full-disclosure - Re: Windows 7 UAC compromised

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 06 Feb 2009 13:07:40 -0500
From: Valdis.Kletnieks@...edu
To: Ureleet <ureleet@...il.com>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Windows 7 UAC compromised

On Fri, 06 Feb 2009 12:46:19 EST, Ureleet said:
> doesnt this work for other oses?

Much of the competition are all Unix/Linux based, and as such the APIs are
*very* similar from one to another.  As a result, you get 2 effects:

1) MacOX, Solaris, RedHat Enterprise (and so on) all have mostly the same POSIX
API, so a vendor can get stuff working on one, and have a pretty easy time
moving to another.  If you're being careful in your coding and avoiding most of
the weirder vendor-specific extensions, moving from (for instance) Solaris to
RHEL is actually easier than XP->Vista.  So if your OS vendor screws the pooch,
you can often get your application for another system.

2) Since there *isn't* as strong a lock-in as with a Microsoft OS, all the
OS vendors have a big incentive to *not* screw the pooch by making radical
incompatible changes - they get done in evolutionary compatible ways.  And
since the OS is all open-source, an enhancement done by one vendor will
eventually show up in the others if it's a useful feature (there's been a
number of things that have over the years crossed from Linux into the
*BSD/Darwin/OSX world and visa versa).

Also, most of the open-source companies have a totally different business
model.  They can't make much money selling me open-source bits - what we pay
them for is *support*.  I hit a bug, but I have better things to do than
track it down - I throw it at the vendor, and they do the bugfixing and
ship me a new version.  A new release of OpenOffice comes out, with different
pre-requisites, I pay the vendor to sort it all out and build it to save me
the time and effort.

So Microsoft has good economic reasons to *not* fix stuff so they keep their
customers captive - while RedHat's survival depends on them shipping me stuff
that *works*.  Different market niche, different mindset, different results.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/