Hacker News Reader

Comment by mikewarot | Hacker News Reader

Looking back on all both Daves said, there is an extraordinary amount of attention paid to getting things done and out the door, and almost no mention of planning ahead, and actual security strategy. Its all commercial pressure to get the sausage out of the meat grinder, and keep the failures down to an acceptable level.

No wonder things never get better, and never take a turn in the right direction, industry wide. I used to think we'd eventually get to capability based security, but now I see we'll always be stuck with application permission flags, the almost worthless bastard cousin, instead.

I weep for the future.

View on HN

Most execs at most companies really are driven by very short-term planning and thinking, as it benefits their career to do so. They just need enough good quarters/years to justify their promotion from VP to SVP or SVP to CEO. Nobody gets blamed and punished three years after they move on to a new role for the shortsighted choices they made in their previous role.

Having said that, Cutler is not one of those execs, but was certainly subject to pressure from above to get systems out the door and keep the revenue stream coming in. As he mentions early in the interview, he’s really bothered by shipping bugs, really disappointed with the quality of software engineers in the industry, and really bothered by program/project managers treating every bug like a rare corner case. I concur with him on all three. Most of the bugs I file are “corner cases”, and yet I hit those issues every day and my bugs have multiple dups in the database and/or my bug gets duped back to an early report.

Having spent a few decades in this industry, all of it in Big Tech, I have yet to come across a company that doesn’t fold to the same sort of pressure, even if the engineers and first-level managers are pushing to get bugs fixed before shipping, and pushing for more frequent bug fix updates.

Steve Jobs pushed individual contributors to perfect products before shipping them. Bill Gates had no taste to justify any sort of perfectionism, or compunction against shipping buggy products (https://www.youtube.com/watch?v=IW7Rqwwth84). It was all dollars and cents, as far as I can tell.

As an Apple user since the launch of the original Mac, I guarantee there have never been any perfect Apple products.

Every Mac OS until OS X crashed continuously on even moderate use. Thankfully Steve did manage to build better systems at NeXT and brought that technology back when Apple acquired NeXT and was able to substantially improve Apple’s Mac product as a result.

It’s still far from “perfect products”, though, even during the time period that Steve was still alive and at Apple. To your point, I do agree that things have gone downhill quality-wise since his death, but I attribute this as much to being completely schedule driven as I do to the personalities involved in managing the projects.

Why would you believe this easily disproven (via brief use of Apple products) myth???

I do use them. The hardware is impeccable. The software is admittedly more spotty. But even then, the OS is great. All in all, I can't think of a better platform or I'd use it.

The impeccable butterflies???

And the question wasn't about a better platform or the vague "greatness", but the myth of perfection, the one where serious bugs unfixed for years should be enough to dispel

Short term planning can mean anything to an observer though. For some, that's the next cycle, others thats the next 10 years.

Microsoft employs a huge squadron of engineers, managers, and execs, all owning distinct products, tools, software, etc.

They can have multiple people planning short and long term things, and they do. I doubt Microsoft will cease to exist within the next 10 years.

Shipping is a feature. Nothing is ever done and nothing is ever bug free. Cutting the scope to have a complete product in finite time is the single most important part of product management.

Agree, with the caveat that I think finding the balance here is really the hard part, and projects that don’t pay down technical debt eventually fail, if only because people decide to replace them because of the debt.

At the time, Windows NT was lauded for having better security than its competitors. I remember “Department of Defense C2 level security” being invoked often. It was a major selling point, though one that didn’t feel relevant for most users (in fact, lots of people felt like “why would I need this?”; it made it seem like an OS that wasn’t for “normal users”).

Early ’90s conceptions of security—both what makes it and how relevant it is/for whom—don’t match our expectations or what we consider state of the art today.

Windows XP still likely meets that standard as long as it's air-gapped and placed in a facility that has at least the equivalent level of access control, and never removed.

... and never used. That was the punchline?

I don't see why? You can safely use it as long as you don't ever connect it to anything that isn't also at the same or higher level of certification.

Yeah, that was all marketing nonsense meant to confuse laypeople.

TCSEC Level C2 was intentionally designed to be a “baby’s first security certification” level meant to allow existing known insecure products to get a (low) rating so that commercial vendors could get familiar with the concept [1]. It, at no point, was ever meant to indicate any meaningful level of security was achieved, just that you filed the paperwork. In fact, Level B1, the level above C2, was meant to be the “training wheels” level. Microsoft has still never achieved a security certification in the successor standard, the Common Criteria, that has reached the “training wheels” level.

Microsoft security is a joke now and was a joke then, nothing has changed.

[1] https://www.stevelipner.org/links/resources/The%20Birth%20an...

Frankly, those are just box ticking exercises. Same with SOC certifications. Security is not a state of being, it is a process.

In what world are formal proofs of correctness “box ticking exercises”?

You are wrongly extrapolating that the lowest levels of certification, that were literally designed to allow people incapable of more than box ticking to be rated on a unified scale, somehow applies to the levels that were designed to evaluate actual security.

That is like saying the Richter scale is useless because you can not even feel a 1.0 earthquake. That is the entire point. The scale can measure from very low to very high. You are complaining that the scale is useless because the lowest ratings are easy to get, yeah, duh, that is why they are low ratings.

However, you are correct for SOC. That is because the highest ratings are easy to get and are mere box ticking exercises. If the highest rating is easy, then the standard is useless for evaluating anything beyond that. This logic does not apply when a low rating is easy to get; that just means anything which can only get a low rating sucks.

Adding the word "formal" to something doesn't mean it can do the impossible. It's not realistic to prove things correct, since it's both an impossible amount of work and you'll end up finding that your definition of "correct" was incorrect.

(CompCert, a "formally correct C compiler", has had bugs found in it.)

I do not see how that is relevant to my statement that formal methods, as required by the higher Common Criteria levels, do not constitute “box-ticking exercises”.

Or are you arguing that these standards which require proofs of correctness are useless because proofs of correctness are much less impressive than box ticking?

They are extremely expensive box ticking exercises.

Furthermore, I don't think anything except box ticking exercises exists or could ever exist.

You can only write down ways to make a process worse, not better.

I know that I have more confidence in a proven compiler that is thoroughly tested over a random compiler Joe the intern slammed out, but you do not seem to think that way. That is fine, you do you.

Nothing realistically complex can be proven "correct". There is even a mathematical theorem about it - given a program's code, one can't even prove that it ever stops.

One can, of course, apply proof of correctness to simple curcuits, where all possible inputs and outputs can be enumerated.

That is a complete misunderstanding of consequences of Rice’s theorem which generalizes the halting problem.

You can not prove non-trivial properties about all programs that could could ever exist with no false positives or false negatives.

You can prove non-trivial properties about almost every program.

For instance, if I want to disallow programs that will not halt, I can just reject any program with a unbounded loop. I may also reject programs with a unbounded loop that will halt, a false negative, but I do not care. I just want to be certain that I will never run a program that will not halt. I just decided: “will definitely halt for my purposes” even though the halting problem is unsolvable in general.

This is generically true and is why formal methods work at all.

> At the time, Windows NT was lauded for having better security than its competitors

But not as secure as the classic Mac OS!

https://web.archive.org/web/19991128124149/http://www.dtic.m...

> However, he said the Army has moved its web sites to a more secure platform. The Army had been using Windows NT and is currently using Mac OS servers running WebSTAR web server software for its home page web site. Unger said the reason for choosing this particular server and software is that according to the World Wide Web Consortium, it is more secure than its counterparts.

> Unger said the reason for choosing this particular server and software is that according to the World Wide Web Consortium, it is more secure than its counterparts. According to the Consortium's published reports on its findings, Macintosh does not have a command shell, and because it does not allow remote logins, it is more secure than other platforms. The report also said the Consortium has found no specific security problems in either the software or the server.

That’s a rather dubious conclusion if based on that criteria.

> I used to think we'd eventually get to capability based security, but now I see we'll always be stuck with application permission flags, the almost worthless bastard cousin, instead.

My hope is that WASI will introduce capability based security to the mainstream on non-mobile computers [0] - it might just take some time for them to get it right. (And hopefully no half-baked status-quo-reinforcing regressive single-runtime-backed alternatives win in the meantime.)

[0]: https://github.com/bytecodealliance/wasmtime/blob/main/docs/...

Strong agree. My main concern is that someone will "fix" WASI by grafting on a POSIX extension and kill its security.

WASIX?

That was the unfortunate entity I was implying in my post, yes :(

Their EULA absolves them from all consequences! why would they care what happens to your computer after they get their chunk? That could arguably be the biggest economic contribution software has "given" us, these binding agreements that "we'll take your money, but we don't promise you anything, Sucker!"

The market rewards companies that get there first. Market and regulators hand out slaps on the wrist for lapses in security. Actually punished if you are second to market

I mean a lot of this stuff was built before the internet.

More accurately, before Microsoft cared about the Internet.

No, not just that, but before the idea that most systems would be internet connected.

NT's design was started in 1989 and 3.1 was released in 1993 - development started a full 7 years before the idea of a connected world was commonplace, and a full 12 years before wide deployment of broadband.

Whatever comes along that is a clean break with NT, and Unix - will have these assumptions built in.

POSIX is incompatible with security. Any such new system can not support it to have any hope of being secure. Do you think folks can live with that?

It's like trying to introduce outlets and circuit breakers to folks used to just hot wiring directly to the grid.

The idea of the OS directly enforcing the will of the user(through power boxes that return handles/capabilities, instead of dialogs that return names) takes a little adjustment.

Not how I remembered this era. When I got my first NT beta CD in 1992 the place I worked already had public IP connectivity and NT already had working TCP/IP. We were pulling new beta releases down from the MS ftp server (rhino.microsoft.com) by early 1993. It was Windows 3.1 that was developed without consideration of internet networking.

Reply on news.ycombinator.com