3 ms·

>"We don't have a cyber security problem – we have a software quality problem. We don't need more security products – we need more secure products." Uhmmm. The

>"We don't have a cyber security problem – we have a software quality problem. We don't need more security products – we need more secure products." Uhmmm. The foundation of a lot of the modern economy is built on Windows and the Crowdstrike fiasco has shown, Windows requires a security software to save it from itself by running at the kernel level. If we truly want secure products, we should shutdown all Windows machines?

davisr 2y ago
> If we truly want secure products, we should shutdown all Windows machines? There should be a period where you put a question mark.
juunpp 2y ago
Precisely.
lmz 2y ago
Crowdstrike also provided software for Linux systems. It's something you install to satisfy auditors and they would demand the same of any OS unless such functionality was built-in.
idle_zealot 2y ago
Running the world's critical infrastructure on verified, small, readable codebases rather than a diaspora of unvetted closed-source programs sprinkled across Windows and Linux systems sounds like a good start.
- Aerroon 2y ago
  It wont matter unless the code is written specifically for the hardware and will only run on that hardware.
- jdougan 2y ago
  We would need to dump POSIX/WinXX and replace/upgrade them with something better, probably using an object-capabilities approach. WASI, Capsicum. etc.
bruce511 2y ago
But wait... most Windows runs on Intel, we should shutdown Intel. Of course shutting down Windows will have zero effect on security. There are plenty of exploits for Linux, and most data leaks are hosted on Linux (but have nothing to do with the OS.) To the degree to which software is a failure at the coding level (like every SQL injection, phishing, social engineering , sim swap, php, attack ever) the OS is irrelevant.) In truth most all security has to do with people; programmers and users. The OS might be a nice scapegoat but it's not the root of the problem. Blaming it though helps to deflect attention away from ourselves though.

davisr 2y ago

> If we truly want secure products, we should shutdown all Windows machines? There should be a period where you put a question mark.

juunpp 2y ago

Precisely.

lmz 2y ago

Crowdstrike also provided software for Linux systems. It's something you install to satisfy auditors and they would demand the same of any OS unless such functionality was built-in.

idle_zealot 2y ago

Running the world's critical infrastructure on verified, small, readable codebases rather than a diaspora of unvetted closed-source programs sprinkled across Windows and Linux systems sounds like a good start.

Aerroon 2y ago
It wont matter unless the code is written specifically for the hardware and will only run on that hardware.
jdougan 2y ago
We would need to dump POSIX/WinXX and replace/upgrade them with something better, probably using an object-capabilities approach. WASI, Capsicum. etc.

bruce511 2y ago

But wait... most Windows runs on Intel, we should shutdown Intel. Of course shutting down Windows will have zero effect on security. There are plenty of exploits for Linux, and most data leaks are hosted on Linux (but have nothing to do with the OS.) To the degree to which software is a failure at the coding level (like every SQL injection, phishing, social engineering , sim swap, php, attack ever) the OS is irrelevant.) In truth most all security has to do with people; programmers and users. The OS might be a nice scapegoat but it's not the root of the problem. Blaming it though helps to deflect attention away from ourselves though.