4 ms·

Years? Try decades. When has Microsoft not been a source of endless security problems?

by the_biot 2y ago

IshKebab 2y ago
Windows is quite secure these days. Arguably more secure than Linux.
- nosefrog 2y ago
  Who argues that?
  - dboreham 2y ago
    People who know something about both kernels?
    - staunton 2y ago
      Like who?
  - fr4nkr 2y ago
    If I had to guess, people who judge Linux security based on niche desktop distros with no security features enabled.
  - deleted 2y ago
    [deleted]
  - hollerith 2y ago
    Lots of security professionals say that user-facing (as opposed to server) Linux except for Qubes, Android and ChromeOS is significantly less secure than user-facing Windows, MacOS, iOS, Qubes, Android and ChromeOS. And I think they're probably right (although I'm not a security professional).
    - JackSlateur 2y ago
      Those people recommends what is best for their businesses. How about the opinion of people who have nothing to win nor lose ?
      - hollerith 2y ago
        They make detailed arguments for their position, for example, https://madaidans-insecurities.github.io/ https://madaidans-insecurities.github.io/ The people who think that Linux security is fine also make arguments, but those arguments are much less detailed (and much less convincing IMHO), such as the frequently-made argument that the fact that Linux's source code is readily available at no cost to anyone who wants to search it for security holes means that Linux's security will tend to be better than the security of systems whose source code is held secret. I mean, sure, if that were the only thing we knew about operating systems and we were forced to choose an OS based on that single piece of information, we'd choose one of the open-source ones, but the persuasiveness of that argument is more than cancelled out when we consider all the other things we know, such as the fact that many exploitable vulnerabilities have been found in Linux that examination of old versions of the source code reveal have been present for decades. >How about the opinion of people who have nothing to win nor lose? The question is complicated enough that my guess is that basically the only people who make the mental effort to resolve the question are people with a stake in it. How many people for example who do not have a loved one with the cancer or a unusually high risk for that cancer and who do not hope to advance their careers as cancer-curers or cancer-preventers take the trouble to learn about the diagnosis and treatment of a particular kind of cancer?
        JackSlateur 2y ago
        Reading https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html right now Shall I take each point and explain why they are bullshit ? Probably not, but do tell me. This kind of post is a perfect example of the bullshit I spoke about. Just a quote to illustrate: The Linux kernel's size grows exponentially across each release, and it can be thought of as equivalent to running all user space code as root in PID 1, if not even more dangerous. What the fuck.
- cjk2 2y ago
  At first I thought this was an astonishing point to make. And then I asked myself if it is or isn't. Can Firefox still write to ~/.profile if there's a buffer overrun somewhere for example? Did I curl | sh some random shit 50 times since December? What is security even?
  - taneq 2y ago
    “Do you trust this program?” No, and why is this a yes/no question?
    - cjk2 2y ago
      Well I use a Mac and it asks me "XYZ is asking to access your documents - should I let it?". Solves all aspects of that question.
- Tangential_ 2y ago
  Microsoft is much more than Windows though. Active Directory is still a terribly insecure mess that forms the backbones of most major companies. Beyond that, all of Windows still runs on unsalted NTLM hashes. NetNTLM and NetNTLMv2 are more secure salted hash types, but both use the original unsalted NTLM hash to form the NetNTLM/v2 hashes. That allows attackers to simply pass-the-hash to authenticate as domain/local Windows accounts without ever having to know the password. I mean this very sincerely: The day Microsoft's products are actually secure is the day I'm out of a job.
  - jiggawatts 2y ago
    This is true, but going away rapidly and being replaced by Entra ID (formerly Azure Active Directory). The big difference is that a breach of any single Entra ID connected service doesn’t give attackers widespread access to unrelated systems sharing the same tenant. For comparison, once you’ve got a foothold on an Active Directory domain member, it’s surprisingly easy to move horizontally to the rest of the network.
  - jpc0 2y ago
    To my knowledge the current best practicen is to have all NTLM versions disabled and use Kerberos which surprise surprise is also the backbone of linux enterprise login... AD is just a fancy interface to LDAP with Kerberos, that sound familiar in any way?

Years? Try decades. When has Microsoft not been a source of endless security problems?

IshKebab 2y ago

Windows is quite secure these days. Arguably more secure than Linux.

nosefrog 2y ago
Who argues that?
- dboreham 2y ago
  People who know something about both kernels?
  - staunton 2y ago
    Like who?
- fr4nkr 2y ago
  If I had to guess, people who judge Linux security based on niche desktop distros with no security features enabled.
- deleted 2y ago
  [deleted]
- hollerith 2y ago
  Lots of security professionals say that user-facing (as opposed to server) Linux except for Qubes, Android and ChromeOS is significantly less secure than user-facing Windows, MacOS, iOS, Qubes, Android and ChromeOS. And I think they're probably right (although I'm not a security professional).
  - JackSlateur 2y ago
    Those people recommends what is best for their businesses. How about the opinion of people who have nothing to win nor lose ?
    - hollerith 2y ago
      They make detailed arguments for their position, for example, https://madaidans-insecurities.github.io/ https://madaidans-insecurities.github.io/ The people who think that Linux security is fine also make arguments, but those arguments are much less detailed (and much less convincing IMHO), such as the frequently-made argument that the fact that Linux's source code is readily available at no cost to anyone who wants to search it for security holes means that Linux's security will tend to be better than the security of systems whose source code is held secret. I mean, sure, if that were the only thing we knew about operating systems and we were forced to choose an OS based on that single piece of information, we'd choose one of the open-source ones, but the persuasiveness of that argument is more than cancelled out when we consider all the other things we know, such as the fact that many exploitable vulnerabilities have been found in Linux that examination of old versions of the source code reveal have been present for decades. >How about the opinion of people who have nothing to win nor lose? The question is complicated enough that my guess is that basically the only people who make the mental effort to resolve the question are people with a stake in it. How many people for example who do not have a loved one with the cancer or a unusually high risk for that cancer and who do not hope to advance their careers as cancer-curers or cancer-preventers take the trouble to learn about the diagnosis and treatment of a particular kind of cancer?
      - JackSlateur 2y ago
        Reading https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html right now Shall I take each point and explain why they are bullshit ? Probably not, but do tell me. This kind of post is a perfect example of the bullshit I spoke about. Just a quote to illustrate: The Linux kernel's size grows exponentially across each release, and it can be thought of as equivalent to running all user space code as root in PID 1, if not even more dangerous. What the fuck.
cjk2 2y ago
At first I thought this was an astonishing point to make. And then I asked myself if it is or isn't. Can Firefox still write to ~/.profile if there's a buffer overrun somewhere for example? Did I curl | sh some random shit 50 times since December? What is security even?
- taneq 2y ago
  “Do you trust this program?” No, and why is this a yes/no question?
  - cjk2 2y ago
    Well I use a Mac and it asks me "XYZ is asking to access your documents - should I let it?". Solves all aspects of that question.
Tangential_ 2y ago
Microsoft is much more than Windows though. Active Directory is still a terribly insecure mess that forms the backbones of most major companies. Beyond that, all of Windows still runs on unsalted NTLM hashes. NetNTLM and NetNTLMv2 are more secure salted hash types, but both use the original unsalted NTLM hash to form the NetNTLM/v2 hashes. That allows attackers to simply pass-the-hash to authenticate as domain/local Windows accounts without ever having to know the password. I mean this very sincerely: The day Microsoft's products are actually secure is the day I'm out of a job.
- jiggawatts 2y ago
  This is true, but going away rapidly and being replaced by Entra ID (formerly Azure Active Directory). The big difference is that a breach of any single Entra ID connected service doesn’t give attackers widespread access to unrelated systems sharing the same tenant. For comparison, once you’ve got a foothold on an Active Directory domain member, it’s surprisingly easy to move horizontally to the rest of the network.
- jpc0 2y ago
  To my knowledge the current best practicen is to have all NTLM versions disabled and use Kerberos which surprise surprise is also the backbone of linux enterprise login... AD is just a fancy interface to LDAP with Kerberos, that sound familiar in any way?