[Discuss] Most Dangerous Operating System

[richard.pieri at gmail.com (Richard Pieri)]

On 5/7/2012 4:03 PM, Derek Martin wrote:
 > So to what do you attribute the decades-long constant stream of
 > serious security flaws in Microsoft's offerings?  I guess it's not
 > "the philosophies, the carelessness and ignorance, that permitted them
 > to occur in the first place."  Seems to me Apple's got a long way to
 > go to catch up to MSFT in that regard...

Most NT vulnerabilities are really variations of the same thing: 
attempts to exploit either the file I/O or the display I/O systems. 
These were originally user space drivers.  The kernel was insulated via 
CPU protected mode context switches which makes the NT kernel a very 
hard nut to crack.  NT 4.0 moved them from user space to kernel space 
for performance gains but which also bypasses CPU protections.  I used 
to say that this was a stupid idea (sometimes I still do), but Mesa3D 
DRI does the same thing for the same reason so maybe it isn't such a 
stupid idea after all.

So no, not carelessness or ignorance; this change was premeditated and 
Microsoft knew that it would lead to security problems and at least made 
attempts at mitigating them.  They didn't always succeed but they did 
try and more importantly they did learn and they have improved.  I can 
give them points for that.

Apple isn't even making the attempt.  This most recent issue isn't the 
result of an attack.  Legacy FileVault users' passwords are being dumped 
straight into the system log files.  In retrospect that's not just 
carelessness or ignorance.  It's negligence from the bottom all the way 
up the release chain.

-- 
Rich P.