Windows Is 'Insecure By Design,' Says Washington Post

Circuit Breaker writes "A Washington Post article says Microsoft Windows is insecure by design. Quote: 'Between the Blaster worm and the Sobig virus, it's been a long two weeks for Windows users. But nobody with a Mac or a Linux PC has had to lose a moment of sleep over these outbreaks -- just like in earlier "malware" epidemics. This is not a coincidence.'"

Comments

Good point, muddled way of expressing it

[Raindance]

There's a large difference between "Windows is insecure by design" and "Windows was not designed to be secure or with security in mind" just as there's a significant difference between saying "Impalas are deathtraps by design" and "Impalas were not designed with safety in mind".

That said, and though the Post's article was a little muddled in general I agree with the spirit of the article in that
1). It's reprehensible that Microsoft apparently didn't have security (a broad term, but the literature to define it is out there) as a guiding design principle when they designed Windows, and
2) As a result of this, Items central to the functioning of Windows do not lend themselves to good security.

Re:Good point, muddled way of expressing it

[the Man in Black]

I didn't take that phrase that way until I read your post. The writer isn't stating that Windows engineers designed the OS to be insecure, he's stating that the way Windows was designed lends itself to insecurity. Two different takes on the phrase "by design". Slightly misleading, sure, but he clarifies in the article, so it's cred by me. I particularly like the comparisons he makes with Windows, OS X, and Red Hat's default install.

Re:Good point, muddled way of expressing it

[rekkanoryo]

The problems with Windows are largely what was pointed out in the article:

• Users complain they don't trust Microsoft and don't apply Critical Updates
• XP's firewall is off by default and takes at least five steps to turn on
• XP leaves five ports open by default--three of them are 137, 138, and 139, the NetBIOS over TCP/IP ports

I have the following to say on those issues, however:

• If users don't trust that Microsoft can patch a hole, they shouldn't use Windows and shouldn't buy PCs preconfigured with Windows, no matter how crappy the software availability and quality for the alternatives
• For the XP Home software, all dialup interfaces should have the firewall on by default. XP can automatically detect broadband connections as well, so on broadband internet connections the firewall should also be on by default
• Ports 137 through 139 should be disabled by default until file sharing is turned on. And even then, those ports should be specifically closed on all internet-facing interfaces. The port that console messages are sent on should be closed to the internet-facing interfaces as well, and probably just closed period on Home since console messages are supposed to be used by administrators in domain environments

These are not the only problems with Windows, nor are these solutions I propose going to be 100% fool-proof. But most of the problem comes to users' carelessness or naivete. By turning off all the unimportant messages in XP such as

• Get a Passport
• Take a tour of Windows XP

should wait until after more important, security-related messages such as

• If you choose to use Windows Automatic Updates, your computer will automatically update itself with the latest security patches. This will ensure fewer problems and enhanced reliability while your computer is connected to the Internet. Click here to learn more.
• If this computer will be directly attached to the Internet through either a dial-up modem, a cable modem, or a DSL modem, you should enable the Internet Connection Firewall by clicking here and following the instructions. The firewall will help protect your computer from hackers and self-spreading worms on the Internet, keeping your computer working properly much longer.

It's simple steps like these that, on top of proper security considerations and testing when designing and writing the code, will help protect users and the net in general from what we suffer right now.

Re:Good point, muddled way of expressing it

[PygmySurfer]

XP's firewall is off by default and takes at least five steps to turn on

I seem to recall XP's firewall being turned on during the inital "Welcome to Windows" wizard that pops up after installation, if you choose the option "This machine will be directly connected to the internet" (Or something like that).

That being said, I always turned the firewall OFF, it was too much of a pain to set up additional ports to allow.

Since then, I've moved to a Mac, and OS X's firewall is much easier to configure.

I certainly agree with the rest of your points though (and the majority of the article).

Re:Good point, muddled way of expressing it

[dhogaza]

Do keep in mind that at major papers like the Post reporters don't write the headlines. Just as they don't decide where their story will run (or if it will run), how big the type used for the head will be, whether or not there will be a subhead, etc.

So don't ding the reporter for the slightly misleading headline. Sounds like the reporter got it right in the part he or she wrote - the article.

Re:Good point, muddled way of expressing it

[hankaholic]

Fair enough, but many people may opt not to download updates because of their rediculous size.

Under Debian, at least, if a package is found to have a security hole, I have several options.

I can download only the affected package. Of course, since it's Debian, I can always opt to just bring the whole system up to date. If bandwidth is really a problem, I can even manually rsync an older local copy of the package against the updated version upstream.

Unfortunately, rsync isn't done by apt-get automatically, but the option to do it manually is there, as many Debian mirrors do support rsync.

The point is, though, that with Linux and the BSDs, you can find out exactly what you're downloading, and determine exactly what effect the new package will have. With XP, you might have no idea what you're getting. Spending eight hours downloading MS updates when you don't know what you're getting isn't something most people consider worthwhile, especially when it's often the case that after updating Windows, it's found that there have been refinements to the updates that just occurred, and so Windows wants to download yet more stuff, and reboot yet again!

People want to use their systems, not maintain them. As long as the MS "critical updates" take ages to download and often create the need for further updates, people will continue to ignore the "Windows updates are available" messages.

Rebooting is a lot to ask. Large downloads are a lot to ask. If I were to install all of the "important" updates available to Windows at the moment, it would require several reboots, especially since many components can't be installed at the same time. Under Debian, not even one reboot would be required, unless the kernel were updated. Under Windows, if I update Media Player, a reboot is required, and Windows won't even let me update other things at the same time!

I'm just glad I'm behind a firewall.

Re:Good point, muddled way of expressing it

[1010011010]

Well, he could have mentioned a true "Insecure by Design" flaw in Windows: the fact that Windows determines that a file is executable based on its *name*. If a file ends in .exe, .vbs, .bat, .scr, or one of lots of other extensions, Windows assumes it's executable and will load and run it when the user clicks on it. Or a "shell" command references it, etc.

On Unix and unix-like systems, one has to explicitly mark a file as executable before ths OS will try to run it, and it's even possible to deny the "execute" permission to an entire filesystem (for instance, users' read-write home directories).

Unless...

[Chemical Serenity]

... you count the *nix administrators who had to scramble to put in antivirus software on the corporate mail server to stem the tide of 50k+ virus mails per day.

On the plus side, if you work as a contractor, it's billable hours. :D GG SoBillable^H^H^H^H^H^H^HSoBig!

In a sense, it's true

[Anonymous Coward]

The old DOS/Windows had security as a pretty secondary concern, it was just about getting things to run and not crash a lot of the time. NT/2K/XP is much imrpoved, but it still suffers from this legacy. For example, it's still difficult to run users in non-Admin roles because some applications expect the user to have full Admin rights. Only when most of these applications are update will the ability to use real user security settings become practical.

Quick linux security test.

[Anonymous Coward]

To test if your linux box is secure, press alt f2 to open up the run dialog, then type

yes > /dev/mem

.

If nothing happens then you have a reasonably secure linux box.

Re:Quick linux security test.

[Negative Response]

I just did it and the result is:

zsh: permission denied: /dev/mem

You know, being funny aside, you just demonstrated one excellent point: Users should have enough rights to have work done, but not so much to easily screw up the system. Don't use root privilege in vain!

'windows attacked because popular'

[gl4ss]

the author makes nice (partial if you may)rebuttal of this myth, and also points to something to back it up like the number of open ports that create potential possibilities for holes,and that are for services that are default enabled, yet shouldn't be used in hostile environment(and how ms does nothing about it, and how xp was supposed to be more secure in matters like this). and frankly i haven't heard of non-hostile environment involving more than 10 people in a deserted island with lots of food and jolly sunshine happiness to keep them away from their computers.

-

Linux users

[jabbadabbadoo]

"But nobody with a Mac or a Linux PC has had to lose a moment of sleep "

Like a Linux PC owner sleeps anyway....

Good idea

[Rosco P. Coltrane]

Here's a modest proposal: Microsoft should use some of its $49 billion hoard to mail an update CD to anybody who wants one. At $3 a pop (a liberal estimate), it could ship a disc to every human being on Earth -- and still have $30 billion in the bank.

Please Microsoft, use CD-RWs. I already have a wall covered with silver AOL CDs ...

Re:Why was this posted?

[Audity]

It was posted because people have been saying for a long time that windows is insecure, but Joe Shmoe computer user won't know that (you mean there's computers that don't run windows?) until it gets some attention in the mainstream media. This is the media attention a lot of linux geeks have been waiting for.

Re:95% a target perhaps?

[Anonymous Coward]

what about web server worms? apache is much more used than iis, but this didn't help iis...

Re:Ummm...

[Li0n]

indeed...

I've had to patch and put up to date almost a dozen systems in my free time these weeks. Not seeing one penny for that since they all belong to friends and family... :/

That aside from the bozos at work that got hit and the flood of questions along the lines of "my computer keeps rebooting on me everytime I connect to the Internet... what can it be?..."

And people wonder why techies are grumpy...

Obligatory Question and

[Anonymous Coward]

Obligatory Response:

The argument sort of breaks down when you talk about webservers, with Apache solidly in front with % usage, yet it's the smaller-target MS offering that is the one hit with exploits.

There's something more fundamental about the differences in security -- yes, MS is a bigger target, but that doesn't mean that it can't also happen to be the easiest target (and it is).

MS Bashing

[mOoZik]

This is a bit unfair. Microsoft identified the problem and offered updates long before the worm hit the streets. Microsoft cares about the security of Windows, but it was the stupidity of the users which led to the compromise of their systems. If a Linux hole is found, nearly ever user would update to fix the change, because the average user of Linux knows what putting it off may entail. The average Windows user does not have the same computer knowledge, and hence, Microsoft gets the blame. Just another MS bashing is what it is!

Re:MS Bashing

[cduffy]

There're two issues:

1. There's this bug users didn't patch for

2. The system's default configuration made almost everyone vulnerable being attacked via the bug, even if the user isn't actually making use of the buggy service.

On item [1], yes, there's a really strong argument that it's the user's fault. On item [2], though, it's pretty damn clearly the vendor's negligence.

Actually mac and linux users were affected

[jdigriz]

Some of us alternative OS users were actually affected by the virus, even if we weren't infected. In addition to the Net slowdown, the friggin SoBig.f virus forges emails. So if you have any windows using acquantainces, or even people who received a forward with your address on it, the SoBig.f virus will cheerfully send out copies of itself purportedly from you! It doesn't just stop at the address book either, but allegedly scans documents on the drive to harvest addresses. Evil, evil thing. So, no computational loss, but potential harm to reputation, even though it's easy to prove via the headers that it did not originate from you, the vast majority of those windows users who get infected with emails bearing your From: line don't know a header from a hole in the head.

Re:Ummm...

[aussersterne]

Not only for that reason.

I don't have Windows anywhere and haven't for several years now. I don't run Outlook. But it turns out that at least one of the current batch of worms spoofs email addresses.

So all week I've been getting email messages from postmaster@ saying "...your message to so-and-so will not be delivered because it contained the SoBig worm, we advise you to download a security update from..." I wrote a couple of them and got two responses from mail admins saying essentially "Yes, we know it spoofs your email, sorry there's nothing we can do, please understand that we're under tons of pressure on our end, everyone is infected, this worm sucks, you have it easy, you run Linux, stop complaining!"

Anyway, people are receiving messages marked "from" my email address and are getting infected with a worm as a result. Obviously one or several people (editors, management, etc.) that have me in their Outlook address books have become infected and now the worm is spreading from their machines and spoofing my email address as the source. I totally resent this and actually worry about my liability.

Do I now have to trademark my own email address or something and then include a disclaimer in my email saying "This email address is my trademark, you are not allowed to add me to your address book in any way"?

The crap Windows security model has certainly affected me, a non-Windows user.

Re:95% a target perhaps?

[justsomebody]

Funny, you say that. That excuse is getting to its old age.

But it makes a great difference (on Windows) right in a moment after you:
step1) Disable Internet Connection to Explorer and Outlook (almost no one virus can connect to internet to download it's other part or upgrade, because they mostly use ActiveX download object)
step2) Start using Mozilla or Opera or even better Thunderbird and Firebird (in this step you disable IFrame and OCX viruses)
step3) Teach users not to open .pif and .vbs (Here you stop user interaction for virus to be downloaded)

Problem with Windows is not 95%, but IE and Outlook are made as centerpart of the system, thus allowed to any action no matter how stupid it is.

Based on that: YES, Windows is insecure in its roots.

Re:Corporate Blinders

[vacaboca]

"all this evidence for the need for operating system diversity in the corporate realm"...?

That seems to be a rather easy thing to say if you're not actually trying to manage a business with a large, complex interconnected system of technologies... having spent a rather painful amount of time (actually, more like an amount of rather painful time) in very large companies (35000 PC users at all levels of use), I have to say that a desire for OS diversity is far from an obvious choice. I'm not saying it's a bad idea, just a potentially unpractical one in many real corporate situations.

Working with the single devil you know as opposed to a vast army of individually varied devils may be preferable, at least in theory.

Re:Ummm...

[theCoder]

"...you have it easy, you run Linux, stop complaining!"

That's when you snap your suspenders, scratch your beard, and remember why you have that smug look on your face :)

Someone Who Gets It

[MBCook]

Everything I've heard on TV and Radio that's been more than just "There is a new virus" that has an attitude that I just can't stand. A thing I heard on NPR put it perfectly. Basically the attitude is that this is the way the computer industry is, and maybe they should do something about it.

Computer industry? WHAT COMPUTER INDUSTRY? The VAST majority of these big viruses exploit who's products? All togerther now: MICROSOFT. This isn't Apple's fault, Macromedia's fault, iD's fault, or anyone else. These things are almost all MICROSOFT's. Finally someone in the media seems to get it.

Re:Ummm... AGAIN, WHY NOT WINDOWS LINUX????

[croddy]

oh yes. they could call it MSUX.

Re:95% a target perhaps?

[deputydink]

Funny how 95% of PC users have Windows, I wonder why a Virus writer would want to target Windows??!? Perhaps that is why so many exploits are found, because people are targeting it religously, start targeting Mac and Linux as much and see who is insecure

Actually, virus writers write virii targetting windows machines because windows machines are easy targets, not because there are so many licenses sold.

According to Netcraft's site survey only a quarter of active sites run Windows leaving the bulk of the public internet running on *nix.

I suspect much of the 95% of PCs you speak of are safely walled up in institutions, schools and corporations private networks, which are generally out of scope for a worm like blaster to target.

Now koniosis, what you should impress you is that *nix's run the majority of public sites on the internet, (those sites most easily attacked, i might add) with a marked minority of serious compromises as compared to Windows. More sites, less bugs. Simple.

Finally, only a Microsoft employee could think that its justified that the amount of embarrasing code compromises grow proportionally to desktop marketshare.

Re:MOD PARENT UP, more..

[SoftwareJanitor]

Where you are wrong, and the Washington Post is correct is that Windows doesn't have to be intentionally flawed to be 'flawed by design'. Something can be flawed by design as far as security goes just in neglecting to design a proper security model to begin with. Windows is flawed because it wasn't designed to be secure from the beginning, and newer versions, even those written after Microsoft started to become more aware of the need for security, have been hamstrung by their need to retain backwards compatibility with older versions and for software written for older versions which in many cases just won't install and/or run correctly on a properly locked down installation of Windows. Whether Microsoft intentionally designed in security flaws isn't what matters, what matters is Windows, as it is currently designed and implemented has some inherent design flaws which make it less secure than it needs to be. Among them are the fact that so much Windows software relies on being able to write to system directories (to add DLLs, etc) to be installed, which leads most people to allow too many users to be able to access too many files. Another is the fact that Microsoft built in scripting which allows too much access to low-level functionality (in other words, it doesn't run everything in a restricted sandbox) into just about everything, including the email clients and office software most Windows users depend on. Another is the fact that executability is based on file extension and not by permissions, if it wasn't, then people wouldn't be able to accidently execute malicious downloads so easily. This problem is compounded by the fact that by default most Windows facilities and software likes to hide the file extension.

The Washington Post article is not a troll or flamebait, it is a very necessary wake up call to the average Joe Windows users. If more of them had patched their systems and used mail clients other than Outlook or Outlook Express as you have, then these viruses/worms wouldn't be such a big problem. Without the mainstream press letting these people know, they will not get the message.

Re:Ummm...

[Geek of Tech]

And people wonder why techies are grumpy...

Well, yeah, because you know we all make so much money...

Yeah.....

Re:Ummm...

[nikal]

If you digitally signed all of your electronic communication then you could effectively get rid of this worry. People who trusted your key would know immediately that this was a spoof.

Re:If you "trademark" your mail addy...

[Geek of Tech]

I am just trying to figure out how to strike a balance between limiting my exposure to liability in this networked world (because everyone is happy to sue these days) and still participating in society in normal ways.

Uh, hate to tell you, but unless you're sueing somebody you're not participating in society in normal ways.

Re:Ummm...

[Li0n]

They cease to be liable the moment you click "I Agree"

Re:Insecure by Design

[BRTB]

Also fact: System relies on file extensions to differentiate between executable and non-executable files, which in my mind is a bit worse.

Re:MOD PARENT UP, more..

[Flower]

MS chose to enable features as default that did not need to be on most installs. That is an insecure design. To be fair, earlier versions of RH did the same stupid thing and got burned by it. Macs also used to suffer from worms though I don't know why things got better - sorry used to keep up with Macs but not anymore.

Anyway, as for your requirement for "INTENT." Back when the CodeRed came out, work gave me the responsibility of locking down our IIS servers. Back then I didn't have any experience with IIS so I did the smartest thing I could come up with - started reading and convinced work to send me to a one day SANS seminar. Well, the instructor told a story from an MS employee of how MS figured it was cheaper enable crap like Internet Printing and the like by default than it was to eat the cost of projected support calls they would get from people who wanted the feature but couldn't figure out how to enable it.

IOW, enabling everything in IIS was done because it saved MS a few bucks. That is a design decision. It was intentional and most importantly it was insecure.

You still want to mince words on this?

Worse: insecure ON PURPOSE to allow macros etc

[Doug Merritt]

Windows is flawed because it wasn't designed to be secure from the beginning

True, but far worse: Microsoft quite intentionally continues to make Windows and Office etc insecure on PURPOSE, as a side effect of offering full programmability of email, Excel, etc.

There wouldn't be any email viruses nor spreadsheet viruses nor Word document viruses if these apps were lobotomized -- if they could not be programmed.

But Microsoft continually makes the business decision that adding the power of programmability to every app is much more important than the resulting insecurity.

The vast majority of Linux apps do not allow that kind of programmability -- even when extension languages like Guile/elisp/etc are available in Unix apps, programs aren't automatically and blindly run whenever some hapless user receives email or views a spreadsheet or whatever.

Conversely, whenever that kind of programmability is added to Unix apps, if it is triggerable just by receiving/viewing a file, then Unix viruses will become far more rampant. (A small saving grace is that the Unix viruses mostly, but not always, will run as some user rather than as root, but this is really only a small issue.)

This should be a wake-up call to teams like Gnumeric; just yesterday on Slashdot Gnumeric was criticized for not supporting every single MS Excel feature, and Jody Goldberg replied that hopefully it would include those by next year. But any Unix app that is 100% compatible with a MS app will be virus prone!

Quote from a poster on that story:

Worksheet functions are great, but a lot of Excel's draw comes from its embedded VBA. Companies that rely on workbooks with embedded VBA probably wont be willing to switch to Gnumeric until it has support for VBA, or something very similar.

Mmm-hmm, and there goes security.

(Story link: Gnumeric Now Supports All Excel Worksheet Functions )

The really sad thing is that the marketplace clearly agrees with Microsoft about this tradeoff: corporate and personal users are far more concerned with having the power of macros/Visual Basic/etc built in to everything than with even basic security.

The main problem with windows is the users..

[Ramion]

Today I sat down at my computer when I got a MSN message from a friend. That friend is complete noob with computers and now he had a problem.

This is pretty much what was said:
Friend: Hey. I got a problem with my computer. It has shut itself two times today, without me doing something. What do you think is wrong? I heard something about a virus.

Me: Yeah there is a few major virus's flowing around the net right now. Have you patched your system?

Friend: Patched ? ?

Me: Yeah. You know downloaded updates for windows.

Friend: No..

Me: Oh well. Here is a link to a virus scanner try and run that first. .... After awhile, me trying to explain him how to scan for viruses. Yeah! It found a virus named blaster and I THINK he got it removed...

Me: Good now to update your system. .... I, after awhile, get him pointed to the windows update and the patch for blaster. Again I think he got it installed ....

Me: So, Now I suggest you update your system with patches from windows update.

Friend: Why? What should I waste time download all that? What good does it do me ?

Me: Well... It secures your system, give you updates to windows programs and IE and new drivers. You know. Makes it upto date.

Friend: But how do I do it ? .... I try to explain him how to use windowsupdate but is almost giving up since he just dont get he just gotta press scan for updates and then install updates. Well in the end he gives up and says he dont care ....

And there is the entire windows Security problem. Users that just come to their computer to surf abit and download a few programs like kazaa or emule just dont feel the need for updates. And they end up spreding the viruses to the entire net. Oh.. And it dont help that MS dont allow pirate versions of windows to be updated fully. I can see why it would in sense suck for them to give free updates to people that havent payed for the system. But people dont get updates when its all blocked. Which in end leads to viruses like this to run wild.

Conspiracy theory

[bokmann]

I'm late to the party with this reply, but I'm posting it anyway for posterity. Someday I'll find this message and link back to it.

Windows IS insecure by design. The Virii and worms that are happening now are pissing people off. In the future, Microsoft will bring the 'security' scheme from the XBox to Windows... code will have to be signed by Microsoft in order to run on Windows. the press will love it, and you will see tons of articles saying things like "Microsoft gets Security Right" and "Microsoft Announces the End of Virii".

And in the end, you and I won't be allowed to fire up a compiler and write a trivial little 'Hello World' program without buying a runtime license from Microsoft, which will be embeded in every program you write.

Innovation will be stifled... I doubt Microsoft will be very license-friendly to Sun, or Apache, or Cygwin, etc.

Microsoft's own lax security is a plan to pave the way to their heavy handed takeover of your computer.

mark my words.

Perhaps I'm doing something wrong...

[ScottGant]

I'm not an XP lover, but it's the OS that's on my computer. It just is. I play games and run Photoshop and other programs...so I use XP because my favorite programs all run on this OS on fairly cheap hardware.

Now, I may be doing something wrong here, but I've NEVER had a virus. I've never had a problem with a worm or anything really. XP hasn't even crashed on me before....ever. I've had programs hang up or crash...but the OS itself hasn't crashed.

And this has been the same on the 2 different machines that I've run XP on.

But yet, I always hear about everyone raking XP and Windows across the coals all the time. Yet I've never ever experienced nor do I know anyone anyone that's ever had major problems with XP. Oh, I know people out there have problems...but it's just that I personally have never known any.

Why is that? Now, as I said, I'm not an XP zealot at all. I could take it or leave it. But after reading here on Slashdot the evils of Windows and XP it would seem that my machine should have burst into flames months ago, yet it's going on day after day, never turned off, always hooked to the net...and chugging right along.

And I'm not really doing anything special. I keep up with all the updates to XP...which takes about 2 minutes out of my week. And I have basic Norton Antivirus running. I have Seti@home running when I'm away from the machine and I do a disk clean up and defragment maybe once a month or so.

So again, I must be doing something wrong (or right) to where XP doesn't give me one iota of problem.

I'm not praising XP...at least I don't mean to be praising it. You only see people bashing Windows, never praising it. To praise it would mean being thrown out of geekdom. So I think if XP or NT is working for you, you keep your mouth shut or just talk about how great Linux is.

I guess your mileage may vary.

Re:JRTFA

[abirdman]

Right on. My experience was the same. I was immunized from BLASTER on July 17th according to the log from MS Update. It's very hip and au courant to ignore MS Updates, because they're a pain, and their Service Packs don't have a great reputation. But updating early and often has kept me out of trouble.

When I started getting Sobig emails on Tuesday, I even took the time to call two of my friends (who subscribe to some of the same lists I do) to warn them not to trust emails with attachments. I had to explain the whole concept to them, but they got it. I got 40 the first day, 20 the second and only a handful since. And I had no desire to open any of them.

The biggest threat that Windows poses is that from users who are totally clueless... they turn on their machine thinking it's some kind of "email machine" and nothing else. Not a clue there are threats or risks out there. And no indication from Windows, or Outlook, or IE that anything they do could be unsafe. Windows update works, at least this time it did. They're not going to get more saavy, so there's no harm in telling people to use windows update.

Tell your friends:
1. Don't preview email
2. Delete email you don't know or trust
3. Don't open attachments if they're not absolutely known and expected
3. Update early and often

The article is right, Windows is dangerous. MS isn't going to tell the consumer, because that would threaten their (considerable) cash flow.

I'll shut up now.

Re:Ummm...

[ball-lightning]

MS is at fault, the root of it, to be sure.

It's kind of funny, but I didn't have any problems with either of those viruses in any of my three WinXP machines. Maybe it was the common sense (Sobig) or the fact all my machines were updated (MS Blaster)or the common sense that 300 e-mails with the same attachment from people I don't know might, just might be a virus. This is not to mention of course the firewall, pestpatrol, and Norton Antivirus. Now, you might say, "well hey, my linux box had none of that, wasn't patched, no firewall, nothin!" but think for a few seconds. These viruses were programed for windows, not linux/any other os. Of course your non-windows computer was not infected, because the virus/worm was not made for it. So before you get on your high horse, remmember it can happen if someone bothers to write it.

Re:Ummm...

[1lus10n]

please please please PLEASE do not reference wired if you wish to garner any kind of respect.

and just for reference (as a person who works hell desk (tech support) for linux servers) i have not yet met a single person affected or infected by slapper. unix and unix derivatives are vastly more secure because of the way they were designed. not to mention most distro's dont leave 45 uneccasary things running by default, hence the admin of a unix box has to do less to be decently secured.

i will admit this virus wasnt particularly microsofts fault. but we have been doing this same routine for 8 -10 years now with them. sooner or latter they are going to have to own up to it, and yes microsofts systems are inherintly insecure. and no i dont run anything M$ on anything i own or admin.

i am also very aware that i am having a bad spelling day.

Re:Ummm...

[andreMA]

Yes, so very many of them:

• Sunday, October 06, 2002 10:08:43 US/Pacific: Installed "Security Update 2002-09-20" (1.0)
• Sunday, October 06, 2002 10:09:19 US/Pacific: Installed "Internet Explorer 5.2 Security Update" (5.2.2)
• Sunday, October 06, 2002 10:21:30 US/Pacific: Installed "Mac OS X Update" (10.2.1)
• Friday, February 14, 2003 18:31:25 US/Eastern: Installed "Mac OS X Update" (10.2.4)
• Friday, March 07, 2003 17:43:42 US/Eastern: Installed "Security Update 2003-03-03" (1.0)
• Sunday, March 30, 2003 22:10:29 US/Eastern: Installed "Security Update 2003-03-24" (1.0)
• Saturday, April 12, 2003 13:35:20 US/Eastern: Installed "Mac OS X Update" (10.2.5)
• Tuesday, May 13, 2003 14:28:01 US/Eastern: Installed "Mac OS X Update" (10.2.6)
• Tuesday, June 10, 2003 12:52:53 US/Eastern: Installed "Security Update 2003-06-09" (1.0)
• Sunday, June 22, 2003 15:12:53 US/Eastern: Installed "Security Update 2003-06-09" (2.0)
• Thursday, July 24, 2003 15:30:54 US/Eastern: Installed "Security Update 2003-07-14" (1.0)

This includes security updates and point-revisions of the OS (which one might presume to have less-critical security updates rolled into them), and excludes application specific updates for the i-App suite, Safari, etc. that were not labelled as "Security" related (one might assert that they were in fact security related, but they included point-upgrades to the applications as well. Those toatlled perhaps 8-10 updates over the span covered). Note that two (Stuffit! and IE) are for 3rd-party bundled apps with labelled "Security" updates.

yes, I'm aware that I haven't installed the latest one to patch the off-by-one bug that impacts the FTP server. I'm waiting until I need to reboot for some other reason.

TOTAL UPDATES OVER THE PAST 10 MONTHS: 5. 7 if you count patches to 3rd party apps, one of which was IE. 10 if you're really liberal and include the point-revisions of the OS too.

Please tell me where these "lot of security updates in the past 6 months" are... I'm not seeing them.

Windows does not have to be insecure.

[facelessnumber]

...Or, "The Tecn Commandments of Windows Security."

I run Linux on my servers, but for compatibility, certain programs I need, etc., etc., my workstations use XP. I haven't patched anything. I don't trust the patches and especially not the Service Packs. They can break things and slow things down. If my box is working, why tempt fate? There are a few, very simple things to do that will keep Windows almost entirely secure:

1 - No scripting host. If you don't need it, kill it.

2 - No Outlook. Outlook is bad. IE is almost as bad. Everyone should know this by now. And if you must use it...

3 - Don't open file attachments from anybody unless you know what the hell they are! Why is this so difficult? Well, it's because people never...

4 - Unhide the file extensions. You wouldn't eat something from a package simply labled "food" without having some clue what's in it, so why double-click an icon without knowing what it will do? Learn what these extensions are, and Google it if you're not sure what a given one means.

5 - Don't use IE if you don't have to. Mozilla's now advanced and stable enough that you should almost never have to use IE to properly view a site. I never have a problem with popups, and I've never had my browser hijacked. Using IE tempts people to break #6...

6 - Read the question before you answer "Yes." Do you walk around at work slackjawed and answering "yes" to every question you're asked without listening? If you weren't specifically looking for what a site wants you to install, chances are you don't need it.

7 - Firewall. Buy a $30 broadband router, build a Linux gateway, enable XP's own, built-in, pre-installed firewall, or get something like Zone Alarm, depending on your needs and/or level of computer literacy.

8 - Don't download software without knowing exactly what it is. Read the license agreement. Sure, I like to check out neat toys on Download.com too, but not if I have to install Gator or GAIN to use them. See #6. Read!

9 - Check your processes. and read what's going on in there. Google each one. This is a pain in the ass the first time, but do it once and then you'll know when something's not supposed to be there.

10 - Watch who gets your email address. Get two. One for ordering/registering things, and one that you only give to real people.

That's it. I run no antivirus software and my system thanks me for it with good performance. I have not loaded a Service Pack, a patch, anything. None of this is difficult. These rules are simple enough for almost anyone to follow, and the major ones are extremely easy.

Re:Ummm...

[Cederic]

>> this virus wasnt particularly microsofts fault

If you're talking Sobig.F then yes, it is definitely Microsoft's fault.

In the early 1990s, people got laughed at (or gently educated) if they suggested 'I got that virus through email'. It just didn't happen.

Then MS turn up with their inherently insecure 'Automatically run stuff that's emailed to you' email client, actually build it into the OS (thus ensuring greater take-up than would otherwise have been achieved) and email viruses became commonplace.

The only way this virus wasn't Microsoft's fault is that they didn't write it themselves. The environment it runs in, that enabled it, is entirely and absolutely due to insecure design by MS.

~Cederic

Re:Ummm...

[jonadab]

Exchange rates don't mirror cost of living, necessarily. The Aussie
buck isn't worth as much as the US buck on the international market,
but that isn't because the Aussie buck won't buy as much, locally,
as the US buck will buy in the US.

An example: the exchange rate between where I live (Galion Ohio)
and lower Manhattan is 1:1 -- one dollar from here is worth exactly
one dollar from there. Yet, an entire family here can live on less
money per month than the rent of a two-room apartment there.

The exchange rates do have an impact on the cost of living, as they
have an impact on the cost of some items, but not everything is
priced proportionally.

Here, $10/hour is a decent wage for a single person in a blue-collar
or entry-level position. I take home about that amount after taxes,
working as an entry-level computer troubleshooter (basically, a
one-man part-time IT department at a place too small to have a
full-time IT department), but a professional programmer would
certainly make more than that (except, I doubt if we have any in
the area). Fourty minutes' drive south of here there's a big
white-collar area (Worthington/Westerville, suburbs of Columbus --
conference complexes, marketing firms, shopping malls, and
three-quarter-million-dollar houses[1] as far as the eye can see)
where someone in a position equivalent to mine would make triple
my wage and struggle to get along. Rent is much higher there;
food costs more; everything costs more. A lot of people live up
this way and commute to work down there.

[1] Nobody would build a house that expensive in Galion, because
it wouldn't have resale value. We have a sparse handful of
houses in town worth two hundred thousand or a little more.
Part of it is that the land here is much cheaper.