Hacker News Reader

Comment by throwaway48476 | Hacker News Reader

The problem is that windows was developed before security was important. No one has made the necessary investments to create a truly secure computing platform.

Ideally a secure computing platform would have reproducible builds built on public inspectable infrastructure like fdroid. It would also virtualize all untrusted applications in a sandbox and implement the least privilege model.

Today we have the worst security. There is unknown, probably untested and insecure code running at every ring, from the CPU's ME, to the UEFI components, to the OS 3rd party drivers.

SeL4 has a fully verified kernel but it doesn't do virtualization yet.

View on HN

> The problem is that windows was developed before security was important.

I disagree. Plenty of systems have added security as an afterthought and were just fine for the effort.

The problem is most people just want to play video games. They don't care about security. They don't actually want security if it frustrates their efforts to play games or reduces the computing power available for the game.

Look at houses. We could have amazing high security locks everywhere if we wanted. We don't. We don't perceive ourselves as needing them. It turns out "tamper evident" is a decent level of security for the real world and allows homes to be partially secure while being totally livable.

> The problem is that windows was developed before security was important.

But wasn't that Windows rebuilt from the ground up as Windows NT, which had more advanced security features out of the box than basic Unix/Linux (allow/deny ACLs vs octal permissions, SAM database vs /etc/passwd flatfile, SIDs vs manually assigned/reusable UIDs)?

(And some other cool design features that never got used, like POSIX/OS2 subsystems being on equal footing as the "regular" Windows32 subsystem.)

> But wasn't that Windows rebuilt from the ground up as Windows NT

That was the 1990s. Windows security was transformed in the 2000s and then with Windows 10. I'm not sure it can be said to be more vulnerable than other OSes.

It’s definitely more vulnerable than macOS since macOS has more encompassing system protection (SIP), kernel extensions have been moved to user space (DriverKit and FSKit), and pervasive sandboxing.

Interesting, I might need to do some reading, but macOS was terrible for a long time, and seriously lagging behind windows when it came to security. They seemed to just be coasting on the fact that Apple as a platform simply wasn't targeted to anywhere near the extent Windows was.

They didn't even have an ASLR implementation for way too long IIRC.

Does macOS have any form of MAC yet, or do they just rely on sandboxing?

> Interesting, I might need to do some reading, > Does macOS have any form of MAC yet, or do they just rely on sandboxing?

Kind of. There is a set of permissions an application can request in order to access protected services and areas of the filesystem, but maybe that's what you meant with sandboxing?

https://support.apple.com/en-gb/guide/mac-help/mchl211c911f/...

That just seems like stuff that requires an admin password.

> It’s definitely more vulnerable than macOS since macOS has ...

That tells us some things about MacOS security, but nothing about Windows.

The same can be told of UNIX, lets not forget the first worm was targeted at UNIX systems, and the root cause keeps being a regular CVE in C and C++ projects.

Of course. A new secure computing platform would have to be built from scratch and from secure primitives that would not be backwards compatible with anything outside of virtualized emulation.

When that worm was created Windows did not exist.

And yet the root cause for it still hasn't been fixed in UNIX systems.

If you consider plan9/9front Unix 2.0, they did with namespaces.

Namespaces have nothing to do with buffer overflows.

No, but I wonder if the garbage collected C would help.

I like how you started out with a reasonable comment and then ended in a Hacker News word soup of random security memes. It’s like going, “the problem is Python is interpreted, and the design of its interpreter makes it difficult to optimize” and then following up with “this is why we need everyone to write their code in Rust and assembly. There’s this thing called Mojo that looks like Python and has the performance of Rust that we could use”. Like, ok, thanks for your insight? None of it is actually useful or relevant in answering the question.

> windows was developed before security was important

I disagree - At best you could say DOS was developed before users knew security was important... Microsoft has explicitly ignored security since DOS - because functionality sells better than security. Anyone who has worked with Unix systems has always understood just how much of a sieve Microsoft OSes are. Anyone with wisdom has said that about Windows from the very very beginning. Windows anti-virus has been a thing for a very long time.

If your prior is the number of extreme security vulnerabilities in one year - the implication is that there are lot of undiscovered extreme security vulnerabilities.

And competent WaaS (Weaponisation as a Service) now exists to quickly deploy exploits for obscure weaknesses or recently discovered weaknesses. Users and companies no longer have a few weeks grace before mass exploitation occurs.

Use Windows, get pwned. The counterfactual is difficult: it is hard to prove you haven't been pwned... Anti-virus defence is often too late (plenty of examples eh!).

I've seen very careful users/developers get caught out again and again.

Not to say Windows is alone. Routers and other end devices are just as bad. And Android doesn't appear great to me either.

UNIX entire security model is "ambient security" in operating systems literature.

Ambient security is a joke. Real security requires a capability-based model.

seL4[0] implements the mechanisms to do this efficiently. Lions OS implements an entire system with seL4 as core[1] leveraging these mechanisms.

0. https://sel4.systems/About/seL4-whitepaper.pdf

1. https://trustworthy.systems/projects/LionsOS/

Check 9front and GNU/Hurd. Namespaces are good too.

>GNU/Hurd

It will not go anywhere until they manage to move away from the gnu mach kernel.

(as it hasn't happened yet, I am afraid it is quite unlikely to happen anymore)

First I've heard of LionsOS. It is mature enough to run a web server: https://sel4.systems/Info/Website/

>SeL4 has a fully verified kernel but it doesn't do virtualization yet.

It very much does virtualization. And, as far as I am aware, it does it better than any other OS.

Incidentally, seL4 just had its seL4 Summit 2024[0].

0. https://www.youtube.com/playlist?list=PLtoQeavghzr0ZntMmRPwg...

But is the virtualization component fully verified?

There are a few talks on VMM.

The major shortcoming right now is that guests only get one CPU, but as per the talks guest SMP is a priority and will be available in 3-4 months.

I do not follow the verification side much, but what I know is that VMM has some interesting properties.

Namely, VMM itself (which handles VM exceptions) does not get more capabilities than the VM, thus dramatically limiting usefulness of a VM escape.

Do you have links for some of the latest development/research on this?

> Ideally a secure computing platform would have reproducible builds built on public inspectable infrastructure like fdroid. It would also virtualize all untrusted applications in a sandbox and implement the least privilege model.

Also, be careful what you ask for. Such a system would likely require Secure Boot to be enabled a-la Android, complete with userspace detection of a system which does not have Secure Boot enabled, for DRM implementations similar to a game console. We're already close, but UEFI bugs, virtualization, hundreds of TPM variants, and bus attacks have left holes.

> windows was developed before security was important

That was a long time ago, the 1980s and 1990s. Windows has been transformed since then, particularly with Windows 10.

Reply on news.ycombinator.com