Slashdot Mirror
Gates and Lasser on Palladium
A rather funny juxtaposition this morning - Bill Gates or someone with his signature stamp sent a spam-gram to pretty much everyone who receives any sort of Microsoft email: Bill only mentions Digital Rights Management in one throw-away sentence. And like most other spam, he promises it's a one-time mailing. On the other hand, Jon Lasser of Think Unix fame takes a harsher look at Microsoft's vision of a world where your computer is trusted against you.
How is this news? Everybody already knew what Bill would
say and what every other tech in the world would say.
Meh. Next story. Something with kittens maybe please?
~The Sexy Mac
I would never would have thought MS would spam, that is something only desperate companies do.
And here I thought that was a personal note to me. I have spent the last three hours writing my personal reply. Guess I will just send it to this nice Nigerian man who just emailed me, he just suffered a personal tragedy and seems to need some support.
Chet
In the email Bill says "Secure by default" . I say watch out they may acquire OpenBSD ;-)
Never learn by your mistakes, if you do you may never dare to try again
The problem with everyone's understanding of TCPA/Palladium is that there won't be a single authority (flying Black Helicopters over your PC at night). Big companies like IBM (and especially the government) may use it for document control, but that's about it. What Palladium will do for the world is:
- End the untrusted binary problem. Viruses will be blacklisted by a remote server - no more email viruses, ever
- End the trojan horse/worm problem
These are important features that Joe sixpack the home user really wants. Nobody likes getting a virus and losing all the information on their Hard Drive.By jaundicing themselves against the IEEE's implementation of this important standard, the Linux movement is just putting itself behind the curve in computer security.
If Palladium succeeds, and Linux doesn't follow, then Linux machines will be the only computers that can get viruses. How ironic would that be?
No, not of MS, but of Slashdot.
When someone mentions they gave up Linux for Windows (don't feel like searching for the link, but it was a story last week), everyone on slashdot supported MS, and ran against Linux.
But, a few stories later, we find ourselves reaming MS.
Now MS tries to address subjects YOU WANT THEM TO ADDRESS, and the linux community is in an uproar.
I'd like to suggest what someone suggested in the "give up linux" article.
We need to STOP railing MS, and start boosting Linux. I don't want Linux to be successful if the success is based on dirty marketing against MS.
What's worse is this wasn't even submitted to slashdot, its an editor attempting to push MS into a story so we can all moan about it.
I think it'd be in Linux's best interest if Slashdot didn't write anything negative about MS, just tech updates or whatever. It'd be a lot more mature than the dung-flinging that goes on here.
This hypocracy is just as bad as putting restrictions on users and preaching online rights...
BTW - I'm expecting a being modded down, especially editor moderation (how do you make a broken moderation system, worse? Absolute power, of course!), I'm just venting some steam (and losing some karma).
Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
This is not the entire message, but it pretty much covers it. I removed the intro and market spiel and the "What you can do" section at the end.
.NET, and will be doing so for other products as well.
.NET Server 2003 as "secure by default." We believe it's critical to provide customers with a foundation that has been configured to maximize security right out of the box, while continuing to provide customers with a rich set of integrated features and capabilities.
It's interesting that I got this since I specifically asked Microsoft to stop sending me *anything* and they complied. At least until now. I guess they pulled out all the email addresses they've collected over the last 8 years.
-------------
As I've talked with customers over the last year - from individual consumers to big enterprise customers - it's clear that everyone recognizes that computers play an increasingly important and useful role in our lives. At the same time, many of the people I talk to are concerned about the security of the technologies they depend on. They are concerned about whether their personal data is being protected. Although they know that computers can do amazing things, they are frustrated that their technology doesn't always work consistently. And they want assurances that the high-tech industry takes these concerns seriously and is working to improve their computing experience.
Six months ago, I sent a call-to-action to Microsoft's 50,000 employees, outlining what I believe is the highest priority for the company and for our industry over the next decade: building a Trustworthy Computing environment for customers that is as reliable as the electricity that powers our homes and businesses today.
This is an important part of the evolution of the Internet, because without a Trustworthy Computing ecosystem, the full promise of technology to help people and businesses realize their potential will not be fulfilled. Ironically, it is the growth of the Internet and the advent of massive computing systems built from loose affiliations of services, machines, communications networks and application software that have helped create the potential for increased vulnerabilities.
There are already solutions that eliminate weak links such as passwords and fake email. At Microsoft we're combining passwords with "smart cards" to authenticate users. We're also working with others throughout the industry to improve Internet protocols to stop email that could propagate misleading information or malicious code that falsely appears to be from trusted senders. And we are making fundamental changes in the way we develop software, in our operational and business practices, and in our customer support efforts to make the computing experiences we provide more trustworthy.
For example, we've historically made our software and services more compelling for users primarily by adding new features and functionality. While we are continuing to invest significantly in delivering new capabilities that customers ask for, we are now making security improvements an even higher priority than adding features. For example, we made changes to Microsoft Outlook to block email attachments associated with unsafe files, prevent access to a user's address book, and give administrators the ability to manage email security settings for their organization. As a result of these changes, the number of email virus incidents has dropped dramatically. In fact, email viruses like the recent "Frethem" virus propagate only to systems that have not been updated - underscoring the importance of updating them regularly.
We are also undertaking a rigorous and exhaustive review of many Microsoft products to minimize other potential security vulnerabilities. Earlier this year, the development work of more than 8,500 Microsoft engineers was put on hold while we conducted an intensive security analysis of millions of lines of Windows source code. Every Windows engineer and several thousand engineers in other parts of the company were also given special training in writing secure software. We estimated that the stand-down would take 30 days. It took nearly twice that long, and cost Microsoft more than $100 million. We've undertaken similar code reviews and security training for Microsoft Office and Visual Studio
THE TRUSTWORTHY COMPUTING FRAMEWORK
Trustworthy Computing has four pillars: reliability, security, privacy and business integrity. "Reliability" means that a computer system is dependable, is available when needed, and performs as expected and at appropriate levels. "Security" means that a system is resilient to attack, and that the confidentiality, integrity and availability of both the system and its data are protected. "Privacy" means that individuals have the ability to control data about themselves and that those using such data faithfully adhere to fair information principles. "Business Integrity" is about companies in our industry being responsible to customers and helping them find appropriate solutions for their business issues, addressing problems with products or services, and being open in interactions with customers.
Creating a Trustworthy Computing environment requires several steps:
- Making software code more secure and reliable. Our developers have tools and methodologies that will make an order-of-magnitude improvement in their work from the standpoint of security and safety.
- Keeping ahead of security exploits. Distributing updates using the Internet so that all systems are up to date. Windows Update and Software Update Services, discussed below, provide the infrastructure for this.
- Early Recovery. In case of a problem, having the capability to restore and get systems back up and running in exactly the same state they were in before an incident, with minimal intervention.
FIRST STEPS TOWARD MORE TRUSTWORTHY COMPUTING
There is still much work that Microsoft and others in our industry must do to make computing more trustworthy. Here is a summary of some of the progress we've made, six months after my email to Microsoft employees:
- We have changed the way we design and develop software at all phases of the product development cycle. Our new processes should greatly minimize errors in software, and speed up the development process for new products and services.
- Software Update Services (SUS) is a security management tool for business customers that enables IT administrators to quickly and reliably deploy critical updates from inside their corporate firewall to Windows 2000-based servers and desktop computers running Windows 2000 Professional and Windows XP Professional.
- Microsoft Baseline Security Analyzer is a new tool that customers can use to analyze Windows 2000 and Windows XP systems for common security misconfigurations, and to scan for missing security hot fixes and vulnerabilities on a variety of products, including newer versions of Internet Information Server, SQL Server and Office.
- In addition to providing customers with tools and resources to help them maximize the security of Windows 2000 Server environments, we are committed to shipping Windows
- The error-reporting features built into Office XP and Windows XP are giving us an enormous amount of feedback and a much clearer view of the kinds of problems customers have, and how we can raise the level of reliability in those products - and that of products made by other companies. As part of this effort, we recently created a secure Web site where software and hardware vendors can view error reports related to their drivers, utilities and applications that are reported through our system. This enables the vendors who work with us to identify recurring problems and address them far more quickly than in the past. All of our server software products will incorporate these error-reporting features in subsequent versions of the products.
- With Microsoft Windows Update, we are completing the customer-feedback loop based on the error-reporting features mentioned above. This globally available Web service delivers more than 300 million downloads per month of the most current versions of product fixes, updates and enhancements. When customers connect to the site, they can choose to have their computer automatically evaluated to check which updates need to be applied in order to keep their system up-to-date, as well as identify any critical updates to keep their system safe and secure.
- We are working on a new hardware/software architecture for the Windows PC platform, code-named "Palladium," which will significantly enhance users' system integrity, privacy and data security. This new technology, which will be included in a future version of Windows, will enable applications and application components to run in a protected memory space that is highly resistant to tampering and interference. This will greatly reduce the risk of viruses, other attacks, or attempts to acquire personal information or digital property with malicious or illegal intent. Our goal is for the Palladium development process to be a collaborative industry initiative.
- We've incorporated what is known as P3P (Platform for Privacy Preferences) technology in the Internet Explorer browser technology in Windows XP, which enhances a user's ability to set privacy levels to suit his or her needs. The P3P standard enables a user's browser to compare any P3P-compliant Web site's privacy practices to that user's privacy settings, and to decide whether to accept cookies from that site.
Identifying and addressing critical Trustworthy Computing issues will require significant collaboration across our industry. One example of the kind of cross-industry effort we need more of is the recent creation of the Web Services Interoperability (WS-I) Organization (http://www.ws-i.org/). Founded by IBM, Microsoft and other industry leaders including Intel, Oracle, SAP, Hewlett-Packard, BEA Systems and Accenture, WS-I's mission is to enable consistent and reliable interoperability of XML-based Web services across a variety of platforms, applications and programming languages. Among other things, WS-I will create a suite of test tools aimed at addressing errors and unconventional usage in Web services specifications implementations, which in turn will improve interoperability among applications and across platforms.
- There are already solutions that eliminate weak links such as passwords and fake email. At Microsoft we're combining passwords with "smart cards" to authenticate users. We're also working with others throughout the industry to improve Internet protocols to stop email that could propagate misleading information or malicious code that falsely appears to be from trusted senders. And we are making fundamental changes in the way we develop software, in our operational and business practices, and in our customer support efforts to make the computing experiences we provide more trustworthy.
Now this is progress. From actions like these in the computer software industry we can see that they are gradually moving away from the 'hacker' mentality (as in 'hack it together and hope it works') to a more formal design process. Like, software engineering might actually live up to its title!And the closer computing gets to more comfortable real-life metaphors, such as using human-orientated media such as eyeballs and fingers, the more comfortable people will generally find the technology.
Aye man. Innit.
I used to register microsoft {soft|hard}ware when I purchased it, but I stopped a while ago when I got spammed like this. Anyway...
The scariest part of this e-mail is Microsoft's blame on "loosely-knit" services as a key source of vulerabilities. I hold the belief that homogenous, not hetergeneous systems are more vulerable to attack.
The implication is that Microsoft thinks an All-Microsoft shop is a secure shop. I suppose their newly-created inititive to focus on security has twin goals: Increase the reliability of their software, and push customers into an all-Microsoft environment.
The end result will be a much more vulnerable network. Not necessisarily because of using Microsoft software, but because of keeping everything homogenous.
A nice, and a propos story by RMS, called The Right to Read, can be found here. Definitely worth the read.
Fuck it
Passwords are a weak link, but Passport isn't? Doesn't Passport ask for a password? Oh, never mind, I get it... that's what we need a smart card/universal ID for... I feel much safer now.
I posted the same thing but it talked more about Trustworthy computing....which is what the spam-gram is about.
the mail can be found there. Quite annoying really.
Right now I get:
Sorry, we were unable to service your request. As an option, you may visit any of the pages below for information about Microsoft services and products.
Mad Software: Rantings on Developing So
I don't see what the problem is... There will always be sheeple who can't live without Micro$oft dominating their lives, stripping them of their freedom. Palladium is simply the glue that finally binds Microsoft to Intel to make WinTel.
Is that so bad? I mean, yes Intel x86-based hardware is cheap. Palladium hardware will probably be cheaper (due to an easement of fears about Digital Rights Management).
So what? We should only worry about it if we can only see Linux as LinTel. In fact, it is not. It runs on just about any platform in existance. So, don't worry... Be happy! Let go of Intel/Palladium. Follow Linux where it can go.
I think the community's response to DRM is wrong. I don't think that the analysis of it is wrong -- it's a very negative technology. But I think the response is a little off.
If MS wants to put the interests of the large media companies ahead of the interests of its own customers, the people who actually buy the computers and the software, why not let them take it to the market? Let's let the market decide what it thinks of that. Let's give them enough rope to hang themselves.
The thing that we have to worry about is some sort of legal framework that requires all computers to respect some DRM system.
MS is way ahead on the desktop, and their systems have gotten a lot better than they used to be. The only way they're going to get dislodged from that position is by making a really catastrophic mistake.
This could be that mistake!
I think there's a lesson in the current stock market scandals. The big companies can buy legislators. They've shown that they can derail effective regulation of accounting rules. They can set things up so that a crooked CFO who bilks people out of billions and sends the markets into a spiral that wipes out the savings of millions of people gets a lighter punishment than a punk who robs a liquor store.
But in the end, there's nothing they can do against the force of the market itself. They got cocky -- they thought they could get away with anything. It turns out that they can't.
Neither can the DRM boys.
Comment removed based on user account deletion
I think the BSD licence lets them use the whole OS as a basis for a closed source system, I wouldn't put it past them.
I'm sure bill would manage to slip an extra O in there somewhere though.
OpenBSOD
thank God the internet isn't a human right.
Here is something that may help
I got the same thing my fist couple of tries. Hard to believe that Microsoft got Slashdotted...
Ever notice how half the +5 comments on Slashdot mention the poster expects to be modded down?
I wonder why the article is all linking back to microsoft's sites, in the WHAT YOU CAN DO section.
I mean, there's bound to be more sources of information on the security Microsoft has to offer, no?
Anyone tried to read that page with Netscape 4.7?
xx-small fonts... yowtch.
Somehow it is showing up properly on IE. (sarcasm)very strange(/sarcasm)
Nouvelles de jeux et technologies en français. TC
Who here do you think wanted MicroSoft to address DRM in the operating system? I'd guess almost nobody.
Who here do you think wanted MicroSoft to address the 'problem' of users having complete control over their own machines? Again, nobody.
I see no change in attitude here at all. The Slashdot crowd has always disliked DRM and giving Bill the keys to your computer--and that's exactly why there is so much anger at Palladium.
And while I agree with you that we'd be better off boosting Linux than trashing MicroSoft all the time, you still have to point out significant dangers when you see them.
...Windows Update once got hammered by Code Red. "Hacked By Chinese" in big block letters. There goes your theory down in flames.
Knowledge is power. Knowledge shared is power multiplied.
- http://www.attrition.org/security/commentary/ms16
. html : Including the Windows Update site -- which I suspect they "pay attention to". - http://www.computeruser.com/news/01/01/25/news9.h
t ml - http://www.vnunet.com/News/1115617
- http://cert.uni-stuttgart.de/archive/isn/2001/05/
m sg00028.html
Indeed, that first page includes the interesting fact: So I guess for Microsoft, "never" has the same definition as "always" does for their uptimes: some short duration.The Mongrel Dogs Who Teach
One of the ...ahem... interesting things Bill says is: "We're also working with others throughout the industry to improve Internet protocols to stop email that could propagate misleading information or malicious code that falsely appears to be from trusted senders." (emphasis added)
Bob Cringley has written a couple of good articles on eactly this, the second related directly to Palladium. Check them out.
Cringley also has an article on the consequences of Palladium not working.
Sailing over the event horizon
In my mind I see hundreds of SysAdmins at M$ waking up from their afternoon slumber scurrying across their cubholes screaming ....eeeee slashdot....iiiieeeeeee....
Maybe we should make it a Friday thing, post a note on the main page requesting all anti-M$ geeks to click on a M$ story or another Bill's email at sharp 3:00 Eastern time (which happens to be 12:00 lunch time for Seattle when all the Sysadmins at M$ happen to be beefing up on Tofu).
3:30 Eastern Time : Long live www.microsoft.com!
Rapid Nirvana
Linadium is a new chip that will be placed in all computers so that they only run code that Linus signs. Linus promisses to only sign code that is totally secure, in this way he will help Microsoft by saving them time and money.
Incedentally, it's pronounced so that the "lin" rhymes with bin, not wine.
Ask Slashdot: Where bad ideas meet poor googling skills.
If Palladium succeeds, and Linux doesn't follow, then Linux machines will be the only computers that can get viruses. How ironic would that be?
Um, Linux has never had a virus. EVER. NEVER!!! Palladium is not going to make a million virii suddenly pop out of nowhere for Linux and start infecting machines. Linux has a little thing called USER SECURITY that pretects users from loosing data to virii like that.
* End the untrusted binary problem. Viruses will be blacklisted by a remote server - no more email viruses, ever
* End the trojan horse/worm problem
If Micro$uck didn't make Outlook suck so dam much, we wouldn't have to worry about trusted binarys to begin with!!
Big companies like IBM (and especially the government) may use it for document control, but that's about it.
ANY amount of control over my computer is a voilation of my RIGHTS. It doesnt matter if its the computer at my house or my workstation at work. My IT department has NO BUSINNESS telling me what I can and can't run on my workstation. It's MINE.
Your such a troll you make me want to kick Bill Gates in the ass for paying you to post that comment. Linux rules. There's just nothing better, and Micro$oft knows this. The only way they can stop linux is by taking total control of computers, and this is exactly what their doing. I'm not going to stand idly by while they take my rights away from me.
Friends don't let friends use Wind0ze!!
Actually, you're wrong. Palladium gives a corporation the ability to whitelist executables within their organization, blocking all but the ones they have personally inspected. You refer only to the default configuration.
... the notion is repugnant, and should be to anyone over the age of four who has any shred of dignity or desire for self-determination.
Ever here of Microsoft Word & Excel Macro Viruses?
Trusted, signed software doesn't mean you aren't vulnerable. Just because the command reformating your hard drive was signed by Microsoft doesn't meet you're going to lose any less data.
The only way to fix these vulnerabilities is to remove the indredibly stupid "features" like having a mail reader be able to execute any program (signed or not), and remove javascript, ActiveX, and whatever other stupid 'extended scritping' nonsense IE is putting in their browser these days.
Palladium does nothing to secure the computer, all it does is insure the computer can only be used the way [insert authority figure here] deigns to allow you. Whether that authority figure is the Government, Microsoft, Apple (who would presumably be on board in a DRM world), the RIAA, the MPAA, or my local ISP makes little difference
The Future of Human Evolution: Autonomy
Six months ago, I sent a call-to-action to Microsoft's 50,000 employees, outlining what I believe is the highest priority for the company and for our industry over the next decade: building a Trustworthy Computing environment for customers that is as reliable as the electricity that powers our homes and businesses today.
Well that's reassuring! I think the general population of California would like for computers to be a bit more reliable that their electric grid!
And even if you're not in CA, electric power is notoriously unreliable. Brownouts, power outages, power spikes, 120V vs. 220V, etc. Is Bill trying to tell us that Windows will never be reliable at all?
If I could I'd mod you up!
They who would give up an essential liberty for temporary security, deserve neither liberty nor security
Having seen MacWorld NY and nifty little gizmos like a 20gig iPod that should have media corps coughing up hairballs in a matter of days, what of Palladium and DRM when it comes to Apple?
Now granted the **AA's would just love to have a very tight DRM system, and Palladium underneath it all would be like a market research holy grail(knowing the marketeers behavior), but thats all at this point a Windows thing.
Setting aside OSS for the moment, what about the few other players? Apple primarily, but there are a few others. And what if someone wants to truely innovate a new OS?
This is _way_ too controlling a system. I think the barrier to entry would effectively become a steel bulkhead (for any truely new OS).
And what exactly is Apple's position on all this? Especially since OS X. And sooner or later there will be a fairly usable Darwin for x86. If the hardware begins to limit the software as is predicted, them perhaps MS should just make its own hardware for its new OS's. Open up its abandon-ware for the rest of us and strike out along the path of Apple.
Frankly I think all of this is going to fail. And no system will be secure until we can get rid of the users =P
I have written this article before, and so I'm not going to repeat myself. Go see Article (#3842766) for the details on exactly why Palladium is REALLY, REALLY bad for your computer. As to it being a "security" thing, preventing "viruses"... It can't. Palladium can only make computing more difficult. Ratboy.
Just another "Cubible(sic) Joe" 2 17 3061
...who had Bill Gates mentioned his virus by name
Won't somebody please think of the children?
idiot.
There's no hypocrisy to speek of here; Slashdot is a group of users united by an interest in technology. Some like what Microsoft does, some don't, and quite a few fall in between. The more vocal members of each of the extremes tend to be attracted to stories that they can rant about.
Headlines yesterday showed that Microsoft's porifits have grown close to 10% in this weakening PC/IT market. Hmmm...how could that be? The Padisha Emperor himself conducted an investigation and found no wrongdoing on the part of Baron Gates and House Microsoft.
Much to the delight of House Microsoft's board of directors, the Baron unleashed Steve "The Beast" Ballmer to extract as much as he can from their corporate customers in the form of "upgrade plans" and other rackets.
Some talk of a vast hidden population of Lemen, yet official sources dismiss the rumors.
People wouldn't be so paranoid if this were being discussed more as an option and not somthing hardwired into future hardware and OS versions.
I'll decide what I consider acceptable risk. I've been working with computers for 18 years and havn't had anything I couldn't handle. In fact every problem I have had was a issue with a security hole in a Microsoft product. Now Microsoft is pushing that the only solution is to give somone else the power to monkey with my computer and decide what I can store/run on my hard drive. Get real.
"God fights on the side with the best artillery." - Napoleon, Marshal of France - speaking truth to power
I didn't get that email....does this mean I'm special?
The rest of the world backs up products they want to inspire trust in with warranties or some guarantee that the product is actually usable for its intended purpose.
This is something that is notably lacking from MS, their trustworthy intiative seems more about making their EULA more legally binding, without delivering anything to the consumer.
While biometric identification through a trusted, controlled and monitored source might satisfy me for everything and using my biometric keys to provide retrieval-only access to my data might satisfy me, there is no way that I would blindly trust the network, never mind the machine for update.
The consequences are too horrific.
I've been a victim of identity theft and it cost some one her LIFE, such as it was, because she chose suicide instead of a long jail term.
This is SERIOUS SHIT. It happens. It happened to some body I knew. But she ripped me off. I turned her in and she funkin' offed her stupid cowardly self. ("People Who Died" by the Jim Carroll Band is running through my head...)
There is NO FUCKIN' WAY I'd trust my Macs or my Linux PC to reveal information on my behalf.
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
Mandated by whom? Last time I checked there were several major non-Win OSes out there. Do you really think hardware vendors are SO STUPID as to cripple them all in the processor? Or to allow Congress to require same without a very hard fight?
sulli
RTFJ.
Ok this might be completley ludicrious but here it goes.
I would like to see Microsoft and Intel team up and go one way, while AMD and everyone else go the other.
Then Microsoft can lock down everyones PC like apple and do whatever they want to. The rest of us will then be able to enjoy our open systems.
Crazy idea? You decide.
Stupid job ads, weird spam, occasional insight at
I'm done. I've had it. I've used Windows for years, and managed to do what I need w/o massive invasions of privacy. Straw to camel's back: You are broken. This box (Win2K) is going to serve me for as long as I need it. My second machine is getting Gentoo installed right now. I'll have some of my Linux pals help me get it set up and set up right. And help me figure out what I'm actually doing (in part). I've done enough to get around Linux, but I want to know more.
Hopefully, within a year (minding, I like my gaming!) I'll be able to toss Windows and break myself of the habit completely before Palladium comes out and destroys home computing.
DRM with Palladium will only concern you if you buy one. I see this as a method primarily for corporate or government users that need this type of security. Its a big OPT-IN device where to opt-in you have to buy the Palladium equipment. As far as allowing MS and Intel to require this on all computers, well we aren't going to let that happen.
The thing I don't get with palladium is: what happens to developers? New binaries are created all the time. What, now we have to get them "signed" before we can run them? Ah, well, just more time to read slashdot that way, I suppose... I'm also not getting the logistics of palladium; what if I write a program that does X, but also, as an undocumented feature (so that it can get signed, etc.): it can execute other programs. So can I not now use this program to execute whatever the hell I want to? For instance, get wine signed, then run any windows program in linux.
Trustworthy Computing has four pillars: reliability, security, privacy and business integrity. "Reliability" means that a computer system is dependable, is available when needed, and performs as expected and at appropriate levels. "Security" means that a system is resilient to attack, and that the confidentiality, integrity and availability of both the system and its data are protected. "Privacy" means that individuals have the ability to control data about themselves and that those using such data faithfully adhere to fair information principles. "Business Integrity" is about companies in our industry being responsible to customers and helping them find appropriate solutions for their business issues, addressing problems with products or services, and being open in interactions with customers.
Hmm, sounds more like what Linux has offered for the past 5 years than anything Microsoft has ever come up with. Their four pillars of trustworthy computing should read more like this:
- Adherance: You, the end user, shall willingly agree to any and all rules and regulations set forth by the Microsoft Corporation.
- Acceptance: You, the end user, will accept Microsoft as the sole deciding factor as to what are "acceptable uses" of your computer.
- Tolerance: You, the end user, will tolerate all flaws, openings, and gateways in all Microsoft products.
- Reluctance: You, the end user, being too stupid to harness the true power of your computer, will submit to Microsoft's vision of the future of computing. This includes limiting the applications you use to Microsoft or Microsoft approved products, Microsoft or Microsoft approved hardware, Microsoft or Microsoft "Digitally Signed" drivers, and Microsoft operating systems.
By agreeing to the above, you give Microsoft the right to decide where you will go today. Revisions to the above may or may not be made, and you may or may not be informed of the changes. Regardless, and changes made you will adhere to by virtue of your affirmation that you agree to the above.
Welcome to the sad, scary future of computing.
I think one of the interesting things about the rise of Microsoft and the IBM clone PC in general is that it proved that an open, extensible system is going to win out. It doesn't matter how good your closed system is, it just won't win out (witness: Mac vs DOS).
And here we are, it's 2002, and Microsoft, the company that most benefited from having the PC architecture open, is now seeking to close it. For "security". As more restrictions are added, fewer interesting things will happen on the system, and people will start to look elsewhere to get what they want and need.
It's sad that Microsoft has forgotten what got them where they are in the first place. Look for Apple to do even better once Palladium hits.
"I may not have morals, but I have standards."
I am confident we can and will create a truly Trustworthy Computing environment.
Anyone else notice Bills interesting capitalization at the end of the letter? Perhaps we can expect another generic trademark soon?
So, I guess it has finally happened. People don't use the word trustworthy to describe M$, so M$ just created a way for trustworthy to be used with all M$ activities! I guess that is more profitable than actually becoming trustworthy.
-Sean
Microsoft has found the way to be vulnerability free. Instead of fixing their bad code, they will just break IP so much that you can't even send any exploited code! Great idea, Microsoft. (Morons)
If one may not recompile source code and execute it without MS signing it, how will development continue unless you sign your binary at MS headquarters?
... just some thoughts.
To have this work all development would have to be done using MS Visual Studio and every binary would have to be sent to MS.com, be signed, and sent back to the client who then executes it.
Note that signing cannot be done on the compiling machine, otherwise OSS, or even the virus we all fear, will be able to do the same.
-- bartman
I'm not an expert security programmer, but I think I have an ideo on how to handle the data overflow bug in Apache and other systems.
Limit the amount of data that can be inputted from any particular source, depending on how fast the system can handle the requests. Has your system ever slowed down so much that you type something and it appears...five seconds later? Same idea. Why should the system allow gigabytes of data to be inputted when the given system can only handle -- say -- 100 MB at a time? It shouldn't. This is exactly what causes the problem -- the system gets information/data at a rate faster than it can handle it. So basically, my idea amounts to this: don't bite off more than you can chew.
A similar concept might work well to protect against password-cracker programs. Why allow user/password entries as fast as the sytem can handle it? Why not set a limit so that the program only accepts one attempt every 10 seconds, and then after 3 such times closes?
Another suggestion, on Palladium and like technologies/ideas. Basically, the criticism is that it will kill OSS / FS, either because they won't get the seal of approval from MS or because even if they do, or that will be impossible (how do you give such to source code), or that even if its given it will be broken if the user excercises his OSS / FS rights and changes the code. The solution to this problem is for whoever to create a digital approval system such that the user decides which things he approves of. For every chip sold, they will have the "universal" approval stamp on them, and one which is specific to that user: namely, that means that every piece of hardware made would have one common approval stamp (which would be delegated out by some organization) and one private unique one, which the user would control and give the "stamp" to the programs of his choice. Comments?
social sciences can never use experience to verify their statemen
Does anyone remember the fight over the clipper phones? The clipper system used mandatory private key escrows. The idea was that if you bought a clipper phone, the secret key would exist in a government db somewhere. If they wanted to wiretap you, they'd just have to look your key up and decrypt the signal.
It wasn't a rejection of the clipper ideology that sank the proposal. It was a proof that it would be possible to build counterfeit clipper phones that would interact with the system. The NSA screwed up, they built a system that wasn't strong enough.
It seems to me that palladium would face a similar challenge. How do they differentiate between a rogue board that pretends to be palladium compliant and a real one? Especially in a world with flashable BIOS?
What's to stop people from buying boards that will be palladium switchable? If you want to run Windows, you can set the BIOS one way, if you want to run Linux, you can set the BIOS to disregard it?
Or what's to stop people from making boards that accept any signature without checking it? MSs software would think it was on a palladium compliant system, but you could run whatever you wanted.
Palladium is yet another example of Microsoft's flawed software strategy. MS constantly thinks: If there is something wrong, make new products to fix it. Doesn't anyone else think that this is flawed??? Oh yeah...you can't sell stuff like that as much as new "I have better features than my previous version" software.
Palladium is a bandage over the broken user/networking model and the interfaces to them. Instead of stepping back and considering the reasons why most users and processes MUST run as Administrator(locally and network wise), Microsoft wants to promise that yet more software that will sort out the issue for you without thinking. Installing software on a Win2K system can be a bear if permissions have to be setup a certain way. How hard is it going to be to install software on a Palladium system?? Don't think the new Word for Palladium. Think about the legacy software you are still required to use. That should send shivers down any IT Staff's collective spines.
And, at the worst, Palladium fails to fix a giant class of problems. IIS will no doubt in MS's mind be a trusted program to run. However monkeying with "default.ida" isn't something it should be doing. Palladium can protected from "mystery.exe" which is unsigned from running but seems to make no provision for trusted binaries suddenly behaving badly. Default settings, denial of serivce, etc. have nothing to do with signed code.
Beyond this a computer is supposed to get out of the way and let you do your tasks. A "well oiled" Linux machine can do this for tasks. Mac users rave about how its OS goes way into the background when a task is executed. MS through Palladium seeks to get more in the way to protect us from ourselves. Why does Joe Sixpack want a computer that is even more "in your face" than it is now?
As for the future of Linux with Palladium looming on the horizon. I'm not worried. In fact I forsee a great boon in virtual execution environments on Linux and BSD where you can choose to ignore Palladium rules if you the user choose to do so.
I find it amazing that *nix users are getting so caught up in this. I would think they would be smart enough to know that MS can't control the whole computer industry. If users don't like it users won't buy it. If there is a market for components that don't follow palladium specs then someone will fill that market. It's basic economics.
Right now all I hear are some *nix users supporting their arguments with opinion and passing it off as fact.
I am about as sick of the Linux propaganda machine as I am of MS.
Microsoft is truly foolish if they expect to have people switch to Palladium. The majority of their customers were pissed with XP, just having to call Microsoft if they updated their hardware. Now, they expect people to buy new hardware so they can be told what they can't run? Personally, I think Palladium might end up being a new NT, but I seriously doubt it will ever be like Microsoft claims it will.
Sticking feathers up your butt does not make you a chicken - Tyler Durden
Shoddy code running unnecessarily with full admin privs probably had nothing to do with it!
PJRC: Electronic Projects, 8051 Microcontroller Tools
What's the point? MS is talking about how they're doing all this stuff to guarantee your privacy, but in the same breath they've just violated your privacy by sending you spam.
Of what value is a trustworthy system controlled by a company who is clearly untrustworthy? Not much.
The way MS acts, I have to think that they're more like Lawful Evil than Lawful Good. That means they can't make a Paladin. Or a Ranger, for that matter.
I've always wondered what will happen to companies that write commercial compilers and/or tutorials for writing programming code (whether it be C++, C, Basic, whatever) if Palladium becomes the standard.
Will the computer enthusiast be able to write (and thus learn) new programming languages? I find it hard to believe that a compiler could digitally sign all code, and thus it would be impossible for the average Joe to write a "Hello World."
I remember writing my first program (a blackjack game, I believe) in 4th grade in Visual Basic. Isn't that how most (if not all) computer professionals got in the business? Will self-discovery and self-learning be possible anymore?
Quemadmodum gladius neminem occidit, occidentis telum est
chet lives!
i miss omm. i would have loved to see your take on warcraft 3.
while i'm at it, thanks for being one of the good webmasters out there and caring about the users' privacy, popup ads and limiting tracking and invasions of privacy.
keep on rocking.
Get into non Intel hardware now before
it's too late.
Microsoft has a patent on the process of loading an OS on such hardware.
If the hardware hits the market, Microsoft determines who can legally write an OS to run on it, via their control of the patent.
DNA just wants to be free...
The attitude towards accounting fraud is not friendly. The Senate is ticked and the President does not want to look bad on this issue. DAs and judges are similarly going to be out for blood. To prove to Americans that the problem isn't structural but rather with specific individuals the system is going to need scape goats, that is individuals are going to go to jail.
I just attended a private focus group on this subject. All the attendees were Director level IT folk who are constantly hassled by security problems. Some of them came from a management background and some from a technical background. Almost all of them thought this would be a good idea. In fact they thought it was such a good idea that they would be willing to pay $25 to $400 more per server or desktop just for the chance to have this technology.
I think this shows just how far along this idea has gone. None of these people in the room cared a wit about privacy, open source, the ability to compile your own apps, etc. because the vast majority of people don't do even know what they could be missing. All they care about is a golden pill to solve all there security problems.
So we shouldn't all be thinking that somehow this idea will be MS shooting themselves in the foot. That won't happen unless we get the word out.
Peace, or Not?
Yet another reason non-MS vendors won't buy it. Bye-bye Palladium!
sulli
RTFJ.
What about internal business software? Will all businesses have to get their own internal software signed by Microsoft for use on their own machines?
What about hobbiest programmers? I don't know about you, but I got into programming at home messing around with compilers and such... Ummm... Are they trying to extend their monopoly to... programming in general?
I think it's possible that Palladium could end up being either the demise of general computing, or the demise of Microsoft's monopoly, as other competitors such as Apple, Linux, *BSD, etc, step up and offer people their COMPUTERS back to them.
I'm not going to worry. If it comes to it, I'll run Linux on PPC hardware or something. If that gets DRM infected as well, I'm sure there will be other choices, possibly from the other side of the pond. And if it's worse, I'm quitting this industry and going into construction or something. Or maybe politics, it'll get easier and easier to run on a platform of offering people their freedom back!
Sticking feathers up your butt does not make you a chicken - Tyler Durden
(* It is plain that this has nothing to do with Joe Sixpack's security but only with content protection Hollywood and total control by Microsoft. *)
I never figured out how home movies would be allowed through. If people find out that they cannot send home movies to Grandma, things are gonna fly.
Another thing, if the security is based on firmware, it is quite possible to have a bug or two that some hacker can exploit, allowing anything to be "signed". Would we have to upgrade chips to see new content because old ones have been compromized?
Table-ized A.I.
With growing numbers of large businesses starting to use Linux (and other open source software), no hardware manufacturer with a lick of sense is going to make a Palladium-enabled motherboard without making it possible to disable it in the BIOS settings.
Palladium may become an option, but as long as there is a market for non-Palladium hardware, don't you think someone will supply the demand?
Winmodems may be a plague, but they haven't completely driven out hardware-based modems.
This is more FUD. Palladium is bullshit.
- Microsoft does not have the desire or means to control any information which is input into a computer via a means beyond the scope of DRM or Palladium (in unencrypted formats such as MP3), and intends to continue supporting such formats.
- Microsoft employees have a broad variety of opinions on legal and technical issues related to copyright enforcement. The company's position is that the use of DRM should be purely voluntary (in the sense in which the industry uses that term; they do not have a public position that the DMCA's anticircumvention provisions need to be modified).
- Microsoft assumed as a design criterion for Palladium that existing versions of Windows should be able to run on a Palladium PC, as should existing Windows applications, as should existing non-Windows operating systems like Linux. There is no attempt to stop people from booting whatever code they currently use or may write in the future. In addition, the hardware trust features can potentially be used by specially-adapted software, regardless of what operating system is running. It is possible to imagine that a Palladium-hardware-aware version of Linux could be created and could make full use of Palladium's hardware features in order to achieve trust comparable to the Windows implementation. Microsoft is only writing an implementation for Windows, but plans to publish all the technical details.
- Microsoft's nub, including its source code, will be published for review by anyone who wants to examine it, in order to allow all of Microsoft's claims about its security properties to be verified. There is no part of Palladium's design or code which needs to be kept secret, although each SCP will contain secret cryptographic keys loaded at the time of its manufacture. Microsoft will encourage non-Microsoft people to read and discuss its nub. You will also be able to create your own nub, except that changing the nub will (as discussed above) prevent previously-sealed data from being decrypted.
What's the problem here?Linux will do it's own extend-and-embrace, and we'll beat them at their own game.
Palladium also will need to be supported by Intel, AMD, . I doubt all of these companies will lock themselves into a Microsoft-specific hardware platform.
Stop the FUD from the LINUX community!
Joshua Thomas as the AC
The promise of "trustworthy computing" from the Anti-Trust him/itself!
Ah the things that we do with language since "IS" was redefined for us. Bush seems to have caught on too!
Gates et. al. would be pushing this so hard. Isn't it kind of like them saying, "We can't fix our own problems so we are going to have hardware manufacurers try to fix them for us."?
Setting his threshold to 5, Sparky eliminated most of the trolls on /.
I agree with everything this poster said if it weren't for one key word in this discussion: Monopoly.
The very definition of a monopoly implies that the free markets do NOT work in this case. Hence the judges ruling.
Six months ago, I sent a call-to-action to Microsoft's 50,000 employees, outlining what I believe is the highest priority for the company and for our industry over the next decade: building a Trustworthy Computing environment for customers that is as reliable as the electricity that powers our homes and businesses today.
Those utility companies are sure reliable and responsible...
Hey microsoft... I've got some enron stock to sell you...
Palladium (n) (Roots: Paladin, Stadium) The effect of a large stadium falling from the sky upon the party's Paladin. See also: Wish Spell, Twink, Monty Haul, Wishing for Castles, Twisted DM.
"Woohoo! I want me a stadium!"
"Okay. A stadium materializes three hundred thousand feet above your head, and falls. Roll a dexterity check with a -19 penalty, please."
Flawed Microsoft Strategy?
Not so- palladium might just be a ruse to persuade corporate types to order massive upgrades. With Win2K, workstation/server OS's have finally gotten quite decently stable, usable, and friendly to configure, backup etc. Since there isnt that much reason to upgrade from 2K to XP, MS needs a 'killer feature' to promote adoption of the next generation OS -- this would be palladium. Nice side effect- eliminates competition!
SUV's support terrorism !
Here's an earthlink user site that explains.
From my perspective, the interesting thing is, in myth, it ultimately failed to protect the Troy... :)
Well that's reassuring! I think the general population of California would like for computers to be a bit more reliable that their electric grid!
I think in general, your computer can only be AS RELIABLE as the electric grid, not MORE RELIABLE.
Or does your computer have a perpetual motion machine inside?
"And like that
I mean what is to prevent a buffer overflow vulnerability in the TCP/IP stack implementation from being used? Say it receives the wrong data, the stack overflows and your code is now executing with kernel privileges. From the OS's perspective, no new application has been run, therefore, no check for signatures will ever be attempted.
Granted, the nub may prevent you from reading encrypted data, but you will have access to everything that is not encrypted. And you are in a very good position to use the kernel privileges to attempt attacks on the nub.
Also, presumambly, the TCP/IP stack will be part of the kernel which itself is signed and authenticated by the nub at boot time...
Six months ago, I sent a call-to-action to Microsoft's 50,000 employees, outlining what I believe is the highest priority for the company and for our industry over the next decade: building a Trustworthy Computing environment for customers that is as reliable as the electricity that powers our homes and businesses today.
I live in California, need I say more? Not to mention the price of electricity here...
Could be a pretty good for security on servers. Here's my idea of how it could work:
You have the server running as normal, with some crypto code in the kernel to verify signatures.
When a binary is loaded the kernel checks if the file has been changed from the last time it checked it.
If it has, the kernel looks for the signature for the binary on a readonly floppy. If it doesn't match, it doesn't run it.
There should be no big slowdown because the kernel could cache floppy accesses.
If you want to update the server go to another computer, do all the security checks you need and make a new floppy with signatures. Then change the floppy on the server and replace the binary.
"I just attended a private focus group on this subject."
Any knowledge gleemed from a private focus group is suspect at best. The questions and people attending are highly targetted to give back results that are somewhat easy to predict. These results are then applied to any "study" to show "evidence".
--- I do not moderate.
Trust has more that one meaning. Good and bad.
So Palladium is only to make system safer, and isn't intended to control how and what I do with my computer?
Tell me then...will Palladium stop random Ad spamming in my MSN Messenger and ICQ and various web pages? This is an obvious breach of security for unsolicited applications.
No?
The court rests.
Well if it's M$' goal to build "a Trustworthy Computing environment for customers that is as reliable as the electricity that powers our homes and businesses today", then mission accomplished. In California, at least... =]
grib.
maybe
It should be "hippocracy", with two p's. Finding a good text with bad spelling is as rare as finding a good brick wall built by someone who doesn't know how to handle bricks.
What happens when your motherboard dies, and the only replacement you can find needs Palladium because Intel/AMD decided to play close and snuggky with Microsoft? Or that new soundcard/NIC/RAID controller, etc... you need that also will only run with a Palladium based OS? Then what? Are you still in an "opt in" situation, or are you totally screwed?
Boobies never hurt anyone. - Sherry Glaser.
Uh, not by me. I _deleted_ it, bastard illegal monopoly tool that it is.
Of course the Lose98 system now whines about missing it at every mouse click. TFB. I very seldom boot the WinBloze side anyway. It's useless, it doesn't even have a decent telnet client, much less an X server. You can't get it near the Internet without it becoming 0wn3d by script kiddes or spyware, or both. WTF is WinBloze supposed to _do_, anyway? About all it's good for is to backup the WinCE PDA, which of course can't talk to anything else. I shoulda bought a Palm Pilot.
Oh, it also is the only thing that the xirlink camera can talk to, unless some geek out there has hacked that protocol.
Exceeding the recommended torque is not recommended.
Can anyone explain how having (for example) IIS signed by Microsoft is going to make it any more secure? It's not as though there's some "untrusted" version of IIS going around that the Palladium system will be able to detect and disable, is it?
All signing can do is reassure you that you are indeed running the same binary that Microsoft (or whoever) is offering. It certainly doesn't prove that the binary is competently designed, well tested, or secure against crack attempts.
Palladium is a terrific solution for a nonexistent problem.
For a site which claims to present news, slashdot is very biased. The only articles about Palladium I've seen are about how it's going to kill open-source. Now, let's think rationally. Most hardware manufacturers do not like MS. Therefore it is unlikely they'll elect MS to be the person to keep the list of programs that are considered safe to run on your computer. Even if they did, there'll probably be an option in the BIOS to turn off Palladium if you don't want it. Then you can freely run linux just like before. On the other hand, if linux chooses to use palladium, then it will be much less vulnerable to being hacked.
Vote for Pedro
not virii, see http://www.perl.com/language/misc/virus.html.
People might listen to you if you didn't sound like you were spreading dishonest propoganda. (Oh yah, that and most people are too informed to believe you.)
My computer would be alot more trustworthy if it didn't crash every hour and stall as frequently from massive memory leaks. I swear every time I visit the family and end up using WindowsME, I want to put my fist through the thing.
... then go ahead and use that non-DRM, non-Palladium piece of Open Source code. But you will be prosecuted to the full extent of the (MS dictated) law"
Sothing like it would do just fine, and it's what I'd like the FSF and whoever to prevent from happening. If they force us to secure our systems in the way they like, we'll lose our freedom as well as our privacy to who knows what. Maybe we may even lose our right to execute whatever program we like.
unfinished: (adj.)
Okay, this is a little off-topic. But the blurb for this story says "Microsoft's vision of a world where your computer is trusted against you."
Well, sometimes you should trus the computer over humans. Like that plane crash over Germany -- the TCAS-II said pull up, and the ATC said dive. Quite naturally the Russian pilot chose to dive, which was the completely wrong thing to do. TCAS-II had it right.
Of course, TCAS-II was coded to keep planes from colliding. MS software is coded to keep you running on the Microsoft Gerbil Wheel of Corporate Profits.
I just wanted to point out that sometimes, you really can trust the computer. Even more so, I think, when the code is available for peer review, or can be reverse-engineered without commiting a DMCA felony.
I wonder if the code for TCAS-II has comments like:
!seineeW erA stoliP naissuR
Palladium is yet another example of Microsoft's flawed software strategy.
Well, if they can repeat the flawed software strategy again as they did before, reming me to shoot myself in the head for not buying having bought MS shares today.
unfinished: (adj.)
Improve as in 'embrace and extend'? What's wrong with TCP/IP, SMTP, or POP3? The problem was never with the transport protocols. They work perfectly. The real problem was with microsloth's crappy Outlook Express gleefully surrendering a user's mailing lists and blindly running every virus script that came along, no questions asked. The problem was further compounded by their reluctance to fix it, despite getting pounded by one virus after another over the course of several years. Even with the recent Apache and SSH exploits, I'd still trust a linux system over M$ any day.
When all else fails, run.
Well, one anyway. Mine. http://www.cs.fiu.edu/~flynnj/kittenpics/
(runs from the flames)
He is right, security is important. Especially from software companies that want to collect information on you, spy on you, and send spam to you.
Our software is insecure so here is a solution to keep other people's software from running on your system.
Here we are, in 2004. I listened to Microsoft, I made sure my new PC has a Palladium chip integrated on the motherboard. This way, I'm told, my PC will run only cryptographically signed programs, which will prevent these evil virus to execute.
But since I cannot afford to buy a key from MS each time I write a Word macro, I'll have to allow them to run.
And since Outlook cannot be removed from my Windows 2003 PPPP (Palladium-Protected Professional Plus), I use it for all my email. I use macros there, too, because I need Outlook to update my calendar when my boss sends me a meeting invitation.
And Outlook 2003 PPPP and Word 2003 PPPP are Palladium-signed applications. So they're safe, right?
I am sure nobody will ever find any buffer overflow or format string vulnerability in these apps, and that none will ever use them to create another of these worms that propagate using the deadly Word+Outlook combo, and can be activated merely by previewing the message.
This is such a nice improvement over the current situation. So who care if I have to insert my credit card in the MS PPPP Card Reader and pay $1.50 each time I want to read the news on MSNBCNN? That's definitely worth the price.
** N ** O ** T ** ! **
--
Mad science! Robots! Underwear! Cute girls! Full comic online! http://www.girlgeniusonline.com/
> Does anyone remember the fight over the clipper
> phones?
Yep. Of course, this didn't scratch the itches of many folks, since if the average person thinks to {him|her}self, "I hope no one's listening to this phone conversation," they implicitely mean their government.
What the NSA should have done was convince phone companies to make listening in to phone conversations trivial for the average person. And making each phone "scriptable" in some poorly-designed language would have worked wonders.
> It wasn't a rejection of the clipper ideology
> that sank the proposal. It was a proof that it
> would be possible to build counterfeit clipper
> phones that would interact with the system. The
> NSA screwed up, they built a system that wasn't
> strong enough.
I'll take your word on it; some links would be cool. (I'm not questioning your integrity, it just sounds like interesting recent history.)
> How do they differentiate between a rogue board
> that pretends to be palladium compliant and a
> real one?
They can't.
> Especially in a world with flashable BIOS?
Move away from Intel/AMD, and you don't even need to screw with the BIOS. Just boot the OS of your choice and load the Palladium spoofing layer.
> What's to stop people from buying boards that
> will be palladium switchable?
Nothing.
> If you want to run Windows, you can set the BIOS
> one way, if you want to run Linux, you can set
> the BIOS to disregard it?
Yes. Er, no. AAAHHHH! (Magically catapulted to my death. What was the question?)
> Or what's to stop people from making boards that
> accept any signature without checking it?
(This is the best of your questions.)
JAIL TIME MANDATED BY THE DMCA.
Creating such a board would be viewed by the courts as a copyright circumvention device, since you could use it to watch "Incoming Freshmen" without paying the requisite fees to the distributors and (infintesimally) creators of that knocker-oriented masterpiece.
Fear will keep the star systems in line. Fear of this battle station.
"Whatever happened to fair use?"
-- Duff-Man
From the letter:
This is an important part of the evolution of the Internet, because without a Trustworthy Computing ecosystem, the full promise of technology to help people and businesses realize their potential will not be fulfilled. Ironically, it is the growth of the Internet and the advent of massive computing systems built from loose affiliations of services, machines, communications networks and application software that have helped create the potential for increased vulnerabilities.
You have to read it a couple of times, and compare it with reality. "Loose affiliations" are actually open standard, highly decoupled, and typically small interfaces -- the sort of connections that are easiest to test and validate. The greatest actual risk so far has been the "tight affiliation" that is script execution within Microsoft mail clients. Mr. Gates' statement is such FUD that it is appalling. I am developing less and less respect for the man.Also, Trustworth Computing (tm) has certainly already entered the trademark process -- it is capitalized throughout the article.
Y'know, there ARE alternative shells.
[insert witty comment here]
... considering this essay, written by His Billness himself.
- SMJ - (It's not just a name: it's a bad aftertaste.)
Test