6 ms·

No, I think in the FSF's eyes -- rightfully -- it can't be proven that security has improved. I also can't agree that it isn't related. If I tell you I'm weari

No, I think in the FSF's eyes -- rightfully -- it can't be proven that security has improved. I also can't agree that it isn't related. If I tell you I'm wearing a green shirt, how can you know for sure if you or someone you trust hasn't verified it? You can't. It's the same with MSFT. But in the case of MSFT, it has been proven that they wear a lot of Hypercolor[1] stuff. Is it good that MSFT is doing stuff to make things more secure? Sure. Do we still have to take it on faith that they are doing everything they can to protect their users? Yup. [1]http://en.wikipedia.org/wiki/Hypercolor http://en.wikipedia.org/wiki/Hypercolor

criley2 13y ago
So, Microsoft and its Windows product adheres to no industry standards, has no external audit process, has never been verified by a private or Government contract agency through audit or other verification process? I work in a small programming company and we do internal and external audits while maintaining compliancy with federal and state regulators as well as groups like ISO. Sure, our work is closed source, but that doesn't automatically mean it hasn't been externally verified for a number of different things by a number of different organizations...
- obituary_latte 13y ago
  No, I did not say those things. That aside, if you wanted to, after an audit/review concluded, could you put a backdoor in your software? Since it's closed source, would anyone know about it?
  - venomsnake 13y ago
    In deterministic build? It will be very hard. I doubt that any audit signs on anything other than specific versions.
    - throwaway2048 13y ago
      does microsoft use deterministic builds?
  - andrewfong 13y ago
    If there's a deterministic build process, in theory, the auditor would know something was up if the binary differed.
  - riquito 13y ago
    There are these things called signed binaries...
    - danbruc 13y ago
      But signing binaries does not prove from which source the binaries have been build, only who did it.
- rbanffy 13y ago
  > Sure, our work is closed source, but that doesn't automatically mean it hasn't been externally verified for a number of different things by a number of different organizations... Yes, but we have to take your word for it.
  - danbruc 13y ago
    As mentioned below, a software being secure and the ability to convince yourself that a software is secure are two different things.
- belorn 13y ago
  Audit and verifying the security of software the size of Microsoft Windows without source code is like auditing and verifying the security of the international space station with only the help of a hand held telescope. Sure, it looks like its not leaking air. It has not dropped down to earth yet, and all the videos posted on their website looks to show it being fine. However, if I ever went there and depended on its security, I would demand more.
- the_af 13y ago
  If a piece of proprietary/close source software gets audited by an external agency, any of the private actors involved can be involved in deception (the authors of the software, the auditing company and the government or whatever). They can all be in collusion. This would have sounded like a conspiracy theory before recent discoveries, but now we've seen this can actually happen. Whereas if the source is open, and you are a subject matter expert (yes, that's a big if), you can review the source yourself. You can decide for yourself whether the software has an NSA backdoor, an innocent flaw or whatever. Yes, a lot of people, myself included, don't have the technical background to do this. But with open source we could, if we had the knowledge (which can be learned), without relying on potentially compromised authorities. With closed source we simply can't. We have to trust the auditors and the government, which have been shown to be unreliable.
deleted 13y ago
[deleted]

criley2 13y ago

So, Microsoft and its Windows product adheres to no industry standards, has no external audit process, has never been verified by a private or Government contract agency through audit or other verification process? I work in a small programming company and we do internal and external audits while maintaining compliancy with federal and state regulators as well as groups like ISO. Sure, our work is closed source, but that doesn't automatically mean it hasn't been externally verified for a number of different things by a number of different organizations...

obituary_latte 13y ago
No, I did not say those things. That aside, if you wanted to, after an audit/review concluded, could you put a backdoor in your software? Since it's closed source, would anyone know about it?
- venomsnake 13y ago
  In deterministic build? It will be very hard. I doubt that any audit signs on anything other than specific versions.
  - throwaway2048 13y ago
    does microsoft use deterministic builds?
- andrewfong 13y ago
  If there's a deterministic build process, in theory, the auditor would know something was up if the binary differed.
- riquito 13y ago
  There are these things called signed binaries...
  - danbruc 13y ago
    But signing binaries does not prove from which source the binaries have been build, only who did it.
rbanffy 13y ago
> Sure, our work is closed source, but that doesn't automatically mean it hasn't been externally verified for a number of different things by a number of different organizations... Yes, but we have to take your word for it.
- danbruc 13y ago
  As mentioned below, a software being secure and the ability to convince yourself that a software is secure are two different things.
belorn 13y ago
Audit and verifying the security of software the size of Microsoft Windows without source code is like auditing and verifying the security of the international space station with only the help of a hand held telescope. Sure, it looks like its not leaking air. It has not dropped down to earth yet, and all the videos posted on their website looks to show it being fine. However, if I ever went there and depended on its security, I would demand more.
the_af 13y ago
If a piece of proprietary/close source software gets audited by an external agency, any of the private actors involved can be involved in deception (the authors of the software, the auditing company and the government or whatever). They can all be in collusion. This would have sounded like a conspiracy theory before recent discoveries, but now we've seen this can actually happen. Whereas if the source is open, and you are a subject matter expert (yes, that's a big if), you can review the source yourself. You can decide for yourself whether the software has an NSA backdoor, an innocent flaw or whatever. Yes, a lot of people, myself included, don't have the technical background to do this. But with open source we could, if we had the knowledge (which can be learned), without relying on potentially compromised authorities. With closed source we simply can't. We have to trust the auditors and the government, which have been shown to be unreliable.

deleted 13y ago

[deleted]