NetNews Usenet Archive 1992 #19/NN_1992_19.iso/spool/comp/os/mswindo/misc/2537

Text File | 1992-08-30 | 6.9 KB | 149 lines

Newsgroups: comp.os.ms-windows.misc
Path: sparky!uunet!elroy.jpl.nasa.gov!nntp-server.caltech.edu!heathh
From: [e-mail] (Heath Ian Hunnicutt)
Subject: Re: Windows == OS
Message-ID: <[e-mail]>
Sender: [e-mail]
Nntp-Posting-Host: punisher
Organization: California Institute of Technology, Pasadena
References: <[e-mail]> <[e-mail]>
Date: Mon, 31 Aug 1992 04:59:41 GMT
Lines: 136

[e-mail] (Name) writes:
>>   You are ONLY describing the lack of security in the OS Windows. The main re>   ason
>>   for that is, that all apps and the system are running on the same CPU
>>   protection ring.
>Correct, I am ONLY describing the lack of security in Windows
>(please don't put OS, it creates a bitter taste in my mouth, you'll
>understand why in a while, it is premature to explain why now), AND I
>have continued to explain the argument, but you missed it even after
>I explained it.  Let me ask you, what is the essense of the argument
>you commented?  Actually, answer what does this lack of API security
>in windows, in particular, mean?
    It means exactly this: NOT ALL OF THE HARDWARE THAT WINDOWS
SUPPORTS ALLOWS FOR A SECURE OPERATING SYSTEM.  Windows 3.0 ran on
the 8088 and 8086, for heaven's sake.  Even the 286 (which the
Windows OS 3.1 supports) does not make it possible to do many things,
among them effective memory security.  Bill Gates called it (the 286)
"brain damaged" for good reason.
    However, I can also run XENIX on a PC/XT.  Now, if you try
to tell me that XENIX is not an OS, you will be wrong.  However,
XENIX on the PC/XT has NO CHOICE but to allow unrestricted memory
access.  i.e., it is not secure.
    Windows is not secure for the same reason that XENIX on
8088-based machines is not secure: the hardware does not support
memory security.

>Windows is not viewing the underline machine as bare hardware, it is
>aware of the existence of an underline machine+an operating system
>that runs it (DOS).  Hence, calls to the underline machine and to the
>operating system that runs it are possible.  Look at the
    Calls from Windows apps to the DOS services are intercepted
by Windows, and (for the most part) fulfilled BY WINDOWS.  The exception
to this is some file I/O that operates on the DOS file system.
    If you don't believe me, then you don't know enough about
the differences between protected mode and real mode.  i.e., no
DOS calls from WinApps at all would work without the work of Windows.
I know Petzold does not go into this in all the fory detail, but
that does not mean that it is not true.  Petzold's book is rife with
errors, omissions, and stylistic mistakes.  (As in, Windows'
interface style, not writing style...)  I am not criticizing either
Petzold or his book, I am just pointing out that the Petzold book
is not holy writ.

>diagram of OS/2 again:
>[very nice ASCII art deleted]

>These API functions are are application APIs (sort to speak).
>However, to implement these APIs windows had to "implants" some things
>into DOS, which contributed to your conceptual confusion (and which
>makes windows something that is also prematured to discuss now, but
>not an operating system).
    I don't understand the first sentence grammatically.
Which APIs are Application APIs?  What do you mean by "Application
Application Programming Interfaces"?  If you are cutting on the
fact that Windows EXEs and DLLs can extend the Windows interface,
then you should be aware that this is also possible in OS/2.


>>   BUT AN OS HAS NOT TO BE SECURE TO BE AN OS.
>This is the result of you misunderstanding my arguments; mistaking
>subtle argument to ignorant onces.
    Well, that's a bit trite, but I see what you're _trying_
to say.  You think that Windows should isolate a program from
its PSP, since the PSP is a DOS construct.  Correct me if I got
it wrong.
    However, they way you originally phrased your point
indicated that in Unix, you are not allowed to directly access
your PSP, while in Windows you can.  I can certainly see why
the normal reader would confuse your complaint with complaining
about the lack of security in Windows.
    You see, *some* versions of UNIX are able to use hardware
devices to restrict memory access such that programs may not
"toy with" their PSPs.  The PSPs, however still exist, and this
does not keep UNIX from being an OS.
    Windows has PSPs, too.  They are accessible to the hacker
only because Windows does not (and should not) make undue assumptions
about the hardware on which it is running.  Perhaps Windows 3.1
could kludge the security, but this would also break many working
WinApps.
    Your real bone seems to be that a DOS-like PSP is used
for every Windows program.  First, the PSP used in Windows is not
exactly the same as the DOS PSP.  The PSP is now a Windows structure,
too.  For example, all the pointers are turned into non-DOS
compatible protected mode selector:offset pointers instead
of segment:offset pointers.  Also, a few fields of the PSP
are used by Windows, but not by any DOS program.
    The reason PSPs exist in Windows is not that Windows
uses DOS for task switching, but that Windows uses DOS as a
"file system device driver."  DOS expects to get a PSP, so
Windows gives it one.  Anyway, Windows had to use something
very similar to a PSP, so it might as well use a modified
PSP structure.

===================================================================
An aside:

    Furthermore, you keep making wild claims about how Windows
must work because "it makes sense," "Petzold implied it," and
"you just know."  When confronted about these assumptions, you
often say "I don't need to see any code to know how it works,
just like I don't need to see the number 123456! to know that it
exists."
    That is a totally bogus argument.

    For one thing, the exponential operator is a well-defined
operation over a well-defined set.  The set is, namely, the
natural numbers.  Exponentiation can be expressed by a recursion
formula.  As you may know, recursion formulas are easy to meld to
the purpose of an inductive proof of existence.  i.e., I can
easily PROVE that 123456! exists, based on axioms of mathematics.

    There are no axioms regarding OS construction, so you can't
pretend to be able to prove that Windows works in any particular
way.

    You have been wrong with regard to your statements of how
Windows "must" work on more than one occasion.  When confronted,
you merely change your tack without replying to the information
presented to you.

    By the way, I know that you are wrong, because I know
people who _have_ seen the Windows source code, and they tell
me that things don't seem to work the way you'd like to believe
they do.

    Remember when this argument started, and you thought
that Windows' schedular never switched stacks?  When about 5
people posted to counter that idea, you replied that that was
never part of your point, anyway.  Why did you rely on it so
heavily at the time, then?

Have a good night,
Heath

--
On Saturday, April 18, 1992, this .sig became self-aware.