BitMastro

I didn't say that, I said that both went for what was the optimal choice at the time.

Why Apple didn't go for Swift from the start? Because Objective-C was used in NeXT and then OSX and so on.. when the time was right ans Swift was mature it has been introduced.

The same with JIT VM, that, again, are then norm for Java bytecode.

Also Google could not be restrictive on the hardware, since they are not manufacturers and the OS is open source. They restrict to ARM CPUs only? Fine, Intel forks it and ports to x86 anyway.

Smart guys work in both companies and they evaluate pro and cons of every approach anyway.

You're comparing apples and oranges, Apple had the privilege of choosing its own hardware and programming language.

For android they went for java because of popularity, and everyone can use it on their own hardware.

So you have a java based language running on ARM, x86 and MIPS, what would you choose? A proven approach like JIT VM or AOT?

I agree in general with all your point, apart from 4 and 5.

Malware in linux repositories is "practically" impossible. Software is most of the times peer reviewed and patched in different ways by different distros. And if a particular software becomes more popular it also comes under scrutiny by more people that want to change the source to add their own features. All the packages are checksummed and repositories have cryptographic keys to establish authenticity.

Of course bugs and security vulnerabilities exist, but the same applies to other OSes as well. And I do understand that UAC is obnoxious for users, but they didn't care about creating problems for legitimate users with the no-ip case since it was posing danger.

That android report makes two assumption: a very wide definition or malware (also installing java should be considered a malware because toolbar), and the fact that a malware doesn't usually last more than a day before being removed automatically.

I'll give it a try:

privilege separation and permission since the beginning

only super user was allowed to install new software

(simplifying) different distros and different versions created diversity making it difficult for an attack area to be widespread across all installations

typing a password for additional privileges requires more attention than clicking a button

apparmor has been enabled by default since a couple of years, it used to break some stuff but not anymore

(simplifying) new files are not executable, and they don't rely on extensions to determine the associated program

since linux is not the default it requires a learning curve that people using windows don't have, so users are more tech savvy

since the source code is available, more people COULD have a look at security vulnerabilities, and in case of emergency the don't have to wait for someone else to provide a patched binary

That said, I don't consider security on windows to be a disaster. It certainly is improving and in general they also pay a lot more attention to security.

1) Linux and other unixes were created with the idea of privilege separation and permission baked in. Windows had to add it later, while keeping compatibility

2) Linux has a variety of kernels and libraries versions across its base, making it difficult to exploit it uniformly

3) MS is indeed capable of making secure OSes, I don't deny it, but you should not use Xbox, Windows Phone and RT as examples, since all three of them can ONLY install approved software (less for RT, but it's not used by end users in the same way)

4) MS could have used the same approach used by Linux and Android (and partially OSX): have a central approved and monitored repository of software, but giving the possibility to add external software by jumping a few hoops, i.e. inserting a password, or checking a couple of checkboxes before allowing untrusted installations.

5) To prove the point, Android has malware almost exclusively outside of the google play store. Never heard of someone getting malware by using android, while I know an handful of people getting malware on windows (this is anecdotal experience, but I don't have any other data)

6) The shitstorm was raised because on some Secure Boot implementations it was impossible to disable it

no-ip primary use case is certainly not botnets. It's used by dsl users to connect to their home network, or to get an easy to remember address for a vps, or maybe while developing something before getting a proper domain.

Sometime we spend time on a project for the good of the community, and it's ok, because sometimes I give back time, sometimes someone else does and so on.

It's also ok to try to get some money out of your time, if it's desired.

Not ok: use someone else's time to gain personal profit, expect someone else to pay for your actions, etc

True, but be polite about it: "Sorry, I'm disappointed because my expectations differ from yours. I'll found an alternative. Good luck with your project"

I would like to thank you for creating go read and making it open source, it's what I use as RSS reader, using my own free quota of App Engine. I hope I can contribute back some day.

  "30-day trial: This action cost me about 90% of my users. Many were angry and cursed at me on twitter. I agree that it is sad I did not say I was going to charge from the beginning, but I didn't know that I would be paying hundreds of dollars per month either."

Honestly I think the sense of entitlement nowadays is way too high, people use a product that is free and needed weeks or months of your own free time, and then complain about it when you change it.

If you decide to charge for it, you're a greedy bastard, instead if it's free, they say "if you aren't paying, you are the product". Other complain that the product doesn't work, when instead it's a case of PEBCAK. When it's not, it means you're going to say goodbye to a couple of night's sleep or a weekend or too, or maybe it's ONE feature away from being perfect (again).

...sometimes I hate people :(

Maybe a solution could be weighting the vote according to the user history: a user leaving a single vote on a single movie shouldn't be as influential as an user that voted on a wider range of movies over time