News for hackers. Stuff that matters.
Re:Windows 0day privilege escalation still not fixed by mwcampbell on Wednesday December 23, 2020 @07:40PM (#25524007)
Having gone from sole developer at a tiny company to a developer at Microsoft (and now back again), I'd like to propose a corollary to Hanlon's Razor: Never attribute to either malice or incompetence what can be explained by complexity that you don't know about.
Re:Windows 0day privilege escalation still not fixed by bawolff on Wednesday December 23, 2020 @08:04PM (#25524143)
Isn't allowing complexity to grow to such an extent that you cannot fix critical bugs in a reasonable amount of time a form of incompetence?
Re:Windows 0day privilege escalation still not fixed by natpalmer1776 on Wednesday December 23, 2020 @08:17PM (#25524221)
In my view, it is a form of incompetence so common and, in practice essential for growth as a business that it has become a ubiquitous baseline against which we should strive to differentiate ourselves from.

It is complexity that is accepted in small amounts across dozens of projects over many years. Projects that add real value to the business while contributing to this invisible debt that from the business point of view, matters only once it has started directly affecting your revenue.

Eventually an organization can't scale without a major refactoring, rewrite, or an entirely new market vertical.

Re:Windows 0day privilege escalation still not fixed by martamorena284 on Wednesday December 23, 2020 @11:14PM (#25525003)
It's simply not economically viable to build software at the scale of windows without such issues. There are thousands of teams (not people) working on it and hundreds of thousands of people over the lifetime of the software. Even companies like Microsoft have pressure to deliver on time and be frugal, not just startups.

Incompetence is to spend too much time making software into a golden, egg laying donkey. As is building software that becomes impossible to change after a couple of years. Finding the fine line in between these extremes is what professional software engineering is all about.

Re:Windows 0day privilege escalation still not fixed by bawolff on Wednesday December 23, 2020 @11:49PM (#25525136)
Which is why there is a bussiness cycle, where every once in a while a startup will wipe the floor with a big inflexible competitor despite not having even a thousandth of the resources.
Re:Windows 0day privilege escalation still not fixed by pjmlp on Thursday December 24, 2020 @03:43AM (#25525977)
Or just end being bought by the competitor and turned into yet another of their departments.
Re:Windows 0day privilege escalation still not fixed by extropy on Thursday December 24, 2020 @11:13AM (#25528718)
That's organizational incompetence not technical one however.

IMO there is no good fix for that past certain company size.

Re:Windows 0day privilege escalation still not fixed by smt88 on Thursday December 24, 2020 @10:17AM (#25528151)
It's impossible to have software as massive as Windows with 30+ years of backward compatibility that is not extremely complex.
Re:Windows 0day privilege escalation still not fixed by tamrix on Friday December 25, 2020 @09:02AM (#25536529)
Your comment is about 20-25 years too late.

Most of these problems are likely contributed to legacy code and backwards compatibility.

Re:Windows 0day privilege escalation still not fixed by LASR on Wednesday December 23, 2020 @11:41PM (#25525106)
You’re talking about Microsoft.

It takes me a couple of lines of code now to spin up a web server than can handle thousands of connections. Or an app with beautiful fluid UI.

But I remember that I am standing on the shoulders of giants. What seems like zero complexity to someone on the shoulder is actually not.

Sometimes the giants fuck up too. Ultimately it is incompetence. But not the kind that is attributable to laziness or stupidity. Engineers at Microsoft, I would assume are like engineers everywhere - no smarter, no dumber.

Just because I can build a Lego bridge perfectly, doesn’t make the guys who’ve built an imperfect actual bridge are incompetent. They’re just solving very different problems.

Re:Windows 0day privilege escalation still not fixed by webmaven on Thursday December 24, 2020 @06:35PM (#25532640)
It sounds like what you are saying is that over the long term, there are no competent developers or organizations.

Or perhaps that due to survivorship bias, the evidence for incompetence that we see sticking around longest is also the most pathological.

Re:Windows 0day privilege escalation still not fixed by konjin on Wednesday December 23, 2020 @10:11PM (#25524733)
I have a modification to Hanlon's Razor: anyone who invokes it is both.
Re:Windows 0day privilege escalation still not fixed by isatty on Thursday December 24, 2020 @01:43AM (#25525517)
Except the user of a commercial application does not need to know about the complexity. They just care if a security loophole is fixed.
Re:Windows 0day privilege escalation still not fixed by TwoBit on Wednesday December 23, 2020 @10:44PM (#25524857)
This is very true. So often I hear people arguing that something surely is simple to do and obviously people are idiots for not being able to, all while having no idea whatsoever about the system to which they are referring.
Re:Windows 0day privilege escalation still not fixed by sinsterizme on Wednesday December 23, 2020 @11:40PM (#25525102)