4 ms·

The problem is that windows was developed before security was important. No one has made the necessary investments to create a truly secure computing platform.

The problem is that windows was developed before security was important. No one has made the necessary investments to create a truly secure computing platform. Ideally a secure computing platform would have reproducible builds built on public inspectable infrastructure like fdroid. It would also virtualize all untrusted applications in a sandbox and implement the least privilege model. Today we have the worst security. There is unknown, probably untested and insecure code running at every ring, from the CPU's ME, to the UEFI components, to the OS 3rd party drivers. SeL4 has a fully verified kernel but it doesn't do virtualization yet.

pjmlp 2y ago
The same can be told of UNIX, lets not forget the first worm was targeted at UNIX systems, and the root cause keeps being a regular CVE in C and C++ projects.
- throwaway48476 2y ago
  Of course. A new secure computing platform would have to be built from scratch and from secure primitives that would not be backwards compatible with anything outside of virtualized emulation.
- ddtaylor 2y ago
  When that worm was created Windows did not exist.
  - pjmlp 2y ago
    And yet the root cause for it still hasn't been fixed in UNIX systems.
    - anthk 2y ago
      If you consider plan9/9front Unix 2.0, they did with namespaces.
      - pjmlp 2y ago
        Namespaces have nothing to do with buffer overflows.
        gavindean90 2y ago
        No, but I wonder if the garbage collected C would help.
  - deleted 2y ago
    [deleted]
morpheuskafka 2y ago
> The problem is that windows was developed before security was important. But wasn't that Windows rebuilt from the ground up as Windows NT, which had more advanced security features out of the box than basic Unix/Linux (allow/deny ACLs vs octal permissions, SAM database vs /etc/passwd flatfile, SIDs vs manually assigned/reusable UIDs)? (And some other cool design features that never got used, like POSIX/OS2 subsystems being on equal footing as the "regular" Windows32 subsystem.)
- mmooss 2y ago
  > But wasn't that Windows rebuilt from the ground up as Windows NT That was the 1990s. Windows security was transformed in the 2000s and then with Windows 10. I'm not sure it can be said to be more vulnerable than other OSes.
  - dagmx 2y ago
    It’s definitely more vulnerable than macOS since macOS has more encompassing system protection (SIP), kernel extensions have been moved to user space (DriverKit and FSKit), and pervasive sandboxing.
    - ruthmarx 2y ago
      Interesting, I might need to do some reading, but macOS was terrible for a long time, and seriously lagging behind windows when it came to security. They seemed to just be coasting on the fact that Apple as a platform simply wasn't targeted to anywhere near the extent Windows was. They didn't even have an ASLR implementation for way too long IIRC. Does macOS have any form of MAC yet, or do they just rely on sandboxing?
      - kchr 2y ago
        > Interesting, I might need to do some reading, > Does macOS have any form of MAC yet, or do they just rely on sandboxing? Kind of. There is a set of permissions an application can request in order to access protected services and areas of the filesystem, but maybe that's what you meant with sandboxing? https://support.apple.com/en-gb/guide/mac-help/mchl211c911f/15.0/mac/15.0 https://support.apple.com/en-gb/guide/mac-help/mchl211c911f/...
gjsman-1000 2y ago
> Ideally a secure computing platform would have reproducible builds built on public inspectable infrastructure like fdroid. It would also virtualize all untrusted applications in a sandbox and implement the least privilege model. Also, be careful what you ask for. Such a system would likely require Secure Boot to be enabled a-la Android, complete with userspace detection of a system which does not have Secure Boot enabled, for DRM implementations similar to a game console. We're already close, but UEFI bugs, virtualization, hundreds of TPM variants, and bus attacks have left holes.
robocat 2y ago
> windows was developed before security was important I disagree - At best you could say DOS was developed before users knew security was important... Microsoft has explicitly ignored security since DOS - because functionality sells better than security. Anyone who has worked with Unix systems has always understood just how much of a sieve Microsoft OSes are. Anyone with wisdom has said that about Windows from the very very beginning. Windows anti-virus has been a thing for a very long time. If your prior is the number of extreme security vulnerabilities in one year - the implication is that there are lot of undiscovered extreme security vulnerabilities. And competent WaaS (Weaponisation as a Service) now exists to quickly deploy exploits for obscure weaknesses or recently discovered weaknesses. Users and companies no longer have a few weeks grace before mass exploitation occurs. Use Windows, get pwned. The counterfactual is difficult: it is hard to prove you haven't been pwned... Anti-virus defence is often too late (plenty of examples eh!). I've seen very careful users/developers get caught out again and again. Not to say Windows is alone. Routers and other end devices are just as bad. And Android doesn't appear great to me either.
- snvzz 2y ago
  UNIX entire security model is "ambient security" in operating systems literature. Ambient security is a joke. Real security requires a capability-based model. seL4[0] implements the mechanisms to do this efficiently. Lions OS implements an entire system with seL4 as core[1] leveraging these mechanisms. 0. https://sel4.systems/About/seL4-whitepaper.pdf https://sel4.systems/About/seL4-whitepaper.pdf 1. https://trustworthy.systems/projects/LionsOS/ https://trustworthy.systems/projects/LionsOS/
  - anthk 2y ago
    Check 9front and GNU/Hurd. Namespaces are good too.
    - snvzz 2y ago
      >GNU/Hurd It will not go anywhere until they manage to move away from the gnu mach kernel. (as it hasn't happened yet, I am afraid it is quite unlikely to happen anymore)
mmooss 2y ago
> windows was developed before security was important That was a long time ago, the 1980s and 1990s. Windows has been transformed since then, particularly with Windows 10.
snvzz 2y ago
>SeL4 has a fully verified kernel but it doesn't do virtualization yet. It very much does virtualization. And, as far as I am aware, it does it better than any other OS. Incidentally, seL4 just had its seL4 Summit 2024[0]. 0. https://www.youtube.com/playlist?list=PLtoQeavghzr0ZntMmRPwg1VA1yJd_T3y9 https://www.youtube.com/playlist?list=PLtoQeavghzr0ZntMmRPwg...
- throwaway48476 2y ago
  But is the virtualization component fully verified?
  - snvzz 2y ago
    There are a few talks on VMM. The major shortcoming right now is that guests only get one CPU, but as per the talks guest SMP is a priority and will be available in 3-4 months. I do not follow the verification side much, but what I know is that VMM has some interesting properties. Namely, VMM itself (which handles VM exceptions) does not get more capabilities than the VM, thus dramatically limiting usefulness of a VM escape.
    - ruthmarx 2y ago
      Do you have links for some of the latest development/research on this?
akira2501 2y ago
> The problem is that windows was developed before security was important. I disagree. Plenty of systems have added security as an afterthought and were just fine for the effort. The problem is most people just want to play video games. They don't care about security. They don't actually want security if it frustrates their efforts to play games or reduces the computing power available for the game. Look at houses. We could have amazing high security locks everywhere if we wanted. We don't. We don't perceive ourselves as needing them. It turns out "tamper evident" is a decent level of security for the real world and allows homes to be partially secure while being totally livable.
saagarjha 2y ago
I like how you started out with a reasonable comment and then ended in a Hacker News word soup of random security memes. It’s like going, “the problem is Python is interpreted, and the design of its interpreter makes it difficult to optimize” and then following up with “this is why we need everyone to write their code in Rust and assembly. There’s this thing called Mojo that looks like Python and has the performance of Rust that we could use”. Like, ok, thanks for your insight? None of it is actually useful or relevant in answering the question.

pjmlp 2y ago

The same can be told of UNIX, lets not forget the first worm was targeted at UNIX systems, and the root cause keeps being a regular CVE in C and C++ projects.

throwaway48476 2y ago
Of course. A new secure computing platform would have to be built from scratch and from secure primitives that would not be backwards compatible with anything outside of virtualized emulation.
ddtaylor 2y ago
When that worm was created Windows did not exist.
- pjmlp 2y ago
  And yet the root cause for it still hasn't been fixed in UNIX systems.
  - anthk 2y ago
    If you consider plan9/9front Unix 2.0, they did with namespaces.
    - pjmlp 2y ago
      Namespaces have nothing to do with buffer overflows.
      - gavindean90 2y ago
        No, but I wonder if the garbage collected C would help.
- deleted 2y ago
  [deleted]

morpheuskafka 2y ago

> The problem is that windows was developed before security was important. But wasn't that Windows rebuilt from the ground up as Windows NT, which had more advanced security features out of the box than basic Unix/Linux (allow/deny ACLs vs octal permissions, SAM database vs /etc/passwd flatfile, SIDs vs manually assigned/reusable UIDs)? (And some other cool design features that never got used, like POSIX/OS2 subsystems being on equal footing as the "regular" Windows32 subsystem.)

mmooss 2y ago
> But wasn't that Windows rebuilt from the ground up as Windows NT That was the 1990s. Windows security was transformed in the 2000s and then with Windows 10. I'm not sure it can be said to be more vulnerable than other OSes.
- dagmx 2y ago
  It’s definitely more vulnerable than macOS since macOS has more encompassing system protection (SIP), kernel extensions have been moved to user space (DriverKit and FSKit), and pervasive sandboxing.
  - ruthmarx 2y ago
    Interesting, I might need to do some reading, but macOS was terrible for a long time, and seriously lagging behind windows when it came to security. They seemed to just be coasting on the fact that Apple as a platform simply wasn't targeted to anywhere near the extent Windows was. They didn't even have an ASLR implementation for way too long IIRC. Does macOS have any form of MAC yet, or do they just rely on sandboxing?
    - kchr 2y ago
      > Interesting, I might need to do some reading, > Does macOS have any form of MAC yet, or do they just rely on sandboxing? Kind of. There is a set of permissions an application can request in order to access protected services and areas of the filesystem, but maybe that's what you meant with sandboxing? https://support.apple.com/en-gb/guide/mac-help/mchl211c911f/15.0/mac/15.0 https://support.apple.com/en-gb/guide/mac-help/mchl211c911f/...

gjsman-1000 2y ago

> Ideally a secure computing platform would have reproducible builds built on public inspectable infrastructure like fdroid. It would also virtualize all untrusted applications in a sandbox and implement the least privilege model. Also, be careful what you ask for. Such a system would likely require Secure Boot to be enabled a-la Android, complete with userspace detection of a system which does not have Secure Boot enabled, for DRM implementations similar to a game console. We're already close, but UEFI bugs, virtualization, hundreds of TPM variants, and bus attacks have left holes.

robocat 2y ago

> windows was developed before security was important I disagree - At best you could say DOS was developed before users knew security was important... Microsoft has explicitly ignored security since DOS - because functionality sells better than security. Anyone who has worked with Unix systems has always understood just how much of a sieve Microsoft OSes are. Anyone with wisdom has said that about Windows from the very very beginning. Windows anti-virus has been a thing for a very long time. If your prior is the number of extreme security vulnerabilities in one year - the implication is that there are lot of undiscovered extreme security vulnerabilities. And competent WaaS (Weaponisation as a Service) now exists to quickly deploy exploits for obscure weaknesses or recently discovered weaknesses. Users and companies no longer have a few weeks grace before mass exploitation occurs. Use Windows, get pwned. The counterfactual is difficult: it is hard to prove you haven't been pwned... Anti-virus defence is often too late (plenty of examples eh!). I've seen very careful users/developers get caught out again and again. Not to say Windows is alone. Routers and other end devices are just as bad. And Android doesn't appear great to me either.

snvzz 2y ago
UNIX entire security model is "ambient security" in operating systems literature. Ambient security is a joke. Real security requires a capability-based model. seL4[0] implements the mechanisms to do this efficiently. Lions OS implements an entire system with seL4 as core[1] leveraging these mechanisms. 0. https://sel4.systems/About/seL4-whitepaper.pdf https://sel4.systems/About/seL4-whitepaper.pdf 1. https://trustworthy.systems/projects/LionsOS/ https://trustworthy.systems/projects/LionsOS/
- anthk 2y ago
  Check 9front and GNU/Hurd. Namespaces are good too.
  - snvzz 2y ago
    >GNU/Hurd It will not go anywhere until they manage to move away from the gnu mach kernel. (as it hasn't happened yet, I am afraid it is quite unlikely to happen anymore)

mmooss 2y ago

> windows was developed before security was important That was a long time ago, the 1980s and 1990s. Windows has been transformed since then, particularly with Windows 10.

snvzz 2y ago

>SeL4 has a fully verified kernel but it doesn't do virtualization yet. It very much does virtualization. And, as far as I am aware, it does it better than any other OS. Incidentally, seL4 just had its seL4 Summit 2024[0]. 0. https://www.youtube.com/playlist?list=PLtoQeavghzr0ZntMmRPwg1VA1yJd_T3y9 https://www.youtube.com/playlist?list=PLtoQeavghzr0ZntMmRPwg...

throwaway48476 2y ago
But is the virtualization component fully verified?
- snvzz 2y ago
  There are a few talks on VMM. The major shortcoming right now is that guests only get one CPU, but as per the talks guest SMP is a priority and will be available in 3-4 months. I do not follow the verification side much, but what I know is that VMM has some interesting properties. Namely, VMM itself (which handles VM exceptions) does not get more capabilities than the VM, thus dramatically limiting usefulness of a VM escape.
  - ruthmarx 2y ago
    Do you have links for some of the latest development/research on this?

akira2501 2y ago

> The problem is that windows was developed before security was important. I disagree. Plenty of systems have added security as an afterthought and were just fine for the effort. The problem is most people just want to play video games. They don't care about security. They don't actually want security if it frustrates their efforts to play games or reduces the computing power available for the game. Look at houses. We could have amazing high security locks everywhere if we wanted. We don't. We don't perceive ourselves as needing them. It turns out "tamper evident" is a decent level of security for the real world and allows homes to be partially secure while being totally livable.

saagarjha 2y ago

I like how you started out with a reasonable comment and then ended in a Hacker News word soup of random security memes. It’s like going, “the problem is Python is interpreted, and the design of its interpreter makes it difficult to optimize” and then following up with “this is why we need everyone to write their code in Rust and assembly. There’s this thing called Mojo that looks like Python and has the performance of Rust that we could use”. Like, ok, thanks for your insight? None of it is actually useful or relevant in answering the question.