3 ms·

I have a feeling that a clone of windows 2000 is going to have some hilari-bad security bugs...

by sudioStudio64 11y ago

jeditobe 11y ago
Actually, at the current moment ReactOS is clone of Windows 2003, not the 2000. That is the big difference!
- sudioStudio64 11y ago
  I know this position isn't popular, but I don't think that will help. They are reverse engineering a really complicated system. Do you think that they have the same kinds of controls that it took MS literally a decade and millions of to dollars develop?...Controls that that were expensive in time and money that then only improved their development to the extent that it has? (far, far from perfect.) Maybe...and this is a big maybe...there is a enough of a difference between react and windows that normal windows bugs won't be surfaced. I'm curios as to whether they support NX, ASLR, or 64 bit? Even if they don't copy the system bug for bug they may be trivially exploitable just because they don't have the resources to harden it.
Pi_User5 11y ago
ReactOS is free and open source and is released under the GPL license so anyone can see the source code.
- sudioStudio64 11y ago
  Open source only makes bugs shallow if lots of people are using the software and reviewing the code. OpenSSL is a great example of code that lots of people ended up using but not reviewing that had/has many issues. I'm not saying anything negative about open source...I'm just saying that its more complex than just having code available.
airza 11y ago
yeah, i mentally multiply "Rewriting a project" times "reverse engineering is hard" and see a lot of exploitable material probably lurking somewhere in there...
- Someone1234 11y ago
  ReactOS isn't reverse engineered or rewritten from Windows 2000. It was a cleanroom re-engineering of compatible Windows APIs. And a lot of their work got back-ported (and visa-versa) into Wine. ReactOS may very well have bugs, security issues, and similar. But those have nothing to do with the fact that it is designed to be compatible with Windows APIs.
  - geon 11y ago
    Aren't they implementing it one .dll at a time, though? Meaning, they still need a lot of the original MS binaries to work?
    - alexi5 11y ago
      Not just DLL after DLL. MS DLLs of course are not included in ISO releases. Nor they could come under license of the releases. They though might work, but they not necessarily are tested nor they are planned to be used.
  - airza 11y ago
    There isn't a lot of difference between "rewriting this in another language" and "cleanroom rewrite" as far as getting burned by the same corner cases in the same languages go. I get what you're saying, though.

I have a feeling that a clone of windows 2000 is going to have some hilari-bad security bugs...

jeditobe 11y ago

Actually, at the current moment ReactOS is clone of Windows 2003, not the 2000. That is the big difference!

sudioStudio64 11y ago
I know this position isn't popular, but I don't think that will help. They are reverse engineering a really complicated system. Do you think that they have the same kinds of controls that it took MS literally a decade and millions of to dollars develop?...Controls that that were expensive in time and money that then only improved their development to the extent that it has? (far, far from perfect.) Maybe...and this is a big maybe...there is a enough of a difference between react and windows that normal windows bugs won't be surfaced. I'm curios as to whether they support NX, ASLR, or 64 bit? Even if they don't copy the system bug for bug they may be trivially exploitable just because they don't have the resources to harden it.

Pi_User5 11y ago

ReactOS is free and open source and is released under the GPL license so anyone can see the source code.

sudioStudio64 11y ago
Open source only makes bugs shallow if lots of people are using the software and reviewing the code. OpenSSL is a great example of code that lots of people ended up using but not reviewing that had/has many issues. I'm not saying anything negative about open source...I'm just saying that its more complex than just having code available.

airza 11y ago

yeah, i mentally multiply "Rewriting a project" times "reverse engineering is hard" and see a lot of exploitable material probably lurking somewhere in there...

Someone1234 11y ago
ReactOS isn't reverse engineered or rewritten from Windows 2000. It was a cleanroom re-engineering of compatible Windows APIs. And a lot of their work got back-ported (and visa-versa) into Wine. ReactOS may very well have bugs, security issues, and similar. But those have nothing to do with the fact that it is designed to be compatible with Windows APIs.
- geon 11y ago
  Aren't they implementing it one .dll at a time, though? Meaning, they still need a lot of the original MS binaries to work?
  - alexi5 11y ago
    Not just DLL after DLL. MS DLLs of course are not included in ISO releases. Nor they could come under license of the releases. They though might work, but they not necessarily are tested nor they are planned to be used.
- airza 11y ago
  There isn't a lot of difference between "rewriting this in another language" and "cleanroom rewrite" as far as getting burned by the same corner cases in the same languages go. I get what you're saying, though.