4 ms·

The way I read these arguments is: the lack of security adds to the case against this product. The reviewers aren't saying there's a self-evident solution, just

The way I read these arguments is: the lack of security adds to the case against this product. The reviewers aren't saying there's a self-evident solution, just that there are self-evident problems. How did this get through review? So it's not that there are two separate arguments, but that the security issues strengthen the main argument that this is a product that shouldn't exist.

andrewflnr 2y ago
That's a very charitable reading. In my reading, the dismissive tone of the "security" arguments implies there's something obvious that MS should have done better specifically security-wise. If there's no such better implementation, then security has nothing to do with the argument, and they should stop talking about it. If they wanted to make a more nuanced argument about how there's no way to make a secure implementation that provides the smooth UX people will actually use, I would respect that a bit more, but I'm not seeing either that particular claim or the evidence to back it up in the mainstream commentary.
- akkartik 2y ago
  I don't know what else you've read, but in the context of OP in particular it's not clear to me what seems dismissive about the "security" arguments.
  - andrewflnr 2y ago
    It's stronger in the initial coverage, I believe by the guy who discovered the story and the immediate commentary on Mastodon. The Verge is a more professional outfit so they're more subtle about it, but it's still there in phrases like "That could make it trivial for an attacker" (emphasis mine) and "There are clearly some obvious holes". Tone is hard to prove, so I'm probably not going to try any harder than that.
    - akkartik 2y ago
      I can totally believe random microblogging takes are stupid, but that doesn't seem worth arguing about. Microblogging is just capturing initial reactions. > "That could make it trivial for an attacker" (emphasis mine) It _is_ trivial, right? The attack _is_ trivial. It's the solution that isn't. OP isn't claiming that. Seems reasonable to me. I went back and reread https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e https://doublepulsar.com/recall-stealing-everything-youve-ev... which is the first link in OP. Again, it doesn't have much to say about encryption at all except to point out that hey, the protections Microsoft is claiming are underwhelming. Without those protections the cost/benefit balance is way out of whack.
- theolivenbaum 2y ago
  While I'm not a fan of the almost forced OOBE setup, I really don't understand the complaining regarding security. It's again another case of if you can run code on my computer you already own it. As Raymond Chen put: "you’re already on the other side of the airtight hatchway. And you’re bragging that you can do something annoying like a denial service, apparently unaware that being on the other side of the airtight hatchway gives you the ability to do far more interesting (and threatening) things". This kind of "vulnerability" has been a constant topic of his blog in the past: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31... https://devblogs.microsoft.com/oldnewthing/20181219-00/?p=100515 https://devblogs.microsoft.com/oldnewthing/20181219-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20121207-00/?p=5893 https://devblogs.microsoft.com/oldnewthing/20121207-00/?p=58... https://devblogs.microsoft.com/oldnewthing/20180227-00/?p=98115 https://devblogs.microsoft.com/oldnewthing/20180227-00/?p=98... https://devblogs.microsoft.com/oldnewthing/20240404-00/?p=109612 https://devblogs.microsoft.com/oldnewthing/20240404-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20200420-00/?p=103685 https://devblogs.microsoft.com/oldnewthing/20200420-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20220907-00/?p=107132 https://devblogs.microsoft.com/oldnewthing/20220907-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20240102-00/?p=109217 https://devblogs.microsoft.com/oldnewthing/20240102-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20070807-00/?p=25683 https://devblogs.microsoft.com/oldnewthing/20070807-00/?p=25... https://devblogs.microsoft.com/oldnewthing/20230206-00/?p=107797 https://devblogs.microsoft.com/oldnewthing/20230206-00/?p=10...

andrewflnr 2y ago

That's a very charitable reading. In my reading, the dismissive tone of the "security" arguments implies there's something obvious that MS should have done better specifically security-wise. If there's no such better implementation, then security has nothing to do with the argument, and they should stop talking about it. If they wanted to make a more nuanced argument about how there's no way to make a secure implementation that provides the smooth UX people will actually use, I would respect that a bit more, but I'm not seeing either that particular claim or the evidence to back it up in the mainstream commentary.

akkartik 2y ago
I don't know what else you've read, but in the context of OP in particular it's not clear to me what seems dismissive about the "security" arguments.
- andrewflnr 2y ago
  It's stronger in the initial coverage, I believe by the guy who discovered the story and the immediate commentary on Mastodon. The Verge is a more professional outfit so they're more subtle about it, but it's still there in phrases like "That could make it trivial for an attacker" (emphasis mine) and "There are clearly some obvious holes". Tone is hard to prove, so I'm probably not going to try any harder than that.
  - akkartik 2y ago
    I can totally believe random microblogging takes are stupid, but that doesn't seem worth arguing about. Microblogging is just capturing initial reactions. > "That could make it trivial for an attacker" (emphasis mine) It _is_ trivial, right? The attack _is_ trivial. It's the solution that isn't. OP isn't claiming that. Seems reasonable to me. I went back and reread https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e https://doublepulsar.com/recall-stealing-everything-youve-ev... which is the first link in OP. Again, it doesn't have much to say about encryption at all except to point out that hey, the protections Microsoft is claiming are underwhelming. Without those protections the cost/benefit balance is way out of whack.
theolivenbaum 2y ago
While I'm not a fan of the almost forced OOBE setup, I really don't understand the complaining regarding security. It's again another case of if you can run code on my computer you already own it. As Raymond Chen put: "you’re already on the other side of the airtight hatchway. And you’re bragging that you can do something annoying like a denial service, apparently unaware that being on the other side of the airtight hatchway gives you the ability to do far more interesting (and threatening) things". This kind of "vulnerability" has been a constant topic of his blog in the past: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31... https://devblogs.microsoft.com/oldnewthing/20181219-00/?p=100515 https://devblogs.microsoft.com/oldnewthing/20181219-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20121207-00/?p=5893 https://devblogs.microsoft.com/oldnewthing/20121207-00/?p=58... https://devblogs.microsoft.com/oldnewthing/20180227-00/?p=98115 https://devblogs.microsoft.com/oldnewthing/20180227-00/?p=98... https://devblogs.microsoft.com/oldnewthing/20240404-00/?p=109612 https://devblogs.microsoft.com/oldnewthing/20240404-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20200420-00/?p=103685 https://devblogs.microsoft.com/oldnewthing/20200420-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20220907-00/?p=107132 https://devblogs.microsoft.com/oldnewthing/20220907-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20240102-00/?p=109217 https://devblogs.microsoft.com/oldnewthing/20240102-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20070807-00/?p=25683 https://devblogs.microsoft.com/oldnewthing/20070807-00/?p=25... https://devblogs.microsoft.com/oldnewthing/20230206-00/?p=107797 https://devblogs.microsoft.com/oldnewthing/20230206-00/?p=10...