Slashdot Mirror
Increased Software Vulnerability, Gov't Regulation
PogieMT writes "An
article in the New York Times
(registration required) suggests that the rash of security flaws, viruses and
worms is leading a push towards greater regulation by the government, which,
according to the piece, has largely relied on the efforts of individual
companies."
how most of the vulns are in microsoft software. i think this should be better emphasized.
Much like car safety between the '50s and '70s. Manufacturers simply didn't care about safety, because the customer didn't care.
Be wary of any facts that confirm your opinion.
Hopefully this will mean more pressure on micro$oft and other software companies rather than more internet controls which may be abused.
Im not paranoid, no really im not.
Microsoft are of course complying with the regulation.
I have over 70 freaks, do you?
Call me cynical, but I don't think the US government are getting into this for the sake of safeguarding my PC from viruses...
Who is going to pay for regulation? I can see goverments passing it between them waiting for someone else to pay. Self regulation by software companies will not work, can you see Microsoft, SCO, Sun and Red Hat sitting down to draft a policy? I can't.
Regulation is not the answer - professionalism is. The government has oversight over the construction industry for example, but engineers are accredited and the profession is run day-to-day but the professional institution, in the UK this is the Institute of Civil Engineers. Same in medicine, the government oversees, but day to day regulation rests with the BMA, the British Medical Association, and doctors answer to them. Same with lawyers, accountants, investment bankers... even lifeguards and hairdressers have professional bodies.
Software development needs to become more like engineering, and software developers should be required to take a qualification like CEng (UK) or PEng (US) in order to work in positions of authority and responsibility. Remember that engineering is about public safety - bridges don't often collapse, buildings don't often topple, and that's all because the people designing them have been certified by independant bodies. Programmers of safety-critical systems are already often required to be certified by the relevant body, usually that of the electrical engineers.
Regulation may or may not work. What would really work would be if the government (Microsoft's biggest customer, I've heard) stopped buying their products in favor of others that are more secure. Re-evaluate that when Microsoft's products have less of an issue.
I know that all systems have some security problems or another. I don't recall any of them having sent me a thousand e-mail messages every day, though. And it's not like this is the first time.
Let the government talk with it's money and people will listen.
Personally, I don't really like my tax money going so much to Microsoft. For one thing, I don't like that the privacy of my information and security of the systems relies on something that seems to have so many problems.
Sean
IMHO this is a good thing as more and more people are able to exploit this and create their own bussiness based uppon standard that are specified by governments not by some standard group that stiffles innovation.
Proud patriot and republican voter.
I tried to submit something similar before as an article but it was denied
Personally I would stop using machines if it were possible to have some form of monitoring of my actions without my authorization. Aside from that it's not a secret that the NSA has been accused of corporate espionage, so I would hope large corporations would think twice about giving them any form of say when it comes to codes for commercial software.
MoFscker
Like the recent virus Microsoft should have been writing secure code, from the start, instead of being to keen to make money. It their lapses that lead to these virus/backdoors being allowed. Digital Update
Why even ask who is going to pay for it? Every government initiative is funded via taxes..
Oh, and higher prices to the consumer...
Is anyone surprised this was going to happen? Im only suprised the goverment hasnt gotten involved until now.
---- Booth was a patriot ----
Isn't it strange how there is a marked surge in software control in the past few months with microsoft's main competitor being an OS that is being built with a relatively low centralized control
!
Gates is probably telling Bush "see, this is why we need trusted computing." Bush will declare that either you are with him, or you are with the terrorists.
That wouldn't be necessary if the user does as his third suggestion, patch the system.
And that wouldn't be necessary if the system would be built more securely from the start.
A good idea for MS would be to not make their stuff so userfriendly that it automatically executes every virus attachement that it comes across but instead would warn the user by default.
While regulation of software might sound like a good idea to the anti-Microsoft crowd, consider how it would effect free software developers. Imagine if you couldn't release any software that hasn't been vetted by some government agency - that would be end end of 99% of the open-source projects out there.
..
And even if there were some excemption for not-for-profit developers, what about distribution companies like Redhat? They would be out of business in seconds
Control and regulation is what the governments of the world does best.
The very existence of a government translates to the control of its people, and its resources.
Them wanting to control the IT market, under the guise of 'for your safety', so common man will accept it, is an expected maneuver.
Not that i agree with it, but its expected and inventible.. Just one more step towards total control of the public...
---- Booth was a patriot ----
Here.
In my opinion the easiest way to cope with this threat is to make software companies responsible for their products - see article by Declan McCullagh.
Of course this regulation has to be done carefully - we shall deem liable for damages only those companies that require MONEY for that product: for instance when you install free version of RedHat Linux - RedHat (or anybody else) is not responsible for the damage, yet if you pay for this distro - then RedHat _shall_ be responsible - they can simply buy an insurance against such claims. I am sure that the price that Linux companies will pay for such insurance will be smaller than in case of Microsoft.
You can defy gravity... for a short time
what SCO?
when their quicken data or other very personal info is 'liberated'. or any number of other personal information. can you imagine how fast things would be patched if a virus/worm scanned for quicken/quickbooks/misc financial data and emailed them to people in the local address book?
eric
Regulating computer safety makes these guys exactly like the AT&T of yore. And don't we all know what happened with that?
So let some damned competition into the market. The only reason to trust these guys in any other situtation is to simply not understand the idea of a world without them, and sadly that seems to be the way most people think.
Sure, regulation and government restrictions in our life is a good thing.. Lets not stop here...
Why not just give them total control of our lives, setup cameras in your house.. let them come in and see everything you do, read, think.
Oh, and send them all our money so they can pay for enforcement.
---- Booth was a patriot ----
A few years ago there was a push on to provide home users with "safe" connections with the ISP running a firewall and virus scanning. What ever happened to this? While this would not fix everything it would help a lot, especially for inexperienced users. The current situation is kind of like making people do their own water purification at home.
You don't buy a car for $20, $50 or even $399. Nor do we build bridges for anything near that cost. Realize that adding regulation will not significantly change the security issues and will cost end users tremendously.
You thought software prices in the 80's were horrible, wait until it costs you $70,000 for a text editor (that's been "certified").. that's where we're headed.
Software "Engineering" is still in its infancy. It's like civil engineering was back hundreds of years ago. In order to create more secure systems, we'll have to completely give up low-level languages and it'll take 10x as long to build in a feature (as it has to be "engineered" in).
Software Engineers will have to buy special insurance to protect them from lawsuits related to any potential bugs and that cost will be passed on.
I think arguments that more pressure should be put on Microsoft, which has been the source of probably 90% (or more) of the vunerabilities. Of course, when the gov't just slap the hands of a giant corporation for destroying markets with its monopolistic attacks, the clout of the gov't isn't all that great.
here
I didn't see any other actual suggestions in the article which were all that bad, but tax breaks stink.
The exact opposite of a tax break might not be too bad. Have some government agency rate companies for their security and fine those with bad records (e.g. Microsoft),
Big Brother Bush is doubleplus ungood.
I think regulation is the wrong solution. A better solution is to hold companies responsible for security breaches.
Everybody keeps passing the buck: businesses blame the software company, software companies blame hackers, and ultimately the taxpayer and customer ends up paying for the incompetence and poor choices of the businesses.
Businesses should be primarily responsible for the harm that arises from the software they choose. If they want to pass on the risk of their choice to the software company, that should require an explicit contractual agreement.
And the government should get out of trying to regulate how software is written, and the government should get out of trying to catch "hackers".
Any user who does not patch daily and harms another due to not being patched should be punished. Here is how I think it should work....
... "If you don't patch and change your behavior, we cut you off without warning."
A few big ISPs should simply start cutting service to those who have been backdoored and are zombies, have opened virus laden e-mails, or are otherwise infected and causing others problems. For example, no firewall on an open, always-on connection. Especially cable modem ISPs and DSL providers should do this. It should be VERY heavily marketed
My feeling is that by doing this, people will finally start learning how to patch and how to not open e-mail attachments. People will get firewalls and AV software ASAP.
I have seen the threat of this work on a small scale. ISPs are dimwitted morons for not requiring this in the first place. How stupid to give a bunch of newbies loaded guns and then deny responsibility. Buy stock in firewall and AV companies!
"If you want to improve, be content to be thought foolish and stupid." - Epictetus
Good Morning Mr United States Action.
The idea of software being distributed without warranty dates all the way back to the first ever spreadsheet. The software company's lawyers were worried that if someone used the programme to design a suspension bridge, and it later collapsed and investigation proved that it was due to a flaw in the software, they might get sued. Furthermore, it would have been a physical impossibility to test the software in all circumstances. These were the days of 2MHz 8080 processors, lest we forget.
The sane response would have been "let them try, we'll never have what they're asking for and you can't be sued for what you've not got." Instead, that company explicitly disclaimed any warranty on their software, and the situation has persisted since. Today, one company is responsible for a lot of software, and they could easily afford to pay for several suspension bridge failures. But the law has not caught up with reality. The solution is simple and everyone will like it except the distributors of substandard software.
My proposed solution is to require all software to be guaranteed to perform substantially as indicated on the packaging. If you buy any other product, and it doesn't do what the literature said it was going to do, then you are entitled to a refund.
The only exception to the requirement for a guarantee would be where the source code is available for scrutiny. IMHO, reading the source code before deploying a mission-critical application is just Due Diligence. It has been stated by some that this is a lot of work to expect people to do. It is, but there is nothing to say independent bodies could not audit software for a fee. The GPL does not seek to prohibit anyone from making money out of their own work; only by misappropriating other people's work.
Whilst stopping short of my Ultimate Ideal, I think this is a fair compromise. Most goods are required to be guaranteed, why should software be any different? But Open Source software is more like self-assembly furniture: you {or a suitably qualified person in your pay} can examine the pieces {source code} before they are put together {compiled and installed}, determine suitability for your application, and make a decision: use as-is, use slightly-modified or reject outright. You only get your money back on kit-built stuff if there are actually any pieces missing; everyone understands that circumstances of deployment are beyond the control of the supplier.
Je fume. Tu fumes. Nous fûmes!
Suddenly a bug is discovered which will give others full control of your system. Acting quickly, a patch is created and a fixed version is put online, and warnings posted to all the regular places.
Several weeks later an exploit program is seen in the wild, attacking systems owned by CLUELESS USERS who either never knew of the problem, or were too lazy/overworked to fix it. The damage is immense, and in the current fingerpointing society most people blame this company even though they did everything that could be reasonably expected from them.
And now a growing group of people feel the government should be breathing down this company's neck for not making secure software?
Replace "company" with "group of OSS developers", and tell me how things should be different for this case, and why.
Mirrors suck, huh?
I read the NY Times Article about calling for government regulation and suing the creators of software. Will this mean that the fine developers that work on the Linux and BSD systems will be sued for bugs in their software that they have donated to the community? Also there is a danger that having the government control computer security will stiffle the openess of the Internet.
Do we want the government looking over our sholder all of the time saying that they are protecting us? We all have locks on our homes and a certain level of personal security. It is not the governmnet's responsibility to make sure we lock our own doors. The same goes for computer security. As a Linux user I have a dedicated firewall utilizing IPtables. Sure it took some time to write the firewall script, compile a custom kernel with patches from the iptables source, but it is worth the effort.
I do not think that depending upon government regulation where the creators of free software might find themselves in a pickle and have a lawsuite slapped on them for damages if someone cracks into someones system.
As much as I despise a certain company in Redmond, I do not think that they should have to face legal law suites from a bug in their code.
It is your responsibility to protect your system and not some beaurcratic faceless agency. Adding more laws on the books is a dangerous idea.
Get rid of the whole regulation issue. Thats not necessary. It would be far better to make the software publisher liable for any faults or flaws in the software that led to an incident such as MSBlaster, Slammer or any other number of worms out there.
Virii like SoBig.F are not something that can be avoided because the vulnerability there is the user themself. The only way to sort out virii like that is to educate users to not open email they are not expecting or recognise. Even then its still a risk.
If Microsoft were liable for the damages caused by the worms such as MSBlaster and Slammer because their software was vulnerable, don't you think their culture would change very rapidly? Instead of having the worst security reputation, they'd suddenly have the very best. Win2k3 is a good start in the right direction by disabling everything by default. I applaud that. Now they need to sort out their coding practices so that these sorts of issues are a non-event.
Governments don't need to regulate anything. All they need to do is make it illegal for a company to not take responsibility for faulty products, regardless of the product. It worked in the automobile industry, its worked in the medical industry, its worked in the engineering industry.
If my car explodes because of a fault in the fuel line at manufacturing, I'm perfectly within my rights to sue that company. If my computer becomes completely unusable because a vulnerability allowed someone to damage it or similar, why shouldn't I sue the publisher of that software? I'd also reserve the right to sue the person that exploited that vulnerability and caused the damage.
Don't need regulation, just liability and a warranty of suitability for a purpose. 'This OS is guaranteed to perform to XXXXXXX level and is considered suitable for XXXXXXXXXX purpose.'
People need to be pointing out that the cost/benefit ratio for monocultures vs heterocultures is changing. The Irish developed an appreciation for the risk of monocultures in 1845-1847 ...
o nocultures.html
http://tingilinde.typepad.com/starstuff/2003/08/m
Microsoft + government regulation = one big clusterfuck
LOL, Your only paranoid if the conspiracy isn't real, RIGHT?
Unfortunately you are probably correct in that this will be used to restrict individual freedom, rather than corporate misbehavior.
"We don't know what we are doing, but we are doing it very carefully,..." Wherry, R.J. Personnel Psychology (1995)
Wrong it is not the voluntary developers (of Open Source), but the salaried developers at MicroSoft that have the problems.
The voluntary developers are taking security seriously, it is the proprietary software houses that need the legislation: disclosure would be a nice start.
We need to take care that legislation does not impose (financial) penalties on Open Source developers - that could cripple OSS contributions.
When M$ Windoze becomes fully warrantied (M$ can afford it), and most OSS coders don't dare accept liability for their software .... "Why should we be using Linux for our company systems? It doesn't even come with a guarantee! On with the windoze installation!"
yeah, should we really be supporting it? it might screw m$, but it'll screw open sourc more in the long run
Billy Boy. You can bet that if his money has its way politicians like Fritz will be modifying the bills to specifically attack OpenSource and Linux. I can here it now: "Surely software can't be made safe if anyone can look at the source!"
I think that here "voluntary efforts" refers to businesses' efforts to handle security without regulations and laws forcing them to (i.e. 'voluntarily'), and doesn't refer to Open Source developers.
Have a nice day.
--
Simon
Part of the charm of the internet has always been its lack of regulation. It has been the last frontier that we can still explore. There were parts of it that should have been labelled on the map, "Here be monsters and sea serpents". Now, it is becoming like the cow town where the railroad now reaches, and the women have arrived, and they want to civilize the place. They want to hire a sheriff and close down the saloons. They want a dry goods store and a bank. The mountainmen and adventurers who first came are no longer welcome, and they will leave by their own choice, as this safe, homogeneous town is no longer interesting. The bad thing is, where will they go? Government regulation will be the death of innovation and the publishing of unpopular or non mainstream ideas. Sure, your IM program will be declared "safe" by the government. Nothing bad can happen, but your "smileys" don't interest me, and I will be leaving then, looking for another map with an area where there just may be sea serpents.
People should just use some of the great security sites out there. E.g. SecurityFocus or Secunia. Both have a large vulnerability database and mailing list with all the latest vulnerability information.
Once government is regulating programming, the companies shrewd at gaining and exploiting political connections will be able to use that political power to squash less "able" competitors. Laws will be written to favor the "big boys," those who have the money to lobby, at the expense of start-ups, smaller companies and open source.
This will be the worst thing to happen to software development and the tech industry.
quiquid id est, timeo puellas et oscula dantes.
In Soviet Union programmers were controlled by government authorities, standards, laws etc. They had to document every piece of their code. Now we see that it wasn't so stupid.
Being allowed to publish product reviews of products would allow a greater risk that tools be chosen based on technical merit rather than ideology. Also, it would help if news stopped refering to MSTDs as "Internet Worms" and "e-mail Viruses" and start talking about options.
It looks like we've reached a junction where it's time to start asking in all seriousness, "Is Windows ready for the Internet?"
Odds are that, despite the great admiration for Bill Gate's personal wealt, it is not. Now when sensitive government documents or personal financial or medical data start circulating (actually they already have), it is too late and will an issue for the courts: gross negligence, willful negligence or fraud. This will be a hard one for both Redmond and CTOs to wiggle out of.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
"What we're seeing is that those voluntary efforts are insufficient, and the repercussions are vast."
Did I miss a meeting? Is this not Slashdot? I'm skimming through the posts and seeing a lot of cammoring that seems to approve regulating software. IS NOT LINUX A VOLUNTARY EFFORT?! Hand this guy a copy of Knoppix and tell him to crack it!
The biggest problem with computers on the internet today is the number of people who ran out and bought a computer because it looked like an interactive television. Hold the end user responsible for what their computer does.
I like to view my computer as one of my best friends... Proverbially, man's best friend is a dog... In other words, a pet. Think of it in this light: Do you sue the kennel when your dog bites your neighbor? No... You sue the kennel for selling you a dog with physical defect, but not a personality defect. You are responsible for your pet's actions, even if the kid down the street was shooting him with the super soaker, makes the dog mad, and the dog goes out on a rampage biting old ladies.
So if your computer goes out and bites another system, then you should be responsible for the cleanup costs regardless of who or what made it go off like that. Sure, it may sound harsh, but if it takes a few "Bonzai Buddy" users out of the pool, I doubt the net will suffer too greatly.
The cause of the current problem is only partially due to insecure Microsoft software. It is very noteworthy that Windows 98 and 95 were immune from the latest round of malware (W32/Blaster, W32/Welchia, W32/Sobig.F). The main cause is monoculture--the dominance of a single operating system, Windows NT and its variants.
What we need is a truly competitive market in which many operating systems compete, no single operating system dominates, and a market that uses many operating systems therefore demands and rewards inoperability and writing software to standards rather than writing to a single vendor's API.
Why don't we have it? Because Microsoft was allowed to get a monopoly and the Justice Department is not doing its job and breaking it up.
It wouldn't be any different if IBM were the dominant company--as it was a few decades ago--or Apple, or what have you.
The problem is not Microsoft. The problem is monopolization. And the answer is not the free market--monopolies exist only when the market has already failed.
"How to Do Nothing," kids activities, back in print!
What the government should do is enforce diversity. Requireing every government department above some minimum size to use systems from at least 3 independent sources would be a start.
_O_
.|< The named which can be named is not the true named
Hmmmm... what was it that republicans were supposed to be opposed to? Wasn't it regulation, taxes and wasteful spending? (think this issue, the tax on LANs and the ever more expensive war on Iraq) As a rugged individualist liberal, I'd have to say that with Bush in office, we've hit the Trifecta where the Bush admin's reputation is concerned. :P Yeah yeah, I know it's somewhat off topic, but you've got to admit it's quite comical.
Un-news
Pressure on MS? No way. The DOJ had their chance. If you read Gates recently talking about how they (MS) are doing so much better, then it's real clear that MS does not feel any pressure, and the boyz from Redmond can continue to smoke whatever it is they are smoking.
You are being MICROattacked, from various angles, in a SOFT manner.
I find it appalling that we tolerate anti-virus software as a necessary solution. IMO, every virus is an exploitation of a bug in the software, and original vendor should be responsible for fixing the hole that allowed the virus to exist.
Why doesn't the press focus on the hypocrisy holding of software vendors more accountable for fixing their problems, while at the same time, advocating supporting a third part to fix the same problems?
I about blew my top when fixing my in-laws' machine for a case of blaster, and MS so "conveniently" linked one of the trusted anti-virus sites that offered removal tools. If it's microsoft's hole, why don't they provide a cleanup method?
(This is not to say we shouldn't have virus filters on SMTP and firewalls - there's nothing wrong with trying to block the spread of virii through multiple means)
The only way Linux, FreeBSD, and all of the other operating systems that have appeared over the years were possible is because of the lack of government regulation. Once the government steps in, it will only stifle creativity and limit consumer options.
Who is best to deal with government regulations? Microsoft.
Thanks, but no thanks. This issue will work itself out. We are in our growing stages. The government is not a solution to everything... actually, not much at all, really.
The gummint will be only too happy to oblige and produce several layers of ineficient, costly, slow, slightly corrupt bureaucracy that will not solve the problem but will never disappear. As usual.
Let us put on our bureaucrat hat and see what can be done, in the immortal tradition of public service that gave us the Transportation Safely Authority. Let's see. Strip search programmers when they come to work in case they bring a copy of 2600? Have them remove their shoes? A nice start, but not enough.
See, the problem is that scumbags are writing programs that are up to no good. No scumbag coding, no worm and virus, eh? So let's put all compilers under lock. Let's make sure that scripting languages only accept input scripts that have been digitally signed by a new Programming Safety Authority. Let's make it a crime to use a computer without PSA-approved tools. Each program has to be certified by the PSA. Use the TCPA and Palladium chips to lock out all the bastards using non-PSA software and operating systems. Ban all non-Palladium computers and electronics. Do an FBI criminal check on each person entrusted with a compiler. And of course, recruits thousands of new civil servants to enforce all these new rules, at a low, low cost of [#insert eye-popping budget that will be overrun anyway].There you have, secure computing. A bit harsh, but it's for our safety, isn't it?
If you think the above is funny, I am sorry. I meant it to be ironic in a chilling way. Because when you start involving the government into a human activity, you never know how the bureaucrats are going to warp it.
So I'm gonna speak slowly so that even New York Times journalists can understand: KEEP GOVERNMENT OUT OF COMPUTING. Got it?
--
Mad science! Robots! Underwear! Cute girls! Full comic online! http://www.girlgeniusonline.com/
One idea could be that software sold which had ANY network component be required to be certified against certain types of problems, such as buffer overflows, having backdoors, etc. If a company sells a word processor with the network component disabled,(In other words, a user cannot use a network share or a network link to open a file, or they cannot use the program itself to e-mail a file) they are in the clear. If they sell a product which has some means of allowing the opening of files from a remote computers, they can be sanctioned if it can be shown their software contributed to a worm spreading( banned from further sales of that product ), until the problem is fixed.
The last two biggies in the worm department last week has opened some eyes. A lot of folks, myself included, are beginning to believe that some sort of regulation is needed to stop the damage being done by mal-adapted software operating on the internet.
Dawn of the Dead
Microsurfs repeat this myth a lot. Is it true? Does WinXX have more viruses and stability problems because it is on "practically every desktop and server"?
While I don't agree with the 'Microserfs' designation (too divisive and possibly misspelled), the AC has a point...yet, folks aren't learning it.
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
Software on airplanes work reasonably well because they test the hell of it and two airplanes of the same model are pretty much the same. Also, the users of the software (airplane crews) are well-trained. The exteme testing and thorough training though makes it very expensive. I don't think we can afford to hire software engineer and tutor for each household.
I would be afraid that regulation would not fully take into account the difficulties of making perfect software and dealing with untrained users.
No-registration-required version of the article.
Mr. Congressman,
Let's first create an oversight board for the software development of all the black box voting machines that are being deployed throughout the country, so we can feel "safe" and "secure" that our votes will actually be counted.
If that oversight board proves to be a success, THEN we'll discuss possible regulation of the rest of the software industry.
Regards,
An eligible voter in your district
I would run out of moderator points just when an actually insightful post appears.
Regulation / certification / etc. have always been tools of large corporations to keep smaller players out of the game. Can you think of an easier way to marginalize Linux than shoving it in the box of, "it's not made by certified programmers; it's untrustworthy"?
All's true that is mistrusted
But on the other hand, if other industries are examined, such regulation will only turn into a further barrier to entry for new entrants to the market and non-commercial (i.e. Free and Open Source ) software.
I already see this when trying to sell FOSS solutions to the public sector, who invariably have successful "Common Criteria" evaluation as a "nice to have" (at least - in some cases it's mandatory).
Getting these evaluations done is expensive, so only the big boys get to play... Ironically, the people I talk with know that FOSS solutions are usually at least as secure as the products on their approved list, but their hands are tied by regulations and auditors.
--
If you want to explore, you'll have to start risking your life. Is it worth it? For some, it is.
$/pound for space flight continues to drop. Right now it's about $3000-$10000 for LEO. Give it another decade and we'll hit $1000 or even $500/lb. Then life starts to get really interesting...
This is my sig.
Now watch as Bill Gates and his cronies push for Trusted Computing, the Palladium project. After all, it's never Microsoft's fault that the bugs exist, right? It's always those darned users and by George we need to foolproof the system. Please. Trusting computing is a joke. It is a power play by top industry corporations to seize power and act as a yet another cohesive monopoly in a so-called free market. Just like the RIAA. Just like the MPAA.
Here's a thought. Hold the software companies responsible for their own goofups and bugs. Let the people sue. Let the people file their class action lawsuits against Microsoft for their errors. But don't let the government take control.
I don't want the ignorant US government, or any government for that matter, looking over the Internet and infringing on it any more than they already are. Half of those farts probably don't even know what the Internet is. I can't say I'd want these clueless individuals, easily motivated by legal bribery (lobbies) and big business (Palladium), to be involved. They will only serve to screw things up, pass ridiculous laws, and tax Internet commerce to death. Let the Internet be that one place government is unable to corrupt.
The problem is that the people who aren't on the Internet; the people who take passive interest in computers, are ignorant to these facts. That's why I feel, unfortunately, that things like Palladium are destined to pass. Microsoft and others are going to get these bills through the door while the politicians are still ignorant to computers.
I'd like to say we can stop them, but we don't have a $47 billion lobbyist group behind us.
One place regulation would help is in mandating open standards for files so people will always have a choice of what software to use. Of course MS will say they use standards (XML) even though others can't read the files. So you could argue that mandating non-patented open source is the only way to ensure interoperability, and hence a hetergenous network, and less vulnerability. I'd prefer to get there along the present path without intervention.
Has there been a worm? Must have missed it. Nothing happened here. Can't be an "Internet problem". Possibly a problem with a particular OS?
Seriously, there is a very real possibility that governments will regulate the Internet down to Compuserve level simply because of a deficient OS and users who cannot organize their own basic security.
I had some buffer overflow problems in my mail client. Silly me. I ran splint and considered hiring another programmer (preferably one who knows what splint is and how to use it).
Now I've changed my mind. Instead of adding engineers who sit at computers and write C, I'm going to add beurocrats who look over their shoulders and produce Word documents.
Fortune 500, here I come!
[this post is close-captioned for the sarcasm impaired. All the previous was SARCASM.]
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
It is no more possible to have 'a little regulation' than to be 'a little pregnant'. Throughout the history of industrialized society, the same pattern has been repeated over and over with a new technology:
Regulating the software business per se would lead to a Federal Software Commission dominated by ex-MS employees, who would write regulations favorable to their former employer -- not even out of corruption but because they express the corporate culture inculcated into them. Mark my words: The day is coming when it will be as illegal to write computer software without a license from the government as it is to practice medicine, law, plumbing or cosmetology without one. Have you noticed that the more laws there are to regulate an industry, the more expensive it is to be a customer thereof? And if you think closed-source is bad, just you wait until the entire profession is reserved for those who take their apprenticeships with other members of the Guild.
Far better to fight laws like UCITA, DMCA, software patents, etc. that attempt to deprive software customers of the few rights they already have, than to try to push for empowering the government to screw customers even more.
The free market has been forbidden to regulate itself. The customer has been forced to accept shrink-wrap licenses that deprive them, potential competitors, and independent consumer advocates, of the rights that would allow the free market to function correctly (by reverse-engineering to provide competing products, and benchmarking to judge performance and reliability). These licenses are already in violation of the fundamental principles of contract law.
We need to use the laws already on the books - how about a class action suit against a software company that puts out a shrink-wrap license that is fraudulent in the 48 states that haven't yet adopted UCITA (because it tells the customer that they must either accept its terms or return the software unopened for a refund, when no such license terms asserted after the sale can possibly be valid)? That would force the
[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.
Corporations and governments have got to start looking at software as a product, not just an entity that will always inherently suck. If a car existed which was always getting broken into and breaking down, would corporations continue to use it?
So why do they continue to use software that crashes and has a bad security record. The government needs to start looking at non-MS solutions.
BTW I use Microsoft cause it's a decent home OS, but I'd never use it in any setting where it's important.
After developing applications for a wide variety of banking industries it became clear that:
1) The only way to develope software systems, is to proactively secure the systems once they are deployed.
2) To proactively and continuously review and examine such systems, you must have the source code and build tools and access to the hardware engineering requirements of the systems involved.
3) The only known process where this can be achieved is through Open Source.
Closed binary proprietary software is not secure, cannot be MADE secure, is impossible TO secure and with patents and copyrights laws as written it could be quite possible you could be SUED for securing the software yourself.
Security became an extension of the software engineering process for the company I started previously, and it involved reviewing the source code and making changes, performing attacks, etc.
Critical to this process was to have as many eyes and opnions looking at the source code as possible. The more experienced professionals that had a chance to offer advice and opinions on the code, the better and more secure the code became.
An entire portion of the software engineering process cannot even be done with proprietary software, and I personally as a CIO, declared proprietary binary only software sales DOA in this industry 2 years ago.
-Hack
Got Geometrodynamics? Awe, too hard to figure out? Too bad.
The internet infrastructure has become essential to the day-to-day business dealings of people, businesses and governments everywhere. Microsoft and Windows have monopoly control on the use of the Internet with a greater than 95 percent share of the desktop market. Microsoft consistently chooses to add features at the expense of security (for example, the windows help function) and a single successful security exploit can disrupt the world economy for days. The use of the internet is too important to be left in the hands of Microsoft without any sort of supervision or monitoring. It's time to put some sort of regulatory oversight in place which can monitor Microsoft's decisions and intercede when necessary. As an alternative, Microsoft could be nationalized and operated as a governement agency that provides essential infrastructure such as, for example, the FAA which maintains cross-country navigational aids for aviation.
Yes, yes, just for fun, think about it:
SoBig.F appears to be the first virus specifically designed to affect public opinion.
SoBig.F harvests email addresses from web pages that the infected machine has visited recently (via the browser cache). So the higher the probability your email address is in someone's disk cache, the more SoBig spam you get. Lots of people have email addresses on their web pages, but only a few people read them regularly enough that there's a strong chance of it being in the disk cache.
Whose email addresses are in LOTS of people's caches? Journalists, bloggers, software authors, maintainers of major websites, ISP tech support -- in other words, the people with the power to change the way email works, and the people with the voice to suggest that the way email works be changed, and have lots of people hear them. If you have articles on CNN, if you run major mailing lists like interesting-people, or run sites like slashdot, you're going to get swamped.
In effect, SoBig.F is optimised to annoy the people who are in the best position to complain about it.
(not a strong Darwinian survival trait...)
So while lots of people have been inconvenienced by this thing, it's not actually a big deal for most people: Here at work, we got a few thousand over the weekend it was at its most virulent. Nasty, but survivable, and that was for the whole company. But individual journos and bloggers were getting megabytes per minute of SoBig.F and have been writing up a storm about it, understandably.
So it looks bigger than it is, and causes a disproportionate amount of angry column inches. According to interviews with internet backbone admins, the traffic was "negligable", worldwide. I'm sure for some of you it doesn't feel that way, but then perhaps that was the point...
Note also that it's version F, the 6th generation in a series of carefully planned test iterations. It "times out", like a lot of commercial beta software, ready for the next update (which is predicted for mid-September... what happened to "When It's Done"? ;-P ). This thing seems to have a plan behind it...
And judging from the news reports, it seems to be working! ;-)
So who has a vested interest in getting people to make email and usenet less anonymous, more accountable...? And maybe doesn't mind scaring people away from porn newsgroups while they're at it? And knows they have an uphill struggle, and could use a nice big mess to point to, to persuade people to their POV? A noisy, ugly one that doesn't actually cause much damage(2), but plenty of annoyance, and gets people good and emotional?
Hmm... (1) well, I have SoBig in mind here, rather than any others
(2) sure, the press can quote a big dollar value, but that's distributed worldwide amongst many companies who individually bear a much smaller load, and anyway, I mentally take at least one zero of the end of any estimate of corporate damages quoted in a newspaper article... ;-)
Ooops, make that DCS-1000.
"Oversight" and "regulation" come down to this: government filters packets. Then they drop packets, arrest the senders and/or recipients of the packets.
It sounds like it's a great idea when the government filters packets that you don't like: spam, viruses, copyright infringing materials, decss, bomb-making instructions, child pornography, gay pornography, abortion literature.
Some people like some of those things. Too bad. The big illusion of government regulation is that the supporters think the government is going to regulate the way that the supporters think is good. But the government actually regulates in whatever way the government thinks is good, and the more power it has, the more it regulates. All of the material above has been the subject of government filtering already. And now the NY Times wants more.
I'd like to ask the New York Times how much "government oversight" they want to have on the content of their newspaper.
So if you're required to take a test to insure that you won't kill someone when you get behind the wheel and you're required to take a test to insure that you won't spam all over the emergency, aviation or commercial frequencies, then why shouldn't you be required to take a test to insure that your system won't be as likely to attack the rest of the internet?
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
You're right. That's exactly what happened in other industries, including the automobile, airline, telephone, television and radio, insurance, securities, and dozens of other industries. In every case, once a regulatory body was introduced, small competitors were driven out of the market, and the few big players that were left came to dominate the regulatory board, as opposed to the other way around.
The continuing growth of bureaucracy and regulation is the reason why our parents were richer and more secure than we are, despite the fact that technology has increased the potential efficiency of industry by a factor of ten or more.
Now, this wasn't perfect, as they didn't require me to use a firewall, but it was better than nothing.
My ISP in Whitby, ON (Canada) (a suburb of Toronto -- damn I miss living in Texas), went a bit further: they were willing to provide me with a static IP address, if I could justify it to them. I let them know that (a) I liked to sink my own email with a backup MX if the connection went down and I did not run an open relay; (b) wanted to administer my home network remotely via ssh; (c) was planning to install a hardware firewall.
Interestingly, this ISP saved me the trouble of picking a firewall: they required that I use a particular brand of firewall/DSL modem. Unfortunately, it came configured wide open, but that was easy to fix. (amazing the traffic posting "crack past this firewall" to #2600 generates).
You could've hired me.
This worked for accessibility. When 11 state governments said that they would stop buying software with lousy accessibility for persons with disabilities, big software vendor(s) finally did something about it. Why shouldn't it also work for security???
This approach used to bring big advantages to the private sector, as manufacturers had to learn to do the right thing on many products. It has lost its impact recently, as the government has given in to business by buying COTS, no questions asked.
The the airforce's new F-22 has been delayed because of computer glitches. Yes, it's under development, but flaws exist and will continue to exist in all forms of complex software engineering.
"The free market has been forbidden to regulate itself. The customer has been forced to accept shrink-wrap licenses that deprive them, potential competitors, and independent consumer advocates, of the rights that would allow the free market to function correctly (by reverse-engineering to provide competing products, and benchmarking to judge performance and reliability). These licenses are already in violation of the fundamental principles of contract law."
And if you actually check court cases, you'll find that a lot of the terms have been thrown out. Just because it's in print doesn't make it legally viable.
"Regulating the software business per se would lead to a Federal Software Commission dominated by ex-MS employees, who would write regulations favorable to their former employer -- not even out of corruption but because they express the corporate culture inculcated into them. Mark my words: The day is coming when it will be as illegal to write computer software without a license from the government as it is to practice medicine, law, plumbing or cosmetology without one. Have you noticed that the more laws there are to regulate an industry, the more expensive it is to be a customer thereof? And if you think closed-source is bad, just you wait until the entire profession is reserved for those who take their apprenticeships with other members of the Guild."
Uh huh. And just how many 'old school' professions do you know that have apprenticeships? Not many I wager. The whole idea of apprenticing has fallen out of favour, a long time ago. As for licensing, there's many a good reason to do so. Anywere were quality, or safety issues rein (would you want an unlicensed doctor operating on you?). They also exist (licenses) because amateurs have ruined it for others (few bad apples...barrel...you know the rest).
It's easy to deride laws and regulations, until you have a need for them (malpractice, exploding gastanks, etc)
"We don't need more laws to fix bad laws. We need to kill the ones that take away our freedom to innovate, communicate, and collaborate, and the customers' freedom to choose, and then a truly free market will work."
I believe this process is called "participating in one's government". Give it a try, it can work miracles.
"I fully expect that we'll see increased security resolutions which are ostensively tough on companies like Microsoft, but those companies will embrace them (while all the while getting good PR about "doing the right thing and making the right sacrfices") because ultimatly they will only be minor inconveniences... while the regulations that show up will all but prohibit free software (at least for commercial purposes, and possibly for anybody who wants to connect to the Internet), meaning that in the long run Microsoft benefits hugely from those "minor inconveniences"."
Really? Well someone better call up IBM and their ilk. Tell them to move to SCO Unixware, because we all know that regulations will never touch that.
That and SCO will win their case, and dominate the entire computing market (even MS isn't safe).
See! Cynical is easy, reality is hard.
1) an agency gets a source of income,
2) the people in the profession get a barrier to entry to prevent newcomers that they do not approve of and
3) consumer protection advocates think the licensing laws are effective at protecting people. Would you trust an unlicensed X? Having a license does not meant that person is skilled, knowledgable nor low risk.
Another reason that occupational licenses for developers will never happen is that would put a serious damper on the ongoing offshoring movement. The window of opportunity to get software developers covered by some licensing requirements has passed.
The software industry has chosen to buy legislation absolving them of all liability in their actions. First part of the backlash will be the repeal of that legislation. The backlash will be there, and only the lawyers will win in the nasty lawsuits to come.
"You can write reliable software for a plane, thats true... but a plane is a relatively simple, relatively isolated system. It does a limited number of things in a limited number of ways, and therefore it can be tested exhaustively and completely. "
And yet, somehow (magic?) Mainframes prove that just because something is a computer doing multiple things, it isn't impossible to have reliability, and stability.
The plain fact is that the majority (monopoly) have never been really exposed to reliability, and stability.
No wonder people doubt it's existance.
Software, as a profession, is very young compared to building cars, bridges, or planes. It takes years (sometimes centuries) to get to the point laws make sense. Let's look at the early days of any of the engineering professions for examples.
Beyond that, software is created by many more people than professionals. As an example, teacher have made hypercard stacks for students. Are we seriously going to regulate these people. Might as well outlaw bad literature.
The government can have one big positive effect on the whole industry. Do not buy software that they feel is vulnerable to these attacks. If they set a guideline not to buy from any company that doesn't meet their minimum safety requirements, then those affected companies will get off their butts and fix the problems.
Let's face it, all software developers who don't right mission critical software (e.g. avionics, nuclear control) know that all bugs aren't fixed because a business has determined that it is not cost effective to make the change. Mission critical software generally can't afford a failure, a word processor can. The customer is not willing to pay for 100% correctness.
If the government won't stop buying the software, then they have no business making regulations about it.
It will if those developers are personally responsible for the work, accountable to a supervisory professional body, and liable to lose their professional status and hence livelihood if they make a serious mistake. All the managers in the world won't get a known bad product out the door at that point, because every professional developer will tell them where to go. It's like unionisation, but with a somewhat different (and arguably less dangerous) slant.
The problem of course, is how to form a suitable supervisory body to do the accreditation. I sure as hell wouldn't trust most of the guys I've worked with to sit in judgement over the coding practices of another. Almost no-one invests the time and effort to get their skills to that level, because in most software development industries it's not worth it unless you're doing it as much out of interest and professionalism as out of a desire to earn your pay. In civil engineering, we have a long history of success stories and failures to provide concrete evidence (no pun intended) of what works and what doesn't. There is no analogue in software development today, and without it, who's to say what really constitutes "best practice"?
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
A commerce psychology is marking our means to protect our investments through an expression of a round of guilt. How this helps our mental well being ... Loosely, interference with jobs and jobs plus lives becoming stressful.
Earth is currently discouraging visitors. Our own lines and ranks approach turmoil over suitable living space. Ventures are to delete minor involvement through discouraging wellful mental outlook and opposing claims in faith. Adopting illness is quick to progess it's feel.
On the 1800's ships the secure holds within the ship maintained the voyages. The mercy was finding land. Why doesn't the same apply in belief and beyond regrets which too common are in news of competitive spring? I see laws to help consumers in ethical prices and non-substitute time for money, rather have time for work.
The Internet has not record to relate, as viewed as a bunch of dated yahoo and yodel. Underneath is education to share and projects for tools. In terms a cost of a tree becomes support services, and deeper into jobs to support services in what jobs support the service. Guilt for victims in unregulated extortion.
The fact is that our world now runs on these programs and when they crash our world comes to a halt. Bad software is just as bad as a power outage that halts work. There needs to be an awareness by the user that 'they do not have to take it anymore' and that they can vote with their feet and get an application that just works as one expects the lights to be on when they get to work.
The OS running on a mainframe targets one set of hardware. If you're lucky, there might be a handfull of peripherals designed to work with that mainframe from the manufacturer of the mainframe.
I could probably go on for an hour about how much simpler the OS design for a mainframe is, but I don't that's needed...
The problem at the moment is not the weaknesses in MS products, but the lack of diversity in the software market. If you look at nature, one of the keys to the continuos success of life, is the diversity of components that make up an animal, a species, and an eco system. If it weren't for the genetic diversity in humans, for example, we would all look the same, act the same, and more importantly, be all be suseptible to the same kinds of illnesses, and be wiped out by somthing as simple as the common cold. The reason these computer viruses can attack so many systems, is the fact the they are all the same. Sure, there may differences on the user level but below that they all function of the same code, the same set of "Genes." What needs to happen is for an era of "Software Darwinism" to come about. The users need to be able to not only pick the software that they use, but to be able to change the make-up of the software to enhance it's abilities, and bolster it's defenses against out side attack. Regulations, like the one's being talked about will not allow software to evolve into a better state. The only way this will happen is if there is an open exchange of ideas in wich everyone is allowed to present there ideas and receive support, advice, and honest critisism form their peers. The open source movement is going in the right direction. Software needs to be seen as an evolving community where every one benifits from the wisdom of everyone else. What needs to happen now is for large companies to be pressured into realizing that they stand to bennifit from freely sharing all aspects of their products. If their products are truely superior, they will have the support of the community as a whole. If not, they stand to profit by using the suggestions of the community to better their products and, once again have the support of industry and the consumers. The governments role in this should not be as a regulatory body. They should have the same responibilities as any educated consumer. They should look at every option availible and then make a unbiased desicion on which options to support, and most importantly why to support them. Regulation is not the key communication is. The computer has a potential for human advancement far beyond that of anything else. It is a realm of great potential profit, both intellectualy, spirtualy and monitarialy.
Software engineering is like no other 'engineering' discipline - with bridges, structures and the like, you're working with known methodologies that have been tried and tested for hundreds of years. Since the laws of physics don't change, the only reason for the engineering to change is when confronted by new circumstances.
With computer software, you have the very distinct possibility that every environment is slightly different than the next - a graphics card from one company (with its own driver), a hard disk from another, an operating system from another, a few utilities, thrown in, and add to this, the inherent instability from something as large as the Microsoft Windows, and there WILL be problems.
The fact is, that unless you have complete control over the user's evironment (and god forbid that ever happens), there is no reasonable way that you, as a software engineer, will be able to assess and test for every possible point of failure. It's a numbers game. Consider the ramifications of extending the testing phase to include a large number of theoretical problems...it would run the cost of software through the roof. It would destroy the software industry as we know it, and it would impose severe, if not downright draconian limits on choice.
Your computer is your responsibility. Just as you wouldn't expect your neighbor (or the government) to make sure your windows and doors are locked, it is no more their responsibility to make sure you're running a patched version of Windows. If *your* computer gets compromised, tough. Learn and move on. The people that have the correctly-patched software will not be affected, and those that refuse to heed the warnings will get what they deserve.
Government regulation will do NOTHING to stop the introduction of viruses, nor will it do anything to remedy situations where there is no prior warning. It will most definitely add a huge pile of red tape to any process that it touches, so that managing a computer network becomes a labrynthine, bureaucratic, nightmare. Imagine NOT being able to apply a patch, or some other fix because it hasn't been offically 'approved' by some government agency. If you think we have problems now....
You are talking about software, correct? What market? There is only one communist bloc known as Microsoft here. Some people say there is Linux, FreeBSD, etc, but they're not part of the market when they are given away for free.
However, you are on to something here, the world governments need to enforce their monopoly/anti-trust laws. The US DoJ did us a big disservice. MS should not be allowed to operate like that. When software developers have to ask Microsoft: "May I please write this program? Please don't crush me." there is a problem. When MS gets their Palladium system going, developers will literally have to ask MS this question. Otherwise their code won't be signed and their program won't be able to touch any DRM enabled files. Seeing as how MS intends to make everything DRM including email, no signature means certain death for any project. No one will buy it if it can't access their files.
It will be legal for those offshore people to send submissions to a Licensed Computer Programmer, but can't be actually delivered outside the company until he signs off on them. There will be a handful of LCPs that act as project managers, and get paid a pretty penny for being licensed, while the scut work is done by cheap interns who have not yet gotten licensed to wipe their own butts without an LCP approving it.
We'll have the equivalent of specialties, as well. The larval form of them is in the various certifications that are currently available. [Let me point out that I vastly prefer certification, which is voluntary, to licensure, which is not. A certification that is irrelevant will be ignored by those in the know, but a license that is irrelevant must still be respected by them.] Once there is a law that requires a license, the demand for higher-level licensure for specialties will come as day follows night. The big money will be in the specialties.
[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.
It is inexcusable that any C or C++ compiler
allocates local variables in the same page
as the procedure call stack return address.
A Stack frame should be a fixed 4 word struct
with a Link Pointer to the previous frame,
a Heap Limit Address, Local Variable Base
Address and Return Address. The call stack
should be allocated at a lower address than
the heap and/or all local variables and there
should be a 4k-64k Guard Buffer of non-
addressable storage before and after the stack.
Negative array indexes and absolute pointers
should both be prohibited by the compiler
and runtime ABI. All Pointers should be
Handles that contain an offset from the
base of the heap. All pointer arithmetic
should be done with unsigned addition
before adding the base address. A Pointer
Overflow Error Exception would be raised
if the overflow, carry or sign flag was set.
A Stack Overflow Error Exception would
be raised if the local variable base is
less than the heap limit.
Such restrictions would have no impact on
well designed code but they would make it
impossible to execute arbitrary code due to
a buffer overrun.
The Heap Base and Local Variable Base would be
kept in registers. Only a 1 load penalty would
be incurred to access a local variable from a
caller's local variable frame. No value testing
or branches would be added to the procedure
call mechanism.
The fact is, that unless you have complete control over the user's evironment (and god forbid that ever happens)
... MacIntosh?
Can you say
I am sure that the engineers employed by Detroit were and are extremely competent and professional. They did wonders taking the motor car and turing it from an expensive luxury to a commodity transportation device. Yet despite all that professionalism, Nader found their cars to be gas-guzzling death traps.
On a similar note, I am sure Anderson only employed the most highly regarded auditors who belonged to the most rigorous professional bodies.
I think there may be a role for regultion, but like motor vehicles, such regulations would be more concerned with performance than dictating design.
Xix.
"Everything is adjustable, provided you have the right tools"
Sure... it sounds great: software that's well-tested, secure, and stable.
/. sysadmins who don't like buggy software?
But at what cost? Nobody seems to ask this obvious question. Software like that costs money, who's willing to pay that cost? The average consumer may rather just have unstable software than pay that extra cost.
Why should the average consumer have to pay extra costs just for the sake of the
The real reason for bugs is simple: developers develop until the software reaches some level of functionality that will be tolerated by most of the consumers, then they sell the product. If you want them to develop longer, you have to pay those costs, not the person that was happy enough with cheap, buggy software.
For a bridge to be tolerable, it needs to have near zero design flaws. But for an email client to be tolerable to most people, it can appearently have as many flaws as outlook express. By "tolerable" I mean that it's good enough that most people would rather have the product as-is than pay more for additional design.
Social scientists are inspired by theories; scientists are humbled by facts.
Ummm...if I ran a software company, it would be worth more to get the hell out of software development as quickly as possible to avoid huge fines for things as inevitable as human errors. Or I might consider moving out of the effective reach of whatever organization enforced it.
Are you suggesting that there's someone moronic enough to keep working in such an environment ?
I think what the original post (about the $100) meant was a voluntary payment by the company to entice people to buy from them, not a forced fine by some crazed authoritarians.
Heh. Right. Perhaps you haven't paid enough attention to history.
Increased government regulation is more likely to mean turning over complete control of every PC to Microsoft (can you say "Trusted Computing", boys and girls? I knew you could...) than it is to mean Microsoft gets pressured to release secure OSes, simply because Microsoft can out-lobby any competing OS that's already secure, which means that "security" will be defined by reference to installing patches.
Mark my words...government regulation of nongovernment computer security could end with it being a felony in the US to run anything but the latest Windows on your PC. But it _definitely_ won't do a single thing to make computers actually more secure.
From the article (yep, read it. yep, subscribed.):"There's a reason this kind of thing doesn't happen with automobiles," says Bruce Schneier, chief technical officer at Counterpane Internet Security in Cupertino, Calif."
Yes, but it's not the fact that MS isn't responsible for the flaws in it's OS.
The reason is that you have to have a drivers licence test in order to legally drive a car, which means you need to have certaing knowledge and skills to safely operate a car. That way, you know you don't drive 80mph in corners, and you know you have to periodically change the oil, tyres and stuff like that. On the other hand, you are not required to have absolutely any knowledge to operate a computer on the internet. And that's where the problem lies.
To expand further: both viruses that 'devastated' the internet lately propagated mainly because of ignorant users. One required you to click on an attachment in a message (Yeah, wicked screensaver, let's see it!), or not to patch your machine for a vulnerability that was announced and patched a month before MSBlaster struck (a month that the author of the virus probably spent writing and testing the virus, counting on people not patching their computers).
My point is: as much as you can't complain if you destroy the engine of your car because you neglected to change the oil, or crash while cornering at 80mph, you can't complain if your computer gets compromised because you neglected to take care of it or take the most basic precaution when operating it.
I'm not talking taking getting a CS degree here, computers can and will patch themselves if you make them do so. Similarly, everyone should know better than clicking on attachments in unexpected/strange messages. I have absolutely no fear of viruses/trojans/worms and have completely avoided all of internet 'disasters' so far, merely by excersizing common sense and judgement. I strongly believe everyone else can do so.
On the other hand, I do fear governments involvment in policing the Internet. If the proclaimed 'Internet security experts' have as little clue as the person cited at the top of my post, what chance of really understanding and doing the right thing a bunch of politicians have? Holding the software companies directly responsible for virus damage will be the end of the software industry. I really do hope the politicians aren't that hasty, although I do believe the armies of MS lobbyists will prevent the worse from happening.
Why does the government regulate technology? They obviously know nothing about it. You get laws like the felt-tip-pen-banning DMCA and firewall-banning Super-DMCA laws which show clearly their lack of knowledge on the subject. This should be fun to watch, if it happens. They'd probably fall prey to Microsoft and their lies and nothing would get done. Oh wait, they might ban Linux for the same reasons imported drugs are banned. That's a little extreme, but you never know.
> don't you think their culture would change very
> rapidly? Instead of having the worst security
> reputation, they'd suddenly have the very best.
You want secure code from Microsoft? Be careful what you wish for, because you just might get it!
Some day Microsoft may get the hang of writing code without gaping holes. But, when they do, they will NOT use their newfound skill to implement anything which you and I would recognize as security.
When you and I say "security," we mean "nothing runs without the machine's owner's permission." When Microsoft say "security," they mean "nothing runs without Microsoft's permission."
If and when Microsoft create a secure operating system, no one (even the owner of the machine) will be able to write or run any software without prior approval from Microsoft.
Some day, every incompetently managed buffer in a Microsoft app will be a reason for celebration, because these "exploits" will be the only way you can run your own code on your own hardware.
Don't laugh, this is already happening to Xbox owners. Look how happy they were when buffer exploits were found in a couple of Xbox games. Without these exploits, Xbox owners would be unable to run excellent software like Linux and Xbox Media Player, on their own hardware.
Yes, there are "mod chips" which can be forcibly installed. But this is merely a first-version hardware oversight; surely the hardware of the next generation of Xbox will be much more difficult to modify. And, similarly, the hardware of the future "Palladium PC" will be nearly impossible to hack, because the Fritz circuitry will be integrated on the same silicon chip as the microprocessor.
Trust me: the day will come when you will hope and pray for a classic, incompetent, Microsoftian, smashable buffer!
Can you say... less than 10% of the market?
Also remember that I can still buy a third-party accelerator, video card, sound card, or other PCI devices. I can also install third-party hard drives, CDs, etc. I can also purchase and install any number of 3rd party utilities, any of which could rely on low-level access to the operating system (or at least the ROM toolbox).