Hacker News new | ask | show | jobs
by cmcd 2350 days ago
We already know Windows has some pretty excessive telemetry, it is not unreasonable to assume this or other elements of the OS can be exploited to gain control of a wallet.

At least with Linux we have thousands of open source developers keeping an eye on things, chances are much higher that an issue would be caught with Linux since Windows is closed source.
2 comments
falcolas 2350 days ago
> At least with Linux we have thousands of open source developers keeping an eye on things

A bit of pithy sarcasm for your morning: Those thousands of eyes worked so well with OpenSSL, didn’t it?

Those eyes are less vigilant than you might think, especially when the eyes aren’t being paid to monitor a particular chunk of code.

link
sudosysgen 2350 days ago
Yes, they worked pretty well for OpenSSL. The issue was found eventually. In a proprietary system, it may have been there forever.
link
jcranmer 2350 days ago
You're discounting the risk that, because it's open source, everyone assumes that someone else has done the security analysis. That is precisely what happened with OpenSSL--everyone assumed, since it's a big open source package, that somebody was keeping on top of this sort of issue, but nobody was.

That there have been two major OpenSSL security fumbles (first was the Debian OpenSSL fiasco, second Heartbleed) sort of suggests that the value of "many eyes" for ensuring security is vastly overrated.

link
pbhjpbhj 2350 days ago
How's that different to MS Windows, we assume the code is good, but some of the errors/oversights that crop up beggar belief.
link
turc1656 2350 days ago
It's not different. I think that's their point. FOSS like Linux doesn't automagically make it "safer" than proprietary systems like Windows.
link
falcolas 2350 days ago
It was not found by general developers doing security audits, it was found by a security company doing fuzzing attacks against SSL libraries.

And not to mention that Windows - the explicitly called out alternative from this article - makes their source available for security companies (as well as general developers who sign up for their MSDN program).

link
ryanlol 2350 days ago
> In a proprietary system, it may have been there forever.

Why? Heartbleed was discovered by fuzzing the compiled binaries, not by eyeballing the source code.

Nothing prevents you from performing the exact same research on proprietary software.

link
ryanlol 2350 days ago
> At least with Linux we have thousands of open source developers keeping an eye on things, chances are much higher that an issue would be caught with Linux since Windows is closed source.

That’s all utterly irrelevant when ElementaryOS doesn’t even offer reproducible builds.

Besides, source code access doesn’t make finding bugs much easier. Usually you’ll be auditing binaries anyway.

link