3 ms·

I've noticed that a surprising number of people here on HN are in favour of locking down Windows and preventing any kernel access at all to Windows users. It re

by Sakos 2y ago

I've noticed that a surprising number of people here on HN are in favour of locking down Windows and preventing any kernel access at all to Windows users. It reeks of the "think of the children" arguments.

lock_it_down 2y ago
No, as a user which has no need for kernel access I want it locked down so the real things I care about, my data, is more secure. It's called security in depth.
- Sakos 2y ago
  As a user who does have need for kernel access, because it's my god damn system and not yours, Microsoft's or anybody else's, I don't want it locked down. It's called security in depth. That means you don't need to prevent all kernel access for users, because there are layers of defense.
  - ruthmarx 2y ago
    > As a user who does have need for kernel access, Why do you need it?
- TheRealPomax 2y ago
  But you know what's even better? Having a choice. Want to lock down Windows? You should have that power. It would be absolutely idiotic if you couldn't secure a computer. But, do you want to fuck with the kernel, patch out something you think should never be called by anything because there is no legitimate use case? You should also have that power. Because one thing that stuff like this doesn't do is "make it easier for the bad guys": want to deliver a malicious payload by exploiting Windows, either because of its design or a recently found vector? I hope you die in a fire but you already have so many options that this one really doesn't give you more power than before. It's just another option in a litany of options. After all, Windows is only as safe as its users with admin powers, which is literally every home user thanks to elevated access being a single "ok" button, if they even have UAC still turned on "because it's so annoying".
perching_aix 2y ago
"heh, nice argument. unfortunately, in my head I have already depicted you as the seething pathetic baby bird and myself as the smug and unflappable red angry bird"

by Sakos 2y ago

lock_it_down 2y ago

No, as a user which has no need for kernel access I want it locked down so the real things I care about, my data, is more secure. It's called security in depth.

Sakos 2y ago
As a user who does have need for kernel access, because it's my god damn system and not yours, Microsoft's or anybody else's, I don't want it locked down. It's called security in depth. That means you don't need to prevent all kernel access for users, because there are layers of defense.
- ruthmarx 2y ago
  > As a user who does have need for kernel access, Why do you need it?
TheRealPomax 2y ago
But you know what's even better? Having a choice. Want to lock down Windows? You should have that power. It would be absolutely idiotic if you couldn't secure a computer. But, do you want to fuck with the kernel, patch out something you think should never be called by anything because there is no legitimate use case? You should also have that power. Because one thing that stuff like this doesn't do is "make it easier for the bad guys": want to deliver a malicious payload by exploiting Windows, either because of its design or a recently found vector? I hope you die in a fire but you already have so many options that this one really doesn't give you more power than before. It's just another option in a litany of options. After all, Windows is only as safe as its users with admin powers, which is literally every home user thanks to elevated access being a single "ok" button, if they even have UAC still turned on "because it's so annoying".

perching_aix 2y ago

"heh, nice argument. unfortunately, in my head I have already depicted you as the seething pathetic baby bird and myself as the smug and unflappable red angry bird"