Hacker News Reader

Comment by magikarp | Hacker News Reader

Author here. Let me ask you something: Have you checked if SSLv2 connections are actually dropped?

The point of my article isn't SSLv2, it's privacy concerns. Also, I did actually check and disabling SmartScreen doesn't seem to be offered during OS install, did I miss something?

Thanks for the disgusting ad-hominem! It totally aids your missing the point.

Edit: Whoa, I think I've figured out why this guy is being so personal; his submission history includes promoting a security company I left after a brief stint. Small world!

View on HN

You can disable smartscreen during install: http://www.winsupersite.com/content/content/142370/clean_13....

Ah, thanks! Updating article accordingly!

It's not worth getting worked up over a jerk on the internet. The comment you are replying to was indeed rude, but stick to disagreeing on the facts and leave it at that. I find that's the best way to get others to do the same.

You're concerned about privacy but you didn't even check what kind of data was being sent by the server before writing this article...

That's a follow-up that anyone can do and corroborate. You're more than welcome to, I'm sorry my article was lacking in that regard.

Edit: Just updated the article with information on that!

This article would have read better without the SSL related discussion, which I think distracts from the major point.

In general, though, I think we're at the point where we can stick a fork in the trust model we've been using up to this point. 2v3/TLS 1.1/EC+DHE isn't the issue, and the more time we spend talking about those issues, the less time we spend focusing on fixing the fundamentals of internet security 3-5 years from now, which we need to actually get right this time.

re: your privacy concern - if that is the concern why did you mention the SSLv2 stuff at all? Although I really don't like smart-screen filter there are really only two ways this could work - Win8 downloads a big white/black list every night, or it checks each time an .exe is launched. I don't think it is particularly shocking that it does the latter.

Microsoft already gathers lots of information from customer experience improvement data and crash dumps and stuff like that, and goes to tremendous efforts to ensure that it is never traceable back to an individual. I don't know for sure but I'd be surprised if the same policies were not in play here also.

Guess again?

Oh! Sorry, my mistake.

Reply on news.ycombinator.com