4 ms·

Linux is on their second and FreeBSD is on their first. How many is Windows on?

pjmlp 5mo ago
Plenty, Microsoft has security teams whose job is to attack Windows. Naturally they don't do blog posts about what they find.
- hnlmorg 5mo ago
  You talk as if Windows is the only OS that has red teams attacking the system when clearly that isn’t even remotely true.
  - asveikau 5mo ago
    No, they're saying security work happens in the Windows world but not as much in the open, due to the closed source nature.
  - pjmlp 5mo ago
    I talk about that because it is public, and the OP mentioned Windows. It he talked about Android, I would have mentioned Project Zero. Don't twist the meaning of posts.
- murderfs 5mo ago
  Local privilege escalation is largely irrelevant on Windows because basically no one uses it in a multi-user system, and application sandboxing is effectively nonexistent.
  - TZubiri 5mo ago
    I get that multiple human users on a same machine is rare nowadays, and that per-app users were never a thing. But windows still has a root and a lower privilege user. You typically need to click on "run as admin" to elevate privileges to, for example, alter system binaries.
    - asveikau 5mo ago
      I know that Chrome on Windows tries to lower its privileges to mitigate exploits, and although it's not very popular, the MS Store app platform does try to do full isolation of apps. So actually, per-app separation of users kinda does happen, or is attempted on Windows.
      - deleted 5mo ago
        [deleted]
    - murderfs 5mo ago
      Sure, but that's mostly academic: compromise of the user account is game over for any real user. Not actually being Administrator isn't much consolation when the regular user account can extract your cookie jar, record all of your keystrokes and mouse movements, record all desktop video (except for DRM-protected content, heh) etc.
dwattttt 5mo ago
If you think Linux is on their first or second, I'm not sure how or what you're counting.
- doublerabbit 5mo ago
  > I'm not sure how or what you're counting. The recent two. FailCopy and DirtyFrag and FreeBSD with Execve. 2 - Linux 1 - FreeBSD. Of course, all OS have had past-time exploits. Three now have made the news.
  - dwattttt 5mo ago
    Your question was "how many high profile privilege escalations Windows has had recently" then? I can't think of any, 0?
    - gdgghhhhh 5mo ago
      https://nvd.nist.gov/vuln/detail/CVE-2026-21250 https://nvd.nist.gov/vuln/detail/CVE-2026-21250
    - doublerabbit 5mo ago
      It was a sarcastic joke, never mind.
    - GoblinSlayer 5mo ago
      Windows vulnerability list is overflowing with lpes, hundreds of them. You should filter it per month, the list is too big to load in full.
  - nubinetwork 5mo ago
    > 2 Linux Three. I don't know if this has a name yet... https://news.ycombinator.com/item?id=48067734 https://news.ycombinator.com/item?id=48067734

pjmlp 5mo ago

Plenty, Microsoft has security teams whose job is to attack Windows. Naturally they don't do blog posts about what they find.

hnlmorg 5mo ago
You talk as if Windows is the only OS that has red teams attacking the system when clearly that isn’t even remotely true.
- asveikau 5mo ago
  No, they're saying security work happens in the Windows world but not as much in the open, due to the closed source nature.
- pjmlp 5mo ago
  I talk about that because it is public, and the OP mentioned Windows. It he talked about Android, I would have mentioned Project Zero. Don't twist the meaning of posts.
murderfs 5mo ago
Local privilege escalation is largely irrelevant on Windows because basically no one uses it in a multi-user system, and application sandboxing is effectively nonexistent.
- TZubiri 5mo ago
  I get that multiple human users on a same machine is rare nowadays, and that per-app users were never a thing. But windows still has a root and a lower privilege user. You typically need to click on "run as admin" to elevate privileges to, for example, alter system binaries.
  - asveikau 5mo ago
    I know that Chrome on Windows tries to lower its privileges to mitigate exploits, and although it's not very popular, the MS Store app platform does try to do full isolation of apps. So actually, per-app separation of users kinda does happen, or is attempted on Windows.
    - deleted 5mo ago
      [deleted]
  - murderfs 5mo ago
    Sure, but that's mostly academic: compromise of the user account is game over for any real user. Not actually being Administrator isn't much consolation when the regular user account can extract your cookie jar, record all of your keystrokes and mouse movements, record all desktop video (except for DRM-protected content, heh) etc.

dwattttt 5mo ago

If you think Linux is on their first or second, I'm not sure how or what you're counting.

doublerabbit 5mo ago
> I'm not sure how or what you're counting. The recent two. FailCopy and DirtyFrag and FreeBSD with Execve. 2 - Linux 1 - FreeBSD. Of course, all OS have had past-time exploits. Three now have made the news.
- dwattttt 5mo ago
  Your question was "how many high profile privilege escalations Windows has had recently" then? I can't think of any, 0?
  - gdgghhhhh 5mo ago
    https://nvd.nist.gov/vuln/detail/CVE-2026-21250 https://nvd.nist.gov/vuln/detail/CVE-2026-21250
  - doublerabbit 5mo ago
    It was a sarcastic joke, never mind.
  - GoblinSlayer 5mo ago
    Windows vulnerability list is overflowing with lpes, hundreds of them. You should filter it per month, the list is too big to load in full.
- nubinetwork 5mo ago
  > 2 Linux Three. I don't know if this has a name yet... https://news.ycombinator.com/item?id=48067734 https://news.ycombinator.com/item?id=48067734