Comment by cycloptic | Hacker News Reader

Comment by cycloptic | Hacker News Reader

Parent Full thread

>They should release software with known security problems, that they have said they won't be fixing? Please no... Botnets are large enough as-is.

The source code has already been leaked, and I would bet that malware authors have no problem with acquiring it illegally. While security researchers working within the law may not be able to look at it at all. The current situation does a lot more to help botnets than it does to help honest customers.

>Plus a lot of people under-estimate the cost and difficulty in releasing the source code of previously proprietary software. You don't just slap it onto Github and everyone goes home, you often need a team of lawyers to look at third party licensing and go through the code file by file looking for potential liabilities. [...] Code that has for tens of years been closed source may contain licensed source code (e.g. decoder libraries) that they don't own the license to publish for just one example.

I'm sorry, I just have no sympathy for the trillion dollar company that trapped themselves in restrictive license agreements and then wants to cheap out on lawyers. It is entirely a problem of their own making, and I would expect them to pay to fix it.

The issue isn't malware authors acquiring it the source, the issue is that other people would then build said source and run it (XP) or worse, build products on it as XP was very stable. Those systems would then get infected and become botnets.

You don't see people flying in trijets anymore as they are dangerous, likewise you don't want to encourage or incentivize people to use or build products on an insecure OS.

Sympathy doesn't matter in the business world, costs do. No normal company is going to undertake a legal review of an unsupported product; it simply isn't worth it.

I'd never heard of trijets being dangerous before and I can't find anything to support that claim. I thought the issue with them was the expenses around building and maintaining them.

This is off topic, but there is increased risk due to the failure of the central engine and the inability to jettison it in the event of a fire.

Wikipedia notes it as a design issue: https://en.wikipedia.org/wiki/Trijet

There are documented cases where failure of the central engine has caused a loss of the rear stabilizer. This can be resolved via additional engineering -> which increases cost of manufacturing and maintenance (which as you note was the main factor in why they went away).

>The issue isn't malware authors acquiring it the source, the issue is that other people would then build said source and run it (XP) or worse, build products on it as XP was very stable. Those systems would then get infected and become botnets.

I don't follow where you're going with this. Why would they build the source or build products on it if they were not interested in deploying security fixes? There is no other developer interest there and no company would ship a white-labeled "XP 2020 Edition" to developers if it was instantly vulnerable to malware.

>Sympathy doesn't matter in the business world, costs do. No normal company is going to undertake a legal review of an unsupported product; it simply isn't worth it.

Right, that's why I don't buy these lines about how they can't afford it. If it becomes a serious security issue that causes them problems then it is worth it.

From reading your comment, you appear to think that I am assuming someone would ship XP to developers, that is not the case and I apologize if I wasn't clear. I am assuming someone would use XP in a product that would be shipped to consumers.

Companies have and will ship products with outdated or unsupported OS if they think they can harden them acceptably. See all the networking devices that run some variant of the Linux 2.x kernel that still appear on the market today as an example.

Embedded XP was also a thing and probably still is in many places.

Reply on news.ycombinator.com