Slashdot Mirror
Longhorn Will Have Ability to Ban External Storage Devices
slashdotbs writes "CNET is reporting that Microsoft will allow IT managers to block devices such as USB memory keys and - shockingly! - iPods. The article refers to 'the threat posed by digital storage devices'."
Block access to USB keys?
Hell, we can do that now!
Remember that SP2 has several new longhorn "features" that were rushed into the service pack in the name of security.
Davak
Microsoft since 2000 has always had Group Policy definitions to restrict CD burning and Floppy use on certain PCs, why is this such a big deal? Because it has the word "iPod" in the article?
It's not like every IT department is going to start locking down USB keys.. it takes one employee complaining to their manager they can't take their uber-important files home to work on at night to get things like this reversed anyway.
Nail biters don't bother.. it's just a slow news day for Slashdot
There is a rage in me to defy the order of the stars, despite their pretty patterns.
While I personally believe this is a good thing, often these things can be circumvented easily by... booting a knoppix CD. Of course a modern BIOS will allow you to restrict booting from a floppy (yes I know... I am the only person who still uses these), or a CDRom, but all can be undone with 30 seconds and enough balls to open your case. Even then, Im sure there is some trick to purge the CMOS without ever cracking the case.
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
I worked on a project where we had to remove every USB, firewire, CDROM, and floppy drive along with sheathing all the plugs and sealing all the connections on hundreds of computers to satisfy some of the more stringent controls required in HIPAA (HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996) that no unauthorised persons be able to access restricted documents. It was cheaper than using control software (trusted computing platforms and certification is wicked expensive).
[RIAA] says its concern is artists. That's true, in just the sense that a cattle rancher is concerned about its cattle.
You can already block IE using an outbound HTTP proxy server which can screen out requests based on the Agent tag. You can also block execution of IE using NTFS permissions. You can also set other browsers to be the default browser on a particular desktop. So...what's the problem?
I see a lot of comments talking about "anal sysadmins" and such. In a commercial environment that may be true. But there's an area where it is even MORE important to be able to lock these devices out: The government / sensitive info computers of the world. Think about all of the work that goes on in these places and the number of computers, many of which are on Solaris and Windows (some Linux is approved, but not much) They have to implement these features to keep national-security type information from walking out on someones keychain. (course those items cannot be in secured areas anyway, but I digress).
Linux has had this since 1991.
Seriously, it's called fstab.
It's also a handy way of keeping confidential information from leaking.
You may want to read the formatted man-page for fstab some time.
I think that you may find the "user" and "noauto" options interesting.