Richard Clarke on Microsoft security

hizzo writes "Richard Clarke, former White House cybersecurity and counterterrorism adviser, harshly critized Microsoft's security track record. 'Given their record in the security area, I don't know why anybody would buy from them.' He also called for some regulation of security for ISPs in addition to better industry self-regulation, such as disclosing QA practices and becoming more accountable for secure code. I wonder if anyone will finally start listening to him?"

Comments

not likely

[pHatidic]

With all the bribes Microsoft gives to politicians, it's no wonder why he is the former White House cybersecurity and counterterrorism adviser

Re:not likely

[ackthpt]

With all the bribes Microsoft gives to politicians, it's no wonder why he is the former White House cybersecurity and counterterrorism adviser

Microsoft's bribes had nothing to do with that. He was competent, professional and honest. He didn't realize the crap Wolfowitz was pushing into the president's head until it was too late. Sadly, Rice sat there and lied to the Senate and still has been confirmed as the SoS.

As for Microsoft's bribing, they had a commendable record of trying to stay the heck out of politics for years, until it became evident that without greasing certain palms that Washington DC would turn on them. Now they make sure enough lucre is spread around Washington and they have many wagging tongues at their disposal and many ears to listen.

Re:not likely

[Leo McGarry]

The part where Microsoft greases palms is totally, 100% true.

No, it's not. Microsoft, like every other business in America, lobbies the government. Just like I lobby the government every time I write my Congressman a letter. It's called "representative democracy."

Lobbying the government is, unfortunately, a very inefficient process. There are lots of middle-men whose job it is to collect public opinion and communicate it to the representatives in Washington. These middle-men eat up a lot of money along the way. This is wasteful and disappointing, but it's completely wrong to describe it as "greasing palms."

And more than a dozen (Democratic) senators agree with the grandparent's analysis of what Rice did.

Are you seriously appealing to the authority of the United States Senate? Dude, if you polled the Senate, you'd find three Senators who think that desegregation was a bad thing, five who think nationalized health care is a grand idea, and a dozen more who think Elvis is still alive.

You don't have to be a brain surgeon to familiarize yourself with the events of the day and to be able to distinguish between truth and lies. That's why everybody's held to that standard, see? Because it's just not very hard to do. So when somebody (like, in this case, you yourself) fails that test, the ridicule is so long and so loud.

Re:not likely

[EnronHaliburton2004]

This is wasteful and disappointing, but it's completely wrong to describe it as "greasing palms."

Congratulations Citizen, you passed the test. Thank you for defending the good corporations of America , here's a coupon for a free Big Mac!

Now go back to your television wall and sit there like a good boy.

Re:not likely

[Viking Coder]

Ha ha ha. Funny.

It's our jobs as citizens to question our leaders. That's just about the only thing you and I are expected to do, in a representative democracy.

I think she was lying when she said that the contents of "the memo" didn't say that Bin Laden was determined to attack America, because I know for sure that that was the name of the freaking memo.

Or is this some wacky truth test that I'm a moron to use?

Microsoft, like every other business in America, lobbies the government. Just like I lobby the government.

Secretary: "Senator, Microsoft is on line one, and some internet guy who calls himself 'Leo McGarry' is on line two."

Funny. You most assuredly do not lobby the government "just like" Microsoft does.

They throw around more money than any other corporation, you spent less than a buck on a postcard. Sorry for burtsting your bubble, but in this representative democracy, Microsoft's voice carries more weight than yours.

There are lots of middle-men whose job it is to collect public opinion and communicate it to the representatives in Washington.

Again, "ha." These guys find someone who says that a survey says what they want it to, and feed that to representatives. It's not scientific at all. And if Microsoft, oh, I don't know, pays for those surveys, are you seriously so naive as to be surprised if the outcome of the surveys they tell people about say something that's always in favor of Microsoft? (Feel free to replace "Microsoft" with any corporation's name here, by the way.)

They're dishonest. Duh. Put on your ridicule-retardant pants, because you're in for a beating.

Re:not likely

[SiChemist]

What a bunch of crap. Lobbyists don't educate, they advocate. They are paid to convince your representative to act in a manner which is unlikely to be in the best interest of the majority of their constituents.

As for "shouldn't business be given the opportunity to express itself", I say no. A corporation (despite that abomination of a court ruling) is not a person. It's interests are often in conflict with those that are supposedly being represented by the congressperson. Yet its voice is magnified by the millions of dollars of influence it wields. It is a legal form of bribery.

Re:not likely

[F34nor]

Its is all about the combination of benefits. Corporations had limited liability and limited rights later the Supreme Court read the 14th amendment as giving human rights to property, thus giving human rights to limited liability legal structures. So now they have the benefit of limited liability and the right to speech moreover money is now considered a form of speech. Therefore corporation may make money illegally, then use that money to affect government. This is just as fucked up as letting churches make money tax free and then letting them use that money to affect government. Its fucking wrong and un-American and need to be stopped. If you want to express your opinion as a business then take the money out of it, pay taxes and be subject to personal limits.
COPRPORATIONS SHOULD NOT HAVE MORE RIGHT THAN A HUMAN BEING.

Re:not likely

[drsmithy]

Then MS and BG threw in big with GWB.

I think you'll find Microsoft "threw in big" with pretty much everyone, as a direct result of the antitrust suit.

Re:not likely

[idlake]

No, it's not. Microsoft, like every other business in America, lobbies the government. Just like I lobby the government every time I write my Congressman a letter. It's called "representative democracy."

When you lobby Congress, it's a representative democracy.

When a business, which is not a human being or citizen but a legal construct, lobbies Congress, it is something altogether different.

Re:not likely

[demachina]

"Just like I lobby the government every time I write my Congressman a letter. It's called "representative democracy."

Yea but chances are your letter is read by a coop and filed in obscurity unless you are the Congressman's campaign contribution list or he otherwise knows who you are.

Large corporations, or their K street lobbyist, on the other will routinely meet your congressmen face to face, offer campaign contributions to the full extent of the law, and other assorted favors to insure their clients get what they want from legislation and contracts.

You should have watched the House and Senate during the Medicare "Reform" Act. The lobby of the Capitol building was swarming with lobbyists for the drug, insurance and healthcare corporations, all circling like the sharks they are, smelling blood(money) in the water. The bill was such a horrible piece of legislation it couldn't pass on its own so House and Senate leadership had to arm twist all night to get the votes they needed and they held the vote open for hours which is against the rules until they got just enough votes to pass it.

During this same time the lobbyists were also hard at work outright buying votes because they desperately wanted that bill to pass. Its a bonanza for the drug and healthcare corporations, and in fact does frighteningly little for seniors for the price tag.

As I recall one congressman was retiring from politics and dead set against it. The lobbyists couldn't buy him because he was fed up and quitting, so they tried buying his vote by promising to get his son elected. As I recall it was in fact probably illegal vote buying though not sure what came of it.

Another example of how corporations lobby and you don't is Billy Tauzin. He is the relatively corrupt politician who lead the charge to ram the Medicare reform bill through Congress. He did this at a time when he had a million dollar plus job offer waiting for him from an industry group representing, you guessed it the drug companies. The unspoken deal, pass Medicare "reform" and we make you rich when you retire.

Another fascinating aspect of the the Medicare Reform, it really is a case study in how deeply corrupted our government has become, is that the Medicare administrator, Thomas Scully, was also job shopping with corporations he dealt with during the run up to passing the "reform bill". It was a blatant conflict of interest but the White House approved his job shopping anyway. This same administrator intentionally and blatantly suppressed the true cost estimates for the bill. If the true cost had come out before the vote it never would have passed. Scully needed the estimate to be not over $400 billion over ten years to get is passed so, he lied and told everyone thats what it was. He was no doubt assured a high paying job in in the private sector in return for being corrupt. One of the people who worked for him had some ethics and started demanding the true numbers, which were $551 billion, be released and Scully threatened him with ruination. The true figure was suppressed until the bill passed and then about a month later the Bush administration admited it was really at least $551 billion which would have never passed. A few weeks ago new estimates came out and its ballooned to $700 billion dollars and it really hasn't even started yet.

One key reason the cost is ballooning is the drug industry lobbyists managed to add a clause in the legislation that forbids Medicare from negotiating the prices for the drugs its buying for seniors. The drug companies can charge as much as they feel like and raise the prices at their whim. They invested a few million on lobbyists and they will reap hundreds of billions of dollars in profits at the expense of tax payers. The only cap on how much this bill will cost taxpayers is how blatant the drug companies want to be in jacking up the prices of the drugs they sell to Medicare.

You really have no clue if you think your silly little letter is even remotely the

Re:not likely

[GSloop]

Sometimes even trolls speak the truth.

Cheers,
Greg

Re:not likely

[JohnsonWax]

It's called "representative democracy."

Ah, so MS gets to vote now, eh? Sorry, but a representative democracy is one where the officials serve the interests of those that elect them. MS or any other company isn't part of that equation.

Lobbying is a means to influence the perception of representation. Don't listen to the voters, listen to me - I employ the voters, I service the voters, etc. and can serve as a proxy for them. It's the suggestion that representatives should act in MSs interests because MSs interests are to some degree the interests of those that MS employs, or are the interests of the community at large because the money that MS brings to the economy provides benefits to the community that the govt. does not need to provide.

Unfortunately, the trend in representative governance is to place significant emphasis on the economic role of government, which companies do play a part in, over all the other roles of government, such as national security, civil rights, individual liberty, and so on. Of course, that's really what corporate lobbyists do - make sure the economic message is the strongest one in any any public debate.

Re:not likely

[Viking Coder]

BEN-VENISTE: Isn't it a fact, Dr. Rice, that the August 6 PDB warned against possible attacks in this country? And I ask you whether you recall the title of that PDB?

RICE: I believe the title was, "Bin Laden Determined to Attack Inside the United States."

Now, the...

BEN-VENISTE: Thank you.

RICE: No, Mr. Ben-Veniste...

BEN-VENISTE: I will get into the...

RICE: I would like to finish my point here.

BEN-VENISTE: I didn't know there was a point.

RICE: Given that -- you asked me whether or not it warned of attacks.

BEN-VENISTE: I asked you what the title was.

RICE: You said, did it not warn of attacks. It did not warn of attacks inside the United States. It was historical information based on old reporting. There was no new threat information. And it did not, in fact, warn of any coming attacks inside the United States.

Where is the word "airplane" or "weapon" anywhere in that conversation? You're so full of bullshit, and you have no desire to find out if you're wrong.

It also did not point to "possible hijackings." According to Dr. Rice, it was entirely historical. Unfortunately for her, the word "determined" means "on an unwavering course of action". That means, "will continue to be." That means, "in the future," or "not just historical." That means, she was wrong or lying.

Who's the moron now, you moron?

They represent a hell of a lot more jobs than I do.

No - the people who work there represent a lot more jobs. Microsoft doesn't represent anything except shareholders.

It's not supposed to be. You're not one of those people who mistakenly thinks everything is about the scientific method, are you?

Facts are clean, and politicians are greasy. The scientific method is the best way I know to determine facts (even facts about opinions). Tell me a better way, and I'll use it.

Until then, Microsoft greases palms, and you're an idiot for thinking they're just exercising their first amendment rights - it's a corporation, not a person. And they're buying votes. The votes that belong only and precisely to you, as a citizen of the democracy that they were elected to represent. If you don't care that you're being screwed, it's because you have no idea what being a citizen means.

When the army that's supposed to defend you starts torturing people, will you sit idly by?

Oh wait, that already happened - and yes, you are sitting idly by.

Does "America" mean anything to you, other than corporate profit and protection from terrorists?

Re:not likely

[bitswapper]

MINNEAPOLIS & ST. L. R. CO. v. BECKWITH, January 7,1889

"we admit the soundness of his position, that corporations are persons within the meaning of the clause in question."
This gave corporations privileges like freedom of speech and due process.

From Timeline of Personhood Rights and Powers "Of the 14th Amendment cases brought before the Supreme Court between 1890 and 1910, 19 dealt with African Americans, 288 dealt with corporations." America - home of the free.

Yes, its totally off topic.

Re:not likely

[demachina]

It is illegal to give outright bribes to politicians and civil servants but the laws are easy to skirtl

In particular, there isn't anything really illegal about taking lucrative payoffs to politcians after they retire from government service which is the payoff of choice at the moment, its called the revolving door from government to the private sector and in some cases like Dick Cheney back in to government and then in 2008 back to the private sector.

I vaguely recall in the late 80's, it might have been illegal for civil servants, not sure about politicians, to take jobs in the private sector with companies they dealt with when in government service. I'm pretty sure it was overturned shortly after it was passed because it ended the gravy train of working in government for a relatively low wage, throwing business to the private sector and then taking a lucrative job in that same private sector. Not sure but I think Dick Cheney in fact led the charge to reopen the revolving door, at least in defense contracting, and he of course took advantage of that very revolving door to go from Defense secretary to Halliburton CEO which made him a multimillionaire. Halliburton's KBR wins billion and billions of dollars of sole source contracts for the army and has since Vietnam. Dick Cheney also lead the push to contract out vast amounts of work from the military to contractors, like food service, fuel supply and transport, etc. Its a just a coinkydink all the work he outsourced to contractors went to KBR, the company he took over as soon as he left office. It stinks, he stinks. Halliburton was caught engaged in blatant profiteering in Iraq in both fuel contracts and catering to the military.

Darlene Druyun is another case study in the revolving door. As the Air Force's lead procurement office she steered a 20+ billion contract to Boeing for 767 tankers and then took a lucrative position as a Boeing exec right after. It was so blatant people in Congress like John McCain screamed bloody murder and Boeing was pressured to fire her and the CEO who presided over the massive corruption but this punishment was the exception not the rule. Lockheed and Boeing's executive ranks are loaded with retired Generals, civil servants and politicians.

Hmm...

[p373]

Gates might have a little trouble calling this guy a communist.

Re:Hmm...

[commodoresloat]

Yeah, right, because the Clinton Administration was communist. Remember how he nationalized the computer industry and sent millions of computer programmers to labor on the collective farm system? And how he used to speak eloquently about the noble plight of the lumpenproletariat? And don't get me started on Al Gore's poetic musings about the withering away of the state....

</sarcasm>

Re:Hmm...

[Doc Ruby]

Yes, Clinton, who presided over the biggest capital gains in history. Not Bush, who's got a $2.5T budget sending hundreds of billions to state-guaranteed corporate gigs like Halliburton and pharmacos. Yep, Clinton, the communist. Where do you get this stuff? Oh, right - the "news".

Re:Hmm...

[drsmithy]

Well it wouldn't surprise me if he did, Clarke is supposed to be quite pally with Clinton remember.

It's comments like this that remind us non-Americans just how far politics in the US is skewed to the right...

Re:Hmm...

[Doc Ruby]

Those "failed socialist regimes" are kicking our ass - haven't you noticed that the Euro is up over 30% since its introduction? No one knows what "HillaryCare" would have done - the Republican Congress's version (boosted by Bush's $750B pharma-welfare last year) is responsible for most of the remaining debt. In spite of Clinton's paydown of the Reagan/Bush debt. Which Bush Jr immediately squandered, creating trillions of new debt every year. We're staring down a $3T budget right now, financed by unprecedented (and unsupportable) debt, all after 4 years of Bush, his Republican Congress, and little denied. Where rightwingers come off lecturing about debt, failed regimes, and even socialism (like our version, state capitalism, corporate welfare) is beyond me. They get called "heartless" because "mindless" gets repetitive after a while.

Re:Hmm...

[dajak]

And how he used to speak eloquently about the noble plight of the lumpenproletariat?

Lumpenproletariat? That would centainly disqualify him as a communist. Marx introduced the concept 'lumpenproletariat' to refer to people of low class outside the productive wage-labor system. These people were considered a force hostile to the revolution of the proletariat. I don't think Marx considered these people 'noble'.

I'm shocked

[novakane007]

A politician I actually like? It's just not like them to tell the truth.
It's amazing what will be said when people aren't afraid of being black-balled in the IT industry.

Why?

[Telastyn]

If people don't listen to their computers getting nuked or their info stolen or any other direct impact upon themselves, they're not going to listen to a pundit.

Disclosing QA practices -

[Black Parrot]

"none"

Re:Disclosing QA practices -

[ackthpt]

"none"

I think QA is on the same door that bears the sign:

SHIPPING

Re:Disclosing QA practices -

[EnronHaliburton2004]

I think QA is on the same door...

You know you've reached Microsoft QA when the person on the phone says "Hello, Thanks for calling Micrisoft Technical Support, what would you like to report today?"

Re:Disclosing QA practices -

[lateralus_1024]

Not true... Quality Avoidance is job 1 !

Why buy from MS...

[Joey Patterson]

Given their record in the security area, I don't know why anybody would buy from them.

Maybe because people aren't aware of the alternatives that are out there (Mac and Linux) or simply resist change.

Re:Why buy from MS...

[jon3k]

Did you read the article?

It was Redhat vs. Windows, as a web server, default installation. It was considered more secure because it took longer for redhat to issue specific patches than microsoft. If they would have simply compiled apache from source, like most competent administrators do, the patch would have been available in hours/days instead of weeks.

Please troll elsewhere.

Re:Why buy from MS...

[Eternally optimistic]

Many people prefer their mother's home cooking, even if it is unhealthy and tastes terrible. Trying something new is scary, not everyone wants to do that.

Seriously

[Anonymous Coward]

Richard Clarke is some kind of expert on computer security? Where are his credentials on the subject?

Just because a person is an expert in one area doesn't mean he knows jack about other areas.

Look at most nerds here. They're pretty smart about computers, but idiots about politics.

Re:Seriously

[dameron]

Richard Clarke was main counterterrorism expert in the U.S. government for 4 presidents. One of the criticisms, perhaps justifiable, of Clarke pre-9/11 is that he was too obsessed with cyber terrorism and computer security.

I think he knows what he's talking about.

-dameron

Re:Seriously

[TheWatchfulBabbler]

Richard Clarke is some kind of expert on computer security? Where are his credentials on the subject?

Well, he handled CIP during his time with NSC, and was cybersecurity czar after being shoved out of his counterterror role. 'Czars' of various sorts are, given their lack of power, perhaps the most ironically-named figures in Washington, but Clarke was certainly the best-informed computer security layman in the nation. So, yes, when the former Cybersecurity Czar specifically singles out Microsoft as a source of major vulnerabilities, I think he's qualified to pass judgment.

Re:Seriously

[anactofgod]

What are your credentials? Must lie in something other than computers and internet, since all of the nerds here can answer questions such as yours by doing a Google search. If you had bothered to so so, you'd have read that Clarke was chairman of Bush's Critical Infrastructure Protection (CIP) Board when he retired in 2003. He was also the first counter-terrorism coordinator. His office also released the US National Strategy to Secure Cyberspace, and he seems to be enough of an authority in the field to be interviewed by IEEE Security & Privacy. There is a lot more to his background, if one really cares to investigate.

So, I'd say that he's pretty well credentialed to comment on threats to US cybersecurity. Perhaps not from the perspective as a bits-and-bytes technologist, but certainly as someone who has expertise in assessing systemic strengths/weaknesses from the perspective of counter-terrorism.

Humph

[Anonymous Coward]

A story only a few hours ago on how Microsoft shines on security.

Fact: any box is as secure at the admin makes it.

Move along.

Re:Humph

[DickBreath]

Fact: any box is as secure at the admin makes it.

Fact: any box starts out as secure as the developer/packager makes it.

For example, having a vulnerable IIS turned on by default on a plain jane workstation.

An incompetent admin can make a secure system insecure.
A competent admin can, with work, might be able to make an insecure system secure.
(Depending upon the nature of the required fixes.)

But a box can start out relatively more or less secure, and that is an important point worth comparing. How secure is a given system out of the box, before an admin gets hold of it?

Re:Humph

[rewt66]

any box is as secure at the admin makes it.

You know, I think that, if I tried hard enough, I could build an OS that no admin could secure.

Moving on from deliberate incompetence, we come to Microsoft. They didn't deliberately try to make an impossible-to-secure OS, they merely made so many bad architectural choices, and added so many features that are inherently insecure, that the effect was close to the same.

Now, in fairness, they are getting better. Windows doesn't fight the admin who tries to secure it nearly as hard as it used to...

Re:Humph

[nihilogos]

Fact: any box is as secure at the admin makes it

I can't believe this got modded insightful. The vast majority of computer users aren't admins, and don't have an admin coming round to their house to 'secure' their system, or stand over their shoulder to tell them they shouldn't open that email attachment.

The 'admins' need to be built into the software you tard.

Re:Humph

[poofyhairguy82]

The 'admins' need to be built into the software you tard.

That is what is slowely happening. Microsoft now offers a firewall, a spyware cleaner, and an update system for XP. The major thing it lacks is antivirus (probably because if Microsoft added that it would be seen as monopolistic).

All of these tools are easy to use as well. I don't care because I don't use Windows, but I do appreciate the fact that MS is trying to simplify the administration of its desktop. Its easier to tell my non-nerd aunt how to download the beta antispyware program on the phone (and get her to install and run it) than it is to get her to replace windows.

Re:Humph

[randomencounter]

For example: the message passing API which was (still is?) a major local privilege escalation vulnerability.

For example: Shipping major software packages that required significant administrative skill to run as an unprivileged user on NT-series OS's (MS Office).

For example: Shipping as their major OS product for years an OS that didn't even have the concept of an unprivileged user (Windows-over-DOS).

They are getting better, but so is everyone else, and they have a lot of catching up to do.

but but but

[SunFan]

Windows is more secure than Linux! Right? No?!? It was all a sham? Oh, I see.

Re:but but but

[isometrick]

Science: Water Is Still Wet
Posted by timothy on Thursday February 17, @05:00PM

...

Science: Scientists Discover That Water Isn't Wet
Posted by timothy on Thursday February 17, @03:00PM

Listening?

[ackthpt]

I wonder if anyone will finally start listening to him?"

I believe after his book that many people in Washington stopped listening to him.

"the war is really hard, uh, you see and we, uh, we're trying to make them all free and ... Karl, what's the buzzing noise?"
"Ignore it Mr. President, that's just a reporter refering to something Richard Clarke said."
"Who?"

Re:Listening?

[Xshare]

And the ex Counter-Terrorism boss of the administration speaking against the war, or at least against how it was carried out, was Richard Clark. This Richard Clark. Sorry buddy.

Will they listen? No.

[Darth Maul]

"I wonder if anyone will finally start listening to him?"

No. With all the spyware and worms and virii out there, people just won't switch. I just don't get it. I suppose they are just stuck in their ways, and don't want to learn anything else. I suppose for most people, it was enough of a trial to "learn" how to use Windows, so they would rather put up with the crashes, spyware, and everything Microsoft, and just call it the norm.

It's a shame. But people really are stupid and/or lazy. That's why they won't start listening to anyone about this stuff. If I were a customer of Microsoft, I'd be organizing class-action suits, writing letters, storming Redmond with torches in hand.... Why these people put up with it most likely can be put into two categories: 1) ignorance, and 2) laziness. Either they don't know there are viable options, or they are too lazy to actually pursue said options.

Just something off the top of my head. Agree? Disagree? Discuss.

another interview

[r84x]

Clarke has talked about cyber security before. To the IEEE, in fact. Read it here.

Apologia

[Stanistani]

Clarke does deserve some kudos as the only responsible government official to apologize to the 9-11 victims's families.

Richard Clarke is a smart guy...

[HouseOfMisterE]

Richard Clark is a smart guy, and his book, "Against All Enemies," is a very good read. Highly recommended by the HouseOfMisterE.

funny guy

[asoap]

I've been reading his book, and there was one story that I found funny in it.

Before the olympics in Atlanta, he went down there with his CSG group to asses the security for the games with the people responsible. They were standing in the olympic village and he said something along the lines of:

"So, it appears that the Olympic village is simply the Atlanta Tech Campus"

All people in charge of the security measures nodded their heads.

"It is also true that there is a nuclear reactor on this campus"

Half of the people nodded their heads.

"I also bet that there are spent fuel rods for that reactor, and as I can see here, there is almost no security for this reactor"

No body nodded their heads, and instead fummbled for their cellphones to make the proper arangements.

I thought that was funny, and I thought you other geeks might also like it.

Re:funny guy

[jd]

Spent fuel rods would probably not have posed much of a threat. You can't exactly stuff them down your trouser legs.

Someone mentioned that such reactors aren't used much. That means nobody would be likely to notice if it got switched on. Or notice if the coolant was leaking. Or noticed if someone had bashed the safeties so that the graphite rods couldn't drop...

So, yes, he was certainly on the right track, but his imagination wasn't nearly up to scratch.

Re:Why listen to this weasel now?

[Rei]

Oh come on, watch something other than Fox and read something other than NewsMax and FreeRepublic for once. :P

Lets take a wide gander here. You've never read his book. You didn't listen to his testimony - only selective excerpts and clips. Your knowlege of his history comes from one or two right-wing articles, without ever reading any counters.

I was (foolishly) hoping that this thread wouldn't get dragged into a left-right debate. I was wrong.

Shooting yourself in the foot.

[GillBates0]

Don't expect Richard Clarke to rely on Microsoft Corp.'s anti-virus or anti-spyware programs to protect his own computer.

Yeah...buying an OS vulnerable to viruses and spyware and then buying anti-virus and anti-spyware programs is like shooting yourself in the foot and then running (limping) to the hospital for help.

And what's more...the hospital profits from lending you a gun and encouraging to shoot yourself in the foot.

I listen to him...

[3Suns]

I wonder if anyone will finally start listening to him?

I watch his "Rockin' New Years Eve" program every year, and I expect lots of other people do too. I had no idea he was into computer security as well, though.

Given the government's record on security...

[Anonymous Coward]

...why should be listening to him? The call for government regulation of ISPs is scary. They will surely have to ask the ISP they want to regulate how to secure their own government systems that by their own accounting have shabby security.

And this is from the same guy...

[DARKFORCE123]

And this is from the same guy who must have done such a great job advising on security matters for the government that most of the government agenecies just recently received an awesome security grade.

http://www.msnbc.msn.com/id/6981279/

Oh wait, that didn't happen!

Whether he didn't have the power to make the necessary changes or he's incompetent the government obviously needs to take some serious steps to increase cyber security soon!

more sources

[r84x]

For you who doubt Clarke's credentials as a "cybersecurity" expert, here are a couple more interviews for you.

From July 2003

From Feb 2001

Re: not a politician

[bracher]

He's not a politician, he's a civil servant. There is a huge difference there.

Re:Will they listen? No.

[u-235-sentinel]

Why these people put up with it most likely can be put into two categories: 1) ignorance, and 2) laziness. Either they don't know there are viable options, or they are too lazy to actually pursue said options.

My excuse for running Windows?

Half Life 2 :-)

Re:Will they listen? No.

[RM6f9]

Lazy. When Linux (any flavor) is as easy to use as Windows (admittedly, Firefox and Open Office are installed on my boxes already), when Linux will run my games with the same "double-click the icon" ease, I'll switch - until then, I don't complain about windows because I know I chose it consciously.
I admit being lazy. Linux needs to earn my respect by catering to my laziness.

This is a trap

[argoff]

Security issues are a wonderfull way to convince people that the government should regulate IT, but ironically it will actually play to the favor of Microsoft most of all. As soon as regulations start out, it will start increasing the bariers to entry in the IT space.

This has happened in every industry it's been attempted in. Plumbing, electricity, telephones, auto-repair. Hell, you can't even sell a hot-dog without going thru 10-20 thousand dollars worth of regulation for it to be legal. Yeah, I know, don't say it. There is always a good sounding reason for these .... yeah ..... right.

Re:This is a trap

[SunFan]

All the heavily regulated industries are that way after lots of property damage and loss of life. Just like a fire inspector might say "all these codes are written in blood." The computer industry is definitely large enough, now, where huge damage is likely.

For example, what was the value in proprietary information lost due to those worms that e-mail random documents off of PCs? Analogously, who would install a filing cabinet that has a door to the outside for the postman to pick up the files and put them in random P.O. boxes?

There is just very little common sense in the IT industry, and where there is no common sense there's regulation.

some serious evasion

[motorsabbath]

"In a statement responding to Clarke's comments, Microsoft said it has formalized its internal security efforts by adopting an official life cycle that it uses to develop secure software,[...]"

Just what the hell is that supposed to mean?

The Real Culprit Is Software Reliability

[MOBE2001]

The security problem really has to do with flaws in software. Most viruses and trojans take advantage of defects in operating systems and applications such as email and browser programs. Microsoft is being targeted because they have a monopoly but all software is at fault.

Software is bad, period. And, contrary to what Frederick Brooks and others continue to claim, unreliability is not an essential property of complex software systems. Unreliability stems from a custom that is as old as the computer: the practice of using the algorithm as the basis of software construction. Switch to a synchronous, signal-based approach and the problem will disappear. For an alternative approach to software construction, see link below.

Re:The Real Culprit Is Software Reliability

[ma_luen]

Hmmm, I looked at your silver bullet link there and while I agree with some of the general ideas it has some serious problems.

First of all the discussion about Turing machines is very wrong. Turing machines are universial because they are basically as powerful as you can get in a computability sense. They can simulate multitape multihead machines just fine. Look at Siper's theory of computation.

Next, actor based computing is not new. It has been done in artifical intelligence as agents (see AIMA Norvig), the OS community as reactive computing (see tinyos) and it is becoming a hot topic for sensor networks. And in a sense it has been looked at via MPI and in some work on composeable software (oddly enough mainly in composeable network stacks). But no one knows how to do it and gets all sorts of wierd race conditions and odd resonant behavior. Baiscally it is all much HARDER to debug than simple sequential algorithms. So, it is interesting but without something more it certainly is NOT the silver bullet for program reliability.

Which brings us to the hardware comparision. CPU's are finite state they can be checked using symbolic execution or model checking. Both of these (currently) fail to scale up to handle even moderately complex approximations of software. (see Bebop, ACL2, or the work on predicate abstraction) So, yes finite state things are easy to verify, unbounded things are not.

Finally, it is not my area of specialty (and I don't like them) but the connection appraoch and COSA work look a lot like Petri Nets. You should really compare your work and work done in this field.

Anyway, I am doing a Ph.D. on software reliabiity and analysis. I am also interested in a message based (reactive) approach to some of the problems. I like the general idea the site presents (there are some serious issues with the details though). There is a lot of work out there that the author of the site has not looked at that would help them a lot.

Mark

It's odd, some people just don't want to learn

[SuperficialRhyme]

A friend here at college was having a spyware/virus problem that she wanted help with. I offered to help her if she'd use firefox afterwards to prevent this from happening again. She refused because she "likes using Internet Explorer." Even when I told her she could still use it for certain sites, but that it's best not to use it for web browsing.

I guess some people are too set in their ways. She couldn't name anything she liked about IE, just that she did, in fact, like it.

That's my experience trying to spread Firefox to some people who might be in your categories 1 or 2. The other people I've introduced to Firefox have all loved it.

*shrugs* She found someone else to fix it without the condition that she try to use Firefox. I guess it would be interesting to find out if she gets reinfected.

Yes, Government Regulation Is Always The Best Idea

[aaronhaley]

And always works out SO well.

Advising != Implementing

[Infonaut]

One of the central messages of Clarke's book Against All Enemies is that for several years he and many other people worked hard to make the system work better, but institutional politics made it practically impossible. In particular, cooperation between US government agencies was atrocious. FBI/CIA coordination was horrible, for example.

The framework established for the Cold War is not suited to the current realities. But knowint that is different than moving the huge icebergs that government agencies become as they expand and atrophy.

Re:Will they listen? No.

[ABaumann]

What about OSX? Noone's ever accused that of not being easy.

Re:Will they listen? No.

[ScentCone]

But people really are stupid and/or lazy

I work hard, and I'm not (very) stupid. The disruption in daily operations for me to cut 40 live web and db servers, along with all of the code, over to Linux from Win2003/SQL/IIS/ASP/VB would be: total budget killer.

Just changing my group's desktops (including the dev tools, custom apps, storage, file structures, user environments, etc) and ignoring the desktops: total budget killer.

Much better off to talk about the suitability of the Linux stack for new business units, operations, or totally-clean-slate start-up companies. Of course, many new business units are spun off by too-busy growing companies, using people that are already hip-deep in their existing IT framework. This is NOT like deciding that, at home, this weekend, maybe it's time to switch. Any real change would occupy a typical department's people for man-months at least. Very few operations of any kind have that kind of slop in their budgets, as we're coming out of a recession and an only just now loosening IT cost clamp down.

I'd be organizing class-action suits, writing letters, storming Redmond with torches in hand

Maybe I would, but... I've had a busy day doing things for which I collect money, and which help my customers to make money. And I spent that whole day using MS products, none of which crashed, none of which picked up any worms, and none of which required a busy team of people to totally grok a new operating system or try to guess where they'd ever come up with time to do that.

Why these people put up with it most likely can be put into two categories: 1) ignorance, and 2) laziness. Either they don't know there are viable options, or they are too lazy to actually pursue said options.

Don't work in a very competitive, time-stressed, low-margin business environment, do you? Or are you 1) too ignorant or 2) too intellectually lazy to imagine that there might be actual, practical barriers to the quick adoption of something that's completely different and which would require hiring, consultants, and substantial risks? It's called inertia, and in tight economic circumstances, bosses and investors don't like to hear: "It's OK, it's completely different, and no one that works here has ever needed to compile code in order to patch something, but we'll figure it out before anything bad happens! Plus, it's free, other than the huge disruption, support costs, and unknown impact on all of our software! Relax, boss - don't be ignorant and lazy. Certain people on Slashdot have a magic Linux wand that they can wave to make this totally painless, instant, and more or less free."

Re:Why listen to this weasel now?

[Coryoth]

I was (foolishly) hoping that this thread wouldn't get dragged into a left-right debate. I was wrong.

Before resorting to foolish hopes I usually consider Fisher's Deduction:

"The more issues a person tries to artificially shoehorn down into a Liberal/Conservative dichotomy, the more certain you can be that the person is an American."

Then consider what percentage of Slashdot posters are from the US. Odds are if an article has any political aspects there will be a number of posters who feel the need to cast it into a false dichotomy. It's exactly this sort of situation that memes like Fisher's deduction were created to help alleviate. Do your part and spread the meme.

Jedidiah.

Its about COMPATIBILITY, nobody will switch

[DickBreath]

People will not switch from Microsoft until an alternative system is compatible with all of their favorite spyware, adware and worms.

Re: not a politician

[McSpew]

My knowledge of Clarke isn't very good, did he politicise himself or was he politicised by the Bush administration ?

Clarke was a civil servant/bureacrat during his time working in the US government. He never ran for office and his service was never a sinecure in exchange for political contributions. He served in various capacities under three Presidents (Bush the Elder, Clinton and Bush the Younger). It wasn't until he had spent time working for Bush the Younger that he began publicly criticizing anybody in the US government. He did so after resigning from government service.

Bush the Younger's entourage began to politicize Clarke and his work in an attempt to discredit him. It didn't work particularly well, although for some reason, US voters chose not to punish their President for his lousy track record on terror.

Anybody who has read Clarke's book can see for themselves that he is not some raving madman. He's a professional who has made a career out of imagining the worst, figuring out who's likely to do bad things, and then trying to get others to do what's necessary to prevent the bad things or capture/arrest/kill the bad people. His failure, if you can call it that, is that he was unable to get the current US President to take al Qaeda and the threat of International Terror seriously until after 9/11, and even then, the President was more worried about Saddam Hussein and Iraq than he was about Mullah Omar and Osama bin Laden.

Re:Will they listen? No.

[Bastian]

No, I think it's just that people don't understand computer enough to make informed decisions about them on so many fronts that i'ts all they can do to just stick with what is most popular. I mean, to get people to switch to Linux, we have to start with explaining to most people what Linux is, and given how many times people told me their web browser was something like Word, Windows, or Google back when I was working tech support, I think you're going to find that to be difficult.

Much easier to suggest people switch to the Mac, on many levels. But to get people to seriously consider that, you have to get them to reconsider a whole host of things they've never really thought seriously about, such as:

-I need a fast CPU.
-Macs aren't compatible. (where compatible == 'the Platonic form for compatibility')
-Macs don't run the apps I need. (assume this means Word and a web browser)
-I have to play video games. A lot.
-Viruses are a serious problem for all computers.
-Spyware is a serious problem for all computers.
-Crashing is a serious problem for all computers.
-Constant headaches with system failures, bit rot, and software/hardware installation is a serious problem for all computers.
-Macs are too expensive. - cf.) "I need a fast CPU"
-etc.

Overall, I'd say most of this comes from ignorance born of laziness. I don't believe that it is difficult for most people to understand computers. I think most people are just too lazy to put out the effort to really learn how they work. I mean, Christ, my father - the guy who taught me how to edit config.sys and autoexec.bat files - now regularly calls me up to ask me to install new software (it's still shrink-wrapped when I get there) and how to do simple things once it's installed ("Hey, could you read this manual for me? I'm too lazy to do it myself.").

Al Quaeda

[oil]

Well, no one in the Bush Whitehouse listened to him about the threat from Al Quaeda before the 9/11 attacks, so why would Microsoft bother to listen to him.

Re: not a politician

[Your Pal Dave]

Here's an interesting interview with Clarke which discusses some of this history. It's part of the background material for the Frontline documentary "The Man Who Knew" which is also viewable online.

Re:Will they listen? No.

[ABaumann]

I happen to own a 12" 1 GHz PowerBook running OS X. It happens to start up, load applications, and play World of Warcraft better then my girlfriend's 2.5 GHz HP laptop or my father's similar 2.5 GHz Compaq machine (both running Windows)

But I must just be a dolt thinking I'm getting my money's worth on a machine that seems faster and less buggy from my perspective.

atlantic monthly article

[flacco]

richard clarke wrote a fictional piece in The Atlantic Monthly - "looking back" from the year 2011 at terrorist activity.

one of the interesting parts was that, "looking back", much of the world had switched to open source software because it was more secure.

Re:Richard Clark is a liar

[binder520]

"Most of the time when someone on the left starts getting a lot of publicity like that, it is really part of a media campaign to sell a book."

Richard Clark is a registered republician.

Re:Unfortunitly

[Viking Coder]

Huh.

Yeah, it couldn't possibly be the fault of the Clinton and Bush administrations.

Good call.

Oh, wait - no - bad call.

I'm not saying he was an angel, I'm just saying that you've leapt to the conclusion that he was to blame, and two politicians who were absolutely detested by opposing sides of the country (Republicans hated Clinton, Democrats hate Bush) were blameless.

It's too bad really. Imagine all of the things that Clarke could have stopped if other people realized that they actually had to work with him.

Reading Clarke

[commodoresloat]

If you want a frightening read, you should pick up the January 2005 issue of the Atlantic, which has an article by Clarke that is supposed to be a voice from the future (Sept 11, 2011) -- assessing the war on terror ten years later. He has some chillingly realistic scenarios for massive terrorist attacks on the American homeland which start in July 2005 as I recall. Not only do the scenarios seem realistic; he also footnotes each one extensively, showing with evidence how realistic these ideas are.

The U.S. needs more people like Clarke in public service. Not because he spins a good yarn, but because he has consistently offered lucid and nonpartisan analysis of the terrorist threat throughout his career. It is shameful that rather than responding to his arguments the Bush Administration went into attack mode, and even more shameful that the Democrats were unwilling to make Bush's failure in the war on terrorism a bigger campaign issue.

Too Bad...

[GReaToaK_2000]

It is too bad that he waited till he was the FORMER White House blah blah blah cybersecurity dude to say something...

Why didn't he say these things when it counted, not after the fact.

Re:When will people listen?

[g0hare]

Ah, he disagreed with Bush, he must not have credibility. I get it now! And as a Republican he's a Liberal!

Insecurity System

[Doc Ruby]

Yesterday, in a Manhattan Chamber of Commerce presentation, Microsoft's CIO Ron Markezich came out to take a Q&A. Most questions were softballs, but two really stuck out, showing Microsoft really is at least as out of touch as it is "evil".

Markezich had detailed how his IT department did more than just support 90K desktops worldwide. The were the first consumers of MS software - MS "eats its own dogfood", as Markezich said, and nothing gets released without Markezich's department signing off, after supporting it for months, if not years. A question from the audience asked "I've been using Internet Explorer for 4 or 5 years. It has so many issues, new ones all the time. So much so that when something like Firefox comes along, it knocks IE out of the leadership. What good is all your testing, if it can produce something as bad as IE"? While there are few good answers to that question, Markezich offered probably the worst possible: "I don't know, it works for me". He said he doesn't have IE problems, that they were surprised that it had all the problems in the field, that he doesn't have to install all the patches MS releases, because he doesn't have the problems they address. Astonishing. Remember, this is the CIO of Microsoft, responsible for all their IT globally, including release of their software "when it's ready".

Another question described, anecdotally, getting a black desktop and mysterious prompt warning that the computer had a security compromise, and the user should click to install important MS security updates. But the user wasn't sure the prompt was from Microsoft, though it claimed to be, and the next click could completely trash a compromised computer. Their question was "how can I tell that a warning and recommendation is from Microsoft, and trust it", considering scams like trojan horses and phishing messages. But Markezich laughed it off, treating it like a weird request for personal tech support - saying "call MS for tech support". I'd have thought that his IT department would be familiar with the scenario, and the issue, and that the question would easily trigger whatever was Markezich's stock response, like "Longhorn will make sure that if a window says "Microsoft" in the title bar, that it's a message only from MS software, or some other lie he made up on the spot. Instead, it's obvious that that kind of social engineering security hole is news to him, though it's been addressed in, say, Java, since day 1.

There is no Microsoft security. There is only spin control. The marketers, and their lawyer "quality control" agents, control the whole company. Even their CIO just takes their marching orders. Without their monopoly, they'd be a joke, game over. As it is, such performances as we got in midtown yesterday have the smell of a dying beast.

Re:Will they listen? No.

[Cyno]

Viruses are a serious problem for all computers.

No, just some OSs. Never had a Linux virus.

Spyware is a serious problem for all computers.

Same thing here. What is this Spyware you talk about? Never seen it on Linux.

Crashing is a serious problem for all computers.

Okay, yes, my computers crash too. Sometimes more than once a year.

Constant headaches with system failures, bit rot, and software/hardware installation is a serious problem for all computers.

Bits can rot? System failures? Is that like crashes? Software/hardware installation is not a problem for my Linux systems. I once replaced a motherboard with a whole different motherboard in my RAID server and the system automaticly detected and configured my software RAID when I put the drives on different controllers and in a different order without me needing to edit a single file. It simply works. I plug in a new firewire card or whatever, chances are I have drivers for it already. Except those open source DRI drivers for some video equipment. But 2D always seems to work , sometimes with minor tweaks.

Macs are too expensive. - cf.) "I need a fast CPU"

Macs are too expensive. I need a fast CPU, too. I need a dual-core 3+ Ghz CPU today for under $200. *sigh*

But I think it all boils down to laziness for most people. I mean, who really wants to learn how these things work, besides me? But at least I offer my services for free to early Linux adopters.

His OTHER comments on ISP security. Be very afraid

[Alsee]

Clarke said he would want to see government regulation of ISPs to ensure that they offer adequate levels of security to their customers.

He gave a speech at a Global Tech Summit back when he was the President's Cyber Security Advisor. Here's a link to it.

And let me give you a few select comments from that speech:

I think we need to decide that from now on IT security functionality will be built in to what we do, to the products that we bring to market.

TCPA, the Trusted Computing Platform Alliance, is an example of bringing hardware and software manufacturers together. But TCPA is not enough.

It is not beyond the wit of this industry to figure out a way of forcing down patches

ISPs and carriers can insist that when cable modems and DSL hookups are made, firewalls are installed. It is not enough for an ISP or carrier to say, oh, and by the way, you might want to think about a firewall.

A law to require ISP's to impose security on their customers. The security he means is TCPA, also known as Trusted Computing, TCG, Palladium, NEXUS, Longhorn and about 42 other names. And using this system they can "force down" operating system patches, whether you want them or not. Of course you can't get onling in the first place without an approved operating system (Trusted Linux is in the works, but you'd be screwed trying to use it). It can also scan what software you are running, in order to insist that you are running an approved firewall and/or virus scanner. And any other software they feel like making mandatory.

Of course it will be a few years before ISP's could do this, almost no one has a Trusted Computer yet. But as Clarke said, the system is to be built into all the products brought to market. Samsung announced a few months ago that they are now manufacturing nothing but Trusted systems. IBM, Dell, and pretty much any PC maker is already selling Trusted system and that will only increase. Microsoft has announced that only Trusted hardware will be properly compatible with the next Windows release, Longhorn. If Longhorn runs on non-Trusted hardware at all, it will only run in a crippled reduced graphics mode. So once Longhorn comes you you can be sure all new PCs will be sold Trusted compliant only. Give it a couple of years after than for the normal PC replacement cycle and *poof*, the majority of PC's out there will be Trusted compliant. And at that point ISPs could very well impose such a security system. And anyone with a non-Trusted computer would be unable to get on the internet. Anyone who did have a Trusted computer but who wanted to control his own computer and software would also be unable to get on an internet.

Clarke is no longer the President's Cyber Security Advisor, but there are still draft poposals in the government for forcing this through. There's really not much point in them doing anything publicly until more Trusted PCs ship. They'll probably wait for Longhorn to come out and start getting established.

-

Just wait....

[theendlessnow]

I just got a message letting me know that my account had been sending out a lot of spam and it came with an attachment to help clean the virus off my system.

Now that's good proactive security. Everyone will be receiving their message soon. Keep up the good work!

Re:MS Integration

[sqlrob]

IE and Media Player run at user level privilege, so quit the FUD there.

The reason a hole in one brings the system down isn't because they are integrated, it's because most users run as admin. Firefox holes with the user as an admin will have the same result.

The problem is that you can't rip one out and replace it with something less buggier. Don't like Firefox? Replace it with Opera. Don't like IE? Tough luck.

Re:Listening to Richard Clarke

[the arbiter]

"beware of folks who's version of what they call 'facts' develop over time, especially when they take a self serving direction."

Oh...you mean like the reasons the Bush administration gave as to why we're fighting a war in Iraq! I get it!

1. WMDs!
-then-
2. Fighting the terrorists!
-then-
3. Bringing democracy to the poor Iraqi people!

I'll be most careful to beware of both Mr. Clarke (a registered Republican) and Mr. Bush (also a registered Republican) in the future.

Thanks for helping me out. I've been having a really hard time being able to tell who was telling me the truth since Reagan was president. You've cleared it all up for me.

Re: not a politician

[HD Webdev]

Anybody who has read Clarke's book can see for themselves that he is not some raving madman. He's a professional who has made a career out of imagining the worst, figuring out who's likely to do bad things, and then trying to get others to do what's necessary to prevent the bad things or capture/arrest/kill the bad people. His failure, if you can call it that, is that he was unable to get the current US President to take al Qaeda and the threat of International Terror seriously until after 9/11, and even then, the President was more worried about Saddam Hussein and Iraq than he was about Mullah Omar and Osama bin Laden.

It's a testament to the character of that man in that he was the first person to come forward and publicly apologize for 9/11.

I've read the book he wrote about the events before and after (as he saw them) and have followed articles about him. I get the distinct impression that he is the type of person who has 'what if i had have done X' thoughts tormenting him quite often.

Re: not a politician

[Doc Ruby]

He left in disgust because the Bush administration is criminally incompetent to protect us, though it will instantly blame people like Clarke for its failures. The administration is very competent at media manipulation and killing the messenger. Look at Clarke's recently declassified 1/25/2001 memo warning Rice about al "Qida". He documented (for internal, secret consumption) the steps taken in the 1990s to stop bin Laden, and the steps necessary to stop him permanently. The month before al Qaeda had been documented as attacking the USS Cole, but even that escalation wasn't enough to keep them on anyone else's radar at Bush HQ. Clarke "covered his ass" because his ass was right, and everyone else ignored him. You're just repeating the neocon spin, blaming Clarke with a smokescreen designed to cover the rest of the "team's" failure to protect us, or even admit we'd failed.

The real reason people don't switch

[dustmite]

She found someone else to fix it

You've just hit on the real reason people don't switch ... it's because they always find some geek they can sucker into cleaning up the mess each time, for free! Most people don't even have to lift a finger to keep their systems free of malware - there are geeks running around everywhere literally doing free maintenance - it doesn't even so much as inconvenience them, why would they change?

Why exactly are we all running around spending hours of our own weekends/evenings etc. cleaning up the mess Microsoft made for them for free? Is your time and expertise worth nothing? You feel "expected" to do it because it's a family member? Or some hot chick sweet-talked you into doing it by flirting a little? (We all know we've done that before). Utter nonsense ... start charging for it!

People will start considering alternatives when they realise it's going to cost them a tidy little packet every time their systems get jammed up with the latest MS malware.

I simply told my folks last time they bought a computer, if they buy Windows, I'm not supporting it for them, if they buy a Mac I'll support it for them. Don't expect me to spend my Saturday doing free support work for Microsoft.

Re:The real reason people don't switch

[themusicgod1]

Why exactly are we all running around spending hours of our own weekends/evenings etc. cleaning up the mess Microsoft made for them for free? Is your time and expertise worth nothing?

Doing good works is part of living a good life, you capitalist asshole. Not everything must be driven by the dollar.

People will either listen to reason, or they won't, but that's no excuse for me not to help them. (btw, This is coming from a geek who has pretty much run out of food and possibly money atm.)

Silly admin... You don't do it that way ;-)

[einhverfr]

I work hard, and I'm not (very) stupid. The disruption in daily operations for me to cut 40 live web and db servers, along with all of the code, over to Linux from Win2003/SQL/IIS/ASP/VB would be: total budget killer.

Ok, lesson in best practices:

1) Migrate gradually and without downtime. Start by migrating the applications to PHP or Perl with a database abstraction layer. This may be slow. Then you can switch out the OS for Linux with no downtime if you already have load balancing (and very little downtime if you don't). Then you can work on moving to PostgreSQL. Expect that this will take 5 years on average ;-)

Ok, so your company doesn't want to hire a full-time employee to do that? Push out the deadlines and migrate app by app and server by server over a longer time. I.e. migrate code first then servers.

Just changing my group's desktops (including the dev tools, custom apps, storage, file structures, user environments, etc) and ignoring the desktops: total budget killer.

Migrate tool by tool. Then you can switch the rest of the OS with little shock.

Note: My first thought about IBM's Linux desktop migration was "it is going to take much longer than the 2 years they are targetting." Again, this is not something you just switch. It is something that takes years.

Re:Will they listen? No.

[RM6f9]

"Linux was never about laziness." No, but computing and playing games *are* about laziness - computers are tools to help us do more faster: If I'm spending my time learning a new OS, that's time I'm not being productive. Or enjoying my recreation (games). Bash Windows all you want, until Linux can show real competitive advantage in ease-of-use, it will continue to be a minority on desktops. Do you drive an alternatively-fueled vehicle, or do you support the monopolistic petroleum industry? Do you live in an alternative-framed home, or do you support the monpolistic lumber industry? I use tools that I find useful. I have Firefox installed, I have Open Office installed, and I am s-l-o-w-l-y learning about Linux, as I want my next system to be a 64-bit AMD, run fast, without any windows on it at all. Want Linux picked up by more people sooner? Make it easier to use. Nobody has to *like* the 900 lb. gorilla known as american intellectual laziness, but it's where the *vast* majority of market share is. Personally, I'm thankful for it in others, it keeps me employed.

Re:Richard Clark is a liar

[Ed_Moyse]

As others have noted he's a republican, and not on the left.

Apart from that, you call him a liar and yet provide no evidence. How exactly has he lied? He may have made mistakes with the benefit of hindsight, but then he's also apologised (has anyone else?) One of your damning pieces of evidence is that he "sounds like a guy who is BSing" ... so shouldn't your comment more properly have been titled "*I* think Richard Clarke is a liar".

Personally I thought he was extremely eloquent and surprisingly honest when I watched him giving evidence. I was very impressed.

P.S.
naivety
ridiculous
acknowledges
orchest rated

MS didn't have ANY anti-[virus|spy] software until

[MMHere]

Strictly speaking, Microsoft didn't have any anti-virus or anti-spyware software.

That is, until they acquired Sybari Software Inc. in order to fill this gaping need.

The acquisition itself proves MS had little to offer internally. They simply bought it from outside.

Is Sybari's stuff any good?

Re:When will people listen?

[homer_ca]

I support everything he's saying, but he's leaking credibility at an alarming rate.

Blanket statements like that don't help your credibility either. I've read his book, and he's a darling of the left wing media because he has by far heaped the most criticism on the Bush II administration. However, his praise and criticism of others did come off as fair and even-handed, and he names names everywhere. For example, praise for George HW Bush for the delicate diplomatic balancing act of holding together a coalition (a real one) containing many Arab countries in Gulf War I, and jeers to former FBI director Louis Freeh for incompetent micromanagement particularly in the '96 Atlanta Olympics bombing investigation. No way you'd ever see any right wing pundit criticize one of their own. Never.

This guy is a career Fed (I mean it in a positive way) who started in the State Dept. He's no liberal hippie. Given his background, some of his ideas on security may seem too authoritarian to many Slashdotters, but at least he's able to make reasonable arguments for their necessity. From his writing style he sounds like a reasonable, no-nonsense kind of guy who values competence over loyalty. These kinds of people tend to piss off other people who have the opposite priorities (loyalty over competence).

Re:Richard Clark is a liar

[saddino]

The only thing that Richard Clark [sic] ever did was approve flights for members of Osama bin LAden's family in the US out of the US and into Saudi Arabia shortly after the attacks.

Clarke's memo to Condoleezza Rice dated January 25, 2001 shows quite plainly that Clarke was urgently asking the White House to start moving on al Qaeda eight months before 9/11. Now that it has been declassified, you can see the actual memo here. [PDF link]

That doesn't look like "BS" to me. In fact, it suggests that "his record" shows a true concern in getting the Bush administration up to speed on what he felt was a huge threat. In the memo, he says "We urgently need such a Principals level review..." Rice finally held his requested meeting on September 4, 2001.

So what's the "only thing" he ever did, again?

Re:MS Integration

[tres3]

I'll take your word for it as I haven't used anything MS for a few years and don't really want to take the time to research this too deeply. I do have a question though: IE is tightly integrated with ActiveX and Windows update, can a user - not running as admin - update the software on their system? Another question, since Media Player uses tightly integrated DRM in the latest version, are the DRM keys/watermarks/whatever stored in a place local for the user so that each user has a different set or are they stored somewhere globally so that they are unique for each computer instead of each user? If that is the case then there must be some form of priviledge escalation in order to access them.

I'm not trying to spread FUD but I do know that many MS users fall over all kinds of security issues that don't seem to affect non-MS users. And Apache should stand out as a light on the dark claim that MS gets hacked because they are more popular. And a final point: I have yet to come across a Linux distro that does not practically force you to create a user account and warn you against running as root; why doesn't MS do the same -- tell users that they should create a non-admin account and use it for everything except reconfiguring the computer. Further MS should explain in more detail the risks that are associated with running as Admin.

In a recent issue of The Atlantic

[JeffTL]

Clarke was talking in thinly concealed terms about a Windows worm being theoretically put out by America's enemies, resulting in a shift towards open-source operating systems.

I wonder if some of the viruses that cause so much trouble are in fact backed by scumbags like bin Laden -- there have been a lot more dangerous Windows viruses since roundabouts 9/11, it seems to me, so I wonder if that's a function of an increase in terrorism, or just the suckage of Windows XP, which came out October 25, 2001. If 19-year-old Russians, the usual suspects, can do so much damage, imagine what people who will not hesitate at suicide can do -- it is frightening at best.

Re:In a recent issue of The Atlantic

[MarcQuadra]

But Bin Laden doesn't WANT unorganized chaos and death. This is a common misconception of mose Americans. If you actually READ the stuff Bin Laden says, his goal is to get us and our influence out of Muslim lands.

If Bin Laden wanted to kill as many Americans as possible, there'd be people getting shot at malls and suicide bombs in America EVERY DAY. Trust me, there's a LOT of available suicide manpower here in the U.S., they just aren't tapped beause the goal of terror is to make a point and get your needs met.

We could stop AlQaeda in ONE DAY if we stopped giving Israel (a leading EXPORTER of arms) aid and a blind eye, and brought our 'stabilization troops' that prop-up the House of Saud back home. Instead we march right into the foray at great human, moral, and financial cost.

If AlQaeda made a computer virus, it would have a payload that showed messages on the screen of your machine like "Stop supporting Israel and I'll stop planning attacks." or "There were NO beheadings before Abu-Gharib, and we behead only those directly involved with the occupation" or even "Click -HERE- to see what U.S./Israeli millitary action inspired me to take revenge on YOUR towers."

What "Trusted System" means.

[jimbro2k]

According to the DOD definition a "Trusted System" is a system with the ability to BREAK your security settings.

You (maybe are forced to) TRUST that the trusted system will do so only in your(?) best interests. You don't trust anyone else.

Trusted systems are not normally systems that have earned your trust from years of service to you, they are by nature, hierarchical systems to which you surrender your trust.

Is there anyone or anything you really trust that much?

Demanding Security?

[Anonymous Coward]

"The market is demanding security now, and that hard work is going forward already," said Amy Roberts, director of product management in Microsoft's Security Business and Technology Unit, in the statement.

Isn't security something we should expect and not have to demand?

Re: not a politician

[Doc Ruby]

What the hell are you talking about? Clarke had been fighting al Qaeda, and Bush demoted him to cyberterror because real terror wasn't important, and Clarke was too threatening to keeping it that way. It talked about the threat of al Qaeda, already well established, and asked for a meeting of the administration people to start specific actions aimed at stopping al Qaeda, rather than waiting for more threats. That request was ignored. And we were attacked, very specifically.

I didn't even mention anything that has to be "believed" about "Bush". You are an obvious, and sickly typical, Bush worshipper, who is so partisan that you come up with an attempt at an insult by calling me "progressive".

"No specific threats"... "terrorism sponsors like Iraq"... "disgruntled former employee"... NO ONE BELIEVES THAT BULLSHIT. Even Rice looks guiltier than Kissinger when she squeezes that crap out. Don't waste our time here with the talking points that lead to nowhere.

Re:Listening to Richard Clarke

[ideath]

> The left in America (I'm sorry, the People's
> Republic of America) seem to love the guy, but for > the open minded who desire to learn more about him > I submit:

People's Republic of America. That's cute.

It's probably true that a great number of people who want to believe Clarke's account are anti-Bush, but that hardly means they're liberal. I know a great number of conservatives who have no love for Bush or his administration and their policies (foreign or domestic, take your pick).

Even as cosmetic details in Clarke's accounts of meetings with the President differed, the points he made are clearly valid. Even the people who don't like him and feel he's an opportunist agree with him on that account.

You can dress a cat up like a pirate, that doesn't change the fact that it's a cat.

P.S. I'm not sure what that last bit means, I just like the image.

Re: not a politician

[justins]

this bio suggests that he worked for a total of five administrations, four at the cabinet level:
http://www.americanpresident.org/action/orgchart/a dministration_units/officeofcyberspacesecurity/spe cialassistanttothepresidentandchairpresidentscriti calinfrastructureboard/richardaclarke/a_index.shtm l

Interesting.

[Anonymous Coward]

Under Clinton, we had one successful Al Qaeda Attack, which was the first one (and the first on the WTC) on our soil. It is known that there no less than 6 others (and possibly more), that was successfully stopped. One of the better well known, was for Y2K, over 300 FBI agents were sent to Seattle. It was to stop Al Qaeda. From what I have heard, it was the nearly the same Richard Clarke, CIA, NSA, and FBI that stopped this one, but failed just several years later. I am curious as to what you attribute this failure to? You really think that these groups under clinton did so well, but just hated GWB that they allowed this to happen? Likewise, many of these same people came out against GWB after 911 and said that he was ignoring everything that they were trying to do? If george tenet and richard clarke were so inept, we did GWB award them the medal of freedom?

Re:Point of View

[commodoresloat]

If Richard Clarke was in a position to represent the executive branch that would be different.

Ummm, he was Counterterrorism Czar. In other words, he was in a position to represent the executive branch, and the executive branch had failed the public in the months leading up to 9/11. That's why he felt the obligation to apologize.

Re: not a politician

[jrifkin]

he quickly jumped on the "not me" wagon by trying to control the discussion

Saying 'not me'? Quite the opposite I think. Perhaps you saw his testimony to Congress, when he
apologized to the country for not preventing 9/11 and said among other things ".. I failed you ..".

Wow. Saying that out loud for the grieving 9/11 family members and the rest of the country took incredible courage. Contrast Clarke's plain speaking with the circumlocutions spouted by the Bush inner circle.

By the way, I read his book. It was excellent. Clarke's a straight talker who give a clear idea of life in government. (You might want to save the first chapter till the end though, it's easier to follow once you've digested the reset of the book.)

Re: not a politician

[Doc Ruby]

He's a liar? Let's see some backup on that. I believe that he didn't know how to make or defuse a bomb when he was terrorism czar. Every cyberterror chief, including him, and the one who came from Symantec, has quit in disgust. And our "cyber" infrastructure is a flammable house of cards. I'd say anyone who's stayed in that office is not fit to be quoted in anything, least of all their opinion of someone who was willing to quit and talk about their ridiculous performance over there. So you're just drinking the koolaid from the Bush fountain. Hope their happy talk is keeping you safe.

Re: not a politician

[Doc Ruby]

Yeah, Clinton was occupied by Congress trying to impeach him for a blowjob, stopping him from doing more to stop al Qaeda. When he tried to do more, like target bin Laden's mobile phone with a drone, the CIA and the Pentagon fought over passing the buck until it was too late. Behind the Republican-controlled Congressional Intelligence Committees smokescreens. The Cole was proven by Clinton's team to be al Qaeda after the 2000 election was over, and presented promptly to Bush as hard proof, but Bush did nothing. As usual, rightwing partisanship has twisted the blame exactly backwards.

The Pirate Internet

[demachina]

"Of course you can't get online in the first place without an approved operating system"

From a geeks perspective I'd look upon this as a challenge. In particular would it be possible to create a Pirate Internet, along the lines of Pirate Radio. Use unregulated wireless and create a mesh network that covers the U.S., and links to the rest of the Internet through Canada and Mexico, or maybe shortwave. Would it be possible to create a alternate network for everyone that opts out of trusted computing and corporate and government control of their computers and the network.

To the extent that radio has turned totaly corporate and boring, I find college radio to often be much more interesting and I suspect pirate radio would be to if I could find some in the area. Would the same be true of the the pirate internet. Would all the really interesting and bold stuff move there and today's Internet would continue down the road to sterile corprate websites and subscription only content.

Another interesting question is if the U.S. tried to unilaterally force trusted computed would the rest of the world follow. I suspect not. I could see China going for trusted computing but only if their government controlled it and not Microsoft, Intel and the U.S. If the U.S. had one brand of trusted computing and China another the Internet would fragment and stop being the internet.

Its also possible the U.S. would try to force trusted computing and the rest of the world would just ignore it leading to two outcomes:

- The rest of the world ignores it, it fails and the U.S. ignores it too
- The rest of the world ignores it, the U.S. clings to it and uses oppressive government regulation to inflict it within its borders, and the U.S. would turn in to a black hole in the internet. The rest of the world would ignore it and potentially block U.S. access to the rest of the world in retaliation. I'm wondering if instead of economic sanctions in a future world we might see internet sanctions where a rogue nation is shut out of the rest of the world's Internet as a form of punishment for bad behavior.

In the later scenario could a Pirate Internet spring up in the U.S. and continue to connect to the rest of the world's Internet in defiance of government attempts to suppress it. It would be pretty hard especially when the FCC sends trucks, full of armed goons, around the country hunting down wireless network nodes. A pirate internet would need a lot of redundancy and nodes that are relatively elusive and transient.

Guess what kind of laptop Clarke uses

[saha]

Actually, in a Frontline documentary Cyber War (I recommend watching the steamed video) which directly relates to the original posting, Richard Clarke singles out Microsoft for being negligent for their lax security. I would have to agree. For the past few years its been either viruses, annoying Windows Messenger pop ups, worms and finally spyware that has plagued the Windows users. The last problem highlights just how negligent Microsoft has been when they could have implemented pop-up blockers and by default have restrictions on Active X downloads, when all other web browsers had pop up blocking two years before Microsoft finally implemented it in XP SP2. Every week I have several people come into my office because of spyware issues. Which I'm starting to believe really does afflict 90% of Windows PC users now. On the weekends when people find out I'm a systems administrator or run into friends they're always asking me how to disinfect their machines from spyware, viruses and other issues. I feel I should reprint my business cards with the URLs of Spybot, Adaware, Mcafee Virusscan, Firefox ...and other tools on the back of the card. I'm honestly fed up of saying the same old thing every weekend when I'm not at work. At work its part of my job, but its irritating and annoying that so many people are afflicted with security issues that Microsoft neglected for so long because they had to try to cram as many features as possible into their bloatware.

During the show Frontline show you'll see Clarke using his a slick Powerbook G4. Its nice to know I'm in good company, using a platform that represents a small yet prominent minority. These days unless my users have a specific application(s) that only runs on Windowson, my usual recommendation because of all my frustration with Windows is for them to get a Mac. If they can't afford to upgrade their hardware to Apple yet, I point them to the most popular Linux distro sites (except Red Hat) or BSD flavors, but I do warn them that there is a little of bit of work involved to get their environment set up right. For those people who like to argue that Windows has more security issues because its more popular, I say that's baloney. Five to six years ago it was my SGI Irix machines that kept getting hacked into once or twice a year. SGIs representing the smallest Unix flavor we had at the time and significantly smaller than the Mac population. Over the past 3 years the number of Windows security issues has exploded exponentially where I can't in good conscience recommend it to most folks.

A Visit from the FBI Seems like FBI prefers Mac OSX as well.

Fascinating.

[aug24]

So their test process for IE involves installing it in a secure, corporate environment. No-one outside the room can take it, sandbox it and try to crack it, but they at least check it surfs OK. Wait for a few months and then, when the surfing experience is good enough and there have been, count 'em, no security issues, bung it out for install on a billion unprotected machines, and let the hackers take it to pieces and actively look for holes. Then - suddenly - all these security issues just 'occur'.

If I tested my code like that, I'd never get another contract.

Justin.