3 ms·

What a disingenuous argument by Microsoft - I really hope nobody buys it. Lots of the most mission critical software runs on Linux. They don't have these securi

by jcfrei 2y ago

What a disingenuous argument by Microsoft - I really hope nobody buys it. Lots of the most mission critical software runs on Linux. They don't have these security issues because they were open from the start.

gjsman-1000 2y ago
Meh - Microsoft can point to the fact that they saved the day by preventing every Linux device from getting backdoored with the `xz-utils` debacle. The fact that it was caught was an exceedingly lucky break, and had nothing to do with quality engineering, or even that the code was open source. (Edit for the downvoters - nothing I said above was an opinion. https://news.ycombinator.com/item?id=41049312 https://news.ycombinator.com/item?id=41049312)
- vectorhacker 2y ago
  I think the fact that it was caught is a testament to the power of open source and the quality of engineering. It speaks volumes about the promise of OSS.
  - gjsman-1000 2y ago
    > I think the fact that it was caught is a testament to the power of open source and the quality of engineering. Ha, no. It was caught because an engineer noticed his SSH was taking slightly longer than normal, a few hundred milliseconds of difference. There was nothing in the code to suggest an anomaly; so he began fully reverse-engineering the binary as though it was proprietary software. The open-source communities meanwhile had approved and were even distributing that code on testing branches. And to top it all off, that engineer worked for Microsoft; so it's pretty ironic to complain about Microsoft's behavior with Windows, considering they just saved Linux from catastrophe.
    - bryanrasmussen 2y ago
      wait, did the open source community have access to Microsoft's code and then fail to find the Cloudstrike vulnerability even though they had the same amount of time with that code that MS had with theirs? I mean open source idea is that even MS engineer can find their problems. And then MS engineer found their problems. So yeah, does seem like a win for open source ideas which is not even something I particular care about...
      - gjsman-1000 2y ago
        > wait, did the open source community have access to Microsoft's code and then fail to find the Cloudstrike vulnerability even though they had the same amount of time with that code that MS had with theirs? Cloudstrike was not in Microsoft's code; so yell at Cloudstrike. > And then MS engineer found their problems. The Microsoft engineer found the malicious code from the binary first - the same way he would have investigated proprietary software. The fact that it was open source didn't help discover the vulnerability in any way. The open source nature only helped with explaining how it got in there afterwards. > So yeah, does seem like a win for open source ideas which is not even something I particular care about... According to many security researchers, the `xz-utils` thing was deeply underrated and shows how, let's just say, not necessarily more secure open source software is. The fact that every Linux computer was nearly backdoored, globally, and it was found by accident, by a Microsoft engineer nonetheless, without any use of the code to find the bug, after that code was approved by both Debian and Red Hat, looks terrible to the open source community. I take that back. It doesn't just look bad - it is bad. The ideology and security assumptions are in question, bad. If Microsoft's engineer had not found that bug, Linux and open-source as a whole could have sustained a mortal wound and a crushing blow to the theory of open-source being more secure.
        CRConrad 2y ago
        > Cloudstrike was not in Microsoft's code; Yes of course it was; it ran in kernel space. Microsoft let it in, ao it was in there. > so yell at Cloudstrike Sure. And Microsoft.
      - Tabular-Iceberg 2y ago
  - mkul 2y ago
    tbf, it was an engineer at Microsoft that found it lol
godurdumb 2y ago
[flagged]
Maxatar 2y ago
My understanding is that Linux is just as vulnerable to this issue as Windows but isn't used as often for desktop software. In fact there two security incidents just this year involving Crowdstrike on Debian and Rocky Linux.
- thuridas 2y ago
  What I understood is that in Linux you could program this kind of security tools in use space by having a somehow estable binary API. Sure, if you access the kernel you can break it. So we should make easier to do the right thing. EU complained that Microsoft was the only one that could access the kernel because a lot of Microsoft applications needed kernel access.
  - Maxatar 2y ago
    I see, reading about this issue it looks like eBPF can be used in Linux to sandbox kernel applications, preventing such applications from crashing the kernel as a whole.
lolokwhatever 2y ago
[flagged]
sonthonax 2y ago
Linux outages and upgrade fuckups happen all the time. The difference is that Linux isn't on a unified upgrade cycle so issues come as a trickle rather than a dulge, so the problems are usually localised to a corporation and don't make the news. Also Linux fanboys will usually blame the system admin for not configuring things properly if things break: "it's not the operating system, it's <something stolen from OpenBSD>". End of the day Linux is only popular because of the inertia UNIX had on mini-computers/servers. For standard end users GNU Linux is lightyears behind Windows and macOS in terms of usability and stability.
overstay8930 2y ago
Linux has the same “security issue” (your words), it’s just considered a skill issue if you foot gun with the tools given to you.

by jcfrei 2y ago

gjsman-1000 2y ago

Meh - Microsoft can point to the fact that they saved the day by preventing every Linux device from getting backdoored with the `xz-utils` debacle. The fact that it was caught was an exceedingly lucky break, and had nothing to do with quality engineering, or even that the code was open source. (Edit for the downvoters - nothing I said above was an opinion. https://news.ycombinator.com/item?id=41049312 https://news.ycombinator.com/item?id=41049312)

vectorhacker 2y ago
I think the fact that it was caught is a testament to the power of open source and the quality of engineering. It speaks volumes about the promise of OSS.
- gjsman-1000 2y ago
  > I think the fact that it was caught is a testament to the power of open source and the quality of engineering. Ha, no. It was caught because an engineer noticed his SSH was taking slightly longer than normal, a few hundred milliseconds of difference. There was nothing in the code to suggest an anomaly; so he began fully reverse-engineering the binary as though it was proprietary software. The open-source communities meanwhile had approved and were even distributing that code on testing branches. And to top it all off, that engineer worked for Microsoft; so it's pretty ironic to complain about Microsoft's behavior with Windows, considering they just saved Linux from catastrophe.
  - bryanrasmussen 2y ago
    wait, did the open source community have access to Microsoft's code and then fail to find the Cloudstrike vulnerability even though they had the same amount of time with that code that MS had with theirs? I mean open source idea is that even MS engineer can find their problems. And then MS engineer found their problems. So yeah, does seem like a win for open source ideas which is not even something I particular care about...
    - gjsman-1000 2y ago
      > wait, did the open source community have access to Microsoft's code and then fail to find the Cloudstrike vulnerability even though they had the same amount of time with that code that MS had with theirs? Cloudstrike was not in Microsoft's code; so yell at Cloudstrike. > And then MS engineer found their problems. The Microsoft engineer found the malicious code from the binary first - the same way he would have investigated proprietary software. The fact that it was open source didn't help discover the vulnerability in any way. The open source nature only helped with explaining how it got in there afterwards. > So yeah, does seem like a win for open source ideas which is not even something I particular care about... According to many security researchers, the `xz-utils` thing was deeply underrated and shows how, let's just say, not necessarily more secure open source software is. The fact that every Linux computer was nearly backdoored, globally, and it was found by accident, by a Microsoft engineer nonetheless, without any use of the code to find the bug, after that code was approved by both Debian and Red Hat, looks terrible to the open source community. I take that back. It doesn't just look bad - it is bad. The ideology and security assumptions are in question, bad. If Microsoft's engineer had not found that bug, Linux and open-source as a whole could have sustained a mortal wound and a crushing blow to the theory of open-source being more secure.
      - CRConrad 2y ago
        > Cloudstrike was not in Microsoft's code; Yes of course it was; it ran in kernel space. Microsoft let it in, ao it was in there. > so yell at Cloudstrike Sure. And Microsoft.
    - Tabular-Iceberg 2y ago
- mkul 2y ago
  tbf, it was an engineer at Microsoft that found it lol

godurdumb 2y ago

[flagged]

Maxatar 2y ago

My understanding is that Linux is just as vulnerable to this issue as Windows but isn't used as often for desktop software. In fact there two security incidents just this year involving Crowdstrike on Debian and Rocky Linux.

thuridas 2y ago
What I understood is that in Linux you could program this kind of security tools in use space by having a somehow estable binary API. Sure, if you access the kernel you can break it. So we should make easier to do the right thing. EU complained that Microsoft was the only one that could access the kernel because a lot of Microsoft applications needed kernel access.
- Maxatar 2y ago
  I see, reading about this issue it looks like eBPF can be used in Linux to sandbox kernel applications, preventing such applications from crashing the kernel as a whole.

lolokwhatever 2y ago

[flagged]

sonthonax 2y ago

Linux outages and upgrade fuckups happen all the time. The difference is that Linux isn't on a unified upgrade cycle so issues come as a trickle rather than a dulge, so the problems are usually localised to a corporation and don't make the news. Also Linux fanboys will usually blame the system admin for not configuring things properly if things break: "it's not the operating system, it's <something stolen from OpenBSD>". End of the day Linux is only popular because of the inertia UNIX had on mini-computers/servers. For standard end users GNU Linux is lightyears behind Windows and macOS in terms of usability and stability.

overstay8930 2y ago

Linux has the same “security issue” (your words), it’s just considered a skill issue if you foot gun with the tools given to you.