Community Comments To Security Absurdity Article 190
An anonymous reader writes, "Earlier this year Noam Eppel's Security Absurdity article generated much debate in the Information Security community (covered on Slashdot at the time). He claimed that we are currently witnessing a 'profound failure' in security. Now the author has posted a follow-up highlighting some of the community comments prompted by the article, titled 'Feedback to Security Absurdity Article — the Good, the Bad and the Ugly.'"
We wouldn't be having this problem if... (Score:3, Insightful)
people would use common sense.
Re:We wouldn't be having this problem if... (Score:3, Informative)
"
* Don't click on links in email messages. Type the URL in your browser manually.
* Disable the preview pane in all your inboxes.
* Read all email in plain text.
* Don't open email attachments.
* Don't use Java, JavaScript, and ActiveX.
* Don't check your email with Microsoft Outlook or Outlook Express.
* Don't display your email address on your web site.
* Don't follow links in web pages, email messages, or newsgroup without knowing what they link to.
* Don't let the computer save your passwords.
* Don't trust the "From" line in email messages.
* Never Use Internet Explorer and instead Switch to Firefox.
* Never run a program unless you know it to be authored by a person or company that you trust.
* Read the User Agreement thoroughly on all software you download to ensure it is not spyware.
* Don't count on your email system to block all worms and viruses.
* Get a Mac
"
Now, how many of those do you think the average computer user knows about? Not many, I think. Most people see features and want to use them so they ignore many of those suggestions. Thus, this common geek sense is not common sense to the average user, and frankly I wouldn't expect the average user to remember or know all of this stuff all of the time unless we tested computer users like we did drivers, and even that has gaping holes.
Re:We wouldn't be having this problem if... (Score:5, Insightful)
Even of the items that I know about - which is most of them - that doesn't mean that I follow them. As far as them being common "geek" sense, they might be, but:
So really, most, if not all, of that list isn't a "never do that", but a "use common sense before you do that", and that's most of what it amounts to in the first place. Security would be better if it wasn't for the hideous defaults that we put up with - which in an ideal environment without worms and viruses and such would make for better usability, but since most people don't use their computers in a hermetically sealed room with no connection to the outside world whatsoever...
Re:We wouldn't be having this problem if... (Score:4, Insightful)
Computer security is a state of mind. Maybe if the internet was more like a construction site, where not being safe = losing a finger... people might take the time to learn how to anticipate threats instead of just blindly applying a set of rules.
Re:We wouldn't be having this problem if... (Score:2)
Computer security is a state of mind. Maybe if the internet was more like a construction site, where not being safe = losing a finger... people might take the time to learn how to anticipate threats instead of just blindly applying a set of rules.
But that's the problem. A construction site is an unusually dangerous place so people use extra caution. There are signs and common safety procedures and everyone allowed in is supposed to be a construction worker specially prepared for these risks. Right now it is as though almost every restaurant, playground, store, and sidewalk was held to the same safety standards as construction sites and it is common for everyone to buy and wear a hardhat most of the time. This is unacceptable.
Re:We wouldn't be having this problem if... (Score:2, Insightful)
Re:We wouldn't be having this problem if... (Score:2)
If you follow point 5, not following point 3 is rather harmless... few viruses run via Wine. ;)
For linux I would instead of point 3 do "Use your package manager to install software
Re:We wouldn't be having this problem if... (Score:2)
The issue, as I understand it, is that some phishing URLs use special characters very similar to standard English letters. Stuff like "http://update.mîcrosoft.com/" (notice the weird thingy on the "i"?) but possibly without even that visible a difference. So if you click the link or even copy-paste it, you risk being directed to a phishing site.
Re:We wouldn't be having this problem if... (Score:2)
Hence the original rule is "type the address in manually".
...if Sysadmins and Programmers did their jobs (Score:5, Insightful)
I'm not sure I agree with this notion of putting all the security onus on the end user at all. What if every time I got on the subway it was my job to check to see if the wheels were about to fall off? Or if every time I sent a letter through the regular mail it was up to me to make sure the envelope was unopenable by anyone but my intended recipient?
When you start having the list of "common-sense" security measures taking up more than a paragraph, that means there's something wrong somewhere up the food chain from the end user.
I know it can be done. I work at a small University and I haven't seen a single spam in my inbox in the last year. I get a list every so often of what the spam filter caught and it's amazingly accurate. And this from a system that's run by the usual half-bright academic computer services staff member.
And what about an operating system that's basically a leaky boat? Before it wastes another minute on giving me transparent windows, Microsoft needs to make Windows impenetrable to spyware without the help of half a dozen spyware catchers, firewalls and adware monitors. If an operating system can't provide basic security, then what good is it anyway?
A huge percentage of the traffic in the internet's tubes goes through a limited number of systems and providers. They might start doing their part too.
And before you lazy bastards who are making a living at "internet security" tell me "you don't know anything about internet security"... You are goddamn right I don't know anything about internet security, and I have no interest in learning. In fact, I own a house and I don't know anything about motion detectors or satellite surveillance (well, actually, I do, but I shouldn't NEED to) to be able to secure my house. I lock the front door and feed my mastiff and that takes care of it.
I am getting impatient with the ever-lengthening list of security measures regular end-users are supposed to take to use the internet. And I'm way past impatient with security measures that involve giving up utility, such as "don't click on hyperlinks, type in your URLs".
Now you there, with the bad skin and "/." t-shirt. Get to work and figure this security thing out and leave me alone with your "common sense".
Re:...if Sysadmins and Programmers did their jobs (Score:2, Interesting)
Well if you're driving a car (which is probably a better analogy) then it is your job. There are certainly measures that can be taken by programmers and network admins to make things better, but the freedom to go anywhere on the web will always come with the price of some degree of responsibility, both for your own well-being and that of other users (again with the car-driving analogy). Surely using a computer to browse the web is too complex an activity to be made completely idiot-proof, without removing a significant amount of the freedom that makes it so worthwhile.
Re:...if Sysadmins and Programmers did their jobs (Score:2)
Of course, I agree that people should use common sense when computing. My only argument is that common sense does not extend to typing in URLs instead of clicking links.
Re:...if Sysadmins and Programmers did their jobs (Score:2)
car = your computer = private/your responsibility
road = internet = public area/greater controlling authority's responsibility
Re:...if Sysadmins and Programmers did their jobs (Score:2)
a) Other cars
b) You, on your own, doing something wrong
Cars are still unable to compensate stupid drivers. They probably never will be.
Computers with dedicated functions can be made to compensate for stupid drivers (Ever seen a 360, Wii, or PS3 getting rootkitted? Me neither).
But multipurpose machines probably never will.
Outlook not so good - and as for exchange (Score:4, Insightful)
There is a thing called email which is far more useful and has been around longer - you also can use mbox files readable even by a text editor instead of some weird database that requires shareware to fix when it gets corrupted. If Microsoft provided tools to support their own products properly I would recommend it - but no, conventional email servers available from a lot of different sources are superior in almost every way. Even the horrible sendmail configuration file is superior to weird registry hacks to change the behavior of exchange.
Disclaimer - I've only looked after 3 MS Exchange servers and one bare metal rebuild from backup to recover old mail (nightmare that would never be required with a sane mailbox format - the whole thing is just too fragile and finicky and required an install with the same service packs, identical company info strings in the install, same registry hacks etc). Open relay by default with one patch too aparently - or perhaps that just has to be fiction because they could not be that stupid could they?
Re:We wouldn't be having this problem if... (Score:2)
Not necessarily overkill. An exploit which existed for quite sometime are Unicode characters which look the same as an US ASCII character. E.g., the greek omicron looks pretty much exactly like an "o". Someone could jolly well have you think you're going to "www.mozilla.com" when it's actually written with an omicron and is, in fact, a completely different site. Or there are a lot of other blocks in Unicode, e.g., the cyrillic (russian) block that has characters which look just like an US ASCII character to you, but to a computer (e.g., to the DNS server) they're a completely different character code.
For reference, see Bruce Schneier. [schneier.com]
So if your mail client supports UTF-8, and honours the encoding in the headers, you can stare at that link long and hard and even in text mode, and it will look legit.
Disabling active content will go a long way, but won't defend you against buffer overflows. If you have a preview pane enabled in Outlook, you can't even (easily) delete such a virus without becoming infected, because the moment you've clicked on it, the buffer overflow has already happened. So, yes, by all means, please do disable the active content, but also do disable the preview pane.
A lot of exploits are/were based on JavaScript exploits, believe it or not. A lot of the fake-ui phishing attacks use JavaScript to, for example, spawn a window without the toolbars and URL bar and with a faked set of bars there. And a lot of cross-site scripting attacks rely on JavaScript to do the dirty work. It may be a badly designed site, rather than a vulnerability of JavaScript itself, but you can do a lot worse than disabling one piece of the puzzle that they rely on. Etc.
As for ActiveX, heh. Don't dismiss that so quickly. I know at least one marketter-turned-(bad-wannabe-)programmer who was telling me about how he cleverly uses Mozilla to be safe from all the IE exploits, but installed some plugin that executes ActiveX in Mozilla. Now I don't know what plugin that is, and wasn't too interested to find out, but I found it funny that someone could be that clueless. The moment you install the same inherent vulnerability in Mozilla, then all that false feeling of security is just Cargo Cult.
Or see the many people who think they're somehow secure because of ditching IE... when all they've done is download some "3rd party browser" that's just a funky border around IE. There are thousands of those "browsers" by now.
So, yeah, I'd insist on hammering that one separately into people's heads. Because, as above, if you just tell them "don't use IE because it's not secure", but they don't understand why and what parts, they'll find a way to shoot themselves in the foot unknowingly.
Re:We wouldn't be having this problem if... (Score:2)
Which sort of suggests the solution. Instead of associating each language with its own set of characters, there should be one master set of characters and each language chooses the set of letters it needs. Thus an 'o' really is an omicron.
That would still leave characters that are subtly different, and the unpleasant question of trying to decide when and what difference is sufficient or not to warrant a new character. But an option to warn you when your url contains characters not in your default alphabet seems like a pretty trivial solution either way.
Re:We wouldn't be having this problem if... (Score:2)
Re:We wouldn't be having this problem if... (Score:2)
How do you tell from viewing the URL that microsoft.com isn't the same as microsoft.com.some.unicode.characters.com.
"don't open unexpected attachments seems more correct than not opening any attachments"
How can you tell unexpected attachments if it comes from a known address and without opening it.
"how frequently is a Mac targeted in preference to a Windows system?"
It's not a matter of frequency, the underlying OS is more secure. The fact is that spam is promulgated by vast networks of compromised Windows computer.
"most people don't use their computers in a hermetically sealed room with no connection to the outside world whatsoever..."
Is it technically possible to design a 'computer' that don't get viruses/hacked by opening an email attachment or clicking on a web URL, that a user without a degree in computer security can use.
Re:We wouldn't be having this problem if...(Score:5, Insightful)
Re:We wouldn't be having this problem if... (Score:2)
Ahhh, the 'macs don't have viruses/worms because they are less common, and therefore not targeted' argument. Except that OS 9 was less widely used than OS X and had many viruses.
MacOS "Classic" was significantly more widely used than OS X.
And which virus/worm writer wouldn't want to be the first successful writer for OS X?
The hard part about viruses isn't creating them, it's getting them to spread. When only one in 100 machines is a target, it's not going to spread very fast.
I don't think that there can be any doubt that OS X is being targeted.
I don't think there's any doubt it is targeted orders of magnitude less than Windows (or, indeed, even Linux - albeit for different reasons).
"Market share" is a simple way of referring to a number of significant factors which all combine to make Windows vastly more exploited than other platforms - and "security" (whatever the hell that's supposed to mean) is a relatively minor factor.
Re:We wouldn't be having this problem if... (Score:2)
Yet there are thousands of viruses for AmigaOS for example..
Re:We wouldn't be having this problem if... (Score:2)
Yet there are thousands of viruses for AmigaOS for example..
Probably because the Amiga was, in its past, one of the most popular computing platforms in the world.
Re:We wouldn't be having this problem if... (Score:2)
Re:We wouldn't be having this problem if... (Score:2)
A memory resident virus on DOS needs techniques somewhat similar to a TSR, but much simpler. All it needs to do is allocate a bit of memory for itself and hook one of the interupts used for calling DOS. Not a very difficult thing to do, and on DOS there are no provisions for managing multiple programs, so there was no need to try and hide from those either.
Not to mention that there were a lot of viruses on DOS as well as AmigaOS that were not memory resident, and did not need such features at all.
Re:We wouldn't be having this problem if... (Score:2)
Uh no, it has never been anywhere close to 'one of the most popular computing platforms in the world', see http://www.pegasus3d.com/total_share.html [pegasus3d.com] and http://arstechnica.com/articles/culture/total-sha
Not profitable (Score:2)
(NOTE: I did not say all Windows users are clueless. I merely said that there is a large population of Windows users who ARE clueless.)
Response from Joe Luser (Score:5, Insightful)
Too much work. I bought this computer to make my life easier.
* Disable the preview pane in all your inboxes.
How do I do that? I'm not smart like you when it comes to computers.
* Read all email in plain text.
I wouldn't get to see the pictures my friends send me if I did that.
* Don't open email attachments.
What? And miss out on the lasest web games my friends are playing?
* Don't use Java, JavaScript, and ActiveX.
No problem. I don't even know what those are. I'm not smart enough to learn all that fancy software.
* Don't check your email with Microsoft Outlook or Outlook Express.
But Outlook is what my computer came with. I can't afford a new computer this month.
* Don't display your email address on your web site.
Unacceptable. My customers need to be able to contact me.
* Don't follow links in web pages, email messages, or newsgroup without knowing what they link to.
How do I know what it links to before I click?
* Don't let the computer save your passwords.
Sorry, I don't have a photographic memory like you techno-geniuses. And don't tell me to write it down either, I'll just lose the piece of paper.
* Don't trust the "From" line in email messages.
Then how do I know who sent me the mail?
* Never Use Internet Explorer and instead Switch to Firefox.
I've used Internet Explorer for years. I have a busy life, I don't have time to learn Firefox or else I would.
* Never run a program unless you know it to be authored by a person or company that you trust.
How do I know who wrote the software, it just shows up on my computer?
* Read the User Agreement thoroughly on all software you download to ensure it is not spyware.
Yeah right. Those are longer than the internal revenue code, even my computer nerd brother doesn't read those.
* Don't count on your email system to block all worms and viruses.
Then what do I count on? And why can't a big company like Microsoft figure out how to block viruses?
* Get a Mac
At home? I can barely keep up with gas prices let alone get a new computer. At work? The company makes us use Windows, we don't have a choice.
Re:Response from Joe Luser (Score:3, Insightful)
JS/Java interpreters should not be able to enter a state where they can damage the user's computer. Maybe they'll crash the tab that they were loaded from, but that's it. This isn't quite how things work today, but software can be improved. Firefox and Java are open source, so that makes finding and fixing any insecurity easier.
The same goes for clicking links in e-mail. You should be able to click any link. The worse thing that can happen is you think the site is your banks (sorry, you're just dumb), or you get the goatse guy. Get over it and move on -- clicking a link should not cause any code execution on your computer.
Re:Response from Joe Luser (Score:2)
Then who will? Do you think the browser creators will? We'll they might, but it's rather iffy. Just take a look at Internet Explorer. It is the most popular web browser from a very large company and it has major problems. Microsoft is just not interested in providing users with a high level of security. That leaves the various organizations that administrate internet related stuff and all of them have shown as much effectiveness as a dead badger.
So at the end of day the users are left with the responsibility of keeping themselves safe. Of course, they have no clue how to do this which is why we still see IE and Windows computers all over the place. Instead they go about practicing their Norton voodoo and listening to everything the big media companies say.
Re:We wouldn't be having this problem if... (Score:2)
The author of that list is being dogmatic, not smart.
Re:We wouldn't be having this problem if... (Score:2)
Well, as of September 22nd it was vulnerable. I'm sure everyone updates their machines the instant that new patches come out, though.
Re:We wouldn't be having this problem if... (Score:2)
Re:We wouldn't be having this problem if... (Score:2, Informative)
I hope everyone realizes that this list was given as an example of where IT "best practices" have failed as a solution for the security problem. The whole point was that the existance of such a list is a symptom of the general security failure, and certainly not as a recommendation from the author.
Don't worry! (Score:5, Funny)
It can mean only one thing... (Score:3, Funny)
Then it is true: Windows Vista is Bill Gates' secret doomsday weapon, the final piece of his twisted plot for total domination, which will destroy humanity and bring about the rise of the machines in our place!
I always knew that paperclip looked shifty.
you got it slightly wrong (Score:3, Insightful)
Re:you got it slightly wrong (Score:2)
In the year 2000:
??? you mean like this... (Score:2)
lunes, martes, miércoles, jueves, viernes, sábado, domingo
Gonna have to dig deeper.
Re:??? you mean like this... (Score:2)
Montag, Dienstag, Mitwoch, Donnerstag, Freitag, Samstag, Sontag
Excludig days with a "g" already solves a lot of problems in some parts of the world
Randomly Generated Title? (Score:5, Funny)
"Alteration Frequents From Space-Age Poetry Bannister"
"From Tabletop Mannered Asterisk Will Age Understood"
"Community Comments To Security Absurdity Article"
"Likely Georgetown Under Wisely Instantiation If"
Wrong approch (Score:4, Insightful)
Virus scanners, network behavior analyzers, "app armor", stack canaries, random load addresses, nothing. 'Search and destroy' the spybots? Please. The biggest problem is C and all the other non-typesafe languages. Safe languages simply trade a certain amount of performance for the impossibility of buffer overflows, underflows, stack 'smashing', heap corruption, double-free's, pointer arithmetic errors, and all of the other low-level attacks. Everything at that level is toast in Java or in "managed" C# for instance.
This entire class of low-level flaws can be solved completely. Then it's just the higher-level problems like impersonating web pages, xss, some trojans, that kind of thing. Still a problem, yeah, but without the entire class of automatic propagation it is so much less of one.
Right approach; at least for some. (Score:3, Insightful)
Where I come from, they call this "securing your revenue stream."
Seems like the security companies are doing A-OK there; they've got more business than they can shake a stick at, and it's not going anywhere soon. They have a vested interest in not 'solving' the problem, even if they knew how to do it.
Like all arms races, if you're in the arms business, you can laugh all the way to the bank. (Until someone decides to rob you, that is.)
OT, I know, but (Score:2)
Wow. That simple statement also sums up the War on Drugs.
disclaimer: USED to work in Law Enforcement as part of said "war"...
Re:Wrong approch (Score:3, Informative)
I think you were looking for the language war article. This one is about ignorant users clicking "OK" to things.
Re:Wrong approch (Score:2)
The user's environment could be restructured so that clicking "open this program" does not allow it to escape and mess up the whole system. So while a user may install google toolbar, and it may report to google everything done, and it may crack passwords and do DoS against some advertiser who didn't pay, when the user selects "Remove google toolbar" it is guarenteed to be gone. But you cannot do this when any program can be hacked at the lowest levels simply because it is written in an unsafe language.
Even high level code like javascript could be constructed to cause a failure in the interpreter, written in an unsafe language, and then escape whatever restrictions are supposedly placed on it (like only being able to run as javascript code for instance).
Re:Wrong approch (Score:2)
Are you proposing we burn all the compilers and shoot everyone who knows C? The very power of the C language comes from its lack of structure. Besides, there's nothing you can do in C that you couldn't do in assembly.
Re:Wrong approch (Score:5, Insightful)
The problem is that the typesafe languages are not realistic for writing desktop software in. Both Java and .NET are plagued with serious technical problems - which is why so few desktop apps are written using them. Even trivial optimisations like stack allocation cannot be done by the programmer in these languages, they take advanced analyses running inside complex optimizing compilers .... running on the users desktop.
Basically, you are right that using these languages would eliminate whole classes of vulnerabilities. But they would not eliminate all of them, and the costs are huge in terms of writing efficient, pleasant-to-use software. Stuff written in Java today is just uncompetitive, secure or not.
Re:Wrong approch (Score:5, Interesting)
Second - What makes you think that you can optimize anything better than a compiler, much less one that profiles your application *as it runs* and makes adjustments on the fly? This has been proven over and over again - Java's garbage collection is in most cases *faster* than hand coded garbage collection. How is that possible? Because Java has more *information* about what is going on at runtime than you do at compile time. It can put very very short lived objects on a special part of the heap, it can do all kinds of things that you cannot do statically.
There are many reasons that Java and now
Pat Niemeyer
Author of Learning Java, O'Reilly & Associates
Re:Wrong approch (Score:2)
Well, yes, but it doesn't always have that information in time to do anything about it.
Both in Java and classic VB, I've wished many times for a way to specify that I'm going to have half a million objects of the same class (I do a lot of batch programming), that should all be created and destroyed as a single unit.
Re:Wrong approch (Score:2)
Virus scanners, network behavior analyzers, "app armor", stack canaries, random load addresses, nothing. 'Search and destroy' the spybots? Please. The biggest problem is C and all the other non-typesafe languages. Safe languages simply trade a certain amount of performance for the impossibility of buffer overflows, underflows, stack 'smashing', heap corruption, double-free's, pointer arithmetic errors, and all of the other low-level attacks. Everything at that level is toast in Java or in "managed" C# for instance.
The point is valid, but the vast, vast majority of security breaches have nothing to do with software flaws (be they design or implementation).
An OS implemented top to bottom in a typesafe language, would not remove the need for a virus scanner.
Re:Wrong approch (Score:2)
We're taking the wrong approach to security. You can fight the symptoms like we have been doing and this will cost a LOT and never really make the system secure. Or you can fight a cause and however much it costs you that problem is solved for good.
Agreed.
The biggest problem is C and all the other non-typesafe languages.
I think you're still attacking the problem at too low of a level. How do you get everyone to switch languages? What is the motivation? What about existing software?
Then it's just the higher-level problems like impersonating web pages, xss, some trojans, that kind of thing. Still a problem, yeah, but without the entire class of automatic propagation it is so much less of one.
Again, much of this can be mitigated if OS designers are properly motivated to do it. If we attack the problem at a higher level yet, this too will be largely mitigated.
In my opinion the solution is simple. All we have to do is properly enforce existing laws. If the US DoJ ordered Microsoft broken up into multiple companies, at least two of which had all the rights to the Windows code base and ordered all their file formats and protocols documented this problem would go away. The cause of most malware is greed. The solution is the same thing. If there were two vendors of Windows, each making changes going forward and forbidden from collusion, their stranglehold on the desktop OS market would be gone. The new companies would have to compete with one another and actually solve these problems and they'd do it to, because it would make them money. Also, alternative's to Windows would no longer be locked out so those OS's could enter the market properly and likewise compete. The solution is simply reestablish the free market and let competitive innovation solve the problem as it should.
three solutions (Score:5, Insightful)
I assume the operating system was Windows? Solutions:
Re:three solutions (Score:2)
Do you even need a firewall? Doesn't NAT auto-magically protect you?
Re:three solutions (Score:3, Informative)
Doesn't NAT auto-magically protect you?
It does until someone tells little Johnny to DMZ his machine so his game will work.
Fix: use router passphrases that the delinquent is unlikely to guess, like "work is its own reward" or "idle hands are the devil's tools"
Re:rofl (Score:2)
Re:three solutions (Score:2)
Re:three solutions (Score:2, Interesting)
I wasn't claiming to have found the magic solution to all security problems. I was just claiming to have found three pretty simple solutions to one particular security problem referred to in the article: the situation where your brand-new computer gets owned while you're still in the process of downloading security updates.
What I object to about the article is that it makes it sound like security is a disaster for everybody. No, actually security is a disaster for everybody who hasn't learned certain skills. Those people happen to be more than 50% of all internet users, but they're still not everybody. The problem is that we're living in a world where a computer user has to be able to do the equivalent of changing the oil in his own car -- some people can, but most people can't.
Re:three solutions (Score:2)
The problem is that we're living in a world where a computer user has to be able to do the equivalent of changing the oil in his own car -- some people can, but most people can't.
I'm a pretty expert user. I have a very good grasp on security. If I'm running a Windows box and want to run an executable I don't know if I can trust, it is not easy. Sure I can make a new user account, lock that account down, use "run as," and hope the executable does not take advantage of any of the common local escalations in Windows. Or I can install a VM and run the executable in the VM on top of Windows and hope that works, for some types of executables. I don't think either of those situations, however, is equivalent to changing the oil on the car. Maybe one person in 10,000 knows how to properly lock down a user account. More can probably install and run a VM, but at a great deal of additional cost. Realistically, just running it and hoping for the best is the only convenient solution within the abilities of a normal user.
So given that running a random executable (be it a game or an installer for something, or some other software a user wants to try) is a common task that is very, very hard to do safely, I think your analogy is way off.
Re:three solutions (Score:2)
You're pointing out a situation that's particularly difficult on Windows, because Windows was never designed from the start with security in mind.
Well that and because Windows does not change to make common tasks like these easy to do safely. I mean, technically the granularity of control is built in. This is very doable and the user would never need to know in most cases. It just would take a little work and MS has no reason to do it
I've never run any application from a user that I didn't have reason to trust.
Users want to run programs. That's why they got a computer. Users will have different levels of trust for different programs. I've audited the code of about three of the hundreds of applications I run on a regular basis. Some I trust more than others, but if I don't run programs I don't have some distrust for, my computer is a paperweight.
That's really a problem with the limited choice of trustworthy software on Windows, not a problem with Windows's security per se.
I think you have the same, very wrongheaded mindset that MS does. As designer of the monopoly OS everyone uses, MS has a lot of influence on the applications that run on top of it, but they don't have the power to dictate to everyone how they make and sell software. They do have the ability to design their OS to deal with the realities of the market today. The problem is, they don't make Windows easy to use for a normal person doing normal tasks safely. You might as well say, "the real problem is people are malicious and write malware." Sure it is, but there's nothing we can do about that and a hell of a lot that can be done to secure our computers. I blame Microsoft for not taking those steps.
In summary, I assume you now concede that safely performing normal task, given the state of application on Windows, is not akin to knowing how to change your car's oil?
Now correct me if I'm wrong... (Score:2)
Somebody tell the security writer what "trojan" means, by the way. I mean, I might have abandoned my history major halfway through, but I don't remember the moral of the story being "Beware when large wooden horses are outside your wall, because that means when you go on a coffee break the large wooden horse will teleport inside your wall, and then disgorge Greeks".
Re:three solutions (Score:3, Informative)
4. Realize that doesn't happen anymore because the firewall that ships with SP2 is an adequate defense.
Network worms targeting out-of-the-box Windows boxes are a thing largely of the past. What may happen is after two months of using the computer and clicking "OK" to those pesky dialogs asking for exceptions to the firewall one of those services may be insecure enough to allow a remote attack. She or he might also get themselves infected via some other method, like surfing the uglier parts of the web with IE6 or opening an executable attachment.
Re:three solutions (Score:2)
SP2 Firewall (Score:5, Interesting)
Also, I wonder what ports SP2 has open in its default, out-of-the-box configuration. Is it totally locked down, with no response to *anything* coming in from the outside? Or does it have a few services still running here and there that could be exploited? Plus, and perhaps this is a stupid question, if you're running a firewall on the local machine as opposed to on a dedicated box, isn't there always a problem of the firewall software having a vulnerability itself? Or the TCP/IP stack? (And why not -- stranger things have happened. Like firmware vulns.) I'm just thinking of everything on the machine that you could possibly overflow/break by sending malformatted packets, for example.
I suspect in the real world, most of the infections happen when users don't go straight to Windows Update right after taking their computer out of the box, and instead get excited and decide to browse around to their favorite forum or two. Since it's not unknown for vendors to load up PCs with all sorts of software, probably including compromised ActiveX controls, all it takes is a trip to the wrong site to get a rootkit/keylogger installed. From there, it's a one-way trip to reformatsville, at least if you're smart. (Which is a real trick, seeing as how many PCs don't even come with reinstall media, instead just taking a chunk of your hard drive for some shoddy "recovery partition.")
Re:SP2 Firewall (Score:2, Informative)
If you fidget a little I'm pretty sure you can unearth some others. For a good reference list where else but here [slashdot.org]?
Re:SP2 Firewall (Score:2)
For a lot of users, whether or not they keep their machine patched is largely immaterial - they'll end up rooting themselves sooner or later when they voluntarily run a trojan or virus. Remote exploits are dangerous yes, but nowhere near as common as an idiot sat at the keyboard with an admin login.
Re:SP2 Firewall (Score:2)
Yes there is. We can educate the users. More importantly, we can make it more difficult to do stupid things, and we can make it simpler to avoid doing stupid things.
Windows XP pretty much requires you to run as administrator. Lots of programs require administrator privileges. If you need to perform some action as administrator, such as installing a program, you must log out (closing all your open windows), wait, log in, wait, perform the action, log out, wait, log in again, wait, set up your work-environment as it was in the first place, and only then can you continue. In linux, I use sudo.
One simple solution is for microsoft to require that any product "designed for microsoft windows" should be able to run perfectly well without administrator privileges. Another would be for them to ship something like sudo (in a gui way, e.g. right-click, choose "Run As"), that is enabled by default.
Or you could do it the way it used to be done (and still is in linux). The web-browser notices that you are downloading a binary file, and asks you to save it. Then the user has to manually run the file him/herself, instead of just getting an annoying popup. (In linux you even have to manually make it executable by chmod'ing it). This means that clueless users will have to prove they have at least a minimal amount of clue, before they are able to do serious damage. And they should not run as administrators, which means the plugin will be installed in their private plug-in folders only.
I'm not sure why MSN messenger needs to allow plugins, and why plugins need to be able to do evil stuff. If MSN messenger need to allow plugins at all, they should be in a sandboxed environment, such as within a JVM, where only "approved" methods and classes would be available for plugin-writers. I have absolutely no clue about this at all, but my guess is that MSN plugins are mostly eye-candy, which means the API available to plugin writers should be limited to just that. A safer alternative would be to only allow "themes" or "skins" or whatever the kids use these days...
Re:three solutions (Score:2)
I'll go out on a limb here... (Score:3, Insightful)
1,000 Cuts (Score:5, Interesting)
When people don't trust technology and don't use online banking, then banks don't spend as much on it. Venture capital and other sources of funding start to dry up; the pace of development slows.
It's not a problem that's probably going to result in a city being vaporized overnight, but that doesn't mean it's not a problem. It's like muggings in a large city: sure, you can wave it off and say that it only happens to tourists, rubes, and the unwary -- why should street-smart people care about it? -- but over time it starts to take its toll everywhere. The economic cost alone starts to act like a tax on everything, and it drives away customers and new business.
People who understand computers and know what precautions to take to prevent being victimized, cannot just put their heads in the sand about the current situation. Particularly since most people who are capable of understanding the problem, earn their living in some technology-driven field, it's those people who stand to be affected by the 'downstream' effects of cybercrime and a culture of insecurity.
Re:1,000 Cuts (Score:2)
Re:1,000 Cuts (Score:2)
Re:1,000 Cuts (Score:2)
I'm currently working for a VERY large bank and it doesn't seem to be significantly impacted. From my admittedly biased view they seem to be putting a lot more resources into expanding their IT based offerings than fighting bad guys.
Are you sure about that? The effects of crime aren't always totally obvious. Maybe you wind up getting less IT commerce business than you would if there wasn't a lot of cybercrime. In some ways the Internet is like a bad neighborhood. There's a lot of people that won't go into that neighborhood for fear of being robbed.
My point is, you don't see the people that aren't doing business with you because of cybercrime unless you actively start looking for them.
The other possibility is, maybe you just haven't gotten hit yet? I hear stories every week about a business having tens of thousands of customer records stolen. How many of those companies said the same thing "We haven't been impacted yet".
Just another ad for Micro$oft? (Score:2, Interesting)
Re:Just another ad for Micro$oft? (Score:2)
Windows and vulnerabilities (Score:5, Informative)
I remember talking someone through setting up Tiscali broadband a few years ago using a Speedtouch and the Tiscali CD. His brand new, shiny Windows XP machine became infected over the connection in under 4 minutes. It's a classic catch-22 situation: You can't update your OS without a connection and you can't go online safely until you've updated your OS.
How about this: Virtualisation is a reality on most machines nowadays. Why doesn't MS use this technology to set up a simple one-time VM to connect and download from a single SSL connection, the public key of which is compiled into the VM, ignoring all other traffic with the single focus of fetching the patches for the worst vulnerabilities, those which have remote exploits? If this were mandatory before enabling the general TCP/IP stack for WAN connections, Joe Sixpack wouldn't be participating in quite so many botnets. Hello! New connection not in my private address checklist. Disable TCP/IP and get the updates before releasing the user to the big, bad Internet. Please wait whilst I sort my ragged arse out and stop you from becoming another statistic...
Or have I simply made the problem too simplistic in my own mind? It seems to me that a single connection from a single port over SSL with no intermediate DNS or man-in-the-middle stages makes sense, even more so if part of the download is the MD5 hash of the update image and the VM rejects any image not matching that.
Bear in mind that the above idea works only for machines using a direct non-RFC1918 or draft-manning address for Internet connections. Those using routers should already be protected from the worst culprits, attack vectors which utilise services running by default, as these usually cannot traverse NAPT, but the feature should include the option to enable manual initialisation over such connections.
Too simple?
Re:Windows and vulnerabilities (Score:2)
Re:Windows and vulnerabilities (Score:4, Interesting)
The reason I suggest a VM is to jail the security update network stack from the main kernel. If you have, for example, a buffer overflow that allows arbitrary code execution in kernel space TCP/IP, you really don't want that running in your main kernel with a public connection; you want it jailed and only when the data is verified and checked against its hash do you want to apply the update image. If the jailed or virtual kernel becomes corrupt, it can be killed without harming the host OS. Detecting the jail doing something nasty should be simple; it should simply talk to one IP and download an image and hash file. If it starts opening other ports, kill it immediately. In fact, simply make the jailed process capable of only talking to the one host on one port. Useless for users and crackers, but just enough to update the OS safely.
I know it's heretic of me in the extreme to suggest the OS takes away a choice, that of diving into the big electronic blue without care or conscience, but a lot of Windows users (and maybe a few others) need these safety nets, if for no other reason than to keep the rest of us safe and our mail servers from fending off spam floods from botnets.
Doing this retroactively isn't an option; users of Windows up to and including Vista gold are now SOL for this idea, which is sad, especially given that Vista has a working out-of-the-box IPv6 stack. You think it's bad now? Just wait until every new machine has it's own publicly routable IP.
The idea, or any such protection mechanism, *must* be implemented in the first RTM version of the OS to work effectively, or at the very least a service pack or point release that OEMs will pre-install. That means in the future, but it is imperative now that IT pros start thinking long-term rather than trying to tidy up their mistakes of the past. These problems cannot be solved by dwelling on mistakes made, just mitigated by exploiting obsolescence and helping time heal.
[1] http://www1.uk.freebsd.org/doc/en_US.ISO8859-1/bo
Re:Windows and vulnerabilities (Score:3, Informative)
I remember talking someone through setting up Tiscali broadband a few years ago using a Speedtouch and the Tiscali CD. His brand new, shiny Windows XP machine became infected over the connection in under 4 minutes. It's a classic catch-22 situation: You can't update your OS without a connection and you can't go online safely until you've updated your OS.
Yes, you can. Just enable the firewall first.
How about this: Virtualisation is a reality on most machines nowadays. [...]
Holy overengineering, batman ! Did you actively try and come with such an incredibly complicated way of avoiding any incoming network connections, or did it just fall out of its own accord ?
Too simple?
Vastly more complicated than it needs to be. All you need to do is not allow any inbound network connections or, indeed, any network connectivity at all until the user has updated (or acknowledged the risk). Which is, incidentally, what Windows has been doing for years now.
Re:Windows and vulnerabilities (Score:3, Informative)
Yes, you can. Just enable the firewall first.''
You are aware that there have been a number of exploits that target Windows's firewall, are you?
Re:Windows and vulnerabilities (Score:2)
For Microsoft to implement any sort of scheme that runs a sandboxed environment until security patches have been applied would require two things:
1. Them admitting that the main product they ship contains serious security flaws
2. Them actually writing a secure sandboxed environment
(1) is something they have been very loathe to do; obviously, no company likes having to admit that their product is seriously flawed. (2) is something that may be possible, but Microsoft's security track record doesn't make it seem very likely.
Still, if the pressure is great enough, we might see Microsoft implementing some sort of solution that makes sure a Windows installation has all available patches applied before being started the first time.
Re:Windows and vulnerabilities (Score:2)
A simple, extensively audited installer that installs whatever it ships with, then contacts some server for security patches, downloads them, and applies them. Only after that do you get to boot Windows.
The big issue I can see here is drivers. Thanks to there being a great lack of standardization in the way hardware is accessed, you will need lots of different drivers for network cards (and, I think, harddisks). These will either have to be implemented specifically for the installer, or the installer will have to support Windows drivers...but that might introduce a complex driver model that will make auditing harder.
Re:Windows and vulnerabilities (Score:2)
That's one opinion. My view is that an OS that targets the general population (e.g. not just experts), but defaults to a less than secure configuration, so that it requires its users to be more knowledgeable of security issues than is strictly necessary, is flawed. If you cater to the general population, make it so that they can safely use it. It's acceptable if the setup becomes insecure after the user changes it - it's not okay if it requires user intervention to become secure.
All of this is obviously for some suitable definition of "secure"; there will always be attacks that can affect the system. However, a system that gets infected quicker than one can download the patches needed to protect against _known_ attacks doesn't meet any reasonable standard of security in my eyes.
Adult pornography? (Score:3, Funny)
Yes, this is clearly over the line. I mean, had it at least been child pornography, that would have been acceptable, but noo, they had to go all the way.
All about Windows (Score:2)
This isn't any surprise that Windows sucks.
What I'm more concerned about is, "How much of this problem extends to Mac/Linux?"
Phishing obviously does and can be avoided with sufficient electrical shock treatment.
But what about the bots and such? I have a lot of hardware sitting online 24x7.
does it matter (Score:2)
does it matter?
so far as i know, neither I, nor any member of my family, nor anyone i know, has actually been seriously hurt by malware, except for a few minutes removing viagra ads, and for me, spambayes does most of that pretty well
as we know, the whole id theft thing is a media exaggeration, like missing children: most of the id theft is from family or friends, and most of the missing children are out for a walk with their parents
it sure does matter .. (Score:2)
It does in that people will be wary of doing online commerce and that will hit the bottom line.
"so far as i know, neither I, nor any member of my family, nor anyone i know, has actually been seriously hurt by malware"
You must be the only one on the planet then.br>
"as we know, the whole id theft thing is a media exaggeration"
"An Emmy-winning film producer whose life was disrupted after hackers stole [usatoday.com] her Social Security number"
was Re:does it matter
Re:Security of who? (Score:3, Informative)
Almost an Advertisement (Score:2)
The article doesn't have much to say outside of the world of Microsoft Windows.
Actually, he dismisses ALL things outside Microsoft and hypes Vista. "Get a Mac" is placed in his list of absurd recommendations along with manually typing links to your browser. Free software is is only implied as a passing part of his core thesis that "security" is so bad that you have to be a computer expert to do normal things with your computer. Putting that onto Mac use shows how absurd the omissions are. Paradoxically after showing just how bad M$ has made the world for us, he praises Vista as a potential savior of the masses.
That kind of advice is terrible and leads to more of the same. A diversity of strong and easy to use platforms is the ONLY solution to the problem. People can and should migrate to other platforms which are secure now and for the foreseeable future. If they don't migrate, M$ will continue to run the vast majority of the world's computers, something that's already a dissaster. If they don't migrate the other platforms will never be as easy and cheap as they should be and M$ will adjust their incompetence to match - they will never do more than they have to. In short, he's ignored viable options to hype one that's sure to fail. I'd call that an advertisement.
Re:Seems a little Windows-centric ... (Score:5, Insightful)
Oh wait. That's right. Linux machines ARE visible targets, yet are not pwned in proportion to their use. "Ah," you cry, "but those are servers, not desktops." True. They are servers with purposefully exposed ports and running outside of firewalls; heck, many a Linux Box (PC or embedded) *IS* the firewall for Windows machines. They COULD in principle be compromised and used in botnets like any other computer out there.
The "bigger target, more problems" arguement is flawed. The underlying problem at the system level (ie, not coutnting phishing, physical security problems, etc) is WINDOWS, period. You can argue about whether it is simply the default security model or braindead design all you want, but until that basic reality is accepted, this point of Windows market share is a deflection from the issue.
Re:Seems a little Windows-centric ... (Score:4, Insightful)
B.
Re:Seems a little Windows-centric ... (Score:2)
Well, I think that's a bit of an over simplification. Sure, the end-user can screw things up - there's nothing you can really do to keep people from screwing up their own machines, if that's what they're into. However, the system design can push things one way other the other. For example, you can make the stack non-executable, getting rid of most buffer over-runs. You can run at a lower security level, requiring user interaction to get elevated privileges. You can default to a browser that runs at an ultra-low security level and reports phishing websites.
Alternatively, you can use a global, shared memory space, omit access controls, and maybe put a big red button on the desktop that will delete all files, and join a botnet. Then for fun, make it so the button can be activated remotely. As a corollary, you could include advanced safety measures, but require recompiling the kernel and hex-editing the resulting binary.
Given the same users, the system with the better design will generally be safer. Although, granted, Bonzi Buddy or Weatherbug could be designed for any OS.
Re:Seems a little Windows-centric ... (Score:2)
Linux isn't in the same class target wise as Windows simply because it isn't the OS of choice for Joe Sixpack.
In my opinion the fundamental problem here is that Windows is not the OS of choice for Joe Sixpack. He just buys a computer and Windows comes pre-installed. If he made a choice the competitive market would solve the malware problem.
When that happens, I feel you will see just as many stupidly successful attacks as you see today in Windows. Why? Because the targets will be those same people that use "password" or "12345" for their security.
It's easy to blame the user, but most infections of malware today involve no user interaction. Even for those that do, a properly designed OS can mitigate most of those problems.
The security of any system, be it Linux, Unix, Windows, OS X, etc... Is solely dependent on the one at the keyboard and unfortunately all too often that person is an idiot.
Scenario 1: malware is downloaded, the OS checks the binary against a known list detects and deletes it and blacklists the host you got it from. Have a nice day. Scenario 2: malware is downloaded and run and infects the user with no warnings from the OS. Is the OS in scenario 1 more secure than in scenario 2, or is the user at fault? Obviously the OS matters. Since I've demonstrated that conceptually the OS matters, all that remains to debate is how much it matters. The answer is a whole lot. Windows and most desktop OS's have really lousy security. New binaries should be sandboxed and restricted by default. The OS should tell you what they're doing and give you the power to decide what it can and can't do. Fix the OS first, then worry about the "idiot" user.
Re:Seems a little Windows-centric ... (Score:5, Interesting)
No. Just no.
I hate this sort of comparison, because it's bogus. It's a classic apples and oranges situation. You are comparing the security of Apache to IIS, not Linux to Windows. Modern versions of IIS are pretty good from what I hear, and besides it's not very hard to be secure when all you run is a firewall and a web server.
If you want to do a real comparison you should compare the Linux desktop to the Windows desktop. Your average Linux desktop is a security nightmare. Firstly there's no active security whatsoever, it's all passive. IE there are no virus scanners/anti-malware tools in common deployment. If the passive defences fail you are screwed, you cannot easily distribute signatures etc to clean up the mess. Secondly, the Linux security model is simply the UNIX security model, which was designed in the 70s for a totally different set of threats. Your average desktop is not a mainframe and does not need to protect users from one another - instead it's decayed into some kind of trivial black/white coarse grained security model in which "root" has absolute power and "users" have less power.
Unfortunately, Linux trains the user to enter their password all the time, given an essentially random set of situations. You have to enter your password to install software, remove software, configure hardware, set the system clock and worst of all to install security updates. The tasks that require root are to the average user totally unconnected. If you are a UNIX geek you can probably figure out why something might need root, but you're in the minority. So users are trained to just enter their password whenever they are asked to, making it trivial to phish it out of them.
Even if you can't get root - who cares? On a modern Linux desktop you can do anything you need without it. Want to crack bank details? Go right ahead, Firefox runs as user and you can ptrace() it to your hearts content. Want to hook into startup so you always run? KDE and GNOME will be happy to oblige. Want to "hide" yourself without modifying the kernel? No problem either, just inject yourself into the address space of each program as it starts and then hook the syscalls at the libc level. Childs play.
So to put it simply - you are dead wrong. The underlying problem at the system level is the system, which is basically the same regardless of whether you use Windows, MacOS or Linux. The UNIX/NT security model is incapable of solving the problem of malicious software, period.
Re:Seems a little Windows-centric ... (Score:2)
If you want to do a real comparison you should compare the Linux desktop to the Windows desktop. Your average Linux desktop is a security nightmare.
You're mistaken. The average Linux desktop is a potential security nightmare, not an actual one. This is because most of the threats you address are not common on Linux so solutions are not as important. I contend that because of the development models, if such threats do become common on Linux, the security changes needed to deal with them will become common because developers are users and are motivated. The same is not true on Windows, because insecure, commonly compromised Windows boxes don't cost the developers any significant amount.
The underlying problem at the system level is the system, which is basically the same regardless of whether you use Windows, MacOS or Linux. The UNIX/NT security model is incapable of solving the problem of malicious software, period.
Windows, OS X, and Linux all have mandatory access controls, application trust verification, UI reforms, etc. in a semi-usable state. For any system besides Windows, they will become commonly deployed as soon as there is a need. The problem is motivating Microsoft (financially) to do the same.
Re:Seems a little Windows-centric ... (Score:2)
IE there are no virus scanners/anti-malware tools in common deployment. If the passive defences fail you are screwed, you cannot easily distribute signatures etc to clean up the mess.
This is false. There are linux-based virus scanners, they just aren't used as frequently on Linux desktop because viruses are less of a threat. More likely, someone will install a virus scanner on Linux when it's a server, and the virus scanner is intended to protect Windows machines. For example, if you have a Linux mail server, it's good to scan e-mail for viruses in order to protect Windows clients.
Your average desktop is not a mainframe and does not need to protect users from one another - instead it's decayed into some kind of trivial black/white coarse grained security model in which "root" has absolute power and "users" have less power.
Even if you don't want to protect users from each other, it's good to protect one user for the spyware that another user runs, isn't it? And what's wrong with the root/user split? Someone needs to have absolute power, but most people shouldn't have it.
Even if you can't get root - who cares? On a modern Linux desktop you can do anything you need without it. Want to crack bank details? Go right ahead, Firefox runs as user and you can ptrace() it to your hearts content.
Well what security model can prevent a user from a program running under that user account modifying that user's files, but without denying access to that user when he wants it?
Re:Seems a little Windows-centric ... (Score:2)
Yeah. When Apache running on Linux ever breaks through and becomes a highly visible target, LOOK OUT.
Not really. The proportion of internet-connected machines which are Linux/Apache servers is tiny and most of the people running them will detect and remedy any exploits in short order.
Oh wait. That's right. Linux machines ARE visible targets, yet are not pwned in proportion to their use. "Ah," you cry, "but those are servers, not desktops." True. They are servers with purposefully exposed ports and running outside of firewalls; heck, many a Linux Box (PC or embedded) *IS* the firewall for Windows machines. They COULD in principle be compromised and used in botnets like any other computer out there.
You do realise that the vast, vast bulk of exploited Windows machines weren't "pwned" by any sort of remote attack, right ?
Servers have _completely_ different risk and exposure profiles to desktop - particularly unmanaged desktop - PCs. So different that even trying to draw conclusions about one based on the other is laughable.
The "bigger target, more problems" arguement is flawed. The underlying problem at the system level (ie, not coutnting phishing, physical security problems, etc) is WINDOWS, period. You can argue about whether it is simply the default security model or braindead design all you want, but until that basic reality is accepted, this point of Windows market share is a deflection from the issue.
Except at the system level, Windows's security model is (relatively) quite solid. By any objective measure, the security infrastructure of Windows is (relatively) good. Clearly, the problem isn't there.
Re:Seems a little Windows-centric ... (Score:2)
You do realise that the vast, vast bulk of exploited Windows machines weren't "pwned" by any sort of remote attack, right ?
You've made this claim before, but I've never seen you provide support for it. Most infections by number are remote with no user interaction.
Servers have _completely_ different risk and exposure profiles to desktop - particularly unmanaged desktop - PCs. So different that even trying to draw conclusions about one based on the other is laughable.
Yeah, which is probably why the previous poster used it to demonstrate that the concept being presented was flawed, as it does not hold true in all cases. Thus the burden of proof shifts to those claiming that market share is the only important factor, since it has been proven this is not always the case.
Except at the system level, Windows's security model is (relatively) quite solid.
He was using "system" to refer to the Windows desktop system that most people have to deal with, not some component of the core architecture, which he pretty clearly conveys using examples. He's saying Windows plus the included software as it makes its way onto the average user is flawed.
Re:Seems a little Windows-centric ... (Score:2)
. Let's say openSUSE replaces Windows as the dominant operating system, I think you'll find that the number times that they are "pwned" will increase significantly. If it's on a network then it's not secure, if someone really wants to screw with your systems then they will figure out how.
Wider adoption of a given Linux distro will increase the number of them compromised. That does not mean it will ever be as bad as Windows is now and let me tell you why. OpenSUSE cannot maintain a monopoly lock-in. It is GPLed and can be forked. That means the developers of OpenSUSE will always be motivated to solve security issues. Microsoft is not strongly motivated to do that.
If OpenSUSE had 90% market share it would be compromised regularly. It would be targeted by worms and trojans and the like. It would also adapt to prevent those problems and address security proactively and reactively. Because it is GPL, there would be little or no motivation for people to use really old versions and if they did, there would still be people providing automated security patches for those versions. It would never get to the state where automated worms compromising thousands of machines daily is commonplace.
You're looking at this in terms of the respective security technologies in the two OS's, but you're missing the underlying causes of those security technologies. The real problem here is that Windows is a monopoly on the desktop and the result of that is a product that dominates, but does not respond to the needs and wants of consumers.
Re:Da Spaghetti Code (Score:2)
Cool, I didn't know gparted could do a whole country!
Re:Da Spaghetti Code (Score:2)