Hacker News Reader

I hate windows, like I'm trying to get off it because of the ads/ragebait news. I hate edge. Microsoft is basically a never buy anymore, but according to this:

https://zerodium.com/program.html

Getting a Windows exploit is higher value than any linux exploit. Given how many servers use Linux, it makes me wonder if Linux 0 click are easier than windows.

There are a bunch of counters like 'there are too many distros', or 'a personal computer of a VIP is higher value than some corporations'. But I'm not sure its fair to include your point number 1.

I like to give people credit where its due, I imagine it took lots of work to make windows as secure as it is. (Giving Android OS the most credit for their 2.5M payout)

Linux servers generally aren't being used interactively though and expose a fairly limited attack surface to the internet, and so I feel like the value in Linux server exploits is more in the openssl/Apache/etc vulnerabilities

Linux is the just kernel. Everything else in a distro is software running on top of it. Kernel bugs are generally hard to exploit remotely and typically have to be chained with other exploits. That's why there's so many specific payouts for common enterprise apps. Windows is a complete, highly integrated OS with a wide array of attack vectors baked right into it.

Plus sketchy companies like Zerodium major customers are nation-state actors who are primarily interested in data exfiltration and the application data stores themselves.

>Kernel bugs are generally hard to exploit remotely and typically have to be chained with other exploits.

This is why its so valuable though.

But what’s the point ? Most vulnerable Linux servers are hosting blogs or dns servers. They’re only useful to run a crypto miner or host a phishing page, and for that you probably don’t need to go further than exploit a wordpress bug. No need to go for the kernel or even root.

Whereas a desktop often has users on it who enter banking details or corporate login credentials. Much juicier targets.

Can be a good DDoS source, lots of bandwidth often. Bonus if they can spoof packets, which needs root.

The payouts are based on what their 'clients' are willing to pay in turn for the exploits. There's just less of a market for Linux kernel exploits. If nation-state actors are involved in deep APT style attacks where they would leverage low level kernel exploits they are going to either develop the exploits themselves or acquire them through their own clandestine channels. Purchasing that stuff from a publicly facing company that could potentially be compromised themselves is high risk and leaves too obvious of a trail.

Two reasons I think Windows exploits would pay higher than 'Linux':

1. The Windows (end-)user base is much larger than Linux (not counting Android), so a Windows exploit enables more potential victims.

2. Windows has been the de-facto corporate OS for a long time, so a Windows exploit offers more high-value targets.

It's strange to me that Thunderbird is even on their chart. Surely only a few free software enthusiasts use that anymore? Most of the population doesn't even use a desktop email client and if they do its work-provided Outlook to connect to Exchange/Office365.

https://zerodium.com/faq.html

>Zerodium reviews, tests, validates, and documents all acquired vulnerability research then provides it to institutional clients as part of the

Zerodium only cares about shit their own customers want to target. They aren't trying to fund the entire world of software security.

Their customers in particular are select governments wanting exploits for their own use. You can sure as shit bet they already have specific targets in mind and what they use.

EDIT: For example, the forum software noted on Zerodium's list are popular for "blackhat" and "darkweb" forums from everything from card dump selling to malware. Many governments would love to get themselves a database dump with some user IPs. Conversely, this is why Discourse which is a major BB these days is missing as it's not popular in those circles.

Desktop Email Clients are good for downloading all your Gmail before Google randomly decides to nuke your account.

I'm sure 99% of the population does not use email personally anymore, except for delivery of their Amazon invoices.

Yep. Receipts and notifications. It’s a bad means for communications.

> I hate edge.

It's a thin wrapper around Blink just like Chrome/Chromium. What is there to "hate"?

Edge allegedly manages to be worse at privacy than Chrome: https://apple.slashdot.org/story/20/03/07/0054219/edge-brows...

> What is there to "hate"?

The endless fluff and clutter to clean up (Search bar appearing on desktop, sidebar foistware). The relentless marketing and push of adjacent services (Bing AI).

The passive-aggressive IE compatibility mode (unremovable nag banner to stop using IECM, your Legacy App URLs expire after 30 days for no good reason).

So many ads on the home page.

'turn it off'

I did. But its not intuitive, its some settings button that is semi-transparent. I literally had to google/bing it.

The inital setup was awful.

Then it opening all my links in edge was not okay. I'm signed in on firefox, I don't want things opening in edge.

I can't remember, I gave up after the whole BingGPT thing was a let down.

Compared to Windows, I find that most linux desktop distros have what I would call ‘stability vulnerabilities’ where the user has to tread carefully when doing something basic like updating graphics drivers or applying other updates, or changing resolution. Otherwise they end up with an OS that wont start or will just show a blank screen. I wouldn’t recommend linux for general business or personal use unless this kind of tinkering is enjoyable or you have sufficient IT staff.

There are the same exact problems on Windows though. Microsoft nowadays basically treats it's install base as beta testers and you regularly hear about breaking updates. There are devices out there with funky drivers, most notably Nvidia cards, but if you can avoid those (I know many people can't, me included) and choose a stable distro, I genuinely fail to observe these supposed instabilities on Linux. Personally, I think the real reason why companies are not switching is familiarity. Think of all that money spent on MS product training over X employees. Billions are spent yearly in this industry I'm sure.

Which is why the first thing I do on any Windows install is disable or block automatic Windows Updates and only run them once every blue moon when I've set aside time to waste on borkage.

And before anyone says I'm in danger by running unpatched Windows:

NO.

My threat model is such that the time lost and wasted from updates breaking shit is significantly greater than the dangers posed by hypothetical threats those patches ostensibly guard against. Updates are simply and literally not worth my time and concern compared to having systems that just work every day all year long.

If I need to comply with regulations or audits or I am the target of focused attacks, then yes the scales shift the other way. But as a general, and particularly personal, concern? No, updates are a waste of my time.

Linux is even worse because I don't even need to run updates for something to break and waste my time.

Your comment feels like it came straight from 2014's /g/. This is literally "My time is too valuable to do X" argument. But perhaps you don't care. Fair enough. You do you. You are, however, absolutely in danger running unpatched Windows, unless it's an airgapped industrial PC or something similar. Even then, such systems can and were compromised (stuxnet, for instance).

>If I need to comply with regulations or audits I hope you are not handling any customer info on such systems... or are you?!

There seems to be a deeper issue at play. I've seen it many times, even here on HN. So very few people actually know anything about information security, and if they do they only have horrifying misconceptions from god knows where. No wonder why there's so many data leaks when the responsible people have these attitudes.

My time is too valuable to be wasted by god damn updates, because you know what? I'm only getting older, my eventual demise keeps looming closer, and I have so many things I want to do and places I want to go before the grim reaper picks me up.

It's the kind of re-evaluated outlook on life you only get as you grow older and you start witnessing more and more deaths and imminent deaths around you. I'm also dealing with cancer in the family (I'll spare the details), so my time really is too valuable for god damn software updates.

>I hope you are not handling any customer info on such systems... or are you?!

I'm not. Like I said, if my threat model actually incorporates the kind of threats that updates ostensibly protect against, the scales would weigh differently.

Would I keep business computers updated? Absolutely, if for no other reason than so I can make it all someone else's problem. I'm talking about my own personal computers.

That is understandable, and, as I said, your choice. You did mention business use in your original comment though, where I wouldn't say it is, or should be.

On a flip side though, I've seen so many older folks loose so much time and undergo a lot of stress (which may be highly unwarranted for medical reasons) from having money stolen by banking malware, or more recently, good old phishing. It's like a vaccine, we endure a small pain to prevent a much greater one in the future.

Anyway, I hope you and your family does well!

I respect your individual experience but this hasn't been the mainstream situation for many years now.

Back in 2012 I was the Head of IT for an A series start-up with about 80 people and we ran almost all machines on Linux (mostly Ubuntu) and it worked like a charm. We scaled to about 400 people before switching to Chromebooks in 2015 for the vast majority of users. Our IT operations team never had more than 4 FTE at any point in time, which compares very favorably with any other company. This was possible because Linux environments are extremely easy to maintain for a trained IT staff and, obviously, because we mostly avoided the MS Office crapware (which was less crappy back then than it is today). Google Suite served us fine and the rest was custom web-based software.

Today I'm at a different company, no longer in the trenches, and use MS Windows machines for my work and there is not a single week going by without need to call tech support. Adding the counter-productive helpfulness of MS Office applications I sometimes think MS is paid by our competitors to destroy our productivity. That's a "stability vulnerability".

Coincidentally, I ran into one of these this week. I decided to upgrade my bog-standard Debian installation on a headless NAS from buster to bookworm. Should have been easy peasy: Update sources.list and then apt full-upgrade, right?

Wrong.

Half way through, Debian seems to have lost[1] libcrypt.so.1, which everything important in the system relies on. Could no longer sudo (needs libcrypt) from the session I was logged into. Couldn't re-log in at all either over the network (ssh needs libcrypt) or locally (local authentication needs it too). Could not even get to single-user mode because init=/bin/bash didn't even work. I ended up having to boot from a liveCD, re-assemble the raid partition containing my root filesystem, and manually copy libcrypt into /lib/x86_64-linux-gnu/

All because I tried to upgrade Debian from 10 to 12, skipping a version, which, apparently you can't do anymore.

As much as I can't stand Windows and I grin-and-bear macOS, I've never had an experience even close to as bad as that on those systems.

1: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993755

Recently had a Windows update break my work computer. Everything seemed fine until trying to run a Windows Service in Virtual Box with the HOST OS being Windows 10 IoT in RTOS mode. The attempt to start the service create an infinite loop. Uninstalling nor re-installing the Windows updates fixed the issue. Took a month to convince IT to re-install Windows from fresh to fix the issue.

The second most recent was when Windows Store local repository become broken. Any attempt at resolving the issue failed using Windows provided tools. Yet again had to reinstall the OS and all applications.

This is the big reason why I prefer Linux over Windows any day of the week. Windows fix always seems to be the same, re-install OS and applications. Never had a problematic Linux installation that couldn't be resolved with a live CD / USB. Boot into live USB, mount encrypted partitions, chroot into environment, fix problematic package(s) or re-edit configuration files, reboot. No need to reinstall the OS and all applications.

Linux packaging system(s) are heaven compared to the Windows update hell-scale. Ever have to find a way to update the Root Certificates in order to install .NET Framework 4.7.2 offline on Windows 7 Embedded SP1 that is air gaped and has not had an update since the computers were shipped? Not fun.

>The second most recent was when Windows Store local repository become broken. Any attempt at resolving the issue failed using Windows provided tools. Yet again had to reinstall the OS and all applications.

oh man, I had my Windows install get into a weird state where trying to open 'Updates & Security' would just crash the Settings app altogether. Eventually I submitted a feedback hub report for it with a dump and tttrace (though that was a journey in and of itself) and in the meanwhile I actually managed to get updates installed via the PSWindowsUpdate powershell module. Alas, that still didn't fix the crashing Settings app. I had a friend at MS promote my feedback hub item to a bug who relayed the reason being that my copy of MusUpdatehandlers.dll was corrupt somehow. Ok, I guess I can try using sfc and dism to hopefully repair that. A couple rounds of that and all I learnt was I actually had a few more update related DLLs that were also corrupted. The real kicker being the copy in the store was also corrupted??

  2022-05-25 16:40:41, Info                  CSI    00000226 [SR] Could not reproject corrupted file \??\C:\WINDOWS\System32\\updatepolicy.dll; source file in store is also corrupted

Anyways, I was too stubborn to just reinstall and got it fixed by grabbing an install.wim from an ISO that matched my install and telling dism to use that. The really dumb thing was i first tried to do the repair in offline mode pointing it at the install.wim for sources but turns out that's just not supported. Instead you get some opaque failure message and it only mentions the fact that wasn't supported in a single line buried in the huge log file.

It was unsupported to jump releases while upgrading twenty years ago when upgrading woody to sarge as is now. Don't spread rumours. I've been there and the READMEs are still online for reference [1]. And unsupported does not mean impossible. One just can't blame the distro for a failed install.

And if you had bothered to read the Release Notes for bookworm: It's in there [2]. Also you are instructed that only upgrades from bullseye are supported, and to upgrade to bullseye first if you are running an older version.

Nobody else to blame for your fall.

[1] https://www.debian.org/releases/sarge/i386/release-notes/ch-... [2] https://www.debian.org/releases/stable/amd64/release-notes/c...

I've been using Debian since before woody, and am well aware of the usual caution against jumping versions. I have jumped versions in the past with very little pain despite it being officially unsupported. Obviously this time I gambled and lost as it clearly breaks your system more severely than usual.

None of that changes the user-experience comparison with mainstream OS's or parent's point about Linux's "‘stability vulnerabilities’ where the user has to tread carefully". Linux is well known for being a sharp tool without safety guards. That, and the "RTFM" tone of the typical response to trouble, are some reasons why the Year Of The Linux Desktop is perpetually stuck somewhere in the future.

The fact you can fix anything (even a misguided attempt) in 15mins with a live drive is a great strength imho. Back in the 90s you’d often have to reformat partitions to recover any OS.

Windows doesn't let you upgrade from Vista to 10, so I guess your complaint is they didn't stop you from manually editing configuration files manually?

I hear this sentiment frequently, but it doesn't match my experience. I sure can relate to the idea, but that was a decade ago. I install a fair variety of Linux distros on a pretty wide variety of hardware between my work and personal efforts, and it pretty much just seems to work these days. The last grief I recall in this regard was trying to run Ubuntu 64 on a Pi4 with Vulkan, but that was a couple years ago when things were known to be unstable. That or maybe doing something obviously inadvisable like trying to change distro on a live system by changing the apt source files on a Debian install to Ubuntu repositories and running an apt upgrade. And honestly even things like that work a surprising amount of the time. I know it's good to be introspective and truthful about shortcomings, but I really have to hand it to all the open source contributors, package maintainers, and all the rest. The modern Gnu/Linux ecosystem is pretty remarkable, in my opinion.

On the contrary, Linus of LTT managed to uninstall the GUI of his PopOS install within an hour while attempting to install Steam only last year. https://youtu.be/0506yDSgU7M?t=618

By forcibly overriding the safeties that stop you from doing that. I can run `rm -rf --no-preserve-root /` in less than an hour, too, and it's just as meaningful.

> changing resolution.

Er, this decade? How would setting resolution go badly today? (The closest thing I can think of is that once upon a time you could mess up CRTs with bad settings.)

True but the older your hardware is the less you encounter it… so I guess the best use for it is giving life to old hardware.

I would imagine this is only true to a certain point.

Like, I would not be surprised if there were issues trying to run an AGP or PCI video card.

There's probably a sweet spot where some hardware is old enough to have had all the major bugs worked out, but not so old that nobody bothers developing and testing it anymore.

I'm sorry but this is all but true. I've a 13700K and a 4090 and it's more reliable than 2 of my old hardware machines..this is slowly becoming a myth unfortunately as new versions of either DEs or desktop protocol (s) are slowly deprecating tons of stuff..

I’ve had good luck with Xubuntu on a couple older machines so far but I’m not trying to run it on anything modern. My experience trying to do desktop Linux on a recent machine is quite old so maybe things are different.

That's pure fearmongering FUD.

Recommending Debian to the retrocomputing community is possibly the most tone-deaf thing I've seen today.

This. I suppose it can't be helped given the link was posted without context. But yours is the only post here that seems to get it.

For everyone else: This project exists for the joy of the retro-computing community. No one in their right mind - retro-computing enthusiasts included - would ever recommend using any of these versions of Windows for anything other than amusement.

No, DOSBox is not always an alternative.

Retro enthusiasts are quite excited by this project. And for anyone wanting to rebuild an old PC running Win95 for fun, this is going to be a very helpful tool.

Michael MJD (YouTube) covered this yesterday in fact: https://www.youtube.com/watch?v=xbeqLmSVqvs

I'm with you that they could have stopped talking after the word "instead" but the rest is not fearmongering nor FUD: installing operating system patches from a random server on the internet just isn't a great idea

> That's pure fearmongering FUD.

It is. It's a community project that you can trust, or not. Debian also reports to servers of "unknown provenance" and updates itself from there.

Now, Debian has probably a lot more eyes on it than some Windows Update revival project, but some more niche distros have essentially the same problem.

> Recommending Debian to the retrocomputing community is possibly the most tone-deaf thing I've seen today.

archive.debian.org might be right up their alley

>If you're playing with Microsoft Windows for personal use, that's fine,

Saying you're free to have your hobby isn't tone-deaf.

When you bury it in FUD it is

The "FUD" is clearly describing non-retrocomputing use cases, where everything they said is completely true.

If you're use for this project is personal enjoyment, have fun. If it's an important cog in your business, you should probably fix that.

People always say this but

1) doesn't even a domestic router block all inbound connections?

2) is there any evidence of unpatched remote vulnerabilities for windows 98?

Yes, and probably not (and even if there were, I suspect no one has a huge incentive to go looking for them anyway.)

> Running Microsoft Windows.

Is Windows 11 with all of the default security settings really that insecure? Like Windows Defender, Windows Firewall, anything that needs admin needed you to click "yes, elevate to admin" through UAC

I just posted this above, but according to Zerodinium, Microsoft Zero Clicks are the highest payout for a desktop OS. Either they are the most secure, or its a popularity thing.

Also maybe because Windows is used heavily in enterprise where there is big money to be stolen from finance departments.

I'll never accuse old Windows of being bulletproof, but I've gotten some considerable reliability out of old appliances by adding SSDs, a passively cooled chassis, and a weekly reboot scheduled task. Basically, just get rid of the moving parts and plan for state drift.

Old OT is actually pretty easy to take care of aside from sourcing replacements for some secret sauce PCI card that is no longer made. New OT blurs the line with IT in a really difficult way however, you can no longer rely on a dead simple airgap to solve your security concerns because everything and its mother wants to be on the internet.

You can not just rely on air gapped either. You have other avenues for attack as well. I actually virtualize most of my legacy OSes when possible. Just maintaining adequate serial connections when a USB to serial connector will not work with your legacy OS and a VM can't maintain a stable serial connection through the host OS. It's been a nightmare.

I'm glad somebody brought this up. I was waiting for the follow-up article to post on HN about the "Botnet of Windows 98 Machines"

Yes, all 48 of them.

"Be very careful connecting to some random server and running code from people you've never met, with whom you have no contract or legal comeback, just because other people are doing it. Also, download Debian!"

You can audit Debian, or rebuild it yourself. Try that with Windows.

Debian had over 324 million lines of code in 2009. How do you propose to audit that in a lifetime?

https://unix.stackexchange.com/questions/111281/exploding-am...

So does Guix, and it has reproducibility features and rollbacks.

>* If you're playing with Microsoft Windows for personal use, that's fine, but maybe consider whether you'd prefer to spend your time and energy instead learning and creating atop an open source software platform.

Open source does not address my need or desire for Windows, regardless outdatedness.

Seriously, it's annoying that fReE and oPeN sOuRcE are thrown around like they will solve all the problems in the world. Spoiler alert, they don't. Especially if that problem involves a practical need that most libertarian neckbeards wouldn't care about.

Yes I run Windows, and yes I happily run EOL Windows because they are required to run something reliably. And yes, I happily run unpatched Windows because updates break shit and waste my time compared to the dangers posed by hypothetical threats outside my practical threat model.

Something being free or open source does not in any way fundamentally address my needs and desires. No, Wine is not a panacea (unless we're talking about the drink). No, I'm not going to waste even more time getting Linux to work just so I can get on with life.

What about retro gaming?

WINE will run tons of w9x games with assistants provided by Lutris just fine.

But lots are not fine... Also people pay real money to play old games on old computers and old CRT screens

You can hook a CRT to Linux any time, even easier since X.org with autodetection features.