Since this subthread turned into an off-topic flamewar, we detached it from https://news.ycombinator.com/item?id=10588972.

Saying it is false and calling views "distorted" does nothing to further the conversation. If you're interested in furthering conversation on the subject try providing reasoning behind your statements instead of condescension.

Perhaps you could explain how the statement "All software is large" "furthers the conversation"? How am I supposed to respond to that?

You think that false statement is a respectable "response" to a comment on the benefits of small software?

Small software exists both in the past (when memory and storage were more limited) and in the present. The very idea of small programs is a foundational one in the field of computing.

"All software is large" is not a "view" that is in agreement with reality. As such, it is distorted.

I am using small software every day. In fact I am writing this comment with a small program. When I write software, it is small, at least relative to anything from Microsoft.

I am too dumb to write large software.

The point is small software just does less; when you need to do more you either build large software or you put together a bunch of small software which is effectively, from a security standpoint, the same thing.

Small programs that don't do anything are secure but nobody cares.

And you've probably written software larger than Notepad; a very popular small Microsoft program.

In contrast to others, this is a comment that reflects truth.

The only points I would contest are 1. that "a bunch" is effectively the "same thing" as large software. A "bunch" can vary in number and quality. My userland is a single "multi-call" binary and quite small. The sum total of source code is not so large that I cannot manage it. It's keeping tabs on the kernel code that presents the challenge; and 2. that "nobody cares".

If "nobody" cared, then you would not be seeing a comment such as mine because there would be nobody to author it.

Moreover there would be no reasonably small kernel source that users like me could use. Some people care enough to maintain that kernel and to keep it relatively small.

Maybe that group of people is like the software: small. Suits me just fine.

> In fact I am writing this comment with a small program.

Which small program is that?

Are you saying you are unaware of any program that can post text to a web server that is "small"?

If all you are aware of is large software, then your statement that "All software is large" makes more sense.

"All software is not as large as Microsoft's software."

Would you agree with that?

I'm also interested in the answer to their question instead of these diversions.

Windows is actually very modular; even the kernel is designed in a micro-kernel style even though it all runs in ring 0. There are versions of Windows with no GUI.

Every other comparable operating system is in the same order of magnitude in the size of the code. The attack surface for any large OS is going to be about the same.

"There are versions of Windows with no GUI."

Do they run in VGA textmode?

I have used a program called "window" and today I use tmux but neither of those come from Microsoft.

How do I obtain one of these versions of Microsoft Windows that runs in VGA textmode?

"The attack surface for any large OS..."

Well yes, because they are all large. But what if the OS is small?

Let me guess, now you are going to tell me that all OS, e.g., kernel plus userland, are the same size?

Of course, not all OS kernel plus userland are the same size. However, we aren't talking about "smaller" we are talking about "small". Small being something you can write and/or fully understand. If you wrote your kernel and userland or at least understand every part of it then, congratulations, you made your point. But if you don't, your OS/userland is smaller but it isn't small.

And probably most developers could write an OS/userland by themselves given enough time but it would probably be a long time before it's practically useful or secure.

Alright, I think we have reached agreement.

Software that is "smaller" than Microsoft Windows.

It exists.

I prefer such "smaller" software and use it every day.

For me, it is "practically useful". I regularly see others stating it is useful for them, too.

Have no idea what "secure" means in the abstract, but maybe smaller software and the way it is used can be "more secure" (or less secure) than Windows.

"Fully understand" is a very high watermark to reach with any system. But given the choice between a larger system that is opaque and one that is smaller and open source I believe I can (partially) understand the smaller one better.

My point is all software is large; even Linux combined with it's user-land is large. Larger than Windows was a while back. What you prefer is pretty immaterial to the discussion; you choice is perfectly valid even though I would personally find it wasteful.

I do not use Linux on a day to day basis as I said multiple times in these threads, nor do I consider the popular Linux distributions as a good example of small(er) software. They keep getting larger.

Some have said the larger Linux distributions aim to be a "replacement" for Windows. I would tend to agree. I have little interest in Windows nor the "desktop" metaphor.

But, at least with an open source kernel such as Linux (aside from the binary blobs), unlike closed source Microsoft Windows kernel, a user can reduce the size.

One can also use an initrd with her own small(er) programs or a mutli-call binary instead of a GNU userland put together by a third party organization.

I have never compiled my own reduced size Windows kernel or any other part of Windows given that it is a _closed source kernel_. The idea that I am even having to state seems ridiculous. Most everyone reading this forum knows this. This whole "discussion" is surreal.

Funny that you use the word "wasteful". That is exactly how I view large(r) software. It wastes valuable resources that, on my systems, are in limited and often short supply.

The reason I mentioned what I prefer was to disclose bias. Certainly everyone has one.

The reason I mentioned what I use was only to provide example, to illustrate that such small(er) software exists. Again, the idea I even have to state this, to someone on this forum, seems surreal.

There are alternatives to Windows and to Linux distributions, at least in my case. I know for fact I am not the only one using small(er) software, but I am not comfortable speaking for others. What software they choose to use is their business, not mine.

No matter how small of a Linux (or other kernel) you compile, as long as it's runnable on a modern system, it's vastly more complicated that almost any other human machine. A minimal kernel is still more complicated than your car, a jumbo jet, etc. Usually well beyond the ability to be certain it has no security flaws.

Elements of your userland might be easy to understand but combine them and you have yet another highly complex machine.

Programmers 30 years ago would be totally amazed at the size of your "small" software.

As for wasteful, I have vastly more computing power than I need -- data is huge but most software, even Windows, is comparatively small. You can run versions Windows on machines that cost just a few dollars. I can virtualize and run multiple operating systems at once on a single machine without breaking a sweat. I also have 2 high resolution 24" monitors which I'm not going to waste on VGA text mode.

Maybe you have a very poor understanding of your systems, or you have given up trying to understand them.

Or maybe you think that because any attempts at understanding systems are in your opinion "difficult", other users should "give up" and leave everything to some company like Microsoft.

Or maybe there is some other explanation. I don't know.

I am not sure why it matters to you how someone else chooses to use their own hardware, or what software they choose to use.

Not sure I really want to know. But I think you are wasting your time.

Your systems are larger and more complicated than they have to be. You have admitted it. You also admit your systems are full of flaws, and it does not sound like you are expending any effort to find and fix them.

Now you are telling me the size of your monitors. Who cares? If you see all software as "large" and "complex", then that is how you see it. So what? What does this have to do with anything?

I started these threads because Microsoft ran an article in the NYT about greater "security". But it's still closed source. Microsoft does not let users unconditionally review nor trim the size of the code.

If you think Windows is the best option for you, then go right ahead and keep using it to the exclusion of anything else. I'm not trying to persuade you to do anything. Do whatever you want. I wish you all the best.

But spare me the comments. I do not follow your reasoning, or whatever point you are trying to make, and I'm not interested.

Why didn't you just answer the question? Which small software are did you use to post your comment? Why be so vague?

What difference does it make what small software program I am using?

You do not believe such a program exists?

Or maybe you want to critique the program? That would be typical commenter behavior, but it is totally irrelevant to the discussion.

The topic is Microsoft software and the relationship between code size and probability of security flaws.

> What difference does it make what small software program I am using?

You brought it up and now you don't want to say, I find that odd. It's hard to have a conversation if you're going to be so.. cryptic.

> Or maybe you want to critique the program?

Maybe I want a significant example of a "small program". At this point, neither terms have been well defined. You called the program used to make your comment "small" so tell me what it is.

> The topic is Microsoft software and the relationship between code size and probability of security flaws.

The greater the code size the greater the probability of bugs. And security flaws can be exploited utilizing the combined flaws across different independent programs or included libraries.

My point is the only programs so small that security issues are a non-issue are either not interesting or combined with other programs to do something useful.

"The greater the code size the greater the probability of bugs."

Right. I think we are done here.

Microsoft Windows is larger than any OS I know of, and only keeps growing.

To answer your question, I am using a text only browser that's based on the links project, with my own minor modifications.

I still have no idea why you and the other commenter are asking. It seems quite clear neither of you have any legitimate interest in such programs. Otherwise you would not be challenging my statement of such a simple fact as the quoted sentence above, as it applies to Microsoft.

I strongly disagree that "small" programs are not useful. As I have previously stated, I use them every day. I use programs such as sed and netcat to interact with the www even more than I use a browser.