News for hackers. Stuff that matters.
Re:Think Windows is insecure? You're wrong, says security fi... by oconnore on Saturday August 13, 2011 @01:44PM (#2881478)
People who say Windows is insecure aren't comparing it to Flash or Java, they are comparing it to OS X, Linux, or *BSD. Without addressing that comparison, this article is useless.
Re:Think Windows is insecure? You're wrong, says security fi... by tptacek on Saturday August 13, 2011 @02:21PM (#2881581)
Windows is comparably secure to Linux and OS X.

This stuff is hard to pin down; for instance, there's a lot of hardening you can (but most people do not) do on Linux, and Lion changes the game on countermeasures for OS X. So it's a uniquely bad time to try to resolve this controversy decisively. But it's also hard to ignore the fact that much of what Lion is doing was pioneered in WinAPI.

(I'm an OS X user; also, I do systems software security).

Whether Windows (Vista+) is safer than Linux is up for debate. But safety and security are different concepts.

Re:Think Windows is insecure? You're wrong, says security fi... by niels_olson on Saturday August 13, 2011 @03:45PM (#2881808)
> safety and security are different concepts

I did anti-terrorism in the military for awhile and I totally agree, but I would love to read the great tptacek's breakdown of the differences.

Re:Think Windows is insecure? You're wrong, says security fi... by StavrosK on Saturday August 13, 2011 @04:37PM (#2881930)
I'm not tptacek, but I think it's mostly clear that a castle in Compton is more secure than a cottage in a village in the Alps, but less safe.
Re:Think Windows is insecure? You're wrong, says security fi... by cosgroveb on Saturday August 13, 2011 @04:45PM (#2881955)
I believe I've seen tptacek say a liquor store in Englewood, Chicago with bulletproof glass in front of the cashier is more secure than a 7-11 in Lincoln Park, but the 7-11 is safer. Or something like that. :)
Re:Think Windows is insecure? You're wrong, says security fi... by StavrosK on Saturday August 13, 2011 @04:45PM (#2881958)
Oh, hm. Sounds like I was close, then :)
Re:Think Windows is insecure? You're wrong, says security fi... by tptacek on Saturday August 13, 2011 @05:19PM (#2882033)
This is a weird little thread right here.
Re:Think Windows is insecure? You're wrong, says security fi... by udp on Saturday August 13, 2011 @03:02PM (#2881697)
It's amusing that Windows only recently introduced both real home folders and UAC, when *nix had been working like that for years.

Imagine how much trouble could have been avoided if MS had used that model in the first place...!

Re:Think Windows is insecure? You're wrong, says security fi... by tptacek on Saturday August 13, 2011 @05:21PM (#2882037)
Home folders and UAC have very little to do with the real-world security of Windows vs. other operating systems. The reality is, even today, if you get arbitrary code execution on any operating system you are probably boned.
Re:Think Windows is insecure? You're wrong, says security fi... by udp on Saturday August 13, 2011 @06:14PM (#2882130)
Even when arbitrary code is being executed, if the user has limited permissions kernel-level, a program can't screw up the whole system.

The Android NDK is reliant on this - any application in Android can perform your arbitrary code execution, and it seems to be working out alright.

Re:Think Windows is insecure? You're wrong, says security fi... by oconnore on Saturday August 13, 2011 @07:05PM (#2882227)
The kernel is not some almighty bug free program. The question is then just whether or not the person who has gained the capacity to run code on your system knows an exploit that will give them root privileges.

The Android thing works because you aren't just running arbitrary code, you are probably running code that you got from the Android Marketplace, which was probably screened to make sure it doesn't do something bad.

Re:Think Windows is insecure? You're wrong, says security fi... by udp on Saturday August 13, 2011 @07:18PM (#2882261)
How would they be screened? If you include native libraries in your APK, they're binaries, not code. They could scan the binary for API calls, but you're permitted to call dlopen() etc, so you could always hide a shared object in there and call it dynamically.
Re:Think Windows is insecure? You're wrong, says security fi... by aidenn0 on Saturday August 13, 2011 @11:44PM (#2882740)
Okay, you can't screw up the whole system, but you can install a keylogger (X has got to be the most insecure windowing system out there), and you can use the system for a DDoS botnet.

Also if you use sudo or su in X, they now have root thanks to the keylogger.

Re:Think Windows is insecure? You're wrong, says security fi... by kabdib on Sunday August 14, 2011 @02:06AM (#2882912)
And with threaded code attacks you don't even need to download an executable. You can run "script level" code by repurposing existing executable sequences.

Security is hard.

Re:Think Windows is insecure? You're wrong, says security fi... by etha on Saturday August 13, 2011 @04:11PM (#2881868)
If people cared about "we did x first" as a reason why some software is better, everyone would be browsing with Opera. What matters is how well they do something now.
Re:Think Windows is insecure? You're wrong, says security fi... by StavrosK on Saturday August 13, 2011 @04:40PM (#2881940)
I can't imagine how bad the guys from Opera must be feeling, when everyone points to them as an example of a pioneer, yet nobody actually uses Opera (a startup once called me "their Opera user")...
Re:Think Windows is insecure? You're wrong, says security fi... by lukeschlather on Saturday August 13, 2011 @04:44PM (#2881954)
Windows XP is still supported, and even if I wanted to run Windows 7, it's too bloated to run on fully a third of the hardware in my organization (and that's just counting x86 desktop/laptops.) Windows XP is a problem, and Microsoft hasn't solved it.
Re:Think Windows is insecure? You're wrong, says security fi... by serge2k on Saturday August 13, 2011 @04:54PM (#2881980)
Yes, they have. The solution is called windows 7.

The only problem is people refusing to upgrade from a decade old OS.

Re:Think Windows is insecure? You're wrong, says security fi... by lukeschlather on Sunday August 14, 2011 @02:16PM (#2884105)
I'm talking about machines which barely fit the minimum specs for Windows XP - I guess this is hard for you to grasp, but some people can't afford to buy a $300 netbook when they have a perfectly functional desktop from 6 years ago.

Also, we have several applications which, while they will run on Windows 7, they simply do not run well. From a business standpoint, it's really hard to justify an upgrade that results in reduced functionality in the name of security. I can clean up after malware pretty quickly - people working with outdated but business-critical applications lose hours of their days when software starts acting up because it wasn't written with a good security model in mind and it's being forced into that environment.

You can say Windows 7 solved the problem all you want, but there remain countless areas where Windows XP is required, and virtualization is not a magic bullet - networking is always tricky. And in any case, we do all that work of migration and what do we gain? Exactly what we have right now, except with hardware accelerated graphics that don't support all our hardware and some difficult to quantify reduction in malware attacks.

Re:Think Windows is insecure? You're wrong, says security fi... by sukuriant on Saturday August 13, 2011 @06:10PM (#2882127)
What sort of hardware are you running? Windows 7 runs on netbooks!
Re:Think Windows is insecure? You're wrong, says security fi... by lukeschlather on Sunday August 14, 2011 @02:12PM (#2884097)
5-7 year old hardware. This is an affluent community - I know it's unusual to think about it here but some people absolutely cannot afford to upgrade. I'm talking about hardware that barely meets the minimum specs for XP.

I'm not one of them, but I see them every day. Windows 7 does not solve the Windows XP problem. (The Windows XP problem will be solved when any given computer can run Windows 7 easily.)

Re:Think Windows is insecure? You're wrong, says security fi... by bediger on Saturday August 13, 2011 @02:06PM (#2881538)
This is Preston Gralla writing. As near as I can tell, that's as good as saying it's a Wag-Edd press release.
Re:Think Windows is insecure? You're wrong, says security fi... by kenjackson on Saturday August 13, 2011 @02:37PM (#2881623)
Funny, I've always Preston Gralla as anti-Microsoft. At least in the past year, his anti-MS articles easily outnumber his pro-MS articles.
Re:Think Windows is insecure? You're wrong, says security fi... by pierreminik on Saturday August 13, 2011 @04:22PM (#2881899)
Criticism does not mean being "anti". It does sometimes but if it's a complex issue and people take their time to understand it's various aspects, the critics are usually never "anti".

From Windows 95 I was hooked on GUI's. I didn't like Microsoft but I liked Windows. I'd almost never care enough about Microsoft to say anything but when it came to Windows I always had an opinion I'd want to air and it was always in the spirit of wanting an improved product. Mac OS 9 felt like a joke and the various Linux distributions felt unfinished.

But eventually I changed to OS X when one of it's later "kitties" came out. Among my friends who have a Mac I'm pretty much the first to ever criticize Apple products but if you look at how much money I spend on the platform and how much time I invest learning about it you wouldn't think I was a critic. I don't have opinions about Windows beside wishing IE wasn't such a pain to design for.

Being critical does not equal being against something. When your critics no longer want to share their opinion of your product or service, that's when you should be truly scared. That is when you're in a really, really bad place.

Re:Think Windows is insecure? You're wrong, says security fi... by kenjackson on Saturday August 13, 2011 @05:08PM (#2882010)
Fair enough. But Preston Gralla is certainly not like a walking MS PR firm. Compare and constrast Preston's stories with someone like John Gruber for Apple. Gruber has written maybe 100 blurbs about Apple in the past year and maybe one that was critical. Daniel Dilger is basically the same -- except maybe he hasn't yet written the critical Apple article yet.

Preston OTOH regularly writes critical MS articles, more often than he writes those that defend MS.

The author who refered to Preston as the equivalent of an MS PR firm doesn't know his history well.

Re:Think Windows is insecure? You're wrong, says security fi... by pierreminik on Saturday August 13, 2011 @10:53PM (#2882634)
I don't really follow any tech writers and my remarks are probably pretty off topic but I think it's important to recognize the differences. To some it might just be semantics but for others it's a whole world in difference because it affect their lives.

My comment is merely meant as an insignificant resistance towards the uprising of the misunderstood reflector and doubter. Far too often are people promoting division with it's constant "us"-and-"them"-rhetoric and "Either you're with us or against us"-policy. It's healthy to doubt and question.

It's exactly how hacktivists such as Anonymous are alienated and how projects such as WikiLeaks is attempted to be criminalized. Whistleblowers are not the enemy nor the ones threatening the safety of the people.

Re:Think Windows is insecure? You're wrong, says security fi... by barista on Saturday August 13, 2011 @07:21PM (#2882271)
But isn't he just reporting Kaspersky's finding. Unless you are saying those are PR too...