Slashdot Mirror
IE Holes Not Microsoft's Fault, Says Bill
thparker writes "As part of the Media Center release discussed previously, Bill Gates had an interview with USA Today. Best quote: 'Q: Speaking of security, Internet Explorer has had well-publicized holes... Gates: Understand those are cases where you are downloading third-party software.' Well now we know -- these problems have all been our own fault." Any counterexamples?
Gates: Understand those are cases where you are downloading third-party software.'
Hrmmmm. Downloading third party software on my Macintosh does not seem to get me into trouble in the same manner as it does on Windows........Why is that Mr. Gates? Furthermore, I have performed the experiment: Install Windows on a computer and hook it up to the Internet. Leave it hooked up without downloading one bit of software from anywhere! and the machine will be compromised. Why is that Mr. Gates?
Moving along: Q: Might you add anti-virus/spyware protection in Windows? Gates: It's not a thing you build in. You have to offer a service......Why is that Mr. Gates? I would have thought that you would offer a secure environment as part of your product out of the box? What does that tell us about the quality of your products? After all, does not my automobile come with airbags and antilock brakes and skid control and all wheel drive? Under your logic, those features would only work if I paid a monthly premium.
You know, I kept waiting for something better to happen with Windows, but I have work to do and things to create, so I'll stick with OS X and my Macintosh. Thanks anyway.
Visit Jonesblog and say hello.
Comment removed based on user account deletion
"Q: Might you add anti-virus/spyware protection in Windows?
Gates: It's not a thing you build in. You have to offer a service. There are third parties who are doing a good job. We're always taking a hard look, but we don't have any concrete plans."
So, apparently Ballmer isn't the only one there who Doesn't Get It.
John
Yes, viri, trojans and spyware tend to be third party. The problem is, IE lets you download these and execute, sometimes by just viewing a page.
Quid festinatio swallonis est aetherfuga inonusti?
Africus aut Europaeus?
Sick and tired of fixing spyware infested machines.
Those holes are what LETS third-party software install its freaking self.
I wasn't aware Windows Update was third-party software...?
I thought it was everyone else blaming their computer problems on Microsoft not the other way around.
Well, it has never been successfully tested.
is like Tony Soprano lecturing about law and order..
Q: Yes, but will people continue to do that with Media Center? Gates: You might well do it. We need to use approaches that block people from ever getting software onto the machine they don't want. Me: Great. Now let me get a PC from a major OEM without windows - oh, not that software?
Don't worry - its just stigmata. Pass me a napkin and don't you dare tell my mother.
So, pray tell, how is making a horribly insecure third-party application model (DirectX) and then complaining about how people are exploiting it supposed to hold water? YOU ARE THE API DEVELOPER. IT IS YOUR RESPONSIBILITY TO ANTICIPATE POTENTIAL ABUSES.
Because if I'm reading this right, then that's exactly what Gates is doing. No wonder Microsoft's products are so shitty; they think that security is something that happens to other people.
Sounds like Microsoft's Trusted Computing Initiative isn't getting as much executive support as it might've.
Remember that, Bill? When you said you were going to make all the Windows computers secure by focusing all your energies on securing your code?
Now, it's not your fault, and you won't do anything to fix it? Then why on earth did you tell everyone that you would?
The more he reminds me of my ex girlfriend. As in - he is just as greedy and his side is never at fault.
Although he is much uglier and....male.
I hear them from the Bush administration almost daily and corporate america is getting a lot more brazen. No one fact checks, dissenting opinions are marginalized, and the corrections page doesn't have nearly the eyeballs the front page does. And that's assuming a correction is ever given.
This is the same mentality of shipping a crappy product and having tech support take care of the issues. Okay, fine, at least I have someone to complain to and I can return products, but with information you don't have that option. You complain to your peers, who are just an echo chamber. The fact that lying usually goes unchallenged in media makes for bigger more destructive lies.
The browser has holes, its a piece of software. This is way over the line. How did the information age become the disinformation age? Perhaps we officially entered the post-postman world where everything is a soundbite that flies through the subconscious and sticks there. Long corrections don't have the same stickiness, so lying is now smart business.
Keep it up Bill, you're making my next Apple purchase all the sweeter.
Disclaimer for the mods: Yes, many politicians lie. Apple isnt perfect, etc. But there is a difference between small and big lies. Lies which are harmless and those which cause destruction.
Especially the ones that you get while downloading the updates.
So the thing the users keep doing wrong is hook it up to the internet.
Q: What's your take on making Windows Media compatible with Apple?
Gates: We're big believers in interoperability.
BWWAAHAHHAHAHAHHAHAAAHHAAAA!!!!!!
Yes yes... ofcourse, interoperability within Microsoft products
Mod article +5 Troll...
Wish there was a rating system for articles.
That's interesting since current statistics are only showing:
2004 IE 6 IE 5 O 7 Moz NN 3 NN 4 NN 7
October 69.8% 6.0% 2.3% 17.0% 0.2% 0.2% 1.3%
September 69.6% 6.2% 2.3% 16.9% 0.2% 0.2% 1.3%
In other words, IE5/6 with 75.8%, not Bill's dream of 90% (not anymore). In fact, it has been since Jan 2002 that IE has had a number even close to 90%, when it was at 86.8%.
Bill, get a clue and stop using your PR department for your FUD.
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
Q: There is talk of a Google browser. Internet Explorer has had its security woes. How do you keep users?
Gates: More has been invested in making IE secure than any browser on the planet by a long shot. Nothing is going to change. That's the one over 90% of people are going to keep using.
Let us all remember the line above then. Nothing is going to change?
I think it will
The power of accurate observation is commonly called cynicism by those who have not got it. -- G.B. Shaw
I need lessons with Bill so I improve my english, I guess its easy to learn it, if you stretch the meaning of the words as much as bill.
Watching a website outside microsoft.com=downloading third party software.
Q: Speaking of security, Internet Explorer has had well-publicized holes ...
Gates: Understand those are cases where you are downloading third-party software.
Here how it goes.
If you never download, let say a third party web-browser like Mozilla's Firefox or Opera, you'd never realize how problematic Internet Explorer is.
So it is us, the consumer, who are to blame for downloading those third party softwares. Especially the ones that make IE look so horribble.
See the quote: "More has been invested in making IE secure than any browser on the planet by a long shot. Nothing is going to change."
Money is no replacement for clue.
What Gates is saying is that Windows does not come with native viruses installed, you have to download them from other places. Well, I sure hope they see that they are missing a market opportunity here. Longhorn better come with its own, native viruses.
You can't handle the truth.
The purpose of Internet Explorer is to download third party files (by viewing Web pages). Mr Gates's claim that vulnerabilites exist because of such downloads is therefore nonsensical; it's like saying we could end deaths due to automobile accidents by banning automobiles. Yeah, there's a certain logic to that, but it sort of misses the point. To take a recent, ongoing example: A malevolent Web page can use an image file to compromise a Windows system. This vulnerability is not created by users who have somehow previously contaiminated the local environment; it's a part of the system's design. The OS was originally built to offer features over security, and maintaining backward compatability rather than fixing those issues would make it more difficult to coax existing users into upgrading (and would also make it easier for existing users to consider alternatives rather than upgrading). I lost two years of my life covering the antitrust trial, listening to this guy and his minions cheerfully perjure themselves, and he just can't seem to stop making it up.
Han: "It's not my fault!"
Lando: "It's not my fault!"
Bill: "It's not my fault!"
You need to see a shrink. You are SO in denial mode. Take it from your users, not your PR cronies, IE is broke, always has been broke, always will be broke. Firefox is great ( but there are still some problems with it) and it will get better. But I doubt if it will ever get a big following. Bill has us by the cojones. We know it, He knows it. Thats why he can lie, lie, and lie some more. Thats it, Bill, blame your users. Just once, I would like for M$ to admit fault. I can dream, right?
First of all, you are a business, so you want to make money. Your target is average Joe NoClue. What is gonna get the attention of Joe NoClue? Features, a whole friggin lot of features. He's not a sysadmin. He's not a freaking security expert. And he certainly doesn't care about thing he doesn't see, like security. You might say that Joe NoClue doesn't like having his computer hijacked. Well he still doesn't have a clue about this. So this is not a problem. Problem arise when Joe NoClue loses some precious data. This is what's important as far as security goes.
...
So let's assume that your product will sell because of it's features, security isn't that much of an isue (Joe isn't going to know about those big gaping security holes, when the product will be at the middle of it's usefull life, then Joe might notice, but not before.)
If you consider this as your view of software and OS, I don't see what Microsoft has wrong. Of course thay have some version for sysadmin, but before being sysadmin, a lot of them have been user... on Windows system. If they didn't touch any other thing, they might try and use some version of Microsoft's server don't you think?
Anyway, the only thing i'm trying to say is that a lot of people, at some point in time, began thinking that Microsoft's main market is not common Joe Dumass. And then these people started expecting thing from Microsoft.
"Microsoft machines are poluting the Internet"
Well, yes, corporation don't care about polution, it cost way more to make something the clean way rather than pullution like a dumass.
Stop expecting secure systems from Microsoft. As long as Joe IDontCare doesn't know about security, he's still gonna be using Microsoft products. If you want to help make Microsoft systems more secure, start educating people around you about the need for secure system and the polution on the Internet.
You'll basically get the same response from people as if it where about nature and other kind of pollution.
People won't care until it's gonna be a problem.
Anyone if free not to share my opinion, but I beleive it's an environement problem. And Microsoft is only going with what people are freaking asking for.
Microsoft is in it for the money.
Features sell beter than security.
Is it that complicated?
But don't you realize that it's because MS being idiots about this that most of us here have jobs? (Or had, if you've moved beyond the hell of tech support.) Yes, crappy jobs that involve cleaning out crap from computers everyday. But imagine if there WAS a good built in virus/spyware scanner in Windows that automatically fixes systems--imagine if Windows had no holes/problems and fixed itself. Who would need tech support then?
read the bunni comic
So Windows Media Centre is going to allow you to navigat your media files in "a very rich way". And Longhorn and MSN search are going to provide a "very rich search" on the desktop. What exactly does this mean?
Are we going to all get gout from using Windows in the future?
I hope my mom doesn't read this, I told her that all the porn on my machine was downloaded by Windows.
My eyes, my eyes! These goggles do nothing!
I believe gravity does. Don't believe me? Try dropping it off a building.
That depends on how tall your building is, what the apple is made of and how the apple is protected.
If I enclosed the apple in six layers of bubble wrap with the bubbles on the inside, encased the bubble wrap in three inches of loose polystyrene beads, enclosed the polystyrene beads in three inches of low-density foam, enclosed the low-density foam in three inches of high-density foam, enclosed the high-density foam in a double-thickness corrugated cardboard box, enclosed the cardboard box in two layers of egg cartons and enclosed the egg cartons in another cardboard box, the apple isn't going to be damaged if I dropped it off the roof of my house.
The only thing necessary for the triumph of evil is for good men to do nothing. - Edmund Burke
Gates: Understand those are cases where you are downloading third-party software.
Q: Might you add anti-virus/spyware protection in Windows?
Gates: It's not a thing you build in. You have to offer a service. There are third parties who are doing a good job. We're always taking a hard look, but we don't have any concrete plans.
So if I get this right the problem with security is that I download third party software and Mr. Gates thinks that it can be solved by third party service (which means probably downloading third party anti-virus software). Now I clearly understand why the problem is never solved...
Blame it on the user.
Again.
As usual.
As always.
Microsoft and especially Mr. Gates have both blamed the user for DOS and windows bugs, et cetera, ad nauseum, since the beginning.
It's one of the things that really encouraged me to dump windows. Being told personally, to one's face, by Microsoft and Mr. Gates that the problems with DOS and windows is my fault made it very easy to walk away from the huge investment in microsoft stuff.
Since the user is at fault, the user can fix it--like I did: dump microsoft.
What I dont understand is how tactics like this have won him the title of richest man in america, Ive seen drug dealers with better customer relations
Like the saying goes, never underestimate the bandwidth of a station wagon full of tapes. -Pyrotic
Come on, mod me +1 FUNNY for all those who haven't RTA...
I pissed myself when I read this one.
Does it go on forever?
This is a classic example of how humans are.. Microsoft give us alot (in vulnerabilities) that cant be exploited until the user downloads a file. So its not the browser thats at fault its the user...
This is just like the pinto.. the car wasnt going to blow up unless the other driver was crap.
I mean, spyware and viruses weren't made by microsoft, IE just helps you download and install them more easily, and even sometimes automatically!
I think we should all thank Bill for coming clean about this ever increasing problem.
Gates: "We're big believers in interoperability."
It is kind of a catch 22. If Windows had built in anti-virus software no one would buy 3rd party anti-virus software and Microsoft would gain a monopoly in the market. They would get their asses sued and everyone would complain that they have a monopoly or they have created an unfair environment. We've seen it before. If Windows doesn't have built in anti-virus software everyone complains they don't.
And even if Windows did have built in anti-virus software, can you honestly tell me, given their track record, that you would feel secure with it? If everyone used Windows built in anti-virus software wouldn't it be just that much easier to exploit and cause even more damage.
Simply put - the "maintenance" that we refer to with software, and that's being compared to cars above is in fact no such thing. Every patch and update that's issued is to correct a _mistake_ in the software - not something that gradually failed because of wear. Cars need regular maintaining because they're physical objects in a physical environment and the stresses and imperfections of that environment cause real physical damage that needs to be repaired. Software "maintenance" is actually incremental development - it's correct mistakes that are in the original.
All that said, software (at least most of it) is far, far more complex than your typical car, and has had far less time to mature. The physical limits that a car operates in are well defined and well understood, and the vehicles are designed with that in mind. There are well known and well understood physical requirements and those requirements are easily tested. Software lives in a very different environment with a very different level of contstraint and a very different level of user expectation.
They tried everything to stop people from doing safety studies and stopping laws making safety devices mandatory. It did not fit their marketing image to have to put safety features in.
Sounds very similar eh? Gates blames insecurity on bad users. The car industry blamed it on bad drivers (this fits marketing as noone thinks of themselves as a bad driver).
Until enough studies came out showing how dangerous cars were (things like the steering column being a spear aimed at your chest) and the public started to get aware and goverment was starting to take action ONLY then and very slowly did the car industry do something. That still won't do anything until laws enforce the use of seatbelts and even then you will have idiots claiming using seatbelts is unsafe. Same as I have met person (not heard about, actually talked to myself) who didn't use anti-virus software because it was reading their files.
So don't hold your breath waiting for MS to move on its own. SP2 was already a huge achievement. Anything more will only come after a long long struggle.
Or a very short one if you install the flippered OS. Or the horned one if your into necrophilia. Then again, that is like driving a volvo. Not cool. Sure your kids might survive an accident but who cares about that eh?
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Software with modern complexity will always have defects. Accepting that fact, and designing for failure tolerance, is the kind of wisdom that has steadily improved automobile safety despite heavier use under less anticipated conditions by many more people. Software is no different, unless you have the magic to reduce software design and implementation errors to nothing.
--
make install -not war
I will never understand. If a grocery store so as much hires someone *unlikeable* to work the cash registers, they lose customers. likewise with vehicle manufacturers. If a bad car is designed, it is branded a lemon, and is treated as such by all consumer reporting websites/newsletters.
So why Bill Gates is still in buisness after making such a comment: "Understand those are cases where you are downloading third-party software" it makes my eys roll. Why is the customer always right? because only the customer knows what he or she wants. If the customer wants a good solid car, they are going to buy a good solid car from *insert favorite car manufacturer here*. So why people put up with this slander from the biggest man in Microsoft is beyond me.
Personally, i think i run a very tight ship. I dont need antivirus, and a nice firewall is all that stands between me and the next script-kiddie on the block. Problems i've ever had are related to IE and poor OS performance.
Because i will shortly be entering my era of University in 2005, my thoughs turn to my financial future. I will not be able to afford a new computer, much less new games/new MS OS. When the time comes when i can no longer play games on my current setup, windows will have no further place on my computer.
*Deep Breath* - Thank you for your time.
You are confusing me with someone who cares.
Gates: Understand those are cases where you are downloading third-party software.
...
Well, sure, if you call the payload in a buffer overflow attack "third party software"
Understand those are cases where you are downloading third-party software.
True, that. Now the point is that you're downloading this "third-party software", aka virus, trojan horse or spyware, even though you never wanted to.
Assorted stuff I do sometimes: Lemuria.org
Why don't they offer the option of never trust Microsoft?
Last Q/A in the article:
Q: There is talk of a Google browser. Internet Explorer has had its security woes. How do you keep users?
Gates: More has been invested in making IE secure than any browser on the planet by a long shot. Nothing is going to change. That's the one over 90% of people are going to keep using.
[Italics and bolded sentence my own markup]
So let me get this straight, Mr. Gates. You have thousands of people working just on Internet Explorer, and yet...a thousand or two thousand people working on Mozilla have bested you?
Nothing is going to change, indeed, Mr. Gates. You're going to keep spewing the same old story, ignoring obvious holes in your own logic (third-party software is to blame for all security problems, true...but that doesn't mean your software should allow third-party software to install itself without the user doing a thing), denying any obvious falsehoods in your own statements (" We feel like we are pioneering an experience that to us is a clear thing most households will want." - Gates, regarding Windows Media Center PCs...I'm sorry, I didn't know you pioneered multicasting from a set-top box...I presume Linksys is paying you licensing fees for their video broadcast device, to name one alternative?), and hoping people will be stupid enough to follow it.
The saddest part of the above discourse is, Gates is probably right. People are, until told otherwise, going to keep using bug-ridden products, until they are shown that there are alternatives...I know many users who have never clicked Windows Update in their lives, and not because they've never used Windows.
I could be wrong, but I'm sensing a downward spiral, when M$ can announce things such as they did in their article, and not get negative feedback from the interviewer. Just my $0.05.
It's only an insult if it's not true.
Our children are being indoctrinated from a very early age to believe what authority figures (parents, teachers, the tv, etc.) tell them. Should we be surprised when a concept ingrained for 10+ years during the most formative childhood years translates to an easily misled populace?
Do not believe anyone. Do not believe politicians, scientists, priests, your parents, the police, and please don't believe the mass media.
Teach your children to think, not believe.
Q.
Insert Signature Here
Downloading third-party software is exactly what gets people into trouble with Windows... especially when IE holes cause them to do so unknowingly!
I just did.
Gates: What the consumer wants is pretty clear: a single remote control that lets them navigate photos, music, videos, TV in a very rich way. They want to see that on any screen in the house and then have a great portable device where they can take that stuff wherever they want anytime. The full realization of that dream is still years away, but we've taken a dramatic step in delivering that with Media Center.
I think it'd be great if we could beat Microsoft to the punch by offering all of this and more using Linux and open formats (not WMA Bill!). It seems like there is already a lot of work in the area going on (MythTV, Freevo, Mister House, VLC) but is any of this ready to be easily set up by the average Joe? Is there any work being done to put all the pieces together. Perhaps a modded distribution geared specifically to creating and setting up a Media Center type environment. Not only could a Linux based solution put anything from MS to shame it could also force Movies/TV/Music industries to support open formats if the Linux Media Center becomes the dominant player.
Am I dreaming or can the open source community take the lead here?
Utter crap.
If you know your customers are going to behave "unreasonably" ie, you know, actually *use* the computer, browse web pages, click stuff, then the OS should protect them guide them etc. So why is it that Windows installs a huge sign saying "COME FUCK WITH ME I'M OWNED BY SOME TWAT WHO CHOSE TO USE WINDOWS"?
The fact that OSX can and does do so much better proves that it's Windows fault. Or are you trying to say that Windows users are a self selecting bunch of morons? For those that *choose* Windows I'd agree, but most people don't get to choose: they either don't realise there's a choice or they have Windows forced on them.
Bad analogies are like waxing a monkey with a rainbow.
They have flaws in the first place because debugging an operating system is pretty difficult
;)
IIRC, the article is about the problems in IE, which should be just a normal user-space application. I don't know how tightly they integrated their IE into the ring-0 kernel space, though
"What's this thing you wanted me to install, son? Uhm ... anti-virus, it said, I think? Is that safe? I mean, I heard Bill Gates on the TV the other night saying that the reason thing go wrong with peoples' computers... it's all because of third party software. Nice guy, that Gates. Good mind for business.
... I have something I want you to check out when you're down at mine. There's this window that keeps popping up in the middle of my screen, telling me that my Internet is slow. It's been doing it for about a year and I keep closing it, but I got to wondering - d'you think it's right? I mean, when I use my Internet Explorer at work it's a lot faster. The little picture in the top right is different, too. Does that have anything to do with it?
"What was I saying? Oh, yeah. Third party software. I dunno. My computer's running pretty slow at the moment, ever since you came over a few months ago and installed all that stuff for me. What was it, Thunderfox or something?
"I remember you tried to show me how to use it, but I prefer that Outlook program. Doesn't try and stop me doing what I want to do, make all the images in my emails broken and stuff like that.
"D'you think that that's why my computer's slow? After all, that Gates guy was saying that third party software's what makes 'em go bad. Are you sure that stuff you installed was safe? I mean, I've heard there are a lot of viruses going around on the World Wide Web...
"Maybe you better just keep this anti-virus software, and take that Thunderfox thing off my machine, and see if it speeds up any. I'll just stick to Microsoft stuff, that should be safe enough.
"Besides, I don't think I need anti-virus stuff, really. My doctor always tells me to get a flu jag, and I ignore him. Hate needles. But I've not been ill for twenty years and I'm not intending to be ill any time soon. I don't go out in the rain without a scarf on, I cover my mouth when I'm sitting on a train next to a guy who's coughing and sneezing away. Sensible, see?
"It's like that with the computer. I don't use the Internet Explorer much - mostly I just use the computer for email and typing up letters and stuff. And I've never been on this World Wide Web thing - I remember a guy at work saying that you could get a lot of viruses off this Web, so I stayed away from it. So I'm pretty safe, right?
"Anyway, I'll see you next week. Oh, and hey, while you're at it
"Yeah, anyway, see you next week. Sure, I'll say hi to your Mom for you. Alright, bye."
Well, if the cable modem (router/gateway I assume) has a firewall, it will obviously block all invalid packets, and sometimes DoS attacks.
Otherwise, all (I think) cable modems / routers will give away their IP, BUT they should all protect the users behind them, through natting or dhcp.
But even then, the machine behind can be targeted using various techniques (one is to exploit the router itself).
If you're not talking about a router, then yes, the IP of the Windows machine (like linux) is exposed which means anyone can run checks and such on services which are vulnerable.
But then it really depends on how up-to-date your windows machine is. It's still highly unlikely that it'll be exploited, unless someone (clueless person) clicks on a link to activate a virus or such through an email, or activates a service for back-door entry.
BTW, note that the jpeg flaw was fixed very quickly, and most machines weren't vulnerable anyway (such as mine).
Windows XP is actually very stable, supporting multiple networked users (multi-user and multi-tasking), but lacks in that all accounts by default have admin privilege(!). And that is mostly the reason behind all the viruses, spyware and auto-spam-servers.
Besides all that, since most Windows vulnerabilities aren't based on a kernel attack (unlike linux), but instead the services you have activated, you can simply disable the ones you don't need, and just be sensible about which applications you open through emails (hopefully none!).
But even after all that, a user can come along and browse the web using IE and activate some activex component, or installs some other IE component or JScript which allows entry to the machine.
If the user isn't using IE and isn't running a server (such as httpd), then it's quite unlikely that anything bad will happen. Unless someone specifically targets the machine and scans for all activated services, etc, and launches an attack against an un-patched vulnerability.
I would be brave enough to state that a Win2k / WinXP / Win2003 is just as secure as UNIX / FreeBSD / OSX, if: -
* The user using the machine doesn't have admin rights,
* Windows and related networking software is kept up-to-date,
* Doesn't use IE / related mail product.
Bill does believe in interop, insomuch as IE provides an api to all sorts of things in Windows, like the phone number used for internet access. The api's a bit rough'n'ready, but who expects clean code from MS?!
J.
You're only jealous cos the little penguins are talking to me.
"Gates: We're big believers in interoperability."
Hahahahaha!
echo mailto: !#^."<*>"|tr "<*> mailto:" net@madduck
You may block the packets used for the DoS from getting to your PC, but your cable line will still be saturated.
Otherwise, all (I think) cable modems / routers will give away their IP, BUT they should all protect the users behind them, through natting or dhcp.
Integrated firewalls in routers/modems are becoming more sophisticated than merely being nat drones. Firewall designers are aware that any response given from the firewall is unwise, therefore they are now stealthed firewalls. And the notion that DHCP can protect you .. well, no comment, lol.
Technical capability of the users.
Good industrial design makes sure, that the average user does per default the save things and doing unsafe things needs extra effort. For this reason, nearly all motorised saws and knives have clever hand- and finger guards to reduce the chance of accidents.
Microsoft and most other software companies take with the opposite approach, they just put the onus of safe operation on the user. Considering that most user don't have don't want the necessary knowledge to do that, this idea will fail.
The solution is not to educate users, but to build systems that can be operated in a safe manner by following simple and logical security rules that even my grandmother can understand.
Rules like: As long as you don't click on it, it can do no harm.
Yeah, you can get away with running some applications using the "RunAs" command, but that is nowhere near as powerful or as capable as the much older *nix version of that.
Seriously though, out of the millions of people that use computers running Windows, very few of those people are even aware different levels of access to the PC and a smaller number of those folk understand that there is a utility in MS Windows called "RunAs".
If you ignore the other uses of a tool, does that make the tool less useful, or you less useful?
At least twice a year Microsoft comes out with another security patch to try and block the latest holes in IE, without changing the underlying design flaws that make the explouts possible. Shortly afterwards, another hole surfaces. Everyone with a passing understanding of the 20th Century knows the expression "generals are always prepared to fight the last war": assuming the lessons learned in the last war are all that is needed to prepare them for the next. The classic example is france preparing for trench warfare all over again, caught unprepared for the German Blitzkreig.
Microsoft doesn't do that well. They're forever preparing for the first war all over again, never learning the lesson they're faced with after every new exploit.
The problem is that Microsoft is trying to use discretionary access control to implement a design that requires mandatory access control. In an environment with mandatory access control, every object (document, program, web page, email message) in the OS has its security level bound to it in such a way that an application displaying that object can have no more rights than the least secure object it has accessed. The only way to raise the security level of an object is through a trusted component that has explicitly been granted the rights to do so.
Their "security zones" can't be depended on unless the whole operating system and all applications operate on this basis. If they're not going to create a compartmentalised Windows AND make it the default configuration (and wouldn't people scream at that!), the only place they can create these compartments, these internal layers of sandboxes, is by having the applications themselves handle their own sandboxing. Remove the responsibility for trust management and remote access from the HTML control and let it merely render HTML. If the document displayed wants to access an image or stylesheet or script, run a script or a plugin or embedded component, let it ask the application for it, and let the application decide if the request should go through. Internet Explorer would let it fetch remote documents, but not run scripts or applets that weren't sandboxed, nor pass URLs or files to applications that aren't prepared to enforce the same level of mistrust. Windows Explorer wouldn't display remote documents at all. Outlook would be even more restrictive. And IE wouldn't blithely pass files to arbitrary desktop applications to open.
You can't do this by having the HTML control guess, no matter how good a guess it can make, because it's not in a position where it can actually know what rights the document should have. Only the application does.
Split the HTML control down the middle like this, and restrict IE to only running fully sandboxed applets and scripts, and there would be very little change in the user's experience. About the only thing they'd notice is that Windows Update would have to become a separate program instead of an ActiveX plugin (and likely run faster), and a few applications would need updates because they were doing dangerous things. There would be an enormous improvement in security, though, and Microsoft could quit wasting time on fixing the unfixable and get around to working on the NEXT war instead.
Q: Speaking of security, Internet Explorer has had well-publicized holes ...
Gates: Understand those are cases where you are downloading third-party software.
This is just a lie. I wonder if he really belives this bullshit.
Q: Might you add anti-virus/spyware protection in Windows?
Gates: It's not a thing you build in. You have to offer a service. There are third parties who are doing a good job. We're always taking a hard look, but we don't have any concrete plans.
And here you can see that the whole attitude towards the security is weird at M$. I mean I don't want Anti-Virus or Anti-Spyware Software from Microsoft. I want the structural problems of Windows solved.
If you start MacOS X the root user is disabled per default. That is why Spyware doesn't have a chance. Even the most stupid user will think twice if he has to enter his system-password if he installs Software. Same with Linux. The whole Spyware-thing would be much much less trouble if the default install of Windows would create a user account.
And Windows has these capabilities. But at the moment this feature ist pretty much unusable because most of the software vendors don't give a shit about multi-user install. And why do they do this? Because M$ creates a default Admin-Account anyway. If M$ would change that, the software-vendors would adapt very quickly, like they did with SP2.
Same with Firewall: First install zillions of services which most of the users don't need at all. And instead of swichting these services off per default, you create a Firewall to fix it.
It's the whole "If we have to decide between usability and security, we will always go for usability" approach that bothers me...
After all, our customers had a choice.
Just to get the question of bias out of the way, I'm typing
on an Apple laptop.
Twice this week I've had to help customers either remove or
completely rebuild/restore Windows because of spy/malware.
In the first case the machine was 'enhanced' with a 'search-bar'
that replaced key parts (read dll's) of IE, removal of this
'enhancement' would render the machine unuasable, while
this software was installed previous to installed SP2 and the most recent batch of Microsoft issued security patches it none the less went undetected by the OS and was only found when NAV was ran.
Now I understand that Microsoft has argued that what you add to IE is your own fault and to some point I agree, but only in
the case where you realize your installing software; If you install fast freddy's pronfinder tool bar you most likely want others to watch you. But Microsoft should concede that the browser, which they've stated is truly part of the OS should be treated wtih more care then if it were just an application (as it should be).
Given that security usually comes at the cost of some
ease of use; Microsoft has choosen to make its OS easy and
at the same time they choose to ignore the customers demands
for more secure default for firstrun. It would not be hard to lock the machine down until its had a chance to check for patches/updates/service packs (call them what you will).
Recently I've read about motherboard manufacturers building appliance style firewalls into their onboard ethernet, sounds like a cool option but they're doing it because their primary audience *NEEDS* it, and truly this might be best for all of us, so long as the filters can be configured to curb outbound traffic as well.
Unix, an obscure operating system developed by bored researchers in an attempt to get a better game playing experience.
That just rules! We believe in interoperability, as long as you bow befor us! Kneel before Zod, errr... Bill! It is almost laughable, if it weren't so sad, to hear Bill Gates saying bad things like the above quote. Isnt what he accuses Apple of EXACTLY what Microsoft has been pusing the world to for years? What is the difference between being the sole supplier of iPods and iTunes (which Apple is) and being virtually the sole provider for desktop OSs, and using such position to force the adoption of "standards" that favor MS products.
Funny, thats the exact thing that was said about web browsers before IE became so ingrained into the Windows code base that its pretty much inseperable... Its amazing... it really is. Its like, his lips are moving, but the words coming out dont match the movements. Just like a poorly dubbed kung-fu movie. Ummm... if that is the case, if I were Bill, et al, I would be demanding a refund on the IE "security" expenses..."Our funds have never taken part in toxic or death spiral convertible financings of any sort" -BayStar's managing partne
Why isn't there a checkbox for "never trust Microsoft"?
Yes, Internet Explorer is a 100% safe and secure product. Its only when you use it browse web sites that it becomes vulnerable and dangerous.
"YOUR SYSTEM has become busy or unstable."
"THIS APPLICATION has stopped responding."
"Because Windows WAS NOT SHUT DOWN correctly..."
etc etc etc - never once have i seen it admit "Sorry, but Windows just crashed."
So no surprise to see that once again, the blame is on the user and/or the applications installed.
Why a fresh install of XP puts at least 11 instances of Alexa (known spyware) and 5 DSO exploits on a box? Try it, install XP and then Ad-Aware and Spybot. Run them both and see the results. No computer that comes into or is built at the white box store I work at, leaves without those two programs installed. Yesterdays updates put 3 instances of Alexa back in.
Professional Politicians are not the solution, they ARE the problem.
Yes, Angula. I've seen Demudi run off CD Live with zero configuration. It worked well on a 1GHz class computer. Show me a CD from M$ that does half as much.
Knoppix does some of the same.
Mepis also does much of the same but comes with non free goodies like Flash, Real Audio and a version of Xine that plays WMF.
I also think that players like Xine, Noatum etc. have been able to play non free formats for a long time. While it sucks that companies continue to make devices that use such nasty formats, it sucks even worse to not be able to use all those toys. Free software is more than up to the challenge. Sooner or later, those companies are going to turn to free formats as it's cheaper and better.
Friends don't help friends install M$ junk.
If the user isn't using IE and isn't running a server (such as httpd), then it's quite unlikely that anything bad will happen. Unless someone specifically targets the machine and scans for all activated services, etc, and launches an attack against an un-patched vulnerability.
I would be brave enough to state that a Win2k / WinXP / Win2003 is just as secure as UNIX / FreeBSD / OSX, if: -
No, Windows is not just as secure. The point is that there are lots of script kiddies constantly scanning the range of ports used for cable and dsl networked computers. Once they get a response, they scan all the ports on that IP looking for open/vulnerable services. They target Windows because the vast majority of computers on the Internet are running Windows. Look at all the posts in this thread. You can find numerous accounts where Windows computers were infected within minutes of being connected to the Internet.
It's possible that Linux/Unix would be far less secure if it received as much attention from the hacker community, but there are some good arguments that it wouldn't be. Linux/Unix has been a part of the Internet since it was first conceived and the programmers that have worked on Linux and UNIX have generally been more aware of networking and security issues.
Linux has a much more modular design than Windows. Windows has been tightly integrated on the basis of Marketing and Legal rather than Engineering decisions. I doubt that Windows will ever be secure without substantial redesign of the entire OS. Unless Microsoft is successful at throwing up legal roadblocks, Linux is going to continue to outstrip Windows in security, reliability, and eventually usability.
-All that is gold does not glitter - Tolkien
www.ra
Did nobody else notice the complete lack of information in that interview? It seemed to me that Gates had two major responses:
1) We're looking into that and we're going to do it better than everyone else.
2) We suck at that so we're pretending to look into it, but don't expect any actual products.
There was no real information there. Reading that interview was a complete waste of my time and bandwidth. What a complete piece of shite. Whatever happened to hard-hitting journalists that won't let CEOs and others like them just dodge every question?
Then again, what can should I have expected? Fantastic answers to interesting questions? Gates can't really say anything because there's nothing to talk about.
Interviewer: Blah, blah, blah?
Gates: Blah, blah, longhorn. Ooh look, shiny thing.
Hmpf!
*grumble, grumble, grumble*
--James
Everyone says this and that about IE. A good portion of it is true and some not true. User error can't be counted out. If you download a virus without virus checking it, then yes you just got screwed. However my friends... there is a solution. Mozilla. See I used to be a fanatical IE5.0+ user. I defended it to the ends of the earth. Then ofcourse my buddy showed me what mozilla could do. I am so damn addicted to tabbed browsing. I would say the main reason I switched a good while back was that Mozilla had a built in pop-up blocker and IE didn't. Another interesting switch story was that of my fiance. She used IE 6 for a great deal of time. I tried to get her to switch but she never wanted too... that is until, the trojans started happening. Her virus checker was finding about 6-7 trojans a day and she could never figure out why. So I switch her to Mozilla to see what happens. After 3 months she has not had one trojan. Not one. I think that says alot in itself. As minorly thrilled about Mozilla as she is, I can say she is happier that her computer is now virus free.
Not to make excuses for it; basically, your average worm or spyware program will be able to propagate and do bad things as a Limited User, but it won't be able to persist on the system. Reboot and it will be gone.
Newer spyware and viruses work just fine as limited users. Remember that their job isn't usually to take over or destroy the system, it's to monitor users and/or send mail. They don't need to be root to do that. Even as limited users they can install in an XP user's Application Data directory and start themselves at boot time by something as simple as a Startup folder entry.
Developers, developers, developers.
You know, the guys who come up with third party software. Last week, your allies. This week, your scapegoats.
Weaselmancer
rediculous.
And how do you propose several hundred million people get their news, and know its 'fact'?
Reember they have lives, and that they dont live anywhere near the records, which are often kept from the average citizen anyway. ( perhaps not techincally restricted, but the artifical barriers that have been erected serve the same net result )
And btw, the same goes for your totally OT statement about Senator Kerry, appears you dont know diddly either.. Start reading his public voting records and then compare them to what he says.
It should be easy, he tended not to show for work too often.
Or just listen to televised debates, and actually listen to what he says from sentence to sentence.
Where did you get your 'facts', from another biased news service i bet?
( and no, i dont claim his main opponent is any better.. before you go blame me of being biased )
---- Booth was a patriot ----
Q: Might you add anti-virus/spyware protection in Windows?
Gates: It's not a thing you build in. You have to offer a service.
Imagine if automakers charged to offer seatbelts and brakes as a service.
An answer befitting a reboot/reformat monkey.
From all those people that have struggled with your crappy software over the years I say a hardy "fuck you and fix your shitty products".
"I hate to advocate drugs, alcohol, violence or insanity but they've always worked for me" - HST
Whoever told you that didn't know what they were talking about. Most users create admin accounts for themselves (or use the one admin account created) because they can't be bothered to go root to install something.
funny munging
Every copy of windows since 98 MUST USE IE!!!!
You may not use it openly for for browsing the internet, but it is so embedded into the OS that it cannot be removed (just double click on your "my computer" icon and it is IE that browses the hard drive). Don't you remember the browser wars? this was Micro$ofts way of making sure their browser is installed into the OS no matter what.
MacOSX, because making *NIX better is a lot better than waiting for Micro$loth to fix Windows
So Bill your saying it was your OWN fault?
It's also a problem that has affected Gates personally. He said his home PCs have had malware, although he has personally never been affected by a virus.
"I have had malware, (adware), that crap" on some home machines, he said.
remember?
...unfortunately no one can be told what The Mat^H^H^HGoatse is...they must experience it for themselves...
Isn't windows supposed to work with 3rd party party apps? If so, then msft can't excuse msie security flaws because users dared to use a 3rd party app.
They are for interoperability when it will make them money, and against it when it won't. Duh. No contradiction here,hence no funny.
Well.. maybe. Or Maybe not. But Definitely not sort of.
Many Windows programs won't function unless you're an admin. Knowing that most users have admin level permissions, they write their programs making that assumption. I've tried locking down Windows users by giving them lower permissions and half of the programs don't work because of read/write access errors. I can make it work by finding all of the folders that the program calls and resetting permissions, but this kind of defeats the purpose doesn't it?
Why doesn't anything interesting happen when I have mod points?
So in a sense it's harmless; it's just a built-in web search. But it's generally considered to be spyware because of Alexa's reputation.
It probably got installed when you did the Internet Explorer update. I think you get it out-of-the-box when you install XP.
More information here: http://www.imilly.com/alexa.htm
Q: What's the difference between a cow and a bull?
A: The bull smiles when you milk him...
"More has been invested in making IE secure than any browser on the planet by a long shot. Nothing is going to change"
I am not surprised at all from the above statement. After all, IE has the biggest security problems, so it is natural that IE had the biggest expenses in making it secure.
A better example would be of a home builder saying, there's nothing wrong with your roof, it's the rain causing the leak!
- dj
My Linux box is "targetted" as frequently as any Windows box.
Of course, since most of those attempts are from compromised Windows boxes, looking for other unsecured Windows boxes, the attacks don't get very far.
It just that the overwhelming majority of compromised machines are Windows machines that are now looking for other Windows machines.
I make good bank flushing spyware/malware from constipated PCs. My kids eat and I get to buy myself toys. I hardly ever see a Mac come in unless it has a hardware failure.
Make windows secure and I'm going to need a real job.
(Written on an iMac)
"It isn't pollution that's harming the environment. It's the impurities in our air and water that are doing it." -- Dan Quayle
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
Is it MS fault that a 3rd party app needs admin to run? Install yes but run? I would say so if all applications needed that permission. Lay the blame where it is deserved. The application developer not Microsoft (for once).
I thought some USB drives had a "lock" switch that prevented writing. That seems infallible.
The basic idea is a really good one. It adds anothe rlayer of defense, as how many spyware and virii REALLY are going to try and write to mozilla.exe?
People should make more of a distinction between what is possible and the reality of what is around now. A number of people act like because you COULD write spyware for OS X or Linux, that there's no point in switching - when the reality is Windows is the only system you have to deal with that crap right now and it will probably be years before anything hits the other systems.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Just the names that MS gives to applications give them a very very big advantage over Linux Open Source applications.
"Welcome to President Bush, Mrs. Bush, and my fellow astronauts."
"The future will be better tomorrow."
"We have a firm commitment to NATO. We are part of NATO. We have a firm commitment to Europe. We are part of Europe."
check out the best blog ever:
http://oehlberg.com