6 ms·

https://mobile.twitter.com/hashbreaker/status/853224169412206593?p=p https://mobile.twitter.com/hashbreaker/status/85322416941220... The strange "counterargume

by gwu78 9y ago

https://mobile.twitter.com/hashbreaker/status/853224169412206593?p=p https://mobile.twitter.com/hashbreaker/status/85322416941220... The strange "counterargument" I commonly see on HN to any suggestion that Microsoft closed source software could potentially be unsafe for use on an internet-connected computer is that the company has "improved" since some earlier 1990's/2000's time period. Are these commenters suggesting that other, open source operating system choices have not also improved since that time period? Should one consider how much did each respective system need to improve? (By "other, open source operating system choices", I mean the ones that were able to connect to the internet for years before Gates decided the www was something his company should be interested in and to copy the TCP/IP stack from an open source kernel into the Windows kernel). Are there convincing arguments why Microsoft deserves special treatment compared to the open source alternatives, i.e., why their users should not be permitted to freely evaluate the Windows kernel or Office source code via the public web? Are there compelling reasons why MS users should not be allowed i.e. given the option to edit/remove source code they are uncomfortable with and recompile? Consider the effects of limiting the number of people who can find and fix defects in a product. Does closed source status of Windows make Microsoft's software superior to the longstanding open source operating system alternatives?

jmcdiesel 9y ago
Their users don't need to be allowed to freely evaluate the source, period. When you write software, you control its distribution. What the users are free to do, however, is use an operating system/stack that they CAN evaluate the source of. If linux or any other open source alternative was a better actual product, it would find its way to the top of the market. In fact, it already has, on the server... by far. But linux wasn't made to be easy to use, to be quick and easy to install, to install other software onto, etc... and that has kept it back, and it kept it back long enough for microsoft to establish a de-facto standard on the home desktop market... The closed or open source status of a product has no bearing over its superiority at all. Again, in the world of geeks, it may, but in the world at large, it doesn't, and really, it shouldn't.
- beagle3 9y ago
  The sentiment of "the better product will win" is understandable, but wrong as you present it. Microsoft managed to gain a monopoly (legally or illegally - doesn't matter) and has used it to illegally keep others out, and network effects now (and for the past 20 years) have been that "goodness" measure - technical mediocrity had been sufficient (although recently they have been doing a lot of excellent technical work since the horrible 2000's) In every single field Microsoft has not been able to leverage their monopoly (e.g. Phones) they are not in a dominant position, even though in some they maintain a competitive one (Xbox one, c#, SQL server)
  - csydas 9y ago
    This is very true, since the idea of meritocracy doesn't do a lot to overcome business inertia of being in a Microsoft Environment. If there is a Linux solution that in every way exceeds a Microsoft Solution from a technical and price standpoint, you still need to weigh in the transition costs, employee costs, and the long term effect of changing. It's not always as simple as "X is better than Microsoft's Y, people will use it." There are far more things that get considered, and you can get tied down pretty heavily when your entire workflow and operations rely on a single product or vendor. The longer you've been using a product, the harder it is to get away from it. It's not that Linux isn't good or making a lot of cool progress in all realms, it's that Microsoft does "good enough" and the transition isn't seamless enough for many use cases.
  - averagewall 9y ago
    Part of why they succeeded was by being first. Linux was certainly much worse than Windows in the early days when people still used DOS together with Windows. Being first means it was massively better for those people at that time. Plan9 lost out to Linux, perhaps partly by being too late. Do we blame Linux for being horrible?
    - beagle3 9y ago
      As a user of both circa 1994 - no, Linux was definitely not worse. It was about a thousand times more stable, though it lacked e.g. A word processor. When Microsoft produced win 2 and 3, they unfairly (and likely illegally) used their DOS and then Windows monopoly to stop competitors (DR DOS, BeOS, a few lesser known ones); they later used the Windows monopoly to embed IE and kill Netscape. It didn't matter that IE was, in fact, a better browser - everyone wanted Netscape, and it was only with the IE4 merge into the OS that Microsoft took the internet. I was involved with one of the smaller and less famous Microsoft victims at the time, and I can assure you that regardless of technical merits, MS made very significant progress by playing dirty. They paid billions in court for it, but economically it was worth it to them.
jfoutz 9y ago
Microsoft was really really bad at security. Then the internet became a popular thing. I think an fresh xp install would, on average survive 15 minutes before getting infected by blaster. Microsoft, to their credit, improved dramatically. I don't know if they're extraordinarily good compared to other software producers. Microsoft gets the mention because it was so very bad, back in the day. It's kind of like when a very lazy person turns into a marathon runner. They made huge changes.
- deleted 9y ago
  [deleted]
- kbenson 9y ago
  There were versions of windows, 2000 if not XP, that could and would get infected in-between the time the network stack initialized and the local software firewall initialized a second or two later. This was actually addressed and fixed, because it was not a unique experience. That's how pervasive and wild the exploit network traffic was before MS got their act together. Edit: My google-fu is failing me, and I can't find the right keywords to find a reference to this, but I distinctly remember it. Back in the days when firewalls weren't quite as pervasive, and especially not for small colo deployments.
  - ConceptJunkie 9y ago
    I saw this first-hand when installing Windows 2000 using Parallels circa 2006. I mistakenly believed the configuration I had chosen had the VM behind the Mac's firewall, but it wasn't. The VM was infected before Windows 2000 could install the latest updates... just a matter of minutes. This is not as extreme as you are describing, but it was also on the corporate network of a large company, not the open internet.
- secstate 9y ago
  Indeed. But becoming a marathon runner who finishes in 7 hours, after the finish line has closed, and doesn't get a medal because the cut off was 6:30 :) No, it's a great achievement, but there's still room for improvement.
schoen 9y ago
I don't support anyone hiding source code from users (and have given conference talks about hard-to-detect ways of backdooring binaries), and so I don't mean this to be an excuse for the secrecy of the source code, but every single person I know who's worked in the security industry agrees that Microsoft made a major qualitative improvement in their security at every level, based on spending a lot of money and giving security people power in the development process. Most people feel Microsoft is managing security better than the main Linux-based operating systems do, in terms of auditing, coding standards, code reviews, and developer security education. (That doesn't mean that they're doing this better than each and every individual open source project.) Some of the people agitating for giving Microsoft more credit about this have personally seen the results, as in-house or contracted developers or auditors. It can be hard to make an apples-to-apples comparison about what this means for the security of deployed systems because people are potentially using the systems in different ways with kind of different attack surfaces. (For example, quite a few Windows desktop users may still be downloading unsigned binaries from HTTP sites, which Linux users would be less likely to do because of the prevalence of package managers -- though maybe some of those Linux users will do the curl | sh thing from an HTTP site too.) I don't think that a typical open source project has improved to the extent that Microsoft has during this timeframe, though, again, it's hard to know exactly what to compare or how to compare it.
- secstate 9y ago
  That's a really complete argument. But there's still the elephant in the room of the whole operation being closed source, and the inability to do quantitative analysis into the improving security of a closed source system. People on the inside can say there have been qualitative improvements, but that's not measurable on the outside and so is no better than hearsay and conjecture. Meanwhile in the GNU/Linux world, you can browse the git repositories and see and audit every step in the development process if needed. Is it possible that typical open source projects didn't NEED to improve their security over the same timeframe, given that the F/OSS world didn't fuck users over for two decades with unfixed 0days? Meanwhile, the OP here is talking about Word which is likely a world away from the improving security team working on Windows. Hell, I'm surprised they've got more than a skeleton crew working on the desktop version of Word anymore. People in my community 60+ have been using Google Docs for the last five years already.
doggydogs94 9y ago
We will never know the answer to your assertion until more than 1% of the OS market is open source.
emmelaich 9y ago
Only four minutes according to Kevin Mitnick. https://en.wikipedia.org/wiki/Microsoft_Windows#Third-party_analysis https://en.wikipedia.org/wiki/Microsoft_Windows#Third-party_...

by gwu78 9y ago

jmcdiesel 9y ago

Their users don't need to be allowed to freely evaluate the source, period. When you write software, you control its distribution. What the users are free to do, however, is use an operating system/stack that they CAN evaluate the source of. If linux or any other open source alternative was a better actual product, it would find its way to the top of the market. In fact, it already has, on the server... by far. But linux wasn't made to be easy to use, to be quick and easy to install, to install other software onto, etc... and that has kept it back, and it kept it back long enough for microsoft to establish a de-facto standard on the home desktop market... The closed or open source status of a product has no bearing over its superiority at all. Again, in the world of geeks, it may, but in the world at large, it doesn't, and really, it shouldn't.

beagle3 9y ago
The sentiment of "the better product will win" is understandable, but wrong as you present it. Microsoft managed to gain a monopoly (legally or illegally - doesn't matter) and has used it to illegally keep others out, and network effects now (and for the past 20 years) have been that "goodness" measure - technical mediocrity had been sufficient (although recently they have been doing a lot of excellent technical work since the horrible 2000's) In every single field Microsoft has not been able to leverage their monopoly (e.g. Phones) they are not in a dominant position, even though in some they maintain a competitive one (Xbox one, c#, SQL server)
- csydas 9y ago
  This is very true, since the idea of meritocracy doesn't do a lot to overcome business inertia of being in a Microsoft Environment. If there is a Linux solution that in every way exceeds a Microsoft Solution from a technical and price standpoint, you still need to weigh in the transition costs, employee costs, and the long term effect of changing. It's not always as simple as "X is better than Microsoft's Y, people will use it." There are far more things that get considered, and you can get tied down pretty heavily when your entire workflow and operations rely on a single product or vendor. The longer you've been using a product, the harder it is to get away from it. It's not that Linux isn't good or making a lot of cool progress in all realms, it's that Microsoft does "good enough" and the transition isn't seamless enough for many use cases.
- averagewall 9y ago
  Part of why they succeeded was by being first. Linux was certainly much worse than Windows in the early days when people still used DOS together with Windows. Being first means it was massively better for those people at that time. Plan9 lost out to Linux, perhaps partly by being too late. Do we blame Linux for being horrible?
  - beagle3 9y ago
    As a user of both circa 1994 - no, Linux was definitely not worse. It was about a thousand times more stable, though it lacked e.g. A word processor. When Microsoft produced win 2 and 3, they unfairly (and likely illegally) used their DOS and then Windows monopoly to stop competitors (DR DOS, BeOS, a few lesser known ones); they later used the Windows monopoly to embed IE and kill Netscape. It didn't matter that IE was, in fact, a better browser - everyone wanted Netscape, and it was only with the IE4 merge into the OS that Microsoft took the internet. I was involved with one of the smaller and less famous Microsoft victims at the time, and I can assure you that regardless of technical merits, MS made very significant progress by playing dirty. They paid billions in court for it, but economically it was worth it to them.

jfoutz 9y ago

Microsoft was really really bad at security. Then the internet became a popular thing. I think an fresh xp install would, on average survive 15 minutes before getting infected by blaster. Microsoft, to their credit, improved dramatically. I don't know if they're extraordinarily good compared to other software producers. Microsoft gets the mention because it was so very bad, back in the day. It's kind of like when a very lazy person turns into a marathon runner. They made huge changes.

deleted 9y ago
[deleted]
kbenson 9y ago
There were versions of windows, 2000 if not XP, that could and would get infected in-between the time the network stack initialized and the local software firewall initialized a second or two later. This was actually addressed and fixed, because it was not a unique experience. That's how pervasive and wild the exploit network traffic was before MS got their act together. Edit: My google-fu is failing me, and I can't find the right keywords to find a reference to this, but I distinctly remember it. Back in the days when firewalls weren't quite as pervasive, and especially not for small colo deployments.
- ConceptJunkie 9y ago
  I saw this first-hand when installing Windows 2000 using Parallels circa 2006. I mistakenly believed the configuration I had chosen had the VM behind the Mac's firewall, but it wasn't. The VM was infected before Windows 2000 could install the latest updates... just a matter of minutes. This is not as extreme as you are describing, but it was also on the corporate network of a large company, not the open internet.
secstate 9y ago
Indeed. But becoming a marathon runner who finishes in 7 hours, after the finish line has closed, and doesn't get a medal because the cut off was 6:30 :) No, it's a great achievement, but there's still room for improvement.

schoen 9y ago

I don't support anyone hiding source code from users (and have given conference talks about hard-to-detect ways of backdooring binaries), and so I don't mean this to be an excuse for the secrecy of the source code, but every single person I know who's worked in the security industry agrees that Microsoft made a major qualitative improvement in their security at every level, based on spending a lot of money and giving security people power in the development process. Most people feel Microsoft is managing security better than the main Linux-based operating systems do, in terms of auditing, coding standards, code reviews, and developer security education. (That doesn't mean that they're doing this better than each and every individual open source project.) Some of the people agitating for giving Microsoft more credit about this have personally seen the results, as in-house or contracted developers or auditors. It can be hard to make an apples-to-apples comparison about what this means for the security of deployed systems because people are potentially using the systems in different ways with kind of different attack surfaces. (For example, quite a few Windows desktop users may still be downloading unsigned binaries from HTTP sites, which Linux users would be less likely to do because of the prevalence of package managers -- though maybe some of those Linux users will do the curl | sh thing from an HTTP site too.) I don't think that a typical open source project has improved to the extent that Microsoft has during this timeframe, though, again, it's hard to know exactly what to compare or how to compare it.

secstate 9y ago
That's a really complete argument. But there's still the elephant in the room of the whole operation being closed source, and the inability to do quantitative analysis into the improving security of a closed source system. People on the inside can say there have been qualitative improvements, but that's not measurable on the outside and so is no better than hearsay and conjecture. Meanwhile in the GNU/Linux world, you can browse the git repositories and see and audit every step in the development process if needed. Is it possible that typical open source projects didn't NEED to improve their security over the same timeframe, given that the F/OSS world didn't fuck users over for two decades with unfixed 0days? Meanwhile, the OP here is talking about Word which is likely a world away from the improving security team working on Windows. Hell, I'm surprised they've got more than a skeleton crew working on the desktop version of Word anymore. People in my community 60+ have been using Google Docs for the last five years already.

doggydogs94 9y ago

We will never know the answer to your assertion until more than 1% of the OS market is open source.

emmelaich 9y ago

Only four minutes according to Kevin Mitnick. https://en.wikipedia.org/wiki/Microsoft_Windows#Third-party_analysis https://en.wikipedia.org/wiki/Microsoft_Windows#Third-party_...