3 ms·
This is classic Microsoft: give up on securing the underlying system and layer kludgy temporary 'fixes' on top that break standards and functionality. Not so m
by petewarden 17y ago
This is classic Microsoft: give up on securing the underlying system and layer kludgy temporary 'fixes' on top that break standards and functionality.
Not so much security through obscurity, as security through making the system hard to use for everyone! See also Vista's UAC...
- tptacek 17y agoI'm pretty sure you have no idea what you're talking about. Not securing the "underlying system" is not one of Microsoft's problems. No company in the entire industry spends more per line of code shipped or per developer on security than Microsoft; it would not surprise me to find out that Minesweeper got a security architecture review, a line-by-line security code review, and a penetration test before it was last shipped. Your comment added no information. If GUID URLs are "kludgy", explain why they're kludgy. If something about ASP.NET is fundamentally insecure, explain how it's insecure. (I say all this as a devoted Mac user).
- kirse 17y agoI always enjoy when you come into the security threads on HN, call everyone out on their BS and set the record straight. Keep up the good work. =)
- sp332 17y agoSee johns' earlier comment on why it's insecure and kludgy: http://news.ycombinator.com/item?id=706329 http://news.ycombinator.com/item?id=706329
- tptacek 17y agoYou are citing sample code in an MSDN article to defend an argument that the ASP.NET stack is insecure and kludgy (even if you don't realize it, because you haven't really read the comment thread).
- sp332 17y agoI just misinterpreted what petewarden meant by "underlying stack". I thought he meant the particular website in the article, I see now he meant ASP.NET instead.