Slashdot Mirror
Microsoft To Offer Virus Defense
FridayBob writes "According to the New York Times, Microsoft plans to
enter the consumer antivirus business
with a subscription service next year.
Most of us will remember
Microsoft's assimilation of RAV Antivirus from GeCAD Software of Romania in 2003." From the article: "Microsoft plans to expand the service beyond its 60,000 employees this summer and offer an open trial for consumers this fall. No date has been set for a commercial introduction, but the executive in charge of the new business said it would ultimately be offered as an annual service by subscription."
No, no, no! It should be part of the OS. If I buy an OS and it is vulnerable to viruses, it is a flaw in the OS's design. Why do I have to pay extra to make my machine usable?
It seems to me that a company profiting from its own security holes is a serious conflict of interest.
From TFA:
Let's break this down into steps, shall we?
I'm wondering when M$ is going to cut out the unnecessary fluff in their operation and just get a license to print money.
____
~ |rip/\/\aster /\/\onkey
We'll give you virus "protection" for a small monthly fee.
So, your offering a service, to secure the operating system... that you built insecurely... that I paid for... and you want me to pay you MORE?!?!? for this!?!?
its like paying to have GM take care of your car when they built it without brakes!
#include sig.h
A cure for their own disease?
The disease of popularity?
Here they are, trying to address what has been an Achilles heel for them. I'm sure it will get painted here with the brushes of ridicule and scorn.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
It's like paying the mob for "protection" when you pay Microsoft for "security". Thanks but no thanks. I've seen enough Soprano episodes to know what can happen when you deal with the mob.
Isn't that like a doctor purposely exposing you to several deadly viruses/bacteria and then giving you some free perscription drugs to make up for it?
Microsoft used to ship a licensed copy of [then] Central Point Software's Anti-Virus program with MS-DOS 6.0. They stopped shipping anti-virus software with the release of Windows 95, however. I'm surprsied it's taken them this long to start shipping an anti-virus tool with their OS again.
The chick who gave me AIDS sold me Crixivan and condoms
.357 Desert Eagle
The guy who broke into my apartment sold me new locks and an alarm
And the mugger who shot me sold me a Kevlar vest and a
No, this seems like a chance for Microsoft to extract more money from us. They knowingly release software that has many holes and is unstable and now they release ON SUBSCRIPTION the "fix" to their own self-created problem. If the service was free, then I could see it as an attempt to help people.
This is yet another stragegy of the Monopolist.
I'm sure that 'the bill' can guarantee that if you don't subscribe, you will get infected.
From MSFT:
OneCare provides antivirus support, anti-spam filtering and firewall protection, automated hard drive cleaning and back-up, and an update notification service.
http://www.vnunet.com/news/1163024
Give me your pocket money and I wont beat you up!
stay out of the virus market and concentrate on the O/S - no wonder Longhorn is way overdue.
Typical flamebait style heading when Microsoft is involved.
For the uninformed: VIRUSES != SECURITY EXPLOITS
Viruses are written mainly for Windows because it is more popular, not because it is more virus prone.
No, that would be Linux.
A clever person solves a problem, A wise person avoids it. -Einstein
I will state for the record that I am not an MS fan. Now that I have that out of the way:
If MS Windows were not the dominant OS on desktop PCs, would it be as big of a target for virus writers? Let's suppose that the Mac had made it big and held 70% of the market (work with me, here). It stands to reason that there would be a whole lot more Mac exploits, as it would be a bigger target and under the microscope a lot more. Windows might still be more insecure, but it would be getting a lot less attention.
Be excellent to each other. And... PARTY ON, DUDES!
First he creates the industry then he enters it. Next on CNN Mac's start busting in flames Apple offers subscription antieksplosion software.
Their not making enough selling windows,so they'll make it up buy selling you something to fix windows.If nothing else,they have balls.
They will send you a media kit that has bootable Linux CD's and installation instructions. No more viruses.
I'm not a troll, but I play one on Slashdot.
Guys, to be frank, who really cares what M$ what to charge for this thing. It has to be priced reasonably cheaply for joe user to buy it. And if it works and all the joe lunchpacks have it installed on their computers, well this is a GoodThing(TM).
Hopefully it will reduce/eliminate(?) the thousands of port scans/script attacks we all get on our servers every day. So, MS, you have my vote! You're still a c$@t of a company, but better to pay for this feature than not have it at all.
(Heh, then again, most people will just pirate it or expect an OEM bundle deal anyhows!)
With all the OEMs that ship Norton or McAffee or whatever with their computers, I have to wonder how Microsoft is going to approach marketing this. I smell a deal with an OEM like Dell in the works, or at least imagine they are gunning for one.
Really, don't most major-brand PCs (Macs not included, but this isn't an issue related to Macs as I doubt MS will make antivirus for OS X) come with AV? And people who build their own, I would guess, are a bit less likely to buy *cough* a Microsoft AV.
I was involved in a beta test about two years ago for a Microsoft security product for home use that included anti-virus and a firewall. The name of the product escapes me (PCHealth?) but although it worked well enough it was quite a system resource hog. The beta went on for about six months and then shut down with no released product.
"We make our world significant by the courage of our questions and by the depth of our answers." Carl Sagan
Viruses exploit a flaw in the security model of the OS. Fix the flaw and the viruses cannot spread.
Anti-virus software should NOT be part of the OS.
But, by that same token, Microsoft should NOT be selling anti-virus software.
This was announced months ago.
Now I'm just waiting for Microsoft to take the initiative to disable people's computers when their owners haven't subscribed to their service. What's that? Oh, another service pack, goody! I'll install this right away and reboot (for the 50th time today). What's that? A blue screen? Noooooooo!
-- Game Developers: Stop porting badly-textured games from crappy console systems!
This is an outrage. If Microsoft knows how to make their product more secure, they should incorporate it into the OS. "Wow, that's a bad virus! This will be *great* for our antivirus subscriptions..." Will Microsoft's corporate customers accept this?
or is Microsoft trying VERY hard to get into every successful computer related business?
- Anti-spyware
- Anti-virus
- Games console & PC
- The OS
- Office Suite
- Networking Hardware
- ISP
- Phones
- PDAs
- Cars
Ummm I don't thing the DOJ is watching our favorite monopoly very closely. Soon there will be a Microsoft option for everything that can be purchased. I can see it now in stores:
Bob: Hey Carla how about these cool Levis?
Carla: Nah I would rather have the MS-Jeans. They have Anti-virus protection I'll never be sick again.
Bob: Ummm...
Nothing is impossible. It just hasn't been figured out yet.
If you find that unappetizing, get a Toyota or a Honda. They're more robust and less prone to breakage.
"I have never won a debate with an ignorant person." -Ali ibn Abi Talib
Does no one here rememeber MSAV?
D S/M/MSAV.HTM
It shipped with MS-DOS 6.2 and 6.22. I remember it looked a lot like an early BSOD as it scanned for viruses I might have recieved while downloaded a registered copy of Scorched Earth from a BBS.
http://home.earthlink.net/~rlively/MANUALS/COMMAN
Just around the corner, another man is struggling to crawl to a second stand marked "Iced drink antidote - $2".
MSAV is coming back!
Will Longhorn have InterLnk, MSD and DoubleSpace ?
Seems the only thing left is making the autoupdate mandatory by virtue of the EULA and then charge subscription for that as well. The offer for virus protection by subscription might be just the thing to ease the barrier here.
:-)
End result: OS itself is primarily subscription based for all practical purposes. No more trouble with pirated copies. Needless to say, all in the name of making the world more secure.
Of course I'm just theorizing
I used RAV on my Postifx server until they got bought out by M$. I was quite happy with RAV, and still think it was one of the better A/V products. If M$ left it alone, and integrated it as it was, it would be a great product. Unfortunately, they never leave anything they acquire alone.
How biased this article is. Saying that Viruses are purely a Windows problem. Lets wake up here, almost all OSes have security holes, OSX, Linux and others.
You bastards!
I used RAV antivirus on our linux mail servers for years. $50 a year for unlimited user! It was brilliant! And then THEY stole it.
Ah well, clam is even cheaper...
The first thing that came to mind when I read this article was oddly enough the line from the Wierd Al song Mr Popeil:
"Now how much would you pay?"
But instead of offering more and more products for lower and lower prices, instead Micrsoft is heading the other way.
"How much would you pay for an OS? How about $200! But Wait! What if it included a virus checker? What if we threw it in for FEE! Now how much will you pay?"
"There is more worth loving than we have strength to love." - Brian Jay Stanley
The fact of the matter is that many viruses don't bother taking advantage of exploiting Windows or Outlook flaws. They don't have to. By far, the biggest factor in spreading viruses is human stupidity. They don't patch their machines. They click on stuff that reads like this:
FROM: sploitr@fishyware.com
SUBJECT: DO0D YOO gotta secyurtee pr0b/.
BODY: Yer eemail will be canc3lled if y00 do not click the a7tached fil3.
ATTACHMENT: malware.exe
The only way you can seriously argue that this is Microsoft's fault is by saying that they made it possible for people *this* clueless to get on the Internet.
include $sig;
1;
Cat got your tongue? (something important seems to be missing from your comment ... like the body or the subject!)
C|N>K
usually I'm pretty pro-microsoft. I mean, they came up with a good idea and marketed it well. made a crap-ton of cash in the process. They have their problems with stability and security yes, but they pwned everyone else at marketing and availibilty of product. That said, if the OS were secure and the code not exploitable, they wouldn't need to market anti-virus software. damn morons.
forty-two
Will it die off the same way Microsoft Antivirus from DOS 6.0 (IIRC) did?
Anyone else wondering if possibly this is actually just a pay service where you will receive timely updates to the OS to fix potential virii / vulnerability infection???
Call it:
Patch Upgrade Security Service.
Q: You know what *other* business you're in if you're in the business of extermination? A: That's right - breeding rats!
Last I checked, creating a threat and then charging money to deal with it is a protection racket and is illegal. Can the RICO act be used against Microsoft???
Microsoft's goal has been to get users to pay a subscription fee for use of its OS and Office. This is one step towards that.
Expect a "trial" copy to be included in Longhorn that'll bug the fuck out of users until they break down and subscribe.
Microsoft will get its annual user subscription fee. It'll have NO incentive to fix its security problems. And we'll get shafted.
Thanks Bill!
If someone says he and his monkey have nothing to hide, they almost certainly do.
Ah, good, someone else thought of the mob protection analogy. "Nice computer you have here. Shame if any viruses were to harm it."
What I wonder is why more people (you know, average computer users, not /. posters) don't think about alternative platforms such as Linux or Mac. But last night I was watching the local news and they had one of their typically sweeps-inspired scare stories about how letting your kids use their computer to go to gaming sites will lead to spyware, and adware, and who knows what else! Aaaaaah!
OK, ignoring the stupidity of tying gaming to evil, I found the reporter's conclusion interesting. Noting the steps that could be done to protect yourself, he said keep your OS up-to-date, run anti-virus software, run a firewall, and monitor what your kids do with their computer. I kept waiting for the obvious other solution: Get rid of Windows and move to a Mac. End of problem. I could just imagine the reaction of Joe Average watching this report if the reporter had said, "Or you could just switch to a Mac and have virtually none of these problems." Joe Average would have sat up and said, "What? Really? I had no idea!"
And that's the point, most people have no idea there are alternatives out there that minimize the problem. Not that Linux or OS X-based systems are totally invulnerable, but it's a lot harder for a virus even directed at such OSes to get traction when the first thing they have to do is explicitly ask the user for permission to run and ask for a password!
Watching that news report, I realized this is what my sister-in-law would be going through if she were using a Windows box. She is clueless about computers, checks her email faithfully every month or two whether she needs to or not (sarcasm), and is always connected through broadband. That's a recipe for disaster...except I recommended she get an iMac. Instead of having to clear out adware and spyware every time I visit, she just uses her computer as she wants without any problem in the 2+ years she has had the box. No way a clueless Windows user on broadband would be so lucky, but a clueless Mac user? No phone calls to me with tech support issues in 2+ years. If only more average users knew this kind of computing experience was possible.
Microsoft will dominate the security (AV, spyware) part of the software industry. In five years, there will not be a McAfee or others. So whats left on that side of the computer world?
I MUST be a prophet. Ten years ago I said that you will either run Microsoft software entirely or you won't run it at all. Adobe will be all thats left on the Windows side for off the shelf software.
perl -e "eval pack(q{H*},join q{},qw{70 72696e74207061636b28717b482a7d2c717b343 637323635363534323533343430617d293b})"
Does anybody else feel like they're being visited by italian-americans with baseball bats, strongly urging they pay their dues to a community association that ensures they're windows and legs don't get broken?
I'm glad it's only a Microsoft problem, it makes it much easier to deride everything they do on the grounds that somebody is making money off of it.
"I have never won a debate with an ignorant person." -Ali ibn Abi Talib
Traditionally, Microsoft has always offered substandard products. Office wasn't near as good as Word Perfect, Scandisk and Defrag weren't as good as disk doctor and speed disk, and so forth. They have won by cheaper prices, bundling, or flat out black hat tactics like code adjustments in the OS to keep software from working properly. On thinking about it, I have YET to think of something....ANYTHING that Microsoft didn't either buy, steal, or mimic. Doing that, they take the competitions' ideas and crush them.
Several of the posts here are already agreeing with my thinking of "Microsoft, it's your crappy code that's causing the problem. Why should we pay you to fix something you broke but we bought in good faith?" Granted, I'm speaking mostly for my customers here as I am slowly moving completely away from Windows, but the point still remains the same.
It's come to the point where you have to question Microsoft at this point. If they start making money from Anti-virus subscriptions, what's their incentive to fix the flaws in the software that are causing the problems in the first place? The consumer already has a false idea that viruses and malware are just a fact of life and they WILL get infected without doing anything so they just live with it. If a peice of code is flawed that will allow introduction of malicious code of any type without user intervention, it falls to the software producer to fix it, not charge to protect against it. If you ask me, this is Anti-trust #3 in the making.
Look at Ford awhile back when all those Firestone tires were causing havoc. Did the customer have to pay to get new tires? No! This is the same thing. I would urge ANYONE that's considering using any MS products like this that they should reconsider. It will only support Microsoft's belief that they can milk money out of their customers for producing a crappy product.
will it catch the 'real' virus? Being "Explorer.exe"?
Avast Home Edition - Free for personal use. This stuff works like magic. You *do* have to register in order to get a registration code but it is definitely worth it.
I've actually used this software to fix problems that McAfee couldn't (the boot time scan is not possible with McAfee).
More
Can't wait to see McaFee, Symantech and others battles agains each other plus all the free AV out there...
No sig for now.
I was getting ready to invest $5K into Apple. I may have to change my mind now. Just imagine how many consumers or businesses will buy this because its from Microsoft and they will figure that Microsoft knows their OS better than anyone else, so they should be able to protect it better.
Leave it to Microsoft to make money off their own incompetency!
I don't believe in Microsoft bashing, but this does concern me from a competition stand point. Given that many of the malicious pieces of code AV software targets uses security loop holes in software, doesn't Microsoft have an unfair advantage in entering the AV software market.
It strikes me as an abuse of monopoly position since they can look at the source code and figure out exactly what the problems are that the malicious code will target, then write heuristic algorithms to catch them. Competitors cant do this without a NDA and therefore legal risk. Given Microsoft is already a convicted monopoly I'm not sure I trust them not to abuse their position here.
PFE.
Scanning for viruses is the wrong answer. It is impossible to determine the intent of a program by scanning it.
Downloaded software should not be given the power to mess with your system in the first place. This is a fundamental flaw in the design of Windows. Because it gives every running program the full power of the user account, Windows is B. A. D. (Broken As Designed). Linux and Mac systems have the same flaw.
To truly solve the virus problem, limit the authority of running programs.
paying bounty hunters to track down virus writers, what with the size of MS' war chest...
They could use any methods if necessary, but no disintegration!
So basically Microsoft is admitting to the fact that they can't write an un-attackable OS and throwing in the towel. At our expense! Money, Money, Money I'm Broke
Sig: BEEeeeP,,Please press pound, so I can get on with my fucking life!
a 'feetchur' that we can charge for patches instead of requilding on stable ground.
That's the kind of thinking that gets people killed in tsunami prone areas.
M$ has felt the rumblings underfoot, (customer dissatisfaction over security holes), and is seeing the wave build on the horizon, (Linux & Symbian & OS X & others,) and they are offering a patch kit for a hemmorhoid cushion as a floatation device.
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
Do any of you rabid anti-Microsoft zealots realize that viruses mostly work on social engineering?
If you guys could have your ultimate wet dream and have all the clueless users switch to Linux, do you think viruses would go away? No, virus makers would just adapt, and people would still say "yes" when it wants to install viruses as long as they get to play their favorite solitaire game or whatever they just got from their favorite P2P app.
Permissions? Big deal. Have the installer use sudo and prompt the user with a "Oh, I'm sorry, I need your system password to continue". Bang, didn't even have to crack a password file to get root.
I've run MS operating systems for 13 years and I've never had a virus, because I don't do dumb stuff with my computer. That is the key.
IE's vulnerability is a valid criticism, but alternative browsers are catching on, rapidly.
100 Sell platform for problem
200 Sell solution
300 PROFIT
400 GOTO 300
None. Even the Adobe apps can be cajoled to run as an ordinary user.
I hate to be a conspiracy theorist.. really I do..
but, Did anyone else run the latest windows update patch on any of their servers that run Symantec AV? 5 of my servers had the Symantec service crash right after installing this patch. I had to do a reinstall of Symantec to fix it. Coincidence? Maybe. Suspect timing? Absolutely.
Don't Tread on Me
Now, I'm no more of an M$ fan than anyone else here, but from reading most of the comments on this story so far, it looks like everyone is thinking a virus is the same as a vulnerability. While some recent virii have exploited vulnerabilities in Windows to spread, there are still many out there that get around the old-fashioned way, by posing as a legitimate program and/or attaching their code to existing programs. This is a problem with any OS, not just Windows. Short of keeping an checksum database for every executable file(including DLLs, OCXs, etc) which is updated by the install program, there is no way that Windows can, by itself, know if a program has been modified legitimately or otherwise.(The whole checksum thing just happens to be what a lot of AV programs do, but anyway...)
It looks more like basic MS.
It wouldn't even be to hard to implement this on top of current ACL systems. Just create the equivalent of a fake user, based on the current user and some group memberships. The group memberships would mostly implicate "deny" permissions for different sensitive resources (from most about anything up to a level of access almost equivalent to your own).
It seems like this move give Microsoft a vested intrested in producing an insucure OS.
The perversity of the Universe tends towards a maximum. - O'Toole's Corollary
Maybe the irony of Microsoft selling AV software will push some people to look at Linux.
But probably this will just put more pressure on some smaller AV companies that are just squeaking by, forcing them out of business.
If Microsoft follows their usual pattern, the AV group will have access to the Windows source code. They will also have access to the Microsoft marketing team, which means that A) they will sell a lot of AV software and B) they will tend to coordinate bug fixes with the marketing department.
So rather than fixing holes in the OS as they're uncovered by malware (which the AV group can see from the Windows source code), Microsoft will tell users to buy the AV software.
It will provide them a way to shed criticism over vulnerabilities while actually profiting by them. Maybe they'll fix bugs uncovered by the AV group, but probably they'll delay a little bit to generate sales of AV software.
This is the same as saying they should fix the OS rather than sell AV software, but it will give them an out when future problems are discovered. They can dissemble for a while, calling an OS hole a simple virus matter.
Never mind that viruses should not exist. No OS is totally impenetrable, but to have an entire industry devoted to removing automated attack software is ridiculous.
sigs, as if you care.
They should offer a FREE online virus scan. Similar to the TrendMicro Housecall one. Then everyone will be happy. They won't be bundling it with the OS and customers won't have to pay for it. They can just add a link to it in the default Favorites list in Internet Explorer.
It won't be usable in *all* situations... but it will be useful in most.
This is a surprise to anyone?
Just a couple of years back, you know... shortly before "Microsoft's assimilation of RAV Antivirus", when asked why it took Microsoft 25 years to start taking security seriously, Microsoft CTO Craig Mundie was quoted as saying "Because customers wouldn't pay for it until recently."
Come on... this is Microsoft we're talking about here. Color me cynical if you want, but they've never done anything more than lip service with regards to anything other than their own bottom line.
...Rob
The American Dream isn't an SUV and a house in the suburbs; it's Don't Tread On Me.
Microsoft strikes again.
..don't panic
Here's a little allegorical play scene by Me:
Salesman: Mr. Smith, here's your new car.
Mr. Smith: Thanks, Bill. Say, where's the seat belts?
Salesman: Oh, that'll be extra.
Mr. Smith: There's no windows or doorlocks either?
Salesman: Oh, that's extra, too.
Mr. Smith: I'm confused, Bill. Isn't my car supposed to be fully functional and include safety features?
Salesman: Well, Mr. Smith, we can include them on a trial bases for 30 days, but you'll have to return them or pay the subscription price.
Mr. Smith: What the f*ck, Bill? You mean I have to PAY repeadetly for something that should come with my car?
Salesman: Yes, Mr. Smith. Did you not read the EULA?
Mr. Smith: I think I want my money back.
Salesman: I'm afraid I can't let you do that, Mr. Smith.
Mr. Smith: Why the f*ck not?
Salesman: Because by opening the car door, you agreed to the EULA and you are bound to its terms and conditions.
Mr. Smith: You're a bastard, Bill.
Salesman: Actually, I'm the spawn of Satan.
I might know what I'm talkin' about, but then again, this is Slashdot...
as +10 funny.....
This is NOT a signature.
Grrrrr, it's bad enough that you're making a false analogy but at least get your history right.
I have a big firehose and i keep trying to drown you with it. BUT, if you want, I can rent you a nice umbrella.
When antiviruses were just coming out my uncle made a funny comment -- that those antivirus guys have got the perfect formulae: write virus, profit by protecting people from that virus. There is nothing new here. The mafia has been doing this for years. Obviously this is pure stipulation, something to ponder over a drink.
Microsoft Mafia: let's write a P.O.S. OS with gaping security holes in it, making a killing on it, and then write an antivirus to protect people from the OS, and make another killing on it..
--
http://unk1911.blogspot.com/
At some point during its use, a new car will have some sort of deficiency. It's origin may be poor initial design, deliberate misuse, or simply wearing out after a reasonable lifetime. In the case of poor design, efforts should be made to rectify the problem immediately. In the case of deliberate misuse, the responsibility falls on the user. After a reasonable lifetime, the manufacturer can no longer be expected to service problems related to lifespan, even after simple, proper use.
Buying an OS is no different.
Up until now, there has been no expectation of virus protection, implied or otherwise.The manufacturer made reasonable attempts to avoid strangers driving my car recklessly by installing locks and requiring an ignition key. If I handed a stranger the key to my car, the car can't be expected to protect against them.
Getting a virus is no different.
In fact, the latest version of XP makes you intimately aware when you do not have any virus software installed. Microsoft should provide service bulletins, elaborate on any confusing documentation, and make a reasonable effort to fix flaws for a set period of time.
Oh, wait. They pretty much do that.
The most cash is in the banks.
Yet the robbers rob people's homes instead of banks because the banks have far better security than most homes.
It isn't the desire
Just because you WANT to find a hole that can be exploited at your level of skill does not mean that one is there.Yep. That's the whole point. Any script-kiddie can write a "virus" for Windows and it can spread easily.
Security is not about marketshare.
Security is about restricting the avenues of attack.
If Linux is so secure that 99% of the people writing viruses for Windows will NOT be able to write them for Linux, that means that Linux will have fewer viruses.Yep. But having "some" holes is not the same as having a flawed security model.No one ever said they were "bulletproof".
All it takes for Linux to be safe from viruses is for Linux's security model to be secure enough that the infection rate falls below the repair rate.
If the virus is being removed from machines faster than it can spread, the virus is dead on Linux.I understand that argument.
It has been made many Many MANY MANY times before.
That doesn't make it any more accurate.
Having people looking for flaws does not mean that flaws for them to find are magically created.Again, looking for something does NOT mean that you will find it if it does not exist.No.
Finding exploitable holes requires the following:
#1. That an exploitable hole be there to be found.
#2. That a person of sufficient skill be looking for exploitable holes.
Then, for that to actuall BE exploitable, the hole has to be in a sub-system that is common on Linux boxes. Finding an exploit in a 7 year old app that isn't included in any distribution any more won't get you very far.
And for those reasons, Linux is more secure than Windows AND will have fewer viruses even when it has more marketshare.
Me: My car keeps dying for no reason!
Dealer: That's because your motor is being clogged with dust that's in the air!
Me: How do I fix that?
Dealer: You subscribe to our air filter service.
1) You assume that allcoding is equal and the only different is market share.
2) Fedora, mandriva are not Linux. The fact that you don't relize this give me the suspicion that your knowledge about this issue is limited.
3) "...virii. "
suspecion confirmend
The Kruger Dunning explains most post on
Since Gates claims that viruses will be a thing of the past for longhorn why would they spend all this time and money on virus software unless they know something that we don't?
And works great.
Uhmm, it occurs to me that, although I agree with the mindset that Microsoft shouldn't be creating antivirus software (confict of interest and all that). Where in the article did it say you HAVE to buy your antivirus software from Microsoft? McAfee and Symantic both have a booming businesses from the hole that Microsoft so kindly left for them to fill.
I've been trying to use it for the past six months or so on a Win2k box, but roughly every other time it checks for updates it also tosses out a message saying its installation is corrupted, and I end up having to repair the install using the installation program. What a pain!
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
Er, there is a huge conflict of interest here. Microsoft is capitalizing on the flaws of it's operating system. IMHO, they should be charged with making their OS secure and stable. There are parts of this that should be in the OS, and parts of this they shouldn't touch.
I'd say you twisted the argument to the point where it doesn't make much sense.
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
Whoever modded this great allegory "Offtopic" should be metamoderated into oblivion. We don't need ignorami like them with mod points.
Microsoft just admitted to be unable to or unwilling to secure their operating system(s) (I suspect it's a mixture of both).
Lets just sit back and watch Microsoft get sued over and over again by countless clients which relied on Microsoft "security". Just a few arguments:
1) This service should be free, the custumors paid for a secure and capable os (windows is neither - except for games, for which it is perfectly suited). Should the customer pay again to actually get security?
2) Windows gets advertised as being secure. Then why is such a service needed? (lieing in advertisements is punishable in some countries).
At the very least this will be more fodder for the "Genuine Windows" effort to enforce one licensed copy of the OS per CPU. Any additional boxes running the same copy will be locked out of the anitvirus/antispyware cocaine.
So, I bought myself a brand new Chevy Truck the other day. On the way home, the gas tank blew up. I guess I should have subscribed to "Chevrolet Gas Tank Protection Service". D'oh.
So, to review, Microsoft will sell you the disease (virus-prone Windows) and the cure (Windows antivirus software). And since the cure requires a subscription, Microsoft has even less incentive to improve security in Windows. They are going to happily feed at the trough of recurring revenue brought about by their own shoddy code.
This reminds me of the articles you see in the news every so often about the volunteer fireman who is discovered to be an arsonist.
I seem to remember a 'Microsoft Anti-Virus' program that came with a windows 3.11 machiene I bought back in 1995. Does anyone know if that was a microsoft product or if it was another product rebranded? It did not have updatable definitions as far as I can remember, but this was before the internet was so wide spread.
A rather large number of people would have a problem with that (it isn't just *Linux* users that have been critical of Microsoft in the past -- some of us have been in that position for longer than Linux has even existed), and I suspect the crowd would include Federal regulators since it could result in the elimination by Microsoft of Yet Another Market.
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
It also doesn't seem fair to competing virus protection vendors, because people are naturally going to want the (likely more tightly integrated due to full access to the codebase) OS vendor's version.
(%i1) factor(777353);
(%o1) 777353
I'd say you twisted the argument to the point where it doesn't make much sense.
I think the post in question made perfect sense.
MS has, by virtue of their direct control over the Windows OS, the ability to render viruses impotent and irrelevant by actually fixing the root problems that most viruses take advantage of. Instead, they're issuing a band-aid and asking you to pay extra for it. Is that simple enough to understand?
Someone else said "but if MS didn't charge for it, it'd put all the other anti-virus companies out of business!" The point is anti-virus companies exist because of problems in MS's OS. What you are asking MS to do is ignore the disease - which it is in their power to heal - so that companies selling the equivalent of headache medicine can stay in business. There is no reason for these companies to be in business if viruses are not a problem to begin with. And there is no reason why viruses should be a problem to begin with - the reason they are is that MS does not take security seriously enough.
This is just another example of that, despite its initial appearance to the contrary. Rather than actually fixing their OS's problems, they're saying "how can we make money off of our OS's problems?" Pretty ingenious - if utterly cynical - business model.
A simple AV signature scanner or heuristic code scanner doesn't really care about the kernel -- all it cares about is the executable file formats that it's scanning.
Such scanners look for known code sequences and suspicious patterns of instructions and API calls -- and while some API calls might change over time as a kernel adds/drops/changes features, it's only the core system services calls that are typically an issue, and those don't change all that quickly.
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
Then it's likely that every time you get an update, it will make any competing anti-virus product stop working. Some of us still remember the old rhyme: The code's not done till WordPerfect won't run.
If MS eliminates all other anti-virus vendors then we are put in an interesting situation. We have all heard the rumors that some AV companies have made deals with some spyware vendors and with the government to ignore programs that the vendors don't want scrubbed from your computer and that the government uses when investigating criminals. If there is only one vendor of AV software on Windows, there is only one company anyone has to negotiate with to keep their software from showing up as a virus.
On the other hand, I believe that the security of the computer is fundmentally the job of the operating system. So the software designer in me says that's where it should go. It should be a loadable module of the OS and it should be layered so that it doesn't just look for signatures but for suspicious behavior. It should check the logs for bad behavior, etc.
Finally, I simply will never fully trust any software that is built from sources that I can't inspect. I dont' care if it's the OS or the anti-virus software. I don't believe in security by obscurity. I want to be able to make sure that my AV software isn't excluding some malware because of a little money changing hands. My computer is MY property. If the government want's to know what's on it, I think they should bring a warrant, not plant programs on it.
While I recognize the value of "wiretaps" in law enforcement, I think that establishing a back door through which the government can load malware onto your computer will quickly turn into a backdoor that any hacker can and will use. Whatever technique they come up with, someone will figure it out, steal it, or buy it from some under-paid government worker. It will only leave all of our computers open... kind of like they are now.
I strongly suspect that Microsoft is going to try to dominate the AV market and use that domination to push their "Trusted Computer Model," where, effectively, MS owns your computer and controls what you can and cannot do with it.
All of this reinforces my commitment to never buy another MS Operating System. I only use Windows now because I love computer games and computer game manufacturers have not, for the most part, embraced the Linux market. I wish they'd hurry up and start porting.
-All that is gold does not glitter - Tolkien
www.ra
That plus MS Office are Microsoft's main sources of revenue. Look at their financial numbers.
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
You have to pay extra so that someone besides you can effectively tell you what you can and cannot do with your own computer.
I also see this as possibly a first step toward a software-by-subscription model. I realize that other vendors do this, but they don't have anywhere near the level of control that Microsoft has. If I'm not mistaken, Microsoft has demonstrated that they'd prefer this model anyhow, since having people pay annually, rather than once per upgrade, would likely mean a great deal more revenue.
Microsoft made spreading trojans EASY when it allowed the extension to be hidden. You think it's a picture, but it's an executable.
Real viruses aren't that common right now.
Stopping trojans requires a different approach than stopping viruses. To prevent trojans, you either have to disable the user's ability to run new code or only allow new code to be run in a sandbox.
This says to me that Microsoft has no intention of ever improving the security of their operating systems -- if anything they will purposely weaken it so they can sell more (dis)servicies.
People will buy into these services because they're ignorant, or scared, or brainwashed, or because the company they work for makes them use it. It's like Windows users are hooked on an OS, like a junkie is hooked on junk.
2) Fedora & Mandriva are distiributions of Linux. Anyone who wasn't out to be snippy would understand my sentence perfectly.
3)"Virii" isn't technically correct, but since "virus" doesn't technically have a plural, in the sense that Latin scholars are still debating it, I say toma(long a)to, you say toma(short a)to. "They" isn't the correct form for the 3rd person singular personal pronoun, but that doesn't stop many people, myself included. "You" isn't the correct form for the 2nd person singluar personal pronoun, but I can't say I've ever heard anyone use "thou" in normal conversation.
2a/3a) Also in my list of assumptions is that, even after a quick lookover for mistakes, I will make a few grammer, spellings, and perhaps even, factual errors. Unfortunately, I'm only human.
4) Unless you want me to say that MS people are idots. They're not idiots at all IMHO; it was a conscious design decision. Well, all I can say, is read what I actually wrote. I said I didn't think they were idiots but made a decision that, in the long run, was incorrect.
5) I did in fact know that it was Chamberlin. I had a brain fart. My bad. Thanks QCompson for pointing it out civilly.
Free MacMini
Don't use Windows in situations where it's known to be vulnerable. There's no reason at all to abandon the x86 platform, or even to abandon Windows. Just stop being stupid when it comes to security issues.
I use a mix of platforms at home. Fileservers are all running Linux (nfs and Samba). My firewall is a Linux variant. My main desktop OSes for surfing, e-mail, etc., are OS/2 and Linux, and even on those I don't use clients which are stupid enough to execute code without my explicit permission. If I want to run an attachment, I save it to a file, scan it, and run it manually.
I use Windows for gaming, MIDI, and some other things, but those boxes are not exposed to the net during typical usage, and when they *are* used for network activities I use clients like Firefox or Thunderbird rather than MSIE or Outlook variants.
I've been doing this for something like ten years, and I've run a number of spyware detectors and other things just for grins. Guess how much spyware they've found? That's right, none.
It's all about common sense, people...
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
The OS should PROTECT the executables.No. You don't need to stop disk writes.
You need to stop modifying existing executables by regular users.
On Linux, this is easy. Which is why viruses do not spread on Linux systems.
Trojans exploit human nature, not the OS.
Worms exploit flaws in a running service.
Finally remembered the name of the product...PC Satisfaction. There are a few news articles on the web about it including this one regarding system performance. My wife and kids nearly killed me for testing it on our home PC as it was such a resource hog. Late in the beta it got a little bit better but then they decided to shelve the product. I'd guess that they took what they learned in that beta and applied it to the AntiSpyware and upcoming antivirus programs.
"We make our world significant by the courage of our questions and by the depth of our answers." Carl Sagan
Microsoft has actually done a decent job with correcting flaws in it Windows.
The virus issue is an interesting question. Any operating system that allows code that the user introduces to the system to run with privelages of the user is vulernable to virus attacks. I mean to say, I can write a binary for a Linux box that wipes every file the user running it has access to.
Is that a flaw or just how things are?
Viruses that exploit bugs or flaws in the OS are deplorable, and show what a lax attitude MS had for so long. However, as MS is fixing those, what's more and more and more common are programs that trick/deceive the user into installing them and then do something that is pretty much malware. How should that be handled? They aren't viruses per se, but they are annoying.
That's whats really wrong with Windows right now. It's just sucky when dealing with stuff on your PC that you don't want.
As Windows is continued to be locked down this is the last "growth vector" around.
At some point, the virsues going around are no longer exploitig what Windows has to "offer", but rather, the users themselves.
Actually, you technically DO need a registration code, it's just packed in with the setup exe now and automatically entered when installing. That makes it improbable to distribute the setup exe, as AVG requires a unique key per install (for the free version anyways).
Imagine you bought a Honda last week. Now road conditions have changed to where the its completely unsafe to travel the roads without a special Add-on. The dealer knew right when they sold you the car that they were selling you a car with safety problems. They knew that in all likely hood these problems were just going to get worse but they did NOTHING about it. So now its a week after you bought the car and its not useable the day you drive it off the lot without this special add-on. The dealer announces they will sell you an addon to make your car safe again. This is exactly what anyone who just bought a system with Windows XP today has to go through. Is that ethical?
You can't blame MS for the viruses themselves, you can blame them for their total lack of regard for the millions of users who use their products and are about to be roped into paying to fix problems MS should have accounted for.
Your right, how does your OS know what it a virus and what is a word processor? But they could have run with least privelage, notify you when your browser has been hijacked, notiy you when programs are added to your startup, etc etc etc. There are a millions of thing MS could have done to limit the damage that viruses and spyware do to your system. Yet they did shit and now are going to offer expensive bandaids? That's bullshit.
If you wanna get rich, you know that payback is a bitch
2) reformat HD
You have now successfully removed the XP virus.
In other news Phillip Morris has announced offering of a new Health Maintenance Organization.
When the people fear their government, there is tyranny; when the government fears the people, there is liberty.
I think you're confusing viruses (which propogate by infecting executables and which could easily present a problem on "secure" platforms which enforce user permissions as long as users themselves are idiots) with worms, macroviruses, and other such threats (which would be addressed by better security on the part of Microsoft, but which are only a subset of the types of malware that AV companies address).
I agree that many types of malware would be better fixed by changing Windows itself, patching obvious entryways such as ActiveX and such, etc;, since the majority of those are actually exploits of Windows system flaws rather than viruses in the traditional sense.
I also agree that the simple release by Microsoft of a free anti-malware products is little more than a band-aid in terms of fixing the general malware problem found on Windows today.
I do, however, disagree that Windows is alone in having traditional viruses (the classic Mac was also hit very hard in the past), and I think the recent focus of AV companies on Windows-centric forms of exploitative malware in addition to their more traditional activities (the detection and removal of traditional viruses) has blurred the distinction between the two types of malware in your eyes.
The two classes of malware are NOT the same.
Even if Microsoft were to fix the massive security holes that exist on their platform, a market for third-party anti-virus tools would still exist.
However, a Microsoft AV offering has the potential to remove that marketplace comepletely.
That's the difference...
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
This is great.
M$ makes money by selling software, which has security flaws.
M$ makes money by selling software to deal with those security flaws.
It's clearly genious to be in the business of addiction. Much better than being a scumbag, illegal drug dealer.
If they could just think of some subscription based software that we need after death.
That's what it all adds up to.
-- Tigger warning: This post may contain tiggers! --
However, I've done periodic scanning with various other tools (NAV, F-Prot, Avast!, etc.), and none of them have been able to find something wrong.
I suspect AVG just dislikes something about my one Win2k system, and because of its instability I've nearly decided to pay for something like F-Prot for Windows (which I've used for years under DOS and OS/2 anyway, and which I admittedly trust a bit more than some of the newer scanners out there).
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
I think this pretty much defines the core of the problem.
To me, one of the largest reasons MS software is so vulnerable is that it seems to be designed to also serve as a marketing platform. Eliminate the hooks that marketeers are allowed to exploit, and you may eliminate a large numbers of holes exploited by the l33t h4X0r5.
I, for one, could do well without executable HTML in my e-mail.
I'm not tense. I'm just terribly, terribly, alert.
I mean how can they charge people for a tool that detects and removes a virus from exploiting a hole in an operating system they created.
It would be like car manufacturers asking you to pay for safety recalls or to pay a monthly subscription in the event there is a safety recall.
If i'm paying Microsoft for anti-virus protection, i'd better get a herve villechaize to stand next to my machine and tell me "You got a virus boss. You want me to take care of it?".
$10 says this doesn't go to release as a pay service. Remember how they said Giant^H^H^H^H^H their antispyware tool ws going to cost you something only to announce that it was going to be free three months later?
There are 01 types of people in this world. Those that understand binary, and me.
I'm not a fan of MS products, much less Windows but the fact of the matter is that viruses are a pain in the rear and anti-virus software should be a RIGHT, not a PRIVILEGE. Microsoft, should make it free to everyone but that does not absolve them from fixing the problems with Windows. They need to do both.
Although this might look like a great source of revenue, this is actually a trap for Microsoft - a no win situation.
It highlights all their product imperfections - like noone else could.
It makes everyone - maybe even politicians - see the sickening M$ corporate extorsion.
I can't wait channel flipping, when one ad will praise great M$ products and an other is pushing for M$ antivirus services.
normally i would be open to the idea pending they don't charge an outrageous price. but at this point in the game m$ should worry and pool all of their resources to getting longhorn out then when that is out they can worry about stuff like this.
m$ seems lately to be neglecting the hand that feeds them(their os) and is branching out while pushing back the deadlines for any os they plan on releasing. i think if they keep this up its gonna come back to haunt them.....
People steal cars everyday. It is uncommon for a car owner to return to the car maker and blame them for making a car that could be broken into. Along the same lines, it is not a conflict of interest for GM to start selling cars with Lo-Jack for an additional fee. Who thinks GM is going to ease up on their default security in order to sell more Lo-Jack systems? I guess that depends on how shiny your hat is.
Microsoft isn't writing the viruses. They are just trying to add Lo-Jack to their OS.
Now if you can prove that Microsoft is intentionally leaving holes in their products to allow the bad stuff in, then that is a different story.
Funny that you should mention this. :)
Check out Polaris.
So if the AV service takes off, that's a revenue stream to protect. How do you protect it? Don't fix some of the holes in Windows. Release viruses designed in Redmond. Whatever it takes, but don't jeopardize the subscription revenue stream by changing the OS to that viruses are ineffective.
Edith Keeler Must Die
As in like the guy who claimed excess Twinkie consumption was the valid cause for him killing someone?
/F
Stupidity... has a habit of getting its way.
Am I the only one who's paranoid enough to see that this is a conflict of interest? If Microsoft makes so much money from the anti-virus division, what incentive do they have in securing Windows? After all if Windows was secure, they would make no money from the anti-virus division. This also gets them the lucrative subscription business from home users that they covet so much.
The popularity excuse is wearing thin. I doubt Microsoft's position is that the software is designed for the future, when they only have 10% market share! Windows XP was created fully in the Internet age, and it still requires an admin's knowledge to keep safely running.
How bad is M$? Set up a wireless network? I'm far from clueless about tech (I'm posting here, aren't I?) and trying to get a secure network running etc. was an hours long process. And I was _trying_ to be secure, some people don't bother (like neighbors). Sometimes solutions are worse than the cure- firewalls have to be trained (which no one in MY family knows how to do), antivirus updated, email software is effectively all online.
The reason they're bad? Microsoft is about business, not home, and until IE use started dropping, they were fine with making corporations and home users fend for themselves- enriching the security and fix-it industries.
Why start the Xbox? They couldn't get their PC software to play compelling games easily and reliably. How much more powerful is my computer than the PS2, and yet most of my games are ps2.
If they're not inept why doesn't the RunAs service have a slick graphical interface? Why do I need firewall software to feel secure? Why do I need to have an adminstrator-level account to play games - 5 years after Windows 2000? Remember when the Windows Update site got hijacked? When worms slashdotted the entire Internet?
Yes, 'only' 5 to 10 years, but it's 4 versions of Windows ago- many more if you count the mobile, server and embedded versions that distracted M$ from fixing things for once and all. Windows XP was a 'brand new' OS, according to M$ marketing materials. So why did it have problems with market share of only 10%?
Not everyone has a lot of time to learn computers, or a lot of money to fix them or to pay for anti-everything software. This has effectively kept my parents- and many others- from being online at home. And killed computer games.
It's been 10 years since I started dialing up. Enough is ENOUGH!
I do, however, disagree that Windows is alone in having traditional viruses (the classic Mac was also hit very hard in the past)
Not to be a Mac zealot, but in the years I administered MacOS 7.5 up until 9.2.1 across a base of hundreds of machines, I never saw a single virus. Not one. Even the dreaded "Graphics Accelerator Worm" of the day. I never saw one as an Apple Certified Tech. either, when I worked on the average user's unsecured PowerMac from the 6100 on up to the final Classic-supporting G4's.
I use mostly MS-based systems these days (though I also look afer some OS X boxes), but I've never seen the classic Mac have a virus issue, especially when compared with DOS/Win9x/Win2k/XP, all of which I have used and supported.
Never look down your nose at others. Someday, someone is bound to see your boogers.
Actually, the rhyme is even older than you think: "The code's not done until Lotus won't run."
Just like they teach in high school, abstinence is the safest way to protect yourself from Windows!
Essentially, a TCPA compatible computer will refuse to run all code which hasn't been pre-approved by some "trusted" organisation. This would make not-for-profit software development almost impossible.
Supposedly the consumer will have some control over what is "trusted" or not. You can read more about this at the TCG website.
Microsoft done alot of damage last time they bundled anti-virus. I think Dos 6.2 included a virus scanner, unfortunately there were no updates, the result was that millions of PCs had very out of date anti-virus protection. In some ways this was worse than having none as there was a false sense of security. In retrospect free anti-virus but no means for updates was a bad move.
Microsoft should be very careful with this product (and the anti-spyware too). They must commit to making a GOOD product, a half assed affair could do alot of damage, particularly as Microsoft software could seriously dent the competitions sales.
Jason.
If M$ is going to be selling subscriptions to their anti-virus, what incentive is there to actually fix the problems that are causing the need for anti-virus. In fact, since there's money to be made in AV, why not just keep adding security holes that only M$ AV can fix. In fact, why not make the AV actually patch the holes (which other AV makers can't do) so that they look like the better solution.
This reeks like three day old fish...
So how is this any different than a company that releases a piece of software that has spyware all over it and forces the user to give up money to remove it?
Inconceivable!
The way they were made safer was through regulation, not self-motivated sense of "let's do this to gain some kind of competitive edge.", or "to protect consumers.." kind of arguements.
Then, when they were regulated into providing safer cars, the price of cars went up to pay for safety R&D. How much they went up doesn't matter.
Maybe I'm wrong, but I hardly think the current American political environment would support regulating MS.
Microsoft costs you every month:
The average american (including PHB's) won't care. Microsoft will be the equivalent of a cable tv monopoly. There's a base package (the OS), extra for HDTV (antivirus), extra for Pron channels (Pron) that consumers gladly pay each month now.
The worst thing that can come out of it for Microsoft is the equivalent of what some consumers do now. Which is buy the Tivo separately at Worst Buy. Who cares?
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
But, over time, the threats change to take advantage of new avenues.
Email trojans are currently a much larger threat to most people than viruses are
In the future, cell phone worms may be the biggest problem.
Over time, the threats change.Nope. It is easy to patch my Debian systems. I just have to su to root.Exactly. And that is because it is a HUGE security hole.
A security model states what can and cannot be done by which users, etc.
Not allowing something to be done IS part of the security model. Even if a different OS does allow that.
What I would like to see is the Justice Department figure out what you've just articulated and take another shot at Microsoft.
When car manufacturers put out a vehicle in which a flaw is discovered, they have to issue a recall. At most only a handful of cars and their owners are actually damaged due to a recalled car's flaw.
When drug companies discover a potential adverse side effect in a medication, they have to recall the drug. At most, only a handful of people are actually physically injured by the medication.
When Microsoft produces an operating system whose security flaws expose MILLIONS of people to data and service theft, cause BILLIONS of dollars in lost business overtime wages, upgrades, and has spawned a multi-BILLION dollar AV industry as a direct result of their slack attitude towards security, how is it they can get away with saying, "sure, we'll fix the problem for another $49.99. Per year."
They should be BANNED from the AV industry the way Arthur Andersen was BANNED from SEC auditing.
Responsibility is the punishment for compentenc
that it does sound like a Mafia extortion racket.
Please pay us to protect you against our software's design flaws....
Sort of like:
Please pay us to protect you against our organization's personnel flaws....
LedgerSMB: Open source Accounting/ERP
Buy three McGrease Sliders (TM) and get a free trial of the new Pee-a-Bucket chewy tablet. Comes in three flavors. After a few months, the McDiet pills will be charged separately.
Unimaginative, grumpy consumer associations have derided the new offer, saying that McDonald's should reduce the high sugar, grease, salt and cholesterol content of their food in the first place.
--
Mad science! Robots! Underwear! Cute girls! Full comic online! http://www.girlgeniusonline.com/
Any operating system that allows code that the user introduces to the system to run with privelages of the user is vulernable to virus attacks. I mean to say, I can write a binary for a Linux box that wipes every file the user running it has access to.
./funny-pictures
Well, in Windows malicious code can be embedded in things that have no business having executable code, such as a word file.
And even straight exe files are executable simply because of there name.
That being said, I'm sure you could convince some users to:
chmod+x funny-pictures &&
But, that still wouldn't trap as many users as double-clicking "funny-pictures.doc".
nil
The difference between Linux and Windows is that Linux does not have hooks deep into the kernel that a virus running in user space can exploit.
The fact that you can run a virus in user space on Linux means nothing. It can't cross the line between user space and system space unless it has root privileges which means coding an unpatched root exploit into the virus.
This could certainly be done, which is why I don't agree with people who say Linux viruses are impossible (Peter Breuer on the Mandrake newsgroup, for instance). But it's not as easy as it is with Windows.
Your basic point is correct, but extending it to blur the distinction between Windows and Linux is misleading.
Your point about malware always being able to exploit the user vrs the OS is correct as well, but can be mitigated by giving the kernel more power than even root - something I've advocated before. The kernel of any OS should protect itself even from stupid shit done by root - hopefully while still enabling root to protect himself against stupid shit done by the kernel programmer...lol...
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
It's sort of like the NSA selling tin foil hats.
Reminds me of several things:
- The mafia. They threaten to burn down your home and business, rape your wife, and kill your children. However, for a nominal fee, payable in several convenient methods, you can buy protection, and then they won't do that to you, maybe.
- The United States Immigration and Naturalization "Service" (INS). They screw up your paperwork as a result of problems inside their own bureaucracy, which is their fault. Then, as a result of their screwups, your petition is not handled in the timeframe prescribed by law. Furthermore, there is nobody inside this bureaucracy whom you can contact to find out the status of your petition or why it isn't being handled. Instead, there is a recording telling you something to the effect of, "Don't call us; we'll call you." Because your petition has now extended beyond the deadline prescribed by law, you (that's right, YOU ) must pay a fine to the INS of approximately $1,000.00 USD. To recap: The INS screws up; You suffer; Then you pay the INS a fine for this priviledge.
The above examples are akin to:- Cause damage to someone.
- ???
- Profit!!!
So we've finally discovered the secret to success.This is truly sick. They've realized that every other OS is more secure on the virus front than them, so instead of FIXING the problem, they're going to charge YOU money to sell you software that fixes their software that they've already sold you.
This gives the perfect insentive to do the following things, and I don't doubt for a second they will:
I know I'm cynical, but history has shown you can never be too cynical about microsoft. Just think about it, who has more access to their own code to be able to hack into it? Who could now PROFIT off a huge computer plague, and suddenly come up with the perfect "antidote" that would protect you, and do this on a bi-yearly cycle.
If viri started running rampant on Windows and Microsoft offered a relatively "cheap" fix. Sure they might lose a few customers to linux or OS X, but the majority will hack up the couple hundred bucks.
Hell, planting virus's would be GREAT for business because they could always come up with the patch FIRST, being public heros and making Symantec, Norton, Virex, and other anti-virus providers look slow and moronic. Perfect stratagy to kill off more software providers to move in on their territory AND gain public support.
Windows users... get ready for your own self-perpetuated appocalypse. At least I won't be there to be "late paying the rent".
- Eric
Multiplayer Gaming (defined): Sitting around, discussing single-player games with my friends, at the bar.
but, here it goes anyway:
1. Unleash badly designed OS on the market with lots of security holes;
2. Make sure everyone uses it thanks to your lock-in of the market;
3. Stay cool as many worms, trojans and viruses attack your consumers' PCs and they despair after a solution;
4. Aquire a cheap antivirus solution;
5. Offer solution as _the_ solution for the security problems with your badly designed OS;
6. Profit.
I don't feel like it...
I don't have mod points, but I wanted to say this is an incredibly insightful analysis of what may be going on here.
As I understand your thesis: The MS AV group makes Windows patches part of the AV software, which is sold separately from Windows itself. This way, they get to charge for security patches rather than being forced (by community-think that patches should be free) to give them away.
Plus, they get the marketing advantage of publicly saying that their AV software is helping to make Windows more secure, and not just in a passive way.
What AV companies could compete with this?
Computational Chemistry products and services.
What a SHOCK! Attack Firefox for its security vulnerabilities and get demodded to hell. I'm such a bad, bad citizen of Slashdot.
"I have never won a debate with an ignorant person." -Ali ibn Abi Talib
I remember during the anti-trust trial, Microsoft paraded Symantec around having them tell the gov't how a separate company could thrive in the Microsoft world.
I am curious to know how they feel about that now, or maybe feel about this two years from now.
Whose going to protect us from Microsoft?
Let them do their stupid virus defense. Everything they do suck.
A while ago I was sitting at a class at my university. The professor was using a Windows box with a projector to display a presentation.
After a few minutes of being idle (i.e. not touching the computer), all of the sudden, in the middle of the lecture, a window popped-up with a bunch of naked women.
So embarrasing, so unprofessional, so Microsoft.
Look, it's true, MS doesn't do enough to make Joe User more secure. But the main reason Windows is a target for all things viral and spyware is because it's such a huge share of the market. If you want to do the most harm, you target Windows. MS negligence makes that much worse, granted.
The bigger problem with this is, if the same people who produce the OS produce the AV software, what you get is less protection. The same principle of the monoculture applies. To protect your system, and for the health of the overall market too, what you want is a variety of evolutionary lines in your viral protection. The blind spots MS has, maybe Symantec doesn't have. And even if they overlook the same angles, their protection methods are going to vary. That's a harder target.
If MS gave this away for free with the OS, Joe User would likely say to himself, "Cool, I'm protected." And virus writers would have a vast, similar pool of target systems whose traits they could predict down to the specific directory. Does that sound good?
"Fundamentalism" isn't about divine morality. It's about human authority.
Your extremely biased comment is the same as saying:
The automobile industry is responsible for car theft because the cars they produce are not unstealable
Which is complete and utter crap.
Backup not found: (A)bort (R)etry (P)anic
&nbs
I think that that putting 3rd party anti-viral companies out of business would tend to dampen the criticisim of MS's flagship OS -- and that's where their payoff will really come from.
I doubt that MS are shortsightedly looking at the profits of an antiviral operation when their cash cow is ailing. I think they have a longer, more profitable strategy in mind: The continued world domination of the OSs -- at a time they appear to be losing their grip on it!
Symantec have, in my opinion, been recklessly scaring up business to their own profit, so let's not cry too much over how much this will hurt them!
Having said that, let's hope they stay in business long enough to provide the checks and balances on Microsoft.
Where does this leave Symantec-Veritas merger ? It's a well known fact that you cannot compete with M$ on these terms...
will it detect and try to delete windows?
-judging another only defines yourself
Decent?
DECENT!!?
Oh no! Are you really 10 year old?
I think, though, that as Linux takes hold on the "user desktop" market, they'll just integrate that if they havent already into whatever GUI shell is used by the masses. If someone downloads a binary, it should run if double clicked: that's what users expect. So if the user double clicks, the system will attempt to execute it. And we'll be right back where Windows is now.
Microsoft is actually thinking Unix-like, and seperating binaries from data on a pretty consistent basis now. Especially with less use of OLE and more use of XML.
"Microsoft plans to expand the service beyond its 60,000 employees this summer and offer an open trial for consumers this fall."
This doesn't sound right. The last time I attended a Microsoft seminar the Microsoft employees were still using the CA Antivirus product.
Microsoft officially entering the anti-virus industry means the incumbent anti-virus vendors will have to evolve, or die.
Think about it, folks! The AV industry has stagnated over eighteen years because of their reliance on the Addictive Update Model. AV software hasn't significantly advanced in all of this time because users won't buy better products.
A Microsoft anti-virus product is going to penetrate the AV market like Internet Explorer did. It'll be bundled with later versions of Microsoft operating systems, making current AV software obsolete. AV vendors will finally have to release better AV products - products that can catch viruses before the fact - just to stay competitive.
If the incumbent AV vendors respond to this threat to their bottom line, AV security will dramatically improve. About time, too.
Use Evolution instead of Outlook? Bewa
Try posting anything in the least bit positive about Microsoft (e.g. ".NET is a pretty good tool", etc)
Okay, I'll try. Microsoft has managed to make Windows significantly more stable and somewhat more secure over the past few years. Comparing Windows 95 to Linux was laughable. If you wanted to run any applications, you might as well plan on rebooting 95 at least once every couple of days and often multiple times every day. XP can actually run for several days.
Microsoft offers full virus defense, and Linux doesn't even have virus. Once again open source lagging behind, what a shame ...
Your car analogy isn't too far off. Microsoft is like a car maker who puts locks on the doors. The locks sometimes work, and sometimes don't. (Microsoft tells you they work all them time.) Remarkably, when the locks don't work, the car starts up automatically when the door is opened.
Now certainly if no thief came along to open the door, it wouldn't make any difference if there were working locks on the door. But most of us live in the real world. Someone will eventually try your car doors to see if they are locked.
To make matters worse, the government has allowed Microsoft (continuing with your analogy) to be the only car manufacturer in the country. Everyone relies on these cars that are continuing to be built with faulty locks. Businesses use them. Police use them. Unfortunately since all of the cars are vulnerable at any time, nobody can count on their cars to be around when they need them. Nobody can leave anything in their cars, since the locks don't work.
Quit complaining about people who point out that the software you're developing is substandard and get back to work trying to improve the damn stuff. Biased comment my ass!
The difference between Linux and Windows is that Linux does not have hooks deep into the kernel that a virus running in user space can exploit.
Do tell what some of these 'hooks' are.
I have NEVER had a problem with a virus because I've never done much of my work on an MS Windows system and now don't use any Microsoft software at all. My machines run only GNU/Linux. I continue to be amazed that a company that consistently produces such poor software can stay in business when patently superior alternatives are available. The only thing newsworthy about the fact that they are going to make a half-baked effort to deal with a problem of their own creation and get people to pay for it is that they have the chutzpah to try it.
Just depends on how this level of security is implemented. I think its horse shit that Microsoft sells fixes for its own cataclysmic flaws. Its too easy to perpetuate that kind of business. System security, like with *nix, should be on the kernel level with other applications enhancing and managing it, not on the application level leaving system security to the wits of the user. This top level handling of viruses is, redunantly put, another ploy to extend their monopoly. Its far too convenient for Microsft to say 'well you bitched about the security and we are offering a fix, so shut up' when the bottom line is that these problems should never have existed in the first place, and Microsoft should be held accountable for that.
You are about to give someone a piece of your mind, something which you can ill afford...
What's interesting to me is that this could be their side door to
n /kidtalk.mspx)
:-)
making Windows a subscription operating system, a universally
repugnant notion. But they may get their users to drink this
particular koolaid in disguise. Let the word twisting begin. I
propose:
Microsoft UnCare
Microsoft WhoCares
Microsoft OneSnare
Microsoft BlankStare
Microsoft 0n3C4r3
(http://www.microsoft.com/athome/security/childre
Copyrights etc. You heard 'em here first
I believe the offender was scotttrade. :)
they're the only broker/ticker I've found that lists the high for maxco as $951.47, as the article reported.
I guess he really does like giving people more than they paid for
nothing to see here, please move along.
emt 377 emt 4
There were many nasty malware traps for the pre-Mach Mac. Disinfectant (freeware) easily took care of the early ones and some simple precautions took care of many others.
I was always prudent with the Macs I supported (all heavily networked from the 80's on), but it was nowhere near the gut-wrenching havoc we had to fend off on DOS and its offspring.
I think it's misstating the case to say that classic Macs were hard-hit in comparison.
Damn those pesky terrorists
the classic Mac was also hit very hard in the past
The classic Mac OS (that is, up to and including 9.x) had something like 30 viruses (with a few variants). Total. In all its years of running. I'm excluding Word macro viruses, which saw crossover from Windows.
While this *is* pretty piss-poor compared to Linux, this would be phenomenally good from the standpoint of most Windows users.
arn't there rules against a company providing products for all purposes related to an industry (ie. microsoft providing all possible software to computer industry) and then using their influence to make people use only their software?
why would i need antivirus software... oh thats right, i need MICROSOFT antivirus software to secure the crappy insecure MICROSOFT Windows software...
hmmm... tiger was $130 right?
Mike
I heart the RIAA & MPAA, im sure its mutual...
"DOS ain't done til Lotus won't run."
You know, just in case one of us /.ers goes outside and meets a woman (gulp!) and she asks why her Lotus product won't run...
Big if.
Which "problems" do you propose they fix, and how ?
That has nothing to do with Windows and everything to do with the applications that allow it.
And even straight exe files are executable simply because of there name.
NTFS also has an execute permission, if you want to use it.
I don't think that Microsoft will be able to bundle this lovely piece of software with their operating system, mainly because they would have to shut out the version of Windows launching with Norton preinstalled. Even though it comes with only a trial on some systems, it's there and is meant to be upgraded to full. Also, with other virus protection software that Microsoft advertises (not saying they will stop, but you know... their product needs to be on top according to them) they will dismiss it. Microsoft will want their anti-virus software to sell more than anything else. But I think the same will happen to this than the same with WMP, except they will probably try to sell this. But I don't know, I guess we will have to see what happens -- Microsoft Anti-Spyware was actually a nice little piece of software. It's free and you can download it no problem if you want it... and people do. I use it and enjoy it and the same might be said about this program. This is just my two cents though, nothing more, nothing less.
"Instant gratification takes too long." - Carrie Fisher
Neither does Windows.
The fact that you can run a virus in user space on Linux means nothing. It can't cross the line between user space and system space unless it has root privileges which means coding an unpatched root exploit into the virus.
Neither can it on Windows.
Except there are more unpatched root vulnerabilities on Windows than Linux. Do I know which ones? No - because they haven't been discovered yet. But based on MS history, they will be. Far fewer will be found on Linux and they will be patched quicker.
And your suggestion that there are no hooks into system space is just plain stupid. Currently patched systems do not count - it's the future holes that count.
Troll.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
Evidence ?
Do I know which ones? No - because they haven't been discovered yet.
No, I didn't think you had anything apart from meaningless rhetoric.
But based on MS history, they will be. Far fewer will be found on Linux and they will be patched quicker.
I think you'll find the proportion of privilege escalation exploits is weighted far towards the unix side of the equation.
And your suggestion that there are no hooks into system space is just plain stupid. Currently patched systems do not count - it's the future holes that count.
Then, presumably, you have some evidence to support your assertion ?
Congratulations, you've just condemned pretty much every piece of free software out there.
To truly solve the virus problem, limit the authority of running programs.
So your solution is for users to become computer experts ? Yep, I can sure see that being popular (not to mention, if they did that then current systems would be more than sufficient).
Okay, I'll play your game.
You have some evidence to disprove my assertions?
Thought not.
Windows troll.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
ActiveX (get rid of it altogether).
Deploy basic safety nets at the framework (kernel/library) level.
Whole classes of buffer overflows can be avoided with very little effort these days. Yet, MS refuses to do so. Remember, a while back, you could use a specially crafted BMP image to trigger an exploitable buffer overflow. This is ridiculous.
Don't encourage the user run as "Administrator". Heck, don't let him.
At the very least there must be prominent warning messages all over the place, screaming that the user is doing something exceptionally stupid right now.
Don't let fucking office macros write to the filesystem or exec() without popping up 20 warning messages.
Do something to the so called outlook address book so that not every fucking trojan can use it to broadcast itself.
Do not open RPC ports to the world. No, the dysfunct firewall that ships with windows (have they fixed it finally?) doesnt help.
Audit *all* services that *could under any circumstance* be exposed to the outside world and harden them. Better would be generic mechanisms (see "safety nets" above) so that at least these exposed services are protected from buffer overflows and the like.
Well, I could on for a bit, but the essence is: Windows is so broken (securitywise and in many other aspects) that large parts would have to be rewritten to fix only the worst of insanity. They need to scrap it and start from scratch - just like apple did.
Mac OS X shows the way how a modern "Joe Sixpak" operating system is supposed to work. Stable foundation for the backbone and a shiny surface that can't cause much harm even when there are bugs.
It sure has some flaws of its own but none that I know of comes even close to the truckloads of braindead-ness from redmond.
I've actually used this software to fix problems that McAfee couldn't (the boot time scan is not possible with McAfee).
Another good, free alternative is AVG Antivirus [grisoft.com]
It's great for tinfoil hatters too, since you don't even need a registration code.
Don't anthropomorphize computers: they hate that.
Goddamn dupe people.
Wakey, wakey.
NTFS may have an execute permission but you need to use third party tools to access it.
Let's just hope it does a better job at getting virus than their beta Spyware removal tool!
Donate to the cause HelpMeGetAMac.org
I think that Microsoft has an ethical responsibility to provide free AV to its consumers.
First off, a large number of virus' out there are a direct result if the software flaws of the M$ OS. If M$ were to charge for AV, for the conspiracy theorists, it could almost seem that they were intentionally putting out flawed software to drive sales of their AV.
It's been reported that Microsoft was going to sell their AV, but at a price that completely undercuts the likes of Symantec. In other words, Microsoft is trying to bully their way into the market and make sure they get at least "enough" of their share to make it profitable, but while still trying to fend off anti-trust lawsuits.
With all the software that M$ has been putting out lately, including the anti-spyware tool and firewall, this is the LAST thing that Microsoft should be charging for. With such a small market out there actually keeping anti-virus, and up-to-date anti-virus, this has a big potential for Microsoft to really cut down on those rampant virus outbreaks. That alone would boost their image in regards to security with the general public.
As for anti-competitive behavior by offering it for free? Screw it. Anybody who's had to deal with Symantec tech support will be able to sympathize with the rest of those who have had to deal with their lousy support practices. From that perspective, I don't care if Symantec were to go out of business. Innovate or die. The same goes for the others. Come up with something better that people will want to use, or go under. This kind of security too big of a deal to charge people for.
I'm not asking for some completely revolutionary AV software with uber functionality. However, I believe that M$ would be alienating consumers that are going to give them a really funny look when they see that the same company that is a result of the reason they lost all their data last time they had to reformat their HDD is now trying to hustle AV software onto them.
As I said earlier, I think it's both an ethical responsibility for M$ to provide AV software to their consumers at no additional charge, as well as a PR responsibility.
A community-oriented lyrics site
Sandboxing it would be sufficient. Really, it's just an application delivery tool and in controlled, trusted environments it's very useful. I think disabling it by default and making re-neabling it non-trivial (eg: only by GPO) would be a reasonable solution.
Deploy basic safety nets at the framework (kernel/library) level.
You'll have to be a bit more specific than that.
Whole classes of buffer overflows can be avoided with very little effort these days. Yet, MS refuses to do so.
Actually, they do - one of the reasons XP's SP2 was so large was it replaced large portions of the OS and supporting code recompiled with safer compilers to reduce the possibility of buffer overflows. It's also one of the reasons some applications broken with SP2.
Remember, a while back, you could use a specially crafted BMP image to trigger an exploitable buffer overflow. This is ridiculous.
But not uncommon. A similar bug was also found in the GTK and QT libraries when dealing with PNG images not that long ago as well, IIRC (not so sure about QT). Buffer overflows are the quintessential unix error - hardly something found only on Windows.
Don't encourage the user run as "Administrator". Heck, don't let him.
I wouldn't say they *encourage* it, but I'll agree they don't do enough to *discourage* it. I can't agree with disallowing Administrator users altogether, either.
The biggest hurdle to curtailing Administrator usage in Windows is the mod-boggling large number of software developers who are too stupid/ignorant/lazy to write proper code. Lots of applications seem to require Admin privileges to run, and the silly thing is the workarounds are generally trivial permissions fiddling that demonstrate the developer is simply doing the wrong thing (eg: Doom 3 "requires" admin access because it tried to write to a file in the program's directory - modify the write privilege for that one file appropriate and it runs perfectly as a regular user - I have to wonder of the Linux version is similarly broken and, if not, why not).
This is less of an issue in a managed environment, as admins can make the appropriate permissions changes so the applications work and the end user need know nothing. However, in the unmanaged home user scenario, where the user typically isn't capable of making such changes, there's little option but to open everything up just so they can use these poorly written applications.
Fundamentally, it's not a problem Microsoft can be held responsible for, or exert a great deal of influence over.
Don't let fucking office macros write to the filesystem or exec() without popping up 20 warning messages.
This is an Office issue, not a Windows issue Certainly, Microsoft is responsible for Office, and the wisdom of a scripting language that can do that sort of thing is questionable, but we're talking about *Windows*, not applications that run on Windows.
Do something to the so called outlook address book so that not every fucking trojan can use it to broadcast itself.
If you can think of a workable way to do this while retaining the usefulness of an address book, I'd be impressed. Besides, it's not like doing the equivalent on most other systems is particularly difficult - a simple grep command through home directories will get you a fairly comprehensive list of email address on most unix machines.
Do not open RPC ports to the world. No, the dysfunct firewall that ships with windows (have they fixed it finally?) doesnt help.
You have a point, but the firewall does fix it quite adequately by blocking any traffic.
Audit *all* services that *could under any circumstance* be exposed to the outside world and harden them.
This is happening. They're also (finally) starting to run listening services at low privilege levels (another change XP's SP2 introduced).
Better wo
You need to convince them to save the file, make it executable, and run it. The instructions are different for each MUA, and the default save-to directory may be different on each MUA, and may also differ between distros.
/home with the noexec or installed an SELinux kernel (which ships with Mandrake and several other distros) all bets are off.
You have to either send a massive statically linked binary or get the system libraries right first time, or send an interpreted language program (ie, people can easily look at it to see what it does; even non-programmers can see nasty-looking strings and many of them are not going to be too happy about a big, opaque block of hex and a decrypter stub).
On Mandrake systems at any but the most token security levels, the user needs to be a member of the ntools group to use any network tools. Of course, if the admin mounted
If you want to send spam, you either have to code the SMTP yourself (and get it right) or depend on the sendmail binary being visible to the user.
And so on.
Got time? Spend some of it coding or testing
And shoot the bugger who modded it down!!
Pain is merely failure leaving the body