Hacker News Reader

Comment by ndsipa_pomu | Hacker News Reader

I think the reason that Linuxes are considered secure is the behaviour that is encouraged amongst its users. With Windows, users are encouraged to install software from random internet sites and there's no central method of updating software (without installing some third party updater from a random internet site).

Also, there's some design decisions made in Windows that lead to poor security. e.g. treating a file's extension differently, assigning it special meaning and then hiding it by default from the user.

View on HN

I dislike this trope of knocking Windows because of no central method of updating software. Windows software by the very nature has automatic updates, just like Mac, for each application that is installed and well supported (usually). Most applications will check for updates on launch and/or periodically. You could use a third party utility but that just increases the chance of break-age depending on what gets updated. And on a Corporate/Enterprise Environment, all of these points are moot with centralized repositories. The core point is moot in so many ways and shows a lack of understanding of the ecosystem.

The file extension bit is sort of silly as well, as, it's what made Windows as user-friendly and wide spread as it is today. Better that than treating everything as a file and allowing anything to be piped anywhere.

I think the bigger point is the ethos behind the Operating System(s) and the opaque nature of Windows that causes these downstream effects.

> The file extension bit is sort of silly as well, as, it's what made Windows as user-friendly and wide spread as it is today

I don't think that showing a file extension is massively confusing to people if they were always shown them. The problem is that there were real problems with a file extension looking like e.g. a picture, but instead had an executable extension e.g. image.jpg.exe

> The file extension bit is sort of silly as well, as, it's what made Windows as user-friendly and wide spread as it is today.

Are you sure? To me it looks like Windows got popular in spite of glaring security decisions, not because of them.

Windows has had `winget` as a central package manager for a while now. It works great!

Thanks - this is the first that I'm hearing about it, though I don't use Windows that often.

Do many third parties use it?

I wouldn't be that enthusiastic about it. Best I can say is that it is not terrible. In simplified terms, all it does is download exe files from URL addresses that it gets from yaml metadata files, and then silently executes them; which in turn means that it leaves all of the installer's checkboxes unmodified, cluttering your desktop with icons in the process. On top of that, Windows Terminal has been failing to update on my machine as of late. I don't think this should be the standard for a first-party package manager, but I'd say it's par for the course for Microsoft.

It's also worth noting that all of Winget's code was initially taken from AppGet, without much recognition.[1] Apparently Microsoft cared just enough about that detail to mention the project they forked in passing, as part of a list of third-party package manager projects for Windows.[2] This is why, IMO, you should always first consider a copyleft license for an open source project.

[1] https://www.theverge.com/2020/5/28/21272964/microsoft-winget...

[2] https://devblogs.microsoft.com/commandline/windows-package-m...

EDIT: fixed vertical spacing.

Reminds me of the driver update utilities for Windows which notionally did update all your drivers, but also updates all of your viruses.

As opposed to running bash scripts from the Internet.

Well that behaviour is generally discouraged and whenever I do so, I give some due consideration to how much I trust the website. I can also eyeball what the script is doing which is more practical than disassembling some binary although it's common for the script to download a binary. Also, a lot of "install" scripts will set your system up with the software repository, so you use the standard system updates to also keep that software updated.

Great! I don't install driver autoupdaters from random sites either, so either subject is not an issue or your counterargument is invalid.

It's extremely common for Windows users to download and install malware, but very rare for Linux users to do the same, so I don't really understand your point.

You can read those scripts, you know. If you have a passing understanding of bash, it's pretty easy to understand what a script is doing and ensure it's not malicious.

Can you do that with a compiled executable?

You are comparing behavior of people who can read scripts with the behavior of people who consider random 3rd party driver updaters a good idea.

What user can do doesn't matter. It matters what they actually do.

> It matters what they actually do

Yes, and Windows users often install stuff from 3rd party websites whilst it's comparatively rare for Linux users.

> comparatively rare

This would need some substantiation. I personally had not seen many setups that did not require 3rd party websites.

Sorry, I have no numbers for that. However, typical Linux distributions include an incredible amount of software in their repositories, so it's usually only proprietary software that requires installation outside of the OS tools.

No, you are making that assertion. I brought up the driver thing as a joke, but you're the one that turned it into this inane whataboutism

Almost all windows applications are distributed as compiled binaries. Even very advanced users would find it difficult to audit most apps.

Bash scripts are in plain text, and idiomatic enough that it can be read by anyone with a passing familiarity with bash. Which is the very large majority of Linux users. The script very clearly states what it does, and if it doesn't, you shouldn't run it.

Driver updaters are nearly universally malware, and the common advice has always been to avoid them as such. Similarly, running random bash scripts from the internet without even looking is discouraged in the same way. Mystery binaries are much more dangerous than a script because you can't audit them, but the same advice is given for both: don't.

If what the user can do matters less than what they actually do, then Windows is the most insecure operating system by a very large margin. Windows users install malware at rates order of magnitude higher than any other system. Linux may as well have zero vulnerabilities compared to the shit that Windows users will blindly install.

You're right, it's stupid to compare these situations. So why are you doing it?

> If what the user can do matters less than what they actually do, then Windows is the most insecure operating system by a very large margin.

What does Windows have to do with users ignoring best practice again?

> You're right, it's stupid to compare these situations. So why are you doing it?

I was not, you are excusing yourself from your own mistake. I was comparing people who install driver updaters with people who run random bash scripts from the Internet. Then you tried to convince me the right thing would be comparing with (imho mythical) people who read every bash script they download.

Reply on news.ycombinator.com