5 ms·
While I agree with his viewpoints, I just can't take a security professional (or CTO) seriously who uses Windows as their primary machine.
by strict9 13y ago
While I agree with his viewpoints, I just can't take a security professional (or CTO) seriously who uses Windows as their primary machine.
- tptacek 13y agoSo basically you don't take something like 3 of the top 5 vulnerability researchers in the world seriously.
- casca 13y agoCan you please explain why? Is there some evidence you have that shows that Windows is less secure than any other OS? Please take into account the huge market share which means that malware writers will spend a disproportionate amount of time developing for Microsoft systems. Also, people who run other Operating Systems tend to be more technically skilled than people using Windows. This is not to excuse Microsoft, they could certainly do better. But so could Apple and Debian.
- strict9 13y agoMy remark was certainly flippant. It was a gut reaction to statements he's made about a Linux machine as the best bet (see his interview with VICE), but yet he still primarily uses Windows. I think there's a lot to be said for those who practice what they preach rather than sticking with a lesser option out of convenience.
- casca 13y agoPerhaps he's more skilled at Windows than at Linux? In which case, if he were to switch to a platform that's unfamiliar, he would be more likely to make an error that would lead him to being vulnerable. I'd suggest that by using a platform that he knows how to make secure rather than one he's unfamiliar with, he is acting in the best way to ensure the security of his device.
- samstave 13y agoMaybe they have done what is required to fully secure the box? (Short of removing whatever BD NSA might actually have in windows ;-) )
- venomsnake 13y agoI really doubt the fact that NSA have direct backdoor in windows. A lot of countries will treat it as casus belli.
- dragonwriter 13y ago> I really doubt the fact that NSA have direct backdoor in windows. A lot of countries will treat it as casus belli. Against the US? I doubt it. Countries sometimes fail to treat actual armed intrusions without local consent by the US as casus belli because of the imbalance in military power, and you want me to believe that there are "a lot" of countries that will treat a backdoor in Windows as an excuse for war?
- tptacek 13y agoI doubt that NSA has a Microsoft-complicit backdoor in Windows, but would be amazed to find out that they didn't have its functional equivalent. For any given mainstream OS, assume NSA can own it up at will.
- venomsnake 13y agoI am absolutely sure they can enter almost anything not behind solid air gap.
- samstave 13y agoDoesn't that contradict your previous post?
- georgemcbay 13y agoNot the way I read it. The previous post seems to be suggesting the NSA doesn't have some backdoor into Windows that Microsoft put there for them explicitly, while the followup suggests that even without such an explicit backdoor, one should assume the NSA can take control of just about any system with a network connection (which is probably not explicitly true, but is true enough that you should just assume it). The second suggestion being they (the NSA) have a (likely lengthy) list of exploits found in common OSes (and/or firmware or CPU microcode) that they have never divulged and that they have discovered like any external security research would have (albeit one with a very large budget and a very strong incentive to find such control vectors).
- venomsnake 13y agoListen to what I say, don't do as I do. Also there are very good reasons for using windows - dogfooding your own security solutions, fact that a lot of threats are targeting windows machines and the fact that he is not a high profile target (or wasn't before the NSA stuff) so no one will waste undisclosed zero day on him.