Slashdot Mirror
Dept. of Homeland Security Says to Stop Using IE
LWATCDR writes "I have been saying this for a long time but now it is offical. From Yahoo News:
'The Department of Homeland Security's U.S. Computer Emergency Readiness Team touched off a storm this week when it recommended for security reasons using browsers other than Microsoft's Internet Explorer.'" In related news, rocketjam writes "According to Wired, the widespread Internet Explorer security exploit last week and CERT's subsequent recommendation that IE users should consider switching to another browser has resulted in a large spike in downloads of the Mozilla Organization's Mozilla and Firefox web browsers."
"In the meantime, we have provided customers with prescriptive guidance to help mitigate these issues."
This translates to a set of instructions for making changes in I.E. settings since the default settings are not terribly good for security. THe MS spokesperson said that a "comprehensive" security pack for I.E. will be out later this summer. You gotta love this. You just cannot make stuff up like this!
Cheers!
Erick
http://www.busyweather.com/
I didn't listen to them when they asked me to duct tape and plastic wrap my house, I didn't listen to them when they raised the alert level 5 different times, I didn't listen to them when they told me to trust them, but I am glad that other people do... Perhaps this will do double duty! It will fix websites that cater to IE only so that they work with the currently "broken" Firefox so that I don't have to refresh or cross my fingers to get it to work.
the courts have ruled that Msft's bundling and pushing IE with every OS purchase is good for the consumer. Let business be free to manipulate their customers! It's good for the economy.
try { do() || do_not(); } catch (JediException err) { yoda(err); }
Now that everyone and his brother are using Mozilla Firefox, I guess that I will have to go back to using Opera again. At least the ads do not take up as much space as they used to.
Hopefully people switching to FF will mean that more bugs will be squatched from it. Perfect timing for that 1.0 release.
I donated to Trillian when they were in Beta... I felt that my little bit went a long way.
I have purchased Opera and I have never regretted that decision.
I will wait until Firefox is as smooth as Opera then I will donate.
ChozSun
ChozSun.com
..that the hackers will start targetting Mozilla/FireFox now as it might become the dominant browser out there.
They will always target the browser having the most user base as the probablity of exploit becoming successfull increases.
I've been posting news articles like this one around the workplace, but man, is it hard to get anyone to listen. If HQ won't even listen to this headquarters's own IT department, why should they listen to someone in R&D?
Bah. Anyone have any advice on this?
Si la vida me da palo, yo la voy a soportar Si la vida me da palo, yo la voy a espabilar
Actually, I believe any account that can execute code in its home directory should work. Firefox is downloadable as a zip (or was about a year ago).
"Microsoft certainly respects the work CERT does to help protect the Internet and users. Regarding the consideration that users switch browsers, it is unfortunate that the published articles have misrepresented CERT's suggestions, and we are working with CERT to clarify their advice," Schare said.
Let's see what we have here.
- First sentance tells us that Microsoft isn't going to try to attack the credibility of CERT because that'd be unlikely to get anywhere.
- Second sentance is trying to blame "the media" for misreporting the story, but the media's working from a primary source that has a section heading called "Use a different web browser". I don't know how you're "misrepresenting" that when you take that as a suggesting to download any browser that isn't Internet Explorer which means Mozzila, Opera, Netscape or any other compeitor out there. They want CERT to take back the recomendation to just stop using IE... that's the only kind of "clarification" that's possible here.
Microsoft clearly wants a CERT retraction. But do they stand any chance at getting one?
I've got a better way to convince users.
We need to stand up and tell all the family members and friends we're supporting for free - we are, after all, unpaid Microsoft technical support, without whom the users might as well be using command-line Unix - that they can either stop using IE, stop calling us for support, or expect a $200.00 per hour charge, with a one hour minimum per call.
Enough is enough. No more unpaid work cleaning up after Bill. It's like walking behind an elephant with a dustpan and a broom.
I realize this, but if I went up to my mom and said, "Hey mom, the CERT recommends you stop using IE" she would just be like "Who is that, why should I care?" but if I said, "Hey mom, the Department of Homeland Security recommends you stop using IE" she would instantly know who I am talking about. Its all about the names "normal" people would recognize.
I use IE on most of my PCs because it's fast. Not just fast to launch (that's obvious) but faster at loading pages and faster at scrolling.
In the Real World, Pentium II systems are the norm. Not everyone has a watercooled P4 monster. Heck, in most of the machines I see and work with, you're lucky to have a real video card. There's nothing like a PII/350 with onboard video using shared PC100 RAM. Sooo slooow.
Back to IE, it's *much* faster than even the latest builds of Mozilla and FireFox. With config tweaking and other incantations, the gap narrows a bit, but IE still wins.
I would love Mozilla, *IF* it was faster.
Anyone want to place bets on whether some clever MS lawyer is preparing to argue that any antitrust action related to the browser bundling should be tossed out, because the feds are now encouraging people to use browsers written by the competition? After all, if the government acknowledges that there is legitimate competition, then clearly, MS must not be abusing its desktop monopoly, since so many people are now downloading those free alternatives... right?
As an alternative... imagine if DHS came out and said that a flaw in GM vehicles aided terrorists, and people should purchase Ford and Chrysler vehicles until the flaw is repaired. Do you think GM would immediately start demanding financial compensation for lost sales and market share from the federal government?
Now, extend that to MS, despite the fact that IE is, effectively, free. If the whole thing still seems unbelievable, insert Robert Heinlein's quote about corporations thinking they have an unassailable right to make a profit above all else here. I'll bet good money MS is already preparing the legal briefs for some kind of retaliation.
Someday, you're going to die. Get over it.
Cool, will that mean that some of the idiot web designers will actually start taking non-compatibility complaints seriously? Like those ladened with Javascript that works nowhere else but with IE. Take Expedia.com, where the calendar pop-ups only work with IE or Priston Tale web site where the side menus don't appear if you don't have IE (I already supplied a fix which was ignored) - actually this one should be lumped with the GIS2 web site for excesive use of Flash.
Maybe pigs will fly first?
Just one note Mozilla has one big advantage over Opera and Safari for MS base corportate networks: it supports NTLM.
Jumpstart the tartan drive.
I'd like to take this opportunity to emphasize the negatives of an unhealthy competitive market.
When monopolists crush the competition, and you have one company with 95% marketshare, that company gets lazy.
It produces shitty products, slows development (compare development now with when they were trying to crush netscape), all the while making monopoly profits.
Thankfully, the GPL seriously reduces the barriers to entry, because it would be DAMN hard to get either Gecko/Mozilla or KHTML/Konqueror/Safari relicensed and 'shut-down', or integrated into the MS lineup.
Mark my words, if there was no one else but Opera, MS would think long and hard about crushing it.
Monpoly bad, folks, m-kay?
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
Homeland Defense keeps messing with the terrorist threat alert level. I ignore it all the time. But when something happens, they'll inevitably say "HA! WE TOLD YOU SO!!!", when in actuality, they throw so much shit against the wall that sooner or later, something will stick.
...
Anti-MS basher types are always quick to say "THIS IS IMPORTANT!!! IT'S THE END OF MICROSOFT'S REIGN!!!". They've been saying it for so long, it's noise. But should the day ever come that Microsoft suffers, the basher will say "HA! WE TOLD YOU SO!!!". In reality, there's so much shit tossed against the wall
You know who you are
Too bad that ADODB.Stream is just a symptom and not the root cause of IE's problems. Applying this will only temporarily break some of the IE rootkits, until they come up with a different method for writing files.
For some odd reason, no one cares how bad IE is. I am sure a lot of people here will provide anecdotal evidence of this news switching their friends and family. However, I have never had a hard time convincing people IE and Windows have serious flaws. The people I have spoken to believe I am credible (or so I think!) and I don't think that now that the DoHS is recommending against IE that anyone will listen. They will believe you when you describe the problem, but they don't understand it.
The average Joe just does not care how much windows or IE suck. They probably have 20-30 spyware and adware programs installed and probably more than a handful of resident virii. And they don't even know! Most people will just read the news and wish they understood it, or wish they knew someone who could help them deal with it. Ultimately, all this news means is:
A) Average Joe has to figure out all this on his own, find an alternative browser, learn how to install it, and learn how to use it.
B) Average Joe has to hire someone to do this for him.
C) Average Joe has to call every family member and or friend he knows who might be even the slightest bit more computer literate than he is in hopes of finding help.
D) Average Joe moves on to the next news story about people dying in Iraq and resigns himself to yet another of the world's problems that he can do nothing about.
E) Average Joe just cracks open a beer.
But the stark reality of this Microsoft world is that people don't understand and are afraid of their computers. Many people don't even know what a browser is. They think Internet Explorer is the internet... etc.
Anyways, I am hopeful that the recent CERT news and DoHS news will challenge people to make a change, but I've seen too many catastrophic flaws discovered in Windows to be hopeful. It seems each time people just resign themselves to inferior software.
What if the whole world drove Ford Pintos and no one realized they suck? A thousand auto mechanics would be shouting, "Pintos suck and are dangerous" and no one would listen. Because Pintos would be crammed down the throat of every car buyer and would be just about the only car on most people's block. People just don't understand cars, and don't realize that they don't have to suck. What an odd world that would be.
Wow. Think how much worse this'd be for Microsoft if IE was a core part of the operating system!
- mark
-----
I tried an internal modem, but it hurt when I walked.
Then it will be interesting to see if Mozilla has the same inherent weaknesses as IE, won't it? For years MS has used the excuse that they're the largest installed base, thus the target for most virii, etc. I say lets see if thats true.
Not many companies are in the business of selling open source software, Mozilla included. Mozilla isn't even a company for that matter. The companies that do offer open source software often don't ask for donations, but charge for support instead.
Time makes more converts than reason
Once Mozilla gains sufficiently market shares, we will see exploits for that browser more and more often. And yes - there will be exploits. IE is not compromised so often just because it's poorly written, but because it's so popular that hordes of script kiddies are trying out every possible hack. [emphasis mine]
No, it's not just because IE is poorly written, although that is a big factor. There are several fundamental differences between IE and Moz that make IE more vulnerable (well, there's more than just these , but these are the important ones):
First of all, when an exploit is discovered in Moz we can fix it right away. When an exploit is discovered in IE we're told not to click on any hyperlinks for the next few months.
Second, Mozilla will never truly take over the market while IE is bundled with 'doze and 'doze rules the desktop. Too many people will simply use what's already there.
Finally, a substantial portion of those looking for exploits will continue to look for them in IE for the two reasons given above and because Microsoft is somewhat dispised and, I'm guessing, attacking Microsoft is more "prestigious" among crackers than attacking Mozilla. "Oh, you found a vulnerability in Mozilla. Add it to the bug tracker." vs "Wow! Another vulnerability in IE! Dude! u r l33t!"
You know, everyone says that but I never have problems. I've been using Mozilla (and then FireFox) for ages and I constantly do online banking (psecu), access my (admittedly too many) credit cards (mbna, discover, amex, etc) via web sites, get all my news online, buy stuff online, etc. The only time I ever had a serious problem using a website that was designed for IE and didn't work in Mozilla was AT&T's Blackberry webmail client. Seriously, that is THE ONLY ONE.
I think this whole "IE is required for banks, online stores, etc". is a big FUDdy myth. Start pointing out sites that do not work with standards if there are so many and let's all encourage those sites to fix their broken stuff.
Finkployd
More like "we'll build you a new barn. Promise."
My beliefs do not require that you agree with them.
Gary Schare, director of the Windows Client Division at Microsoft, said that CERT's advice had been misrepresented in much of the press coverage.
So the press misquoted CERT? I've read the text and almost everything I've seen is a quote, albeit summarized occasionally.
I think it's absolute comedy that when MS plays hardball, it's just business as usual, but when things swing the other way they can't stop complaining how they aren't getting a fair shake.
Regarding the consideration that users switch browsers, it is unfortunate that the published articles have misrepresented CERT's suggestions, and we are working with CERT to clarify their advice," Schare said.
Translation: We are currently researching ways to extort CERT into issuing a new statement saying our browser is the most secure as long as you don't use the default settings we chose for you. Fact: IE is the most secure browser when completely blocked by a firewall.
Is IE targeted because it is widespread? Perhaps. But that does not mean Mozilla is just as insecure.
It's not just that IE is widespread, but its a design issue. If the usage numbers were inverted, IE would still have more exploits because it has some extremely poor design concepts behind it. First, it is directly hooked into the OS. If an exploit executes on the browser, then it is a very short leap for it to execute on the OS. Second, IE has a promiscuous plug-in model that allows nasty malware to execute without enough checks or controls.
What drug was the IE design team engineers taking when they decided to to let (or at least failed to prevent) untrusted program execution? The drug is named "Market-share". They were trying to turn on as many features as possible to capture every possible market. Microsoft made an early design decision to tout features over correctness. It is a fatal defect that now is probably nearly impossible to correct.
Now that MS is re-starting IE development, they should probably do what the Mozilla team was forced to do years ago. When Mozilla first inherited NS-Navigator 4.X, they looked at it and decided to ditch most of it. They started clean with new design concepts. I think MS is going have to do the same thing. The current design of IE is fattaly flawed. It will have to be rebuilt from the ground up with a new security model.
It is bad PR for Microsoft and we are all exited about people now starting to install Firefox and Opera. But what in the world makes us believe Microsoft will just sit and watch?
Sooner or later MS will provide some kind of fix for the security holes. Then there will be a version of IE coming which has tabbed browsing and all the other niceties in Firefox and Opera. That new IE will enter the desktop conveniently through Windows Update. That day people will be happy that IE is safe and they will go back to using it. Just because they are used to it and they do not need to bother finding and installing some other strange program.
Today Firefox and Opera are attractive because they offer better features and improved security over IE. What makes us believe it will always be like that? And are features and security good enough to battle the desktop monopoly?
A dramatic increase in the userbase will also make the mozilla/firefox platform more attractive for exploit seekers/writers. Such increased level of "real-world testing" will benefit the quality of the browser in a very positive way if handled properly by the developers.
So when is the Govt. going to fix all of their web sites to work with Mozilla? Currently there are a great number of sites that only work with IE and some businesses rely on those sites.
âoeIn theory, theory and practice are the same. In practice, they are not." â Albert Einstein
Beyond that fact that you're either dumb or stuck if you're running IIS 5.0 these days, does it make sense to link IE w/ IIS 5.0?
--pete
I was hoping to find the links to the CERT and Homeland Security where this information was posted. I assume those would be available online somewhere. The links I see here are all in news sites that actually don't point to the source.
Anyone cares to post the links?
Because one of the biggest hurdles of getting people to change software is the interface. Most end users say to hell with functionality, if they can't recognize how it looks.
while true ; do echo this is my sig; done
'Microsoft certainly respects the work CERT does to help protect the Internet and users. Regarding the consideration that users switch browsers, it is unfortunate that the published articles have misrepresented CERT's suggestions, and we are working with CERT to clarify their advice,' Schare said. In other words, M$ is saying CERT should retract the statement or else. Bet there already have been some nasty letters sent their way on law office letterhead...
You're messin' with my Zen Thing, man.....
I donated $100 to the Mozilla Foundation not because I like their browser (I like epiphany better), but because I see them as an organization which has -- through the rather arbitrary and random nature of the history of the Internet -- been given the responsibility of guarding and furthering the integrity of the Internet (something I'm definitely willing to contribute to), rather than as just another producer of a Web Browser.
"money" , and the reality that most people use IE because of illegal monopolistic actions that resulted in MSOS being the defacto install on their computers, so they use what came with the package, which includes IE, and they are encouraged to go onto the internet without adequate instructions, or without adequate protections, both of which are well known to MS and the various vendors who sold them their computers.
When you have the vast bulk of PCs the last decade and a half being shipped with MSOS, they had a responsibility to make sure they weren't violating anti trust laws, which they failed to do, and got convicted of it.
The consumer was long ago denied any reasonable* expectation of free market choice, when the vendors themselves conspired with MS to ONLY include MSOS to such an extent. It's intent, and to my way of seeing it, is an example of RICO action and should have resulted in MS and several large vendors getting charged with criminal violations, not just civil violations, and several billionaires going to jail over it.
Even though IE is a free download, it is easily observed that most people did not have some other OS OR of their free will go "download IE", it came as a bundled app with their monopoly enforced distribution of MSOS, and the product is seriously flawed. Seriously. The EULA should be challeged, and we need to get a determination of when and how any product may be profited from, but still avoid an implied warranty for suitability for purpose. If they get granted a patent and a copyright, they have certain responsbilites when they trade it in some fashion for money. When you receive something for free, it's a different story. That's the major difference there. And if that again causes a shift in free/open source, how it's distributed, it would be worth it to force closed source/propietary and for-profit sodftware to get classed as a product that is sold, and have normal consumer protections. The tradeoffs are worth it, IMO.
* please note, I said reasonable as opposed to technical. Technically yes, they had a choice, reasonably, no, there was little choice, and still not much. Walk into any big computer store, what is the default install on the boxes there? Are any of them safe to go on the net "as is", how they are sold? No, they are not. The EULA basically is an example of a vast huge case of consumer fraud, IMO. People assume their brand new computers will work, and part of their entire computer package they purchase with real money is the software that comes with it. They would sell little if any new computers bundlked with MSOS if they were merely labled truthfully, as in "you will probably get infected with virus, malware, trojans, backdoors, etc within one hour of being on the internet with the default install and configuration if you click accept on the EULA provided for the bundled microsoft software". If that sticker was on the outside of the boxes, the stores wouldn't seel hardly any of them. How many computers and copies of MSOS would they sell then, if they were merely required to tell the truth, even keeping the current EULAs in place, exactly how they are written now?
I personally *do not care* if the entire software industry top to bottom, left to right, inside to outside has to change licensing,thinking, what they do or how they do it, enough's ENOUGH on claiming a 60 year old industry that has raked in untold hundreds of billions of dollars or more isn't mature and sophisticated enough to offer products that can be covered by minimum consumer implied warranties. Time to take the training wheels off, and get rid of the EULA get out of any responsibility "license". If it slows down releases and causes huge shifts in PHB and investors thinkings and stock holders profits, I could care less, and I bet millions more consumers feel the same exact way. Software will still be written and sold or given away, just of much better quality. Releases will be slower, but they will be much better quality. Pressure will shift from get i
Mozilla and others work to make their browsers just as insecure as IE:
Browser Plug-in Standard
I'm sorry, but "rich" web content basically equates to "insecure" from what I can tell. The more dynamic and powerful you make downloaded code, the harder it is to keep it in check.
Save the "rich" content for some separate application-oriented protocol and leave it out of HTML. That way I can download and run some sort of OS-independent application (the goal) from a trusted site when I need to, and don't have to worry about Joe-random web site abusing it. Surfing the web and running some site-specific application are two distinct tasks with quite different security requirements. I wish folks would stop mixing them, as the problems caused are only going to get worse IMHO.
This may be the beginning of the end... if people massively switch to Firefox (which is open source, not from MS, and damn good), the perception about FOSS will certainly change... people will realize MS is not the only choice.
The next step could be a Windows desktop, but with Firefox, Thunderbird, OpenOffice, and all free/open software with Linux counterparts... once they get used to all that software, the final switch to Linux is seamless.
My website
"Global Class Action Lawsuit against Microsoft"
This is what people don't understand about capitalism. If you don't like the product, you don't have to sue, just stop using the damn product.
I really hate this attitude, "the man keeps us down, so lets sue." It makes absolutely no sense at all. Corporation uses child labour to make affordable products, sue them. Heaven forbid you should accept responsibility for it and stop buying their low-quality products. MSFT sells software for too much money, sue them, don't simply use something else. It's no wonder we have so much unnecessary litigation in this country.
I must admit it's going to be funny to hear them justify all the claims that M$ bought off the Bush Admistration after this. Actually they will probably sulk quietly until they come up with a new rant.
You can only hide poorly written software for so long. Then it screws up bad enough that you look stupid.
Professional Politicians are not the solution, they ARE the problem.
This must by how John Kerry raised over $3 million on Wed. They're obviously using stolen credit card numbers harvested with the help of I.E.
<\tinfoilhat>
http://www.nytimes.com/2004/07/02/politics/campai
Once the alternative web browsers are identified, they will have to be tested to make sure that they are secure and compatible they are.
If this is the criteria used, how was IE ever selected in the first place?
Granted, this is operating on the assumption that the browser should have the highest level of security and compatibility.
Besides not being exploitable by this bug:
[The ActiveX Plugin] is configured to only work with the Windows Media Player control.
You should read the description of the ActiveX Plugin. Having said that, the developer is assumably trying to get all ActiveX to work with Mozilla eventually. I think this should be taken out of the plugins list before Joe Sixpack finds it. The developer can release it on his own if he likes. But making it even possible for Mozilla to be as insecure as IE is not a good idea IMHO.
Will the US Goverment require the removal or disabiling of IE on all of it's computers for security reasons?
If Microsoft continues to claim that they can not remove IE from Windows will the US goverment start removing Windows from there computers and replace it with Mac OS/X and or Linux?
Since they Include IIs in this what does it mean server 2003 and Longhorn?
Remember people that write websites that only work in IE are terrorists.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
I remember a TV commercial...maybe you remember it too....Big conference has come to a halt because of the computer running the PowerPoint presentation has frozen. The audience is yelling out suggestions..."Try restarting, Try Control-Alt-Delete, etc." There is a pause...then someone yells out..."You should've bought a Mac."
After 11 years of Windows 3+, Win 95, Win 98 and Windows 2000...I got tired of the crashes and then the viruses and spyware. I got a PowerBook. I now do my online banking with Mac OS X and Safari.
Be safer online...buy a Mac.
One comment from the defense folks is doing more damage to IE than netscape did in 10 years.
...because they are a monopoly (in regard to the IE bugs and the DHS advisory).
They will be sued because they were willfully negligent in the maintenance a monopoly product, the sabotage of which inflicts material damage upon third parties in the range of hundreds of millions of dollars.
Don't let your dislike of antitrust law cloud the real harm that this software has done. If Standard Oil had sold petroleum products that destroyed the engines of their customers during their monopoly breakup, would they still be liable for damages? Of course.
p.s. IANAL.
...who advised everyone to use Microsoft products, despite the fact that one of their own organizations made a secure Linux available for free?
Dear Homeland Security,
Compare and contrast:
(1) Your ass
(2) A hole in the ground.
"I may be synthetic, but I'm not stupid." -- Bishop 341-B
Is /. populated by communists? The parent should be labeled "Insightful." Seriously, if the product is bad, let the market kill it. As soon as the wonderful and egalitarian Linux is actually usable, I'm there! In the meantime, I'm stuck with a kludgey P.O.S. OS, and continuously patching it.
I use Mozilla for everything internet related and OOo for office tasks because I can actually use them! Call me a moron, but I really don't relish the thought of using an OS that can't do all the stuff I need it to do, specifically, Quicken, Photoshop, and 3D CAD (SolidWorks). I rely on those programs. Make Linux run them and I'll switch immediately. Until then, I suffer with MS crap, along with the rest of the world.
But, please, spare me the Marxist bunk about some "ideal" Star Trek world in which everyone has a perfect job and never wants for anything. It ain't gonna happen.
The Philosophy of Liberty | lewrockwell.com
They don't. By their own testimony, IE is an integral part of their operating system. And indeed, several important operations in Windows are impossible to perform without IE installed. The operating system is not free, and neither are its integral parts.
I don't know where you USian guys get this rubish about companies have only one goal, the damned profit.
You have been brainwashed and repeat your little mantra like the good Chinese workers used to parrot Mao's Red Book.
Companies can be the expresion of an ideal, the realization of a dream or the intent to attack social problems. You have companies that have been set up to ensure fair trade of tea and coffee, other companies that operate in a cooperative basis in which the workers are owners and benefit.
In Brazil a well known style of management (like some forward thinking USian companies like Google) support their employees to start their own businesses on their free time using company's resources that otherwise would not be utilized.
Many companies have programs to vinculate them with their local communities (mine is one of them) helping with reading skills, IT skills on deprived schools, and promoting on their employees a culture of solidarity and social responsibility. Many of you don't know, but many corporations have strict guidelines about what is legal or moreal and what is not, and employess are lectured constantly (to the point of boredom) about legal and moral obligations.
There are companies out there that compete trying to put innovative products on the market and not by the shameful "embracing and extending" touted by the greatest megalomaniac of the IT industry.
The companies are what you want them to be, if they only pursue profit without regards for the consequences it is because greedy unscrupulous individuals have been made heroes by their peers, the media and unsuspected Red Book reciters.
IANAL but write like a drunk one.
people were really conned on this. advertising works, it's a multi billion dollar a year industry. Perople are NOT told it is difficult, or dangerous, to buy and use a computer. They are told it's easy, safe, fun, cheap, new and shiny and they will be losers if they don't jump in the pool with everyone else. When they go to the whitebox sho or back to best buy or whatever, they have never been told to load an alternativ OS, or even a browser, they are just charged for a patch of a fix or sold even more sioftware that alleges cures their computer ills. At work, where their bosses got faked out, they are confronted with the exact same thing. At the store, no choice practically speaking.
Yada yada. Although I think some blame can be laid on the victims,for putting up with it and paying for it for yearsm most of it can go to the actual pepetrators of the scams and cons and on the black hats as well for taking cruel advantage of people because it's easy for them to both do so and to remain anonymous and commit sociopathic actions they normally wouldn't do in meatspace.
Plug-ins are not something that automatically gets downloaded and installed on your machine. You have to knowingly download and then install them. This is for Windows or any other OS that the plug-in framework is residing on.
On the other hand, IE provides "helpful" features like self-installing plug-ins (ActiveX) and a help framework that completely circumvents the security- all without ANY user intervention.
In the proposed solution you offer, there is no difference with the plug-in model of things- you have to actually install something with your own intervention to be able to view "rich" content. The moment you do anything Internet centric, you change the security profile completely. Having one or more applications to do things doesn't change the amount of work, etc. like you seem to think it does. In fact, in some cases, you just made the work harder because now you've got to add more rules in your firewall and monitoring tools which could leave loopholes in your security. And it still doesn't stop idiots from running malware passed along via e-mail, etc.
Your whole premise doesn't work.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas