Slashdot Mirror
Windows Gets Independent Security Certification
linumax writes "Microsoft Corp. on Wednesday clinched Common Criteria security certification from the U.S. government's National Information Assurance Partnership for six versions of its flagship Windows OS. The products receiving CC certification include Windows XP Professional with Service Pack 2 and Windows XP Embedded with Service Pack 2. Four different versions of Windows Server 2003 also received certification. Common Criteria certification, which was ratified as an international standard in 1999, helps customers in key market segments evaluate IT products when making software purchase decisions and contribute to higher levels of consumer confidence in IT product security, Lipner said. SuSE Linux ES 9 has already achieved the certification and almost a year away from being released, Red Hat Enterprise Linux 5 is on the path toward EAL4 certification."
It's as secure as 95% of the destops out there. That's a good score!
Pigs have flown and it's getting a little chilly in Hell.
I am officially releasing my certification of "The Highest Level Of Security", and giving it to my pet OS, ELKS!
Therefore, ELKS is the most secure OS in the world.
The press meeting will be at 24:01 December 31st.
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
They're giving these things out to ANYBODY.
Get paid to code OSS
"This just in: Businesses and Government IT Professionals quickly abandon Common Criteria security certification as a security standard of any useful purpose."
From Wikipedia on a previous certification: "The fact that Microsoft Windows 2000 remains an ISO 15408 certified product, without including the application of any Microsoft security vulnerability patches in its evaluated configuration, shows both the limitation and strength of an evaluated configuration."
I believe that it also shows the limitation and inherent weakness of this criteria as a "security" certification or a confidence booster for consumers. Unless, of course, anyone here reasonably believes that any completely unpatched version of Windows is secure by any stretch of the imagination. I read about a machine like that once that never needed patching... it was unplugged from the net, stripped of all peripherals, dipped in molten lead, and buried inside 10m^3 of concrete and dropped into the middle of the ocean, thus becoming the most secure PC ever. I think it ran FreeBSD, too.
I8-D
Well, it only took 4 years to finally certify XP. Although I guess that's not bad when you consider that in another 4 years they'll have Vista to start evaluating.
https://www.eff.org/https-everywhere
They should have used OpenBSD.
David Gould
main(i){putchar(340056100>>(i-1)*5&31|!!(i<6)<< 6)&&main(++i);}
Man, that just list looks just like assembler op-codes for some kind of bizarre processor.
READY.
PRINT ""+-0
So, who sets the security requirements? Does this certification have any value, or is it the equivalent of "smiley faces for everyone"?
They used OpenBSOD.
*Disclaimer: This post requires flexible definitions of safe, secure, security, and unbreakable.
And I get laid on a fairly regular basis, thank you. Chicks dig a guy who knows where the apostrophe goes.
Ouch! Oh, great. Now I have...Ouch!...monkies flying out of my butt. Ouch!
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage