Slashdot Mirror
Trustworthy Computing At One Year
ackthpt writes "One year ago Bill Gates issued forth an email directing the company to work toward Trustworthy Computing, making Microsoft operating systems, applications and services secure and reliable. Where is that effort at today? vnunet has this Q&A with Microsoft security chief Stuart Okin. Slow, steady progress seems to be the result. They've targeted Security, Privacy, Reliability and Business Integrity, but so far have had a go at Privacy. Okin indicates the strategy may take 5 to 15 years, but more immediate milestones are targeted within the next two years and focusing on reducing vulnerabilities in the next version of Windows, rather than attempting to fix 2000 or XP. I'd chalk this up as a frank and honest interview, rather than madly spun, and paints a picture of the massive cat herding effort undertaken."
My XP machine has never been hacked, so it must have been a success!
...sounds ominous. ;-)
you can't access this post unless you're running a Paladium-enabled OS.
//TODO: Think of witty sig statement
What we need to do is raise that bar and make sure these vulnerabilities are very obscure.
They're not going to fix the bugs, they're going to hide them underneath a new GUI layer.
If tits were wings it'd be flying around.
Isn't that an oxymoron? Nanoox
Microsoft moving to Palladium certainly helps them move toward their goal of privacy.
Q+A: Stuart Okin, Microsoft UK's chief security officer
Emma Nash [26-02-2003]
It's been a year since Bill Gates sent an email to Microsoft's 50,000 staff, informing them that security was the company's new watchword and its Trustworthy Computing strategy was its newest and biggest priority.
Twelve months later and the company says it wants people to be able to trust computing infrastructures within the next 10 years. The software giant is doing all it can to shake off its reputation of having bug-ridden software that is inherently insecure.
Stuart Okin, Microsoft UK's chief security officer talked to Computing about the company's security vision.
How did the Trustworthy Computing strategy came to life at Microsoft and what does it mean?
Trustworthy Computing was born out of chief technology officer Craig Mundie's office in January last year. He coined the phrase and it lead on to a vision that resulted in the famous email that Bill Gates sent out. Trustworthy Computing is a vision of the future in five, 10 or 15 years, which says we want users to say they trust their computing platform.
Craig uses the analogy of the telephone: You can unplug a telephone and move it to another room and plug it in, and 99.9999 per cent of the time it will work. When we use it, we are pretty sure that we know who we are talking to, and we know we'll get a bill at the end of the month and we know what rate we'll be charged at, and we are protected by Oftel. That's the vision, and that's where we want to be.
We have come up with four pillars: security, privacy, reliability and business integrity. We are trying to develop a score card system for each one of these and put an improvement plan in place. To date we've had a go at privacy and we are trying to roll that out. The other three are more difficult.
What improvements have been made so far?
The largest impact has been on our consumer business. About 11,000 programme managers, developers and subsidiaries have received additional security training. A lot of this is about learning how to write secure code, and consider things like - do you need certain functions set as default? We've also seen an impact on our security bulletins.
Microsoft issued 72 security bulletins last year. That doesn't help your reputation, does it?
The problem with Microsoft is because we have a big deployment base out there, we go very, very public with any vulnerability, with patches. Some we actively alert the press about. We know it's going to cause negative press but we have to do it. That's a problem for us. But if you follow any of the vulnerabilities of our competitors, we are not as bad as them. It just takes one vulnerability to be exploited and it has a major effect.
It is a problem from a reputation point of view. And we know that we will never be able to get rid of every vulnerability. Anyone who says the opposite is not living on this planet. What we need to do is raise that bar and make sure these vulnerabilities are very obscure.
Will it be a big struggle to change people's perception of Microsoft and security?
There is a broad spectrum of people that like Microsoft, and there are those that don't like Microsoft. Microsoft is a very successful company and there's a lot of people that don't like success. In 10 or 15 years time we could achieve Trustworthy Computing and there will still be people that don't like us. That's fine. We can't win with everybody, but we can ensure we are transparent, honest and forthright.
How much of these security problems can be improved with education?
It's partly to do with education, but Trustworthy Computing is a roadmap. We will bring out the most secure software we have, but there will always be vulnerabilities. It's about what we can learn from them and then we can raise the bar again next time round.
Will we see a decline in the number of security vulnerabilities in the coming years?
I'm not sure we will see the number decrease particularly, because they go across all of our products. I hope we'll see them decrease in products like Windows 2003 rather than 2000 and XP. We have some internal aims and we work on the basis that we aim for zero, and we see where it goes from there. We have the people, processes and technology in place to get to zero.
Surely this is an industry undertaking and Microsoft cannot get the world to trust computers on its own?
We cannot do it alone. We have to do this with our partners, with the government and with our competitors, because there are things we can do with education and awareness. It's Microsoft's vision but it's not something we can do alone. We are working with our competitors through standards groups, such as Saint.
How progressed is the strategy?
We have done a lot in the last year but we need to do a lot more in the next two years. We need to do a lot more in the patch management area. The product groups are very much independent at the moment - Windows, SQL, Exchange are all pretty much separate. We have to work to common standards, which we've pretty much got licked because of the arrival of the internet and open standards.
The one we haven't got licked is patch management and engineering. Each division has their own engineering group. We have got to bring engineering to a point where all patches are together in a single deliverable way. We're looking to get to two installers in the next two years and then to one some time after that.
"Craig uses the analogy of the telephone: You can unplug a telephone and move it to another room and plug it in, and 99.9999 per cent of the time it will work. When we use it, we are pretty sure that we know who we are talking to, and we know we'll get a bill at the end of the month and we know what rate we'll be charged at"
No, we don't know that. That man has obviously never seen the wiring in my apartment building. I'm lucky if I screw in a light bulb and have it work.
And as for the bill? I scrapped my landline and went with Vonage because I *never* knew what the bill was going to be. The list of 9 different taxes varied every month.
Wow, and with this story still on the front page?
This gives me flashbacks to Statistics classes in college. Specifically a problem where a hypothetical bus company wanted to raise prices, but for each increase they lost riders. The result was to curves and the intersection was where the "optimum" result was.
I can envision that same graph in MS, where "security" and "compalints/bad PR" are the two curves...
Learning HOW to think is more important than learning WHAT to think.
Secure...reliable...I still don't trust all the misc info that is dumped to disk at install time. 400+ printer def's, and misc. etc... MS seems to be throwing hundreds of small .exe's into their system to make it easier for tasks to be done, but correct me if I'm wrong, but isn't it harder to keep a system secure if you keep adding application after application to a base install? More apps, more code...more room for something to go wrong...
-- AcquaCow
up 12 days, 22:30, 2 users, load averages: 993.20, 994.21, 994.56
*makes note to limit user processes...
While you can talk about all the work that is being put into making Microsoft products secure and bug free all day long, it really is pointless.
Think about the read world. I set up a new box with Windows XP server. I got the new service pack and all the latest patches from windows update. IIS on my box was hacked within 2 weeks. I was hosting a warez ftp that I had no clue about. I don't trust Microsoft worth shit anymore.
I am a viral sig. Please help me spread.
the path of least resistance
Since the interests of a business aren't necessarily aligned with those of buyers, and those of a monopoly even less so, MS computing will be about as trusworthy as the rest of the business world. Unless there's someone (regulator or consumer interest group) breathing down their neck, they are unlikely to be worthy of anyone's trust.
I guess that's trustworthyness through DMCA ? If you can't even secure a game box, why would I trust them with my servers !
Some people think it may be a hoax, but for what it's worth...
ISONews
Yahoo
"Whoever would overthrow the liberty of a nation must begin by subduing the freeness of speech."--Benjamin Franklin
So NetBSD, Apache, ErOS users are all... in space? Someone call NASA, I think we have a Mars program...!
Karma: pi (Mostly due to circular reasoning in posts).
a) Huh?!?
b) So it isn't the 72 security bulletins, and it isn't the fact that putting out that many overwhelms IT people, and it isn't the fact that the patching process can be so arduous and potentially destructive (can you say Slammer) that people will avoid it for months on end, and it isn't the fact that MS tends to be initially evasive/dismissive of a large number of exploits discovered. The problem is the going public.
c) I'm still not feeling the Trustworthiness.
You have to admit the man has a point.
Microsoft? Trustworthy? What this means is that our computer systems need to trust Microsoft - a company who, while I'm always willing to give them a chance to try and redeem themselves, are primarily interested in making profit before giving people what they actually need.
I'll none of it. 5 to 15 years is being optimistic!
His answers seemed frank and honest, a nice touch. Makes me wonder if he'll find himself out-of-work next week.
Okin indicates the strategy may take 5 to 15 years
15 years? What M$ product is around today that will be around 15 years from now?
Is it possible for a virtual architecture to sort of repair a flawed real architecture under it? For example, x86 page protection is not as granular as it should be. Is writing a virtual architecture similar to x86 but where these problems are fixed building on a swamp, or could it actually be effective?
Slow, steady progress seems to be the result. They've targeted Security, Privacy, Reliability and Business Integrity, but so far have had a go at Privacy.
/. main page.
No kidding. The best example is the latest Windows Update engine collecting info about all your registered applications, featured earlier right here on the
Talk to me about Privacy and Business Integrity again, and I'll chop your head off.
"Trustworthy Computing is a vision of the future in five, 10 or 15 years
But in the meantime we shall vigorously pedal all the buggy shit we can, and still claim: "It's the most secure yet"
I was always told:
Measure Twice...Cut Once
That's some free advice from me to MS
There are also those who have nothing against success, but do have a problem with being gouged by Convicted Monopolists (tm) selling insecure bloatware.
If, a decade from today, Microsoft is still trying to fix the problems they have now, then they're dead in the water. Someone leaner and meaner will come along and push them aside.
That's the way this business works. We're not the car industry.
I'll tell you what the 'effect' is! It's pissing me off!
The wierdest thing happened today. My father picked up an el-cheapo computer I built for a relative from me, and asked about linux. I was floored. My father is intelligent when it comes to many things, but is not computer savvy. You guys will probably flame me for this, but my father wants to try linux because he can't pirate XP easily. However, his company buys a ton of software based on his recommendations (based upon mine), so his decision usually ends up filling Microsoft's coffers a fair amount. I like the idea because I can ssh into his machine and fix something if it breaks, and I don't have to worry about all the damn viruses, key loggers, and spyware he seems to collect like a bee collects pollen just through regular email correspondance.
When I hear people bitching about the new direction Microsoft is going with anti privacy and anti piracy I rejoice, and wish them to go further. All it does is push more people into a free operating system such as BSD or GNU/linux.
Craig uses the analogy of the telephone: You can unplug a telephone and move it to another room and plug it in, and 99.9999 per cent of the time it will work. When we use it, we are pretty sure that we know who we are talking to, and we know we'll get a bill at the end of the month and we know what rate we'll be charged at, and we are protected by Oftel. That's the vision, and that's where we want to be.
Good lord, that's Microsoft's idea of trustworthy? At least 75% of the Verizon bills I audit at work are wrong, many to the tune of thousands of dollars. And don't get me started about the impossibility of figuring out whether the caller is a telemarketer before picking up the phone...
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Even telephones fail.
There are four pillars in computing to us. We are activaly pursuing one of those.
We have billion customers and only a few tens of thousands of employees to fix there problems.
We may fix most of our security problems in say, 10 to 15 years.
Some people dislike us and we are ok with that...we're still quite rich.
You can fool all of the people some of the time,etc,etc...
No one is 100 percent secure. It is impossible.
Our goal is 100 percent security, and we think we can achieve that.
One last thing, Win200 and WinXP may have security holes (we don't plan on fixing), but Win2003 will be GREAT! Well in about 10 to 15 years...
I suppose YOU could secure a game box where the attacker has physical access to the machine? If so, someone in the security industry should hire you ASAP! But in reality you're just an anti-Microsoft idiot...so nevermind.
I'll say they have! By this time next year they should be nearly finished with their program to eliminate all of the above.
In Soviet Rush, today's Tom Sawyer gets high on you.
It's definitely real
And on a similar note, several sites were shutdown and taken over by the government without a conviction of the parties involved.
There are no known ways to herd a cat. Now, if you're talking about skinning it ...
Cyde Weys Musings - Scrutinizing the inscrutable
He answers to one question:
And we know that we will never be able to get rid of every vulnerability. Anyone who says the opposite is not living on this planet.
then 2 questions later he says:
We have the people, processes and technology in place to get to zero (security vulnerabilities)
so am I reading this wrong or is he contradicting himself?
"...I'm lucky if I screw in a light bulb..."
That brings to mind the old joke:
Q: How many flies does it take to screw in a light bulb?
A: Only two, but how'd they get in there in the first place?
Give me my freedom, and I'll take care of my own security, thank you.
Developers, program managers, QA engineers, and marketing leads should be held accountable for security holes found in the products they ship. Even after the fact. E.g., those responsible for the recent Slammer vulnerabilities should get smaller bonuses and performance incentives this year. This should be part of their "Trustworthy Computing" initative. If development and business owners are not being held personally accountable within Microsoft, their products are not going to improve. Period.
Decent MSFT employees stay on average 5 years. This is more than enough time for the "dis"-incentive of a post-mortem on the security of their product to have an effect.
You listening, Bill? Steve?
PS: I'm ex-MSFT. I left because while I believed in the strength of the individual developers (the best as a whole I've ever worked with) the corporate management does not listen to the actual needs of the customers. They are very, very good at listening to what the customers will buy. Unfortunately, those are two different things right now.
The first three I understand, single words with a direct meaning. The forth business integrity ? Why is integrity qualified with business? Whose business and how? Its seems a little more difficult to pin down what they mean by that.
yes, it has. We've read through your personal files (good stuff, fun) and are now using your box as a spam forwarder and a DOS instigator. Nothing personal.
And I don't think Microsoft really understands the real reasons why. The interview hints at the mentality of MS that its detractors are somehow upset because the company is succesful.
I don't dislike MS because it's been so succesful, I dislike MS because A: Its preditory business practices and B: Its disdain for its users.
It would be like Al Capone saying the only reason why people don't like him is because he was so rich and powerful.
The Internet is generally stupid
The February issue of Information Security has a special report by Lawrence Walsh titled "Trustworthy Yet?" that is a good companion to this article.
When I buy Microsoft products, I know I can trust them to shaft me with shoddy software, vendor lock-in, DRM, gratuitously incompatible file formats, etc.
From the linked article: But if you follow any of the vulnerabilities of our competitors, we are not as bad as them.
Um, which competitors are these? Where are the numbers (minus duplicate counting across distros and inconsistent inclusion/exclusion of apps)?
Would this be the FOSS community that acknowledges and patches holes in hours?
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
The product groups are very much independent at the moment - Windows, SQL, Exchange are all pretty much separate.
;)
How about they just use the IIS guys room as base of operations?
No kidding. People would be much more likely to accept/forgive MS if they ever showed any evidence of contrition. As it is, they settle lawsuits, claim they are just being persecuted, and blame people for being jealous of their success. And they wonder why we don't trust them?
-Looking for a job as a materials chemist or multivariat
But if you follow any of the vulnerabilities of our competitors, we are not as bad as them.
Sorry, but this is just not true. The last time UNIX had a melt-down akin to any of the last dozen or so MShit worms was the RTM worm, and that was in 1988.
I've been alarmed that people have been using pipes like those from the raids to smoke an herb that occurs naturally and has been in use for thousands of years before the DEA existed. Next up are the sinners who use mary-jane for medical purposes. I'll be damed if someone who has terminal cancer is gonna get even mild relief. Die in pain dam it!
Sorry, I meant Win2k Server. (sp3 if you want to know) I was typing in auto mode, sorry.
I am a viral sig. Please help me spread.
> Anyone who says the opposite is not living on this planet.
No, he's not contradicting himself but just doesn't live on this planet.
k2r
Kind of ironic that when you're creating a file that you need to restrict people from because you don't trust them to follow simple instructions it's called trust-worthy computing, eh?
Comment removed based on user account deletion
I hope it wears off by tomorrow...
That is all.
Comment removed based on user account deletion
I don't know about the rest of you, but I certainly feel I can trust Microsoft to help themselves to as much of my privacy as possible! -- Aumaden
Is to have as few as possible cats to keep track of.
There comes a time when the labor of herding the cats exceeds the value of the labor they produce and the whole thing starts to go downhill.
MS hit that point many years ago. They have a lot of money though, and a profit margin that's nearly obscene, so they can afford a lot of cats, so they get them.
You want more, better, faster product from MS? Cut the staff in half, starting with middle management.
Daimler and Benz invented the automobile working alone. The Wright Bros. invented the aeroplane working alone. It takes a team of engineers and designers 6 months to *two years* to make a change in a Ford's hood ornament.
The man month truly is mythical.
KFG
We have to work to common standards, which we've pretty much got licked because of the arrival of the internet and open standards.
Perhaps I'm being cynical, but since when has Microsoft truly embraced open standards? They are still trying to hijack Java, which, I guess, could be seen as proprietary in a sense because Sun owns it but it is open to a certain extent in that it embraces multiple platforms. Also, if they are committed to standards, why doesn't Chimera or Mozilla really function properly as an Outlook web client for Exchange? They send broken style sheets to Opera. The list goes on.
It seems to me they're trying to own the internet, like everything else, after denying its usefulness all those years ago.
Those are such secret bugs/patches, Microsoft doesn't even tell their OWN admins.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
Windows 95 !!!
'Cept you damn Vax people. But then again, you aren't really "people" are you?
If architects would build houses like programmers build programs, the first woodpecker which comes along would destroy our civilisation.
... whenever a text is transmitted, variation occurs. This is because human beings are careless, fallible, and occasiona
MS's true concern (lack thereof) for user privacy is covered in http://slashdot.org/article.pl?sid=03/02/26/132023 1&mode=thread&tid=109&tid=158
which refers to the spyware built into Windows Update. Those who trust MS are fools. The only secure Windows box is one behind a firewall that prohibits it from making connections to the Internet.
The fact is that most people LIKE Microsoft. You may be talking about the OSS geek microcosm on /., or even the relatively small geek microcosm, but survey after survey shows that most people in general *love* Microsoft. I looked up a bunch of 'em for a post a few months ago, I don't feel like finding 'em again.
... should be the ones without Microsoft behind.
So far we've seen a breakdown of every level of security that Microsoft themselves preach, and we've seen it recently:
1. They didn't test their own code(patches) before releasing it. Exchange (summer '01) and NT4 ('03) are examples of products broken after patches. The NT4 patch took over a month to fix! There are still about 9+ vulnerabilities with IE out there, and have been that many ever since it's release!
2. They have seen numerous internal vulnerabilities in house. Examples include the VPN contractor who was vulnerable and exposed their internal code, as well as slapper worm happening last month. The second is a massive issue, no patching on their own systems, I can't believe that one.
3. They are vulnerable to social engineering cracks, which can effect their infrastructure from the top down (someone claiming to be from Microsoft getting issued valid global certificates that all machines trust.) Microsoft wasn't even at fault there, but someone MS trusted was.
The problem is here is that they preach, but the practice, and more importantly the models will *not work* in the long term. As their OS's and software becomes much more hemogenized, the "defaults" won't matter as much, because the system will depend on itself far too much.
An example is security in the windows world is dependant now on auto-updates. You crack that and you crack EVERY WINDOWS PC looking to it since Windows 95.
Where are the checks and balances that will prevent an attack from the top down? I don't see it ever being viable with trust being put in one organization.
fslg503-985-8686503-985-8686503-985-8686503-985-8
Imagine a grocer sells you 5 apples. That same grocer the very next day tells you no I don't sell apples, never have. So you buy oranges instead. Not 5, however, because you are now distrustful of this grocer telling you false advertizing.
Here, Microsoft is the grocer, and we are the suckers who don't know better than to believe such foolishness. You want apples, but Microsoft claims it sold oranges and only oranges. It is ridiculous of course.
I suggest you read Slashdot
"We have to work to common standards, which we've pretty much got licked because of the arrival of the internet and open standards. " Yeah, right!
Quick! Close the source of any Linux project that may have security vulnerabilities.
If architects would build houses like programmers build programs, the first woodpecker which comes along would destroy our civilisation.
funny.
but an unfair comparison. Architects have a profession going back tens of thousands of years. Software Developers go back decades.
That is to say, you will
No. It's not because of the amount of time Architects have been around, it has to do with the fact that there are legal controls within the building industry; it's hard to become a architect, and gain that ability (and liability) to stamp and sign drawings.
OTOH, Anybody can stand up and proclaim themselves an programmer. an 'software architect'. IT's an unregulated industry, and that's why it's so messed up. It hasn't anything to do with how long they have been around; hell cars have only been around a little longer than programmers, compartively. Look at the amount of regulation that goes on there to keep people and the environment safe.
Using a site based on piracy to sell a device whose primary purpose is to promote piracy is simply stupid. You would have to be an idiot to think you could get away with something like that in today's political climate.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I think Microsoft must be softening us up for another round of double speak (refer George Orwell "1984" for a definitive text)
security = anyone can access your stuff and break it privacy = microsoft and your boss (via the network tech) can access all your stuff reliability = system can be relied upon to crash and eat your work at least twice daily business integrity = it's important to tell your customers what they want to hear ie lie
pillars = we only need one to hold everything up
improvement = as practiced by Bill Clinton: talking about it and reporting on the talk is the same as action and progress
phone won't work in another port when your network tech has pinched the port at the hub for something else.
"We can't win with everybody, but we can ensure we are transparent, honest and forthright" The sky is falling the sky is falling, does this mean microsoft wants to go open source??? OK, maybe not, must be more double speak.
transparent = obscure
honest = lie, cover up and divert attention
forthright = crooked, devious, manipulative
all patches are together in a single deliverable way patch3 can't be installed without patch2 which requires patch1 which requires the install upgrade, which is no longer supported, so you must buy the spyware version of our software (XP). Sigh. I'm going freebsd and Xwin or similar.
-- it must be true, it's on the internet.
Mechanical engineers have been around a lot longer then programmers.
And not much to do with regulation. There are plenty of things that aren't regulated and aren't as dodgy as programing.
I still think its more to do the fact that Software Dev is an emerging industry/skill.
Unless someone figures out how to use a whistle to compromise the phone billing. Or use a radio to read the cel-phone signals in order to clone the phone. Or get people to dial 1900 numbers. Or....
Xix.
"Everything is adjustable, provided you have the right tools"
How to use outlook to secure your private email, for example those email jokes and pictures and love notes that can get you into trouble.
remember: its not very secure if it's been through your boss's exchange server.
create a pst file
file > new > personal folders file (.pst)
browse to your pc hard disk and create pst file on there somewhere (don't use the default dir). Chances are that your boss's system is not likely to back up your hard drive. Remember the network techs are likely to trash the hard drive any time they want to do an upgrade so you are responsible for your own backups.
Select some level of encryption and enter a password. Remember the encryption is probably token and microsoft would be able to hack into it using their key.
Drag all your dodgy email into this personal folder. If you can do this the same day as you receive the dogdy email, there is a small chance that you will have downloaded it off the work server before it would have been backed up (usually overnight).
Then each night before you go home, you can copy your fred.pst file onto your portable storage, and securely delete it from the hard drive. In fact if it goes directly onto the portable storage (I love those usb port things) even better.
Now to access the pesky mail at home. You need to go into your copy of outlook and create a new pst file, with the same name and password as your work one. Then replace the file that outlook created with your work one. I dunno why you can't just "attach" the work pst but outlook won't let you.
I don't guarentee this method but it is a whole lot better than leaving it on the work server for anyone else to read. Better is to have your own email with an independent ISP, but if work mates insist on using work email for non work, then hide the results.
I like to think that if my previous job tried to sack me for sending dodgy email, I could take most of the workforce with me or claim unfair dismissal. Can't get anything done (profit) if you have no workers right?
And note, this doesn't protect you at all if you are the one sending the dodgy stuff.
-- it must be true, it's on the internet.
Comment removed based on user account deletion
Regular Joe: Sorry sir, i thought i could open up the hood of my car like my parents used to. You mean i can't ever own a car again because of what i've done?Why don't you trust me anymore?
CIA:You never registered and activated that vehicle and as a result it's been flagged as stolen.
Regular Joe: Stolen?
CIA:Yes it makes no difference if you have a reciept you failed to follow the proper procedures of activation. Following Proper procedures is the only way to ensure full trustworthy compliance.
Regular Joe: But what if i want to go somewhere in a car?
CIA: After your internment in Corporate Reform camp you'll be given a new number in addition to the SS# you already have.
Regular Joe: Why do i need a new number? Isn't one enough already?
CIA: Your new number will be used in our GPS database in order to track your movements from place to place to ensure you are not moving around in any unregistered or unactivated vehicles. If you disable your tracer chip we'll be forced to arrest you again for non-compliance with trustworthiness protocol.
Regular Joe: But i thought you guys only used those for money? You mean you put those in people too?
CIA: Only people that fail to earn trustworthiness. You can earn points towards trustworthiness certificates like everyone else does through reporting on violations of trustworthiness to your local CIA chapter. Upon approval of verified violations you will recieve your first certificate, but if we can prove you have turned into us false or misleading violations you will have to be sent back to Corporate Reform Camp.
Regular Joe: I never thought to take those rules about hood opening so seriously.
CIA: It's too late for that now. As soon as you opened that hood you should have noticed we knew exactly where you were thanks to the GPS chip that's set to go off in case of non-compliance with registration or in the unusual event a hood is opened. Have a nice day. Oh, and remember to thank the CIA for your newfound education reform at Corporate Camp so you can finally be on your way to joining the rest of society in earning full compliance of trustworthiness.
Uncle Bill's and Hopping Steve's Wild and Wooly Happy Upgrade Merry-Go-Round Fleecing is coming to a screechiing halt as businesses realize they don't have to contribute a few thousand sqaure feet to Gates's mansion.
And all the MCSE pushers can't change that because the addicts are wising up...
focusing on reducing vulnerabilities in the next version of Windows, rather than attempting to fix 2000 or XP.
Yeah, why would you want to fix a product that was originally sold as a trustworthy product to an unsuspecting (gullible? naive?) public when doing so would undermine your ability to coerce people into buying your next so-called trustworthy product; which they'll eventually have to buy in order to protect themselves against all of the unaddressed problems with the old product?
How many times will people fall for this? Come on, Charlie Brown, get a clue and stop falling for Lucy's stupid fucking trick!
--Lawrence Lessig for Congress!
> we go very, very public with any vulnerability, with patches.
Hahahahahha, funny man.
Maybe it was a typo.
we go very, very hard after anyone who forces us
to admit to any vulnerability with patches.
Because, too many companies, include MS who said that they're working on the privacy aspect break their promises or hell, don't even TRY. They'll constently send back data about the person's computers, or do what ever they can, to steal our privacy. XP sends back all sort of info about what is on yoru computer. Why? Who knows, but there's no resason for it.
Shadowwalker Delaforge
MS is always mean. I don't think much of anyone would deny that the #1, top, only significant goal of MS has only been to be the dominating, primary, controlling, only figure on the scene, from OS to Office Apps, to Media playback, to DRM, to even the Console Gaming System now.
Hoever, you have a very good point regarding staying with only the OS development. By developing the OS only, they would not have forced competitors in browsers and office apps out of the market. They would not have been an enemy of EVERY business. They would have let other companies design good apps for their product instead of designing it to crash running anything other than their own software applications. In all, Windows would have run better and the programs you run under Windows would have performed better.
"we go very, very public with any vulnerability"
What a total piece of crap! They do not go public with every vulnerability, they do not go public with every "feature" where feature is a terrible hole in the system that they try conning people into believing is a useful tool (to who? russian mafia and script kiddies?). If they went public with every vulnerability, why do hackers have to post vulnerabilities on mailing lists before MS will even acknowledge them and call them features?
And since they don't patch every vulnerability, who cares if they admit to them. They don't admit to them in mainstream media where they lay down the Spin better than a politician. The average user isn't going to be aware of most of the vulnerabilities in MS and are not going to bother anyway, as MS wont patch them, or those patches will crash their system.
This guy is insulting. I am offended because he insults me by pretty much lying to me about the efforts of MS. Not that I don't know what MS is up to, but it's insulting for him to try pulling it anyway.
They are gearing toward their ultimate goal of Trustworthy Computing. :)
I hate this kind of lame ass comparison. The TV has few problems because it does one thing and you don't tamper with it.
A TV that had to be changed every couple of months to handle a different signal from each station would not be "trustworthy".
A phone that had to do 15 things, such as playing games, doing calculations, and decoding text messages would not be as "trustworthy".
The computer must do all these things. But the most untrustworthy part of the computer lies in it's necessity to contact other computers. You have to allow your computer to "trust" some information coming in. Without accepting outside data as good, you could never allow your machine to decode anything. And it just so happens that not everything out there is good. I want my computer to stop crashing. I want decent drivers. But I don't want my computer to be a telephone. I don't want to give up all it's features just so it wont break.
I want to be able to run games from people that MS doesnt like. And I think that MS's version of Trustworthy basically means stopping your computer from running any code they don't approve first and not allowing reputable users from knowing of vulnerabilities.
of course it's behind my OpenBSD server's nat which is where teh real security is ;)
Talk about a load of PR horse crap. What a waste of time. why the hell is this crap even getting posted.
now, I've only done this on ONE machine but, this past week I was assisting a relative to format a new harddrive. The HD utility disk was had become corrupted to I had to go to the harddrive manufacture's site (western digital) and get a new one. They didn't have floppy *.iso where you could use DOS's rawrite so the only way to make a floppy was to download the DOS executable. Unfortunately, it hung after launching it under XP. Luckily, my uncle also had a win98 laptop that I was able to network-transfer the exe and create the floppy
$cat
Call me paranoid, but I think I trust myself more than I'll ever trust a stranger.
Hmmm... Is that what passes for paranoid these days? Ridiculous...
And we're not even talking business or national security.
"Trusted computing" my ass... That's like a Mafia slogan, "Legit business".
Sticking feathers up your butt does not make you a chicken - Tyler Durden
had a go at Privacy Yes, they certainly have...
Paper MCSE's. Seriously, I work with some people who were social research majors who thought that understanding how to use Windows makes them a computer scientist. The people screw more stuff up under the guise of reparing things than anyone I've ever seen.
;-)
And the management and employees I worked with prior to that at the same place went to a different place. I make a point of checking out their uptime on netcraft (running Win2000/iis) vs. ours. Their's is one fourth of our longest uptime - 60 days vs. 240 days for us, and only because the idiots I work with rebooted so they could rerun stinking ethernet cables! I tried to explain to them that they didn't have to turn off my web server to rerun the cable, but those MCSE's, you can't get anything past them!!!
Is it just me, or is MS basically the nerd from highschool?
(Ooh, tough crowd)
Seriously...
They wet the bed, but never confess to it.
They try to see what everyone is doing, all the time, trying to gain more acceptance.
They always seem to say they are becoming more like the other kids.
They say people don't like them because they're smart and rich and successful and and and....
They copy what the other kids are doing, blatently.
The kids who are always getting in trouble keep knocking their books out of their hands.
They just never seem to 'get it'...
More?
Microsoft has everything including the kitchen sink in the kernel. Multimedia codecs are in kernel space. Networking stacks are in kernel space. Internet Exploder is "part of the operating system". (Open a file dialog box from your own application, and three new threads start up, some of them in parts of IE.) Any of this code can contain a security hole. And it all changes constantly. It's hopeless with a system like that.
It can be done right. Look at VM for IBM mainframes. When was the last time you heard about a security vulnerability in VM?
Not that Linux is all that much better. The kernel is much too big. But at least the windowing system is outside of the kernel.
In some cases, yes. TCP/IP is built that way... I forget which is which, and I'm actually way out of my depth here, but one protocol basically sucks, and the other was built on top of it to make it reliable. Other examples, I do not know, and I'm not sure how wel this applies to other situations... Like I said, I'm out of my depth, but I think the principle is sound.
What effect these few changes have had on third party applications? The DRM baked into Office 2003 seems to required purchasing quite a few upgrades. What's are the technical and licensing gothca's?
Information Security magazine have a cover feature on the same subject, specific articles are here, here , here and here. I haven't read my paper copy yet but they're usually fairly good quality (well, better than most trade press anyway.)
No, I have no connection with them.
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
So if you are sharing your car with your mom, you are hurting profits of car makers, because your mom does not need to buy her own car.
So, if you look at it this way, then it is appropriate to "punish" you for such sharing by requiring you to pry out your eye.
:)
hany
I still don't trust all the misc info that is dumped to disk at install time. 400+ printer def's, and misc. etc... More apps, more code...more room for something to go wrong...
You:
I thought Linux/OSS was of the "Do one thing, and do it right" philosophy? So if Microsoft does the same, it's unsecure and A Bad Thing?
IMO AcquaCow is talking mainly about unused stuff (hardly anybody has 400+ different printers installed all at the same time) while you are talking about all stuff (both used and unused by user of the system).
hany
Microsoft making changes to itself to make its programs secure and reliable should frighten you. How often to Microsoft fail at what they set out to do? Pretty soon, the only thing that free and open software will have is just that, free and open. Try explaining that to someone as a reason to use one piece of software over another.
dominionrd.blogspot.com - Restaurants on
It looks like to me that while coder includes resources for such "looping" in their estimates, marketers do not.
Marketers make some initial cost offering, maybe leave some breathing room in it (so profit wont be smaller when somehing goes wrong) but when they are "looping" they think that "it is just small change, it took me 2 minutes to think it up so it takes say another 20 minutes to coders to add this to project (originaly I planed it for 2 hours and they said it'll take them 20 hours to code)" never minding possibility of risking something like:
But I'm not marketer, they should know better. But indications show thet they generaly do not.
hany
The Sky box I have at home connects to the phone line - it is part of it's rental contract that it has to be connected, otherwise you have to pay considerably more.
Ostensibly it is to use interactive services, it is not however a particularly large leap of faith to beleive that it records statistical information on whats being watched, for advertisers etc... Do I trust it - not particularly.
And if you plug the wrong phone into the wrong phone system, you are going to blow out either the phone or the local phone switch. Hell, there are even a few flavors of Analog phone depending on what part of the world you are in.
Now let's assume that we are only dealing with analog phones designed for our ubiquitous american AT&T network. (Yes folks, the reason every phone system in the US in compadible has everything to do with the Bell monopoly.) Is it a pulse or tone line? It is even connected? Is it actually a DSL?
Nope. as a phone/network guy who works in a very old building, I would say your chances of plugging a phone into a jack in the next room and having it working are more like 25%.
I do hear you on the billing issue though. I'm a Verizon customer and some days I wish they would just loose the pretenses and simply charge me more.
"Learning is not compulsory... neither is survival."
--Dr.W.Edwards Deming
Comment removed based on user account deletion
RMS has a pretty good idea what it means:s t.html
http://www.gnu.org/philosophy/can-you-tru
He just lives on another planet.
Recession is when your neighbor loses his job. Depression is when you
lose your job. These economic downturns are very difficult to predict,
but sophisticated econometric modeling houses like Data Resources and
Chase Econometrics have successfully predicted 14 of the last 3 recessions.
- this post brought to you by the Automated Last Post Generator...