3 ms·

It really depends on how you define and measure security. A Windows install's attack surface is massive with tons of legacy crap there for backwards compatibili

by sofixa 3y ago

It really depends on how you define and measure security. A Windows install's attack surface is massive with tons of legacy crap there for backwards compatibility that is very hard to secure properly. Having a TPM and hardware attestation can only get you so far. A random Linux distribution can be a very minimal one, and can have sandboxing too, which is what I presume what you equate to security.

pjmlp 3y ago
I define security by actually taking the steps to make it happen. Linux sandboxing isn't on the same level as Windows 11 Professional, as it doesn't do user space drivers for most stuff, runs drivers in their own sandbox and has critical kernel components running on their own sandbox. All coupled with hardware attestation zones via TPM, SGX and now Pluton.
- AshamedCaptain 3y ago
  > Linux sandboxing isn't on the same level as Windows 11 Professional, as it doesn't do user space drivers for most stuff, runs drivers in their own sandbox and has critical kernel components running on their own sandbox. Nothing except the last part you said about Windows 11 is true. And the only "critical kernel component" which as of today by default runs on its own sandbox is the protected media path, aka DRM. Anything that could even be remotely interesting is not available on the Pro edition.
  - pjmlp 3y ago
    Thanks for proving the point that you lack Windows programming knowledge.
    - sofixa 3y ago
      It's funny that there are two people in this comment thread praising Windows' security, and both are aggressively antagonistic for no reason. Considering Microsoft's general security posture (e.g. check the number of critical cross-tenant and trivial to exploit security issues in Azure - which is unique among cloud providers in their number, criticality and triviality), I wouldn't trust them in the slightest. I know Azure and Windows are different business units, but if nobody in Azure cares about reliability or security, as is obviously the case, I severely doubt that's an organisation that puts emphasis on either.
      - sofixa 3y ago
        What do you know, another trivial Microsoft security issue, fresh from today - https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers https://www.wiz.io/blog/38-terabytes-of-private-data-acciden...
FirmwareBurner 3y ago
> A Windows install's attack surface is massive with tons of legacy crap there for backwards compatibility that is very hard to secure properly. Win32 apps are now sandboxed. https://blogs.windows.com/windowsdeveloper/2023/06/14/public-preview-improve-win32-app-security-via-app-isolation/ https://blogs.windows.com/windowsdeveloper/2023/06/14/public...
- sofixa 3y ago
  This is a public preview of something developers have to actively opt in by using the required packaging and manifests.
  - FirmwareBurner 3y ago
    Wrong. It was a preview when that blogpost was published, but it's been rolled out to all stable users by now via update. I know because suddenly I wake up and see that Sumatra PDF Reader is now operating in sandbox mode.

by sofixa 3y ago

pjmlp 3y ago

I define security by actually taking the steps to make it happen. Linux sandboxing isn't on the same level as Windows 11 Professional, as it doesn't do user space drivers for most stuff, runs drivers in their own sandbox and has critical kernel components running on their own sandbox. All coupled with hardware attestation zones via TPM, SGX and now Pluton.

AshamedCaptain 3y ago
> Linux sandboxing isn't on the same level as Windows 11 Professional, as it doesn't do user space drivers for most stuff, runs drivers in their own sandbox and has critical kernel components running on their own sandbox. Nothing except the last part you said about Windows 11 is true. And the only "critical kernel component" which as of today by default runs on its own sandbox is the protected media path, aka DRM. Anything that could even be remotely interesting is not available on the Pro edition.
- pjmlp 3y ago
  Thanks for proving the point that you lack Windows programming knowledge.
  - sofixa 3y ago
    It's funny that there are two people in this comment thread praising Windows' security, and both are aggressively antagonistic for no reason. Considering Microsoft's general security posture (e.g. check the number of critical cross-tenant and trivial to exploit security issues in Azure - which is unique among cloud providers in their number, criticality and triviality), I wouldn't trust them in the slightest. I know Azure and Windows are different business units, but if nobody in Azure cares about reliability or security, as is obviously the case, I severely doubt that's an organisation that puts emphasis on either.
    - sofixa 3y ago
      What do you know, another trivial Microsoft security issue, fresh from today - https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers https://www.wiz.io/blog/38-terabytes-of-private-data-acciden...

FirmwareBurner 3y ago

> A Windows install's attack surface is massive with tons of legacy crap there for backwards compatibility that is very hard to secure properly. Win32 apps are now sandboxed. https://blogs.windows.com/windowsdeveloper/2023/06/14/public-preview-improve-win32-app-security-via-app-isolation/ https://blogs.windows.com/windowsdeveloper/2023/06/14/public...

sofixa 3y ago
This is a public preview of something developers have to actively opt in by using the required packaging and manifests.
- FirmwareBurner 3y ago
  Wrong. It was a preview when that blogpost was published, but it's been rolled out to all stable users by now via update. I know because suddenly I wake up and see that Sumatra PDF Reader is now operating in sandbox mode.