, Android (Linux) is the biggest player. It is even bigger than windows if both are considered among end-users[1] and I don't see as many people complaining about malware on Android as people complain about it on windows. Of course, I don't think ms is incompetent with regards to windows security. But there are design decisions that make it historically problematic. The fact that win9x had zero process isolation (although with was possible since i386) and people expect program to continue working on winxp (NT kernel), the fact that centralized software distribution is a relatively novelty on windows (compared to apt which exists since 1998) and many other minor things, like extension hiding, make it an easier target than ChromeOS, iOS, Android, MacOS and GNU/Linux. I remember people saying "when Linux become as popular as windows, you'll see it being target by malware devs". Well, consider smartvs, infotainment, servers, supercomputers, embedded systems, mobile (specially Android). Linux is bigger than windows for a long time. I don't think its lower desktop market share is the main reason for its lack of malware. [1] https://gs.statcounter.com/os-market-share#monthly-202206-202307 https://gs.statcounter.com/os-market-share#monthly-202206-20...
- dartharva 3y ago
  > I don't see as many people complaining about malware on Android as people complain about it on windows. Can't believe I'm seeing such a statement on HN. Android phones are arguably worse on malware-related threat vectors, especially when most OEMs themselves package in the majority of malware on consumer phones to begin with. Even assuming less dumb users, at its best it is an unholy combination of adware mixed with spyware, ridiculous amounts of tracking in the name of "telemetry" and consumer-hostile design choices often literally designed to make the user choose the wrong option. Combine that with how ridiculously easy it is to get malware installed on Android (the most popular apps and games on the Play Store are all adware, installing compromised "modded" apks that "unlock premium features" is just one tap away) and you get a platform that would make any infosec manager cry. At least Windows PCs are controllable by the organization's administrator, how are you going to control people's phones unless you start issuing company phones as well?
orbital-decay 3y ago
> As long as some platform is capable and powerful for many things, there will be malware. This is true but there are also degrees of that. Windows in particular is a graveyard of discarded tech waiting to be galvanized by malware, because of the backwards compatibility and because of the Microsoft's habit of abandoning the half-done frameworks and APIs. Apple's stuff is much tidier just because they regularly deprecate and compress their fully owned stack (although they also have their turds of course). In Linux, there's terrible fragmentation and a lot of ancient and barely maintained stuff, but at the same time it can be customized to only include the best practices and omit a lot of dead weight.
INTPenis 3y ago
>As long as some platform is capable and powerful for many things, there will be malware. Might want to rephrase that, uhm, Linux? Windows is a platform that is accessible to the most dumb (and disinterested) users in the world. No offense, but phishers, malware authors and spammers all rely on a sucker buying OEM every minute.
eikenberry 3y ago
You can lock down your computer and keep it a computer. For an example look at the work going on with Fedora Silverblue [1] where you have an immutable OS install and use containers and flatpaks for everything. It is coming along nicely with side projects to allow for customization via Dockerfiles [2]. [1] https://fedoraproject.org/silverblue/ https://fedoraproject.org/silverblue/ [2] https://github.com/ublue-os https://github.com/ublue-os
- rcarr 3y ago
  Steam OS also works this way.
CyberRage 3y ago
I see a ton of linux malware as part of my job but it's a different kind to windows malware(which I also reverse/research) in Linux the focus is on server/enterprise so things like webshells, miners, data scraping are very common
kazinator 3y ago
Apple Macs had like single digit percentage market share in the 1980's, yet were havens for viruses.
xorcist 3y ago
It's not just the kernel, it's the whole ecosystem. How does Linux have anything resembling OLE? SMB? Sharepoint paths on the public Internet? It's an operating system that automatically executes code found on USB sticks. How is this even a discussion?
abrookewood 3y ago
I'm far from a security expert, but this article (or a related one) was posted recently on HN and it covers some fairly technical reasons why Linux isn't as secure as commonly believe [0]. While that may be true, I think in practical terms you are less likely to encounter malware etc on Linux than Windows, but that could very well be because it is a smaller target as you mention. https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html
georgeplusplus 3y ago
I thought PIP and apt upgrade/update were found to have really malicious packages you could easily pull and install.
throw10920 3y ago
> The only other alternative is turning your computer into a glorified phone (a.k.a. a locked-down media consumption device) where everything is nicely sandboxed and nothing has any kind of permission to do "bad" things. Your understanding of security research is badly out of date. Turns out that, since the 80's, we've found a lot of ways to make computing platforms much more secure while sacrificing little flexibility. For instance: capabilities. Apps working under a capability model get denied access to resources by default. If you later determine that yes, you want a program to be able to access the internet, then you can grant it that capability...but, say, only while the program is running, and you can revoke it at any time. The dichotomy of "either malware or a locked down media-consumption device" is completely false.
ensocode 3y ago
This and I think Linux desktop is way less attractive as a target as not used on corporate machines so often. Corporate Windows desktops might be more much more interesting data-wise.

deleted 3y ago

[deleted]

delfinom 3y ago

I wish they would eliminate being able to execute .scr files which were used to share screensavers...back when anyone cared or windows even bothered to use them since its all lock screens. Now they are nothing but guaranteed malware and pretty common for that purpose. There's absolutely no negative impact disabling the support other than someone still using Windows XP with custom screensavers saying "SEE MICROSOFT IS EVIL!!!"

londons_explore 3y ago
I was surprised to find screensaver support still in Windows. And they still have a bunch of screensavers like "3D Text" which appears to still be using the same code from its first release in 1998. They also seem to have isolated them onto their own desktop, meaning that if a screensaver crashes then the users desktop won't be shown. That broke the official 'Bubbles' screensaver in Windows 11 - and they clearly don't test that stuff, because they released it anyway, broken.
- ripdog 3y ago
  Hmm, I just tried the Bubbles preview on Win11, and it worked fine. Is it different when it's running 'for real'?
  - londons_explore 3y ago
    When running for real the background ends up black. (unlike the preview, which works properly)
fredoralive 3y ago
PIF files are perhaps madder. They're configuration files for MS-DOS programmes running under Windows. But you can rename an .exe to .pif and it'll still work as an .exe as the same internal function to start an executable also handles PIF file parsing. But Windows Explorer considers PIF files "shortcuts", and so like .lnk files the file extension is always hidden even if visibility is requested. This included 64 bit Windows (at least for 10), which can't actually run MS-DOS programmes, and has no real reason to actually try and do anything for PIF files anyway.

CrampusDestrus 3y ago

backwards compatibility is the cause for all of this, and it's a bitch to deal with in an ideal world every time you need to break compatibility you would provide extensive documentation and make migration as painless as possible. this might work if it wasn't for the tiny little problem of abandonware. the amount of critical tasks for which a piece of software that nobody knows how it works anymore is required is astounding. should it be illegal for businesses and public-adjacent entities to operate proprietary software that is not actively maintained by anyone and has zero support contracts attached?

o1y32 3y ago
...good luck asking companies that are no longer in business to maintain their software
- CrampusDestrus 3y ago
  If we fined businesses that use unsupported proprietary software they would either have to move to something proprietary and actively maintained or collectively crowdfund an open source alternative.
  - throw47474777j 3y ago
    That would make it infeasible to buy software from any company except the most stable mega-corporations and immediately destroy all independent software businesses.
  - Mountain_Skies 3y ago
    Too much of the FOSS community has gone ideological looney toons lately to assume that software from that environment is inherently stable. We've already seen maintainers try to pull code or insert license terms that demand conformity to certain ideological beliefs in order to continue using their code.
mcpackieh 3y ago
We shouldn't need backwards compatibility built into the OS when we have perfectly functional compatibility shims that can be isolated from the rest of the system or run with reduced/user privileges. VMs, DOSBox, Wine, etc.

johnea 3y ago

Windows has been king of malware for decades, only in the last decade has it seen this dominace challenged, by android. While windows evolved into a data exfiltration and malware distribution platform, android was designed for the task from the beginning.

kernal 3y ago
Windows didn't need to evolve into being the king of malware. It was insecure by design. Whenever you hear a ransomware or virus story on the news you can rest assured that Windows was involved. It's malware superstar.

mrkramer 3y ago

As Linux, Android, iOS and MacOS are as well.

fsflover 3y ago
Linux has no malware included by default.

donatj 3y ago

The single largest outstanding security problem with Windows is the one-two punch combo of hiding file extensions by default + not having an executable bit. This makes it insanely easy for an attacker to simply create a malicious executable that has the icon of a word document or other recognizable type. There is literally no way for a lay person to detect the danger there. If there were an executable bit, exe’s from strange places wouldn’t just run without being granted permission. If extensions were visible by default, the very slightly savvy could SEE the danger. The combo lack-thereof is the danger. With how many notifications Windows gives you already, it really seems like at the very least just warning you when you double click something the first time “this is an executable, use caution” would go a long way. Binaries downloaded from browsers get stapled with a “potentially unsafe” extended attribute that pops a warning the first time you try to open it. This helps but is backwards. It should go the other direction and every binary should warn you until stapled with a “user has acknowledged the danger” attribute.

FireInsight 3y ago
A common technique is exploiting macros in real word documents, which would still work with the added protection of an executable bit and being able to see file extensions.
- nicce 3y ago
  There is protection and that is why macros are mainly used. https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/ https://learn.microsoft.com/en-us/windows/security/operating...
- ectospheno 3y ago
  No human would assume he was providing a solution to every attack. Not doing something because it doesn’t solve every problem is a great way to never fix anything. Not brushing your teeth because you ran out of dental floss is dumb.
nicce 3y ago
> If there were an executable bit, exe’s from strange places wouldn’t just run without being granted permission. If extensions were visible by default, the very slightly savvy could SEE the danger. The combo lack-thereof is the danger. By default Windows does not run anything which does not have valid signature, unless you give the permission. Maybe you have disabled this feature? Many do it, because it is annoying, as you need to give permission almost for anything you download from the internet.

TazeTSchnitzel 3y ago

Vulnerability chains on iOS (and presumably macOS) also rely on various complex 90's/late-80's legacy technologies at the heart of the OS. But I can only assume that such complexity would exist somewhere even in a clean-slate OS.

Run_DOS_Run 3y ago

>Computer security would be about 80% solved Hmm, no. You'd use other attack vectors and once you've closed most of the attack avenues you'd find yourself on a smartphone OS with no permissions and mass tracking... and there would still be malware galore. https://www.bleepingcomputer.com/news/security/apps-with-15m-installs-on-google-play-send-your-data-to-china/ https://www.bleepingcomputer.com/news/security/apps-with-15m...

meitros 3y ago

I like those icons - wonder what he used to create that chart

intsunny 3y ago

I hate how a twitter link only shows the exact tweet and not the replies/context/etc. Not even when the person has multiple tweets about a subject. (I forget what this is called.) I have mostly stopped clicking on twitter links these days.

nimbius 3y ago

Malware isnt even the worst part about windows by far these days. Windows is essentially a downloadable telemetry engine; a spyware go-kart with a login screen. When its not cosplaying a mall kiosk barker, flogging various wares and useless dreck its curated through your complacent surveillance, its gaslighting you like a toxic ex into thinking you dont "need" a new browser because this ones better and good and okay. When its time for an upgrade, you'd better hope you have hardware for it because Redmond will expend the same tireless energy gaslighting you about your 'obsolete' 5 year old PC thats performing just fine as it spends reminding you to check out its ghost town app-store and microtransaction rodeo. Oh and did you somehow manage to install chrome? sorry but most of your apps wont remember that preference for longer than it takes Microsoft to find out you had an opinion that wasnt approved by the marketing department. Windows is like a zombie clown at a haunted carnival, shambling from booth to booth just long enough to offend by its very presence before it shuffles off back to big top corporate america, arguably the only place it still exists to an audience of appreciative patrons at all.

revscat 3y ago
This was beautifully written.
koromak 3y ago
I bootcamped Windows for the first time since 8, its unimaginable how miserable the experience is. Its genuinely disgusting, my desktop feels like a Subway station with shitty ambulance chaser ads and Graffiti spread all over it. Its remarkable how many button combinations lead to a popup telling you to use a different Microsoft product you don't need. I can't believe its gotten this bad. We need a Windows alternative for the average consumer.
throw10920 3y ago
> Eschew flamebait. Avoid generic tangents. Omit internet tropes. This is a generic tangent. The article is about computer security - nothing to do with Windows' user-hostile experience.
- Solvency 3y ago

bb88 3y ago

Archive for those that have hit the api limit. https://archive.fo/2MIuC https://archive.fo/2MIuC

adamc 3y ago

Isn't that a lot like saying "if we just deprecated history, there would be a lot fewer issues"? But history is a thing. Also, every time I click on a twitter link, I seem to get "something went wrong" and have to reload. Is that the modern twitter?

chungy 3y ago
That's been my Twitter experience for many years now. So, yes or no. Depending on your idea of modern.

tester756 3y ago

Ain't gonna lie I thought this tweet >Computer security would be about 80% solved if we just deprecated every technology shown in this graphic. is going to be about memory unsafe languages like C, C++ and JIT compilers (web browser) since >Around 70% of our high severity security bugs are memory unsafety problems (that is, mistakes with C/C++ pointers). Half of those are use-after-free bugs. https://www.chromium.org/Home/chromium-security/memory-safety/ https://www.chromium.org/Home/chromium-security/memory-safet... >Figure 1: ~70% of the vulnerabilities Microsoft assigns a CVE each year continue to be memory safety issues https://msrc.microsoft.com/blog/2019/07/a-proactive-approach-to-more-secure-code/ https://msrc.microsoft.com/blog/2019/07/a-proactive-approach... Also HN title is editorialized.

tracker1 3y ago
Large reason why MS has been embracing Rust recently... IIRC, they have their first rust based dll replacement in testing now. May take a while to see even half of it shift over though.
- sedatk 3y ago
  Yes, Rust has finally made it to Windows kernel: https://twitter.com/esesci/status/1679215711183605760 https://twitter.com/esesci/status/1679215711183605760
CyberRage 3y ago
Vast majority of malware doesn't use any exploits, let alone something like a zero-day Most of malware, logically, abuse common features within the operating system

_trampeltier 3y ago

I think most problem could be solved, if VBA would not have any access outside of the document.

PeterStuer 3y ago

The most popular stack will always be the preferred target of malware. Seriously, if another platform would hold 90% of the juice, you realy think it would not be the victim of malware by a long shot? FwIW, I used to be a front line malware eradicater in the 80's , the prime target back then were Apple Mac's on uni computer classrooms.

halkony 3y ago
That's a pretty cool job. What's the most clever malware you eradicated back then?
fsflover 3y ago
Where is the widespread malware on Linux servers?
- scrollaway 3y ago
  Ransomware targeting server data, primarily.
- peppermint_gum 3y ago
  Servers have much fewer attack vectors. Do you really think that a typical scenario of Windows infection is some kind of RCE in the OS? No, that's extremely rare. Most of malware doesn't exploit any vulnerabilities in the OS. Either a user downloads and runs an infected executable, or they get infected through a bug somewhere in userland (e.g. web browser or image viewer).
- p_l 3y ago
  Linux server malware is common, mainly targeting naive owners for misconfiguration (SSH password guessing), or targeting remote shell exploits in various popular packages (personally had it happen with Gitlab, for example). The opportunistic attackers like that mainly go for dropping some blockchain mining software (monero is popular payload) and sometimes go for deploying botnet agents for things like DDoS ransoming and similar. Low success rate, but low effort on attacker's side, who often buys a premade tool on a forum.

user6723 3y ago

Imagine being dumb enough to run Windows. Running a copy of Windows in a throwaway VM is the only acceptable place to run Windows.

dgellow 3y ago
Please don’t insult people based on something as subjective as the OS they decide to use. That’s completely unnecessary to make your point regarding VMs and doesn’t have that place on HN.
- user6723 3y ago
  [flagged]
jeroenhd 3y ago
I know hating on Windows is popular and I myself detest what Microsoft is doing to their operating system, but Windows is still a better OS than its competition for most people. This is reflected in its worldwide market share. Windows can actually be managed by am IT department and has a massive security ecosystem. If a corporation with more than ten people has to deal with my data, I'd much rather see them use Windows than anything else.
- user6723 3y ago
  >> and has a massive security ecosystem. lol and we all know why
  - anthk 3y ago
    And yet useless because 90% of compability modes will send such security to /dev/null. Office macros, OCX, Active X compat plugins for IE11 (they still are), VBA, VBScript executions, screensavers as they stated, drop-in replacement DLL's, security overrides because that w9x doesn't work with admin rights... And so on. WinNT would be secure if MS ditched Office Macros (or at least hard-sandboxed them) and ran all w9x software on seamless VM's.

tjpnz 3y ago

And ads are the delivery mechanism.

LinuxBender 3y ago

Windows is the malware compatibility layer for everything Windows NT and all versions of Windows after NT have more security controls than just about any other operating system as those controls came right out of VMS. They are mostly all disabled or weakened to lower friction and increase adoption. The controls are also weakened by default on Linux but it was late to the party and was not as happy-clicky as Windows thus more friction for less technical people at first. It isn't just security controls. Both Windows and Linux allow memory over-commit by default which can affect stability but improves adoption by developers. All of these things can be hardened at the risk of breaking applications that were coded to the default behavior so to speak. As others mentioned Windows has the highest adoption and usage so it will be the default target. Should Linux take the lead some day it would gain more attention by malware authors. There are plenty of unexplored attack vectors in udev, binfmt mount, eBPF, systemd and how some of those things are glued together currently for a lack of better terminology. This may happen sooner than later if Linux gaming continues to improve at it's current rate. Gaming platforms often code to default behavior or expect elevated privileges thus rendering OS-hardening not an option and not many people will buy a separate gaming machine to keep this isolated from the machine they do taxes, banking, emails, social media, etc...

onlyrealcuzzo 3y ago
> Should Linux take the lead some day it would gain more attention by malware authors. Android by itself has 50% more devices than Windows.
- richardjam73 3y ago
  GNU/Linux versus Android/Linux
- Bender 3y ago
  I think a key difference is that Android for most people is a mostly-closed ecosystem. Most people can only install that which has been added to the small selection of app stores and the OS configuration is at least partially locked down. There have been an uptick in malware targeting Android [1] just one recent example but people are not installing as many random applications and vulnerable frameworks such as Wordpress or random apps that lack GPG verification, curl | sudo bash. This puts the onus on Google and wireless vendors to manage the security of these devices and most applications. If some day there is a truly open Linux distro on fully unlocked-by-default phones that come with root access enabled and said phones are adopted by the masses and people can tweak the OS however they wish without using debugging tools or installing custom images then I think the phones will almost be on equal footing to Linux desktops, gaming and graphics power aside. They key part being adopted by the masses. Even Android is not a majority market share [2] so people would have to target apps that Android, Apple and others share. [1] - https://www.scmagazine.com/news/malware/letscall-vishing-malware-android https://www.scmagazine.com/news/malware/letscall-vishing-mal... [2] - https://www.bankmycell.com/blog/us-smartphone-market-share https://www.bankmycell.com/blog/us-smartphone-market-share

dekhn 3y ago

Frequency bias- Windows is the most commonly used OS, but has a similar security posture and implementation quality to the alternatives.

whalesalad 3y ago

There are two reasons to use Windows: you are building software for Windows, or you are a gamer.

Aleklart 3y ago
3 You are manager with 240 Mb Excel file with macros and very important 40 gb pst of Outlook mail. You relax by playing solitaire. Your time is important so your PC is managed by IT departments SCCM along with same 10k+ managers and 100k corporate drones PCs. 4 You work in Microsoft

_gabe_ 3y ago

> Computer security would be about 80% solved if we just deprecated every technology shown in this graphic. Computer security would be 100% solved if we just got rid of computers. It's impossible to break into something if it doesn't exist. I wonder why we haven't tried this strategy yet?

Supermancho 3y ago
Abolishing a number of these technologies means that new technologies will be developed to do the same tasks, with similar (and probably some novel) new vulnerabilities. Overall, I do feel like new technologies are being scrutinized more than in the past. Especially when those implementations were done in a corporate vacuum and released as a canned solution.

motohagiography 3y ago

Ransomware exists mainly to persuade us that apps and commercial software are somehow benign and work in our interests.

lucb1e 3y ago

https://nitter.net/matthew_d_green/status/1679135426806784004 https://nitter.net/matthew_d_green/status/167913542680678400...

mikewarot 3y ago

Windows isn't unique, it shares the same design flaw as Linux and MacOs, etc. Ambient Authority is an incredibly bad design choice for an operating system. Until capability based security[1] becomes widely deployed, we'll keep blaming the wrong things, instead of Ambient Authority. This is not permission management as practiced on smartphones and tablets. [1] https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security

somsak2 3y ago

it's even simpler: stop using C/C++. responsible for 70% of CVEs. https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se...

lionkor 3y ago
> Stop using C/C++ The result of which is what, no new CVEs related to memory security? Rewriting everything in Rust? There need to be more tools to detect and prevent memory issues in current C/C++ codebases - and C++ specifically has a lot of tools like this already.

Pxtl 3y ago

Yes, I agree we should deprecate html

at_a_remove 3y ago

I don't see PDFs in this. Did I miss something?

timbit42 3y ago
PDFs are in the other 20%.
- anthk 3y ago
  DJVU was better. No, please, not PostScript until you like running a Game Boy emulator in Ghost Script or a ZMachine playing Zork. And you can actually do that with Zork/Anchorhead or whatever IF Z-code game up to v3 version. PS can be crazy for security. It might be good on plan9/9front where you can isolate namespaces and filesystems for free, but not on the rest of the OSes.

Aaronmacaron 3y ago

Off topic: why can i read this tweet? I don't have an account. Didn't they recently put all tweets behind a login?

sumtechguy 3y ago
they did
mminer237 3y ago
They reversed that change after a few days: https://techcrunch.com/2023/07/05/twitter-silently-removes-login-requirement-for-viewing-tweets/ https://techcrunch.com/2023/07/05/twitter-silently-removes-l...

exabrial 3y ago

So basically as long as Windows is still a thing

1970-01-01 3y ago

Nah. I'm going with a modified Yogi-ism: "Computer security 80% solved if we deprecate technology shown in this graphic. The other half is software."

more_corn 3y ago

Cool, I’ll put on my Q3 roadmap “deprecate html”

1vuio0pswjnm7 3y ago

If computer security is "80% solved" then "computer security researchers" also lose 80% of their "work". There is an argument to be made that these researchers work for "developers", i.e., the people who create and perpetuate the stuff in the graphic, more than they work for "users", i.e., the people suffer as a result of its continued usage. Here the security researcher does not tell users, most of whom do not read Twitter, to stop using software that utilises the stuff in the graphic. Instead he communicates with computer security researchers, developers and other Twitter users apparently hoping that developers will deprecate such usage. (But knowing this will never happen.) Note this comment does not argue that this state of affairs is good or bad. Only a reader can make that so. The comment only makes some observations.

deleted 3y ago
[deleted]

mrguyorama 3y ago

Computer security is 95% solved if we turn off the powerplants. Human sustenance is solved if we choose to let everyone die. These statements have equal utility.

giantg2 3y ago

"Solved"? Lol that's the wrong mindset for someone in security.

fnordpiglet 3y ago

Computer security would be 75% solved if we deprecated technology shown in this graphic: C

PlunderBunny 3y ago

Just reading the headline, I expected solely a picture of a human being (although that's not strictly 'technology' I guess).

Incipient 3y ago

He's clearly making a joke. As much as it would be hilarious, deprecating html would be a bit restrictive.

rc5150 3y ago

I suppose the remaining 20% is the end user.

_8j50 3y ago

Ahh twitter infosec people. They say shit like this for rage/doom baiting but soon enough they buy their own spiel. I had one person tell me switching to macs should be a priority because it will extinguish most security issues. As a regular mac user, couldn't help facepalming at that.

hoistbypetard 3y ago

This (from a self-reply) was gold: " Windows is the malware compatibility layer for everything."

rajnathani 3y ago

Also iMessage.

hot_gril 3y ago

"How to solve computer security? Get rid of computer" is the kind of argument here.