Hacker News Reader

Comment by sudioStudio64 | Hacker News Reader

I have a feeling that a clone of windows 2000 is going to have some hilari-bad security bugs...

Actually, at the current moment ReactOS is clone of Windows 2003, not the 2000. That is the big difference!

I know this position isn't popular, but I don't think that will help. They are reverse engineering a really complicated system.

Do you think that they have the same kinds of controls that it took MS literally a decade and millions of to dollars develop?...Controls that that were expensive in time and money that then only improved their development to the extent that it has? (far, far from perfect.)

Maybe...and this is a big maybe...there is a enough of a difference between react and windows that normal windows bugs won't be surfaced. I'm curios as to whether they support NX, ASLR, or 64 bit? Even if they don't copy the system bug for bug they may be trivially exploitable just because they don't have the resources to harden it.

ReactOS is free and open source and is released under the GPL license so anyone can see the source code.

Open source only makes bugs shallow if lots of people are using the software and reviewing the code. OpenSSL is a great example of code that lots of people ended up using but not reviewing that had/has many issues.

I'm not saying anything negative about open source...I'm just saying that its more complex than just having code available.

yeah, i mentally multiply "Rewriting a project" times "reverse engineering is hard" and see a lot of exploitable material probably lurking somewhere in there...

ReactOS isn't reverse engineered or rewritten from Windows 2000. It was a cleanroom re-engineering of compatible Windows APIs. And a lot of their work got back-ported (and visa-versa) into Wine.

ReactOS may very well have bugs, security issues, and similar. But those have nothing to do with the fact that it is designed to be compatible with Windows APIs.

There isn't a lot of difference between "rewriting this in another language" and "cleanroom rewrite" as far as getting burned by the same corner cases in the same languages go.

I get what you're saying, though.

Aren't they implementing it one .dll at a time, though? Meaning, they still need a lot of the original MS binaries to work?

Not just DLL after DLL. MS DLLs of course are not included in ISO releases. Nor they could come under license of the releases. They though might work, but they not necessarily are tested nor they are planned to be used.

Reply on news.ycombinator.com