Ask HN: Could vast amounts of attck vectors be mitigated by moving off MS?

https://news.ycombinator.com/item?id=39207203

by morphicpro • 2 years ago

6 6 2 years ago

news.ycombinator.com

China's Volt Typhoon has been all over the news this morning.

Reading over the docs on these threats it looks like the majority of these vectors are isolated to MS infrastructure.

https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_PRC_State_Sponsored_Cyber_Living_off_the_Land_v1.1.PDF

sickofparadox• 2 years ago

Depending on what your threat profile is, if you are being targeted by nation-state actors, you do not have the best chance of coming out the other side unscathed. I don't think that switching from MS to various open source infrastructure is going to help you, especially when you consider the fairly reasonable reality that most advanced state actors probably have multiple zero days in various software projects stored in case they need to use them.

morphicpro2• 2 years ago

Ok ok, lets throw java in there with MS then too. :P

Bad jokes aside. From the looks of it most of these vectors are SOHO routers thus not really big corp targets as much as average people too.

mikewarot• 2 years ago

Your best long term strategy is to switch to environments that don't use ambient authority as a foundation.

morphicpro2• 2 years ago

This is the first time I've heard of this term. https://en.wikipedia.org/wiki/Ambient_authority

This was interesting to read. Thanks

Funny I was just reading about Macaroons

hnthrowaway0328• 2 years ago

I have a hunch that if you choose super legacy systems such as Novell the malware might not even recognize it.

antongribok• 2 years ago

This reminds me of a joke:

"The reason we haven't been hacked is because we still run 16‐bit POS systems, and today's hackers don't know how to fix anything is such a small address space."

Ask HN: Could vast amounts of attck vectors be mitigated by moving off MS?

Related Stories