Slashdot Mirror
EU And Microsoft Clash Over Vista Security
An anonymous reader wrote to mention coverage of further clashes between Microsoft and the EU, this time over security in Windows Vista. Microsoft is 'urging' the EU to allow all of the security elements of Vista to remain intact. The EU seems to be under the impression it's not asking for security to be lax; it just wants the software company to ensure a fair playing field for all businesses. From the Newsday article: "European Union officials warned Microsoft Corp. on Tuesday not to shut out rivals in the security software market as the company plans to launch its Windows Vista operating system with built-in protection from hackers and malicious programs. EU spokesman Jonathan Todd told reporters that the European Commission is "ready to give guidance to Microsoft" concerning Vista but added that it was up to the U.S. software maker 'to accept and implement its responsibilities as a near monopolist to ensure full compliance' with EU competition rules."
How about they release a European version with no seucrity and we all sit back with some popcorn and watch as they all get hacked. Not that Microsoft security works or anything but least it makes hacking more challenging and slows em down a bit. I wish I lived in Europe because about a third of my computer repair jobs are caused by Norton.
now stop reading and go play Dance Dance Revolution!
Hackers must unite. When MS bundles in their own security, and users start not purchasing 3rd party protection, hackers must unite and start an all out war on Vista. Then we need a perfectly timed Associated Press article released that shows a correlation between the release of security bundled in Vista, the diminished use of 3rd party protection, and the increase in security breaches. Then we will win, right?
Microsoft spends most of its time producing new OS features in collaboration with other vendors. DRM, drivers, APIs all designed to make MS OSes work better with the rest of the products people will buy. That takes much longer, and more code, than the rest of the OS does.
But its "security" features are MS only. Of course that must be to protect the MS "near monopoly", always its #1 priority. Since the security market is neither very profitable nor already dominated by MS, I expect that their "security" also protects revealing other serious defects of the OS. Whether more monopoly protection, unnecessary security problems, or just bad coding. Therefore I don't see Microsoft opening those facilities for the EU before Vista is released, if ever.
--
make install -not war
And if the "whole infrastructure [is] extremely vulnerable," third-party applications will be created to shore it up.
What's the problem again?
Your mileage may vary, but mine is constant.
And the one in the media spotlight. If you actually do some research you discover that for as much as people whine about MS's anti-competitiveness it's much, much worse in other areas. If you want a scary one look in to Sysco. They own basically every grain silo in the US. They, in a very real way, control the US food supply. Yet nobody makes a fuss because they aren't in the limelight.
It's just how it goes, when you are the one making all the news, you are the one that takes all the shit. The US is another great example. Doing some research you find that plenty of countries engage in imperialistic behaviour, shady deals, etc, etc. However none of them are the news makers the US is and none of the have the same military might, so the US is the one that draws the most ire.
--- Begin Sarcasm ---
Right!
We need to have the EU sue apple and linux producers too for destroying the anti-spyware market in their areas too!
We have to make sure that every OS is insecure so that other companies can profit!
--- End Sarcasm ---
Look, I'm no fan of Microsoft, (I figure I'll be wholly on linux by the time Vista comes out) but you can't force the company to make an (more?) insecure operating system so that security companies can make their dime.
Hmmm witty sig or funny sig? Maybe elitest techy sig!
It seems as though Microsoft is / will have it's security products built into Vista, and will most likely build them into the TCP/IP stack at some level. Here is what most people seem to be ignoring here, and it's pretty simple.
d =l1o2uFAj23U~/
As it always has been, you can choose to use or disable any part of any feature in Windows. As it sits now with RC1, you can enable / disable features at will. Wireless networking configuration is built into Windows XP, but as everybody here knows who has a wireless network device of some sort, upon driver / software installation, that application takes over the duties of the Windows feature, usually by default. I don't know why anybody would have a reason to think that this would be any different from having a firewall in the OS, which, at the request of the user (by way of installation) gets replaced by some other product. We'll leave the discussion about inferiority for another time.
People really should stop talking about a feature of Vista as if its sure to be some set in stone incumberance, and it most likely will not be.
Oh, but it's built into TCP/IP! Anybody here ever installed the Novell client in Windows? Ever see what it does to your network protocols? Microsoft has said time and time again that it is keeping with backwards compatibility, are we naive enough to think that this won't include clients, protocols, craptastic software firewalls and anti-virus-viruses? Not so much. For those of you that need to experience a Novell client install for yourselves, go ahead. It's uninstallable. http://download.novell.com/SummaryFree.jsp?buildi
Windows has more viruses because linux has more virus coders.
There is one problem with the situation as you describe it though. Often, in order to make something as secure as possible, it needs to be as proprietary as possible. I don't want to get into an open source / closed source security debate but look at it like this. If all of these hooks are integrated into the system to allow built in security measures to be disable then those same hooks can be used to compromise the system by some adware software that is masquerading as a firewall / AV service. It's been my experience that the only people running XP that have spyware issues are the amateur users who can't tell the difference between an actual windows error message and a web browser pop-up with a fake error message. Those people install software without reading anything about what they just clicked "OK" to. And those are the same people who will just as likely install some 3rd party software in Vista that will use these hooks to compromise the entire security system without the user even noticing.
It's not so different in the Linux/OSX world either. I've installed Ubuntu a dozen or more times now and NOT ONCE has it asked me a single question related to security other than to enter my user password. No firewall setup, no anti-virus software, etc. (I know, since no ports are open my default I don't need a firewall). OSX is no different, everything is integrated (except AV) and the user isn't expected to go and hunt down any 3rd party firewall software. Just select which services you want to run and you're good to go. Why should Windows be any different. This whole EU proposition is definitely not in the consumer's best interest. It almost goes as far to say "if you're software can't be infected by spyware then you're going to put a bunch of anti-spyware companies out of business and that's not good for the economy." Well I'm sorry your business model isn't going to be able to keep up with evolving software and technologies. However, just because a shortcoming on Microsoft's behalf created a job for you 2 years ago doesn't mean that they are in your debt and have to provide that job forever. Just my two cents.
But is it in the best interest of the public to cripple the security of an OS because a market around bugs has cropped up? Is it in the best interest of the people to remove security out of a product so that they individuals will have to turn around and buy something? Seems pretty darn insane if you ask me.
However, the major security companies have already found ways to hack round all this to make their products work - and if they can, so can malicious people. So what's the point in having it? It just makes the security companies have to spend more money, increasing the cost to the user in most cases. That's about it.
Let me quote some AppArmor literature. It's really vastly superior to Vista, in that AppArmor isn't a "hacked on" bandaid, but a fundamental hook into the lowest levels of the system; AppArmor has incredibly fine grained controls; and AppArmor is not terribly difficult to work with.
/usr/sbin/ntpd { /etc/ntp.conf r, /etc/ntp/drift* rwl, /etc/ntp/keys r, /var/lib/ntp/drift rwl, /var/lib/ntp/var/run/ntp/ntpd.pid w, /var/lib/ntp/drift/ntp.drift r, /drift/ntp.drift rwl,
Security Through LSM: Linux Security Modules Interface
To achieve security (non-bypassability) mediation methods like AppArmor need to be inside the kernel. AppArmor originally was a kernel patch, but that imposes major problems for distribution and deployment, especially for enterprise users. To achieve kernel-grade security without requiring a kernel patch, Immunix Inc. (who developed AppArmor prior to Novell's acquisition) developed a feature for Linux 2.6 called LSM: Linux Security Modules interface. LSM provides a kernel API for modules that allows loadable modules to do effective access control mediation. Other participants in LSM development included the SELinux community, IBM, and assorted other open source community developers.
Mediation at layers other than the kernel, e.g. in libraries, leads to bypassability: if an attacker can induce arbitrary code execution in a confined application (e.g. buffer overflow) then they can cause the program to call the kernel directly instead of through the library, thus bypassing the mediation. Moreover, such mediation is best done deep inside the kernel, rather than by intercepting system calls
Transparancy Through Familiarity
To achieve transparency, AppArmor uses all-classical UNIX security semantics, but applies them to programs. An AppArmor policy specifies the set of POSIX.1e capabilities that a program can have, and specifies the set of files it can access. The POSIX.1e capabilities are specified by name. The files are specified by absolute path names, including embedding shell-syntax wild cards, followed by access modes (R, W, and X, with a bit of embellishment). So an AppArmor policy to confine ntpd (the network time protocol daemon) looks like this:
#include
#include
#include
capability ipc_lock,
capability net_bind_service,
capability sys_time,
capability sys_chroot,
capability setuid,
}
Keep in mind this stuff can be created from GUI.
From here, it would be relatively straightforward to hand-craft security policy for applications through a combination of expert knowledge and trial and error. However, that would be so tedious that the vast majority of developers and users would refuse to put in the work. To further improve transparency, AppArmor includes a "learning mode" to allow policy to be built by running the application and observing what it does. In learning mode, the rules are not actually enforced, but violations are logged, and process forking is tracked, so that the log of an application's execution builds up a characteristic description of the application's activities. AppArmor includes a log analysis program that scans the log, prompts the user with questions, and automatically creates a program profile. Learning mode and the log analyzer are also capable of incremental improvement of the profile if one already exists, but omits some necessary rules.
Application Security and System Security
An individual application can be secured using an individual profile, but how to secure a system? A vital question in securing any system is "against what threats?" We could profile all of the programs on the system, but that would be a lot of effort, and in most cases unnecessary. For instance, consider the network threat model: we wa
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
Besides security non IE browsers and non outlook email clients are almost indistinguishable to the average user. THAT is the reason for that problem. If I show my dad a webpage in Opera he most likely will not notice any difference from IE other than buttons are in different places. The same goes for outlook. Both of those are simple tools that perform simple tasks and do everything most users need.
Look at other areas where MS has a similar product included with the OS such as firewall, MS paint, windows media player, etc and you will see that products that perform better and are noticeably better to not just the power user but also the average user get LOTS of business such as ZoneAlarm firewall, Adobe photoshop, Cyberlink Power DVD player and Nullsoft WinAmp.
Bringing up how IE shows a reason that MS shouldn't bundle software is pretty much pointless because back in the day when IE and Netscape Navigator were the two main browsers Navigator ended up losing because IE was just as usable and at times even performed better (well speedier which equals better to the average user). IE is still the majority because it does everything the average user needs which is displaying webpages, woo big job to do there.
FireFox/Opera/etc are becoming more popular now both for security reasons that users are finally beginning to understand as well as they provide more functionality than just being a tool to display webpages and people are starting to see both benefits.
I say let MS bundle all the software they want, it usually is just software that provides BASIC functionality and anyone who wants better WILL go elsewhere keeping software companies in business. If you work for a company who makes software similar to what MS might be bundling with Vista instead of hoping the EU helps "protect" you why don't you just make your application so kickass and full of features that people will not want anything else?
Hey, there is only one Return and it's not of the King, it's of the Jedi.
The underlying thought here is that some people think it is better that Windows not implement security features, based on that they would be in competition with products that provide those security features. This whole premise is absurd - to leave a necessary feature, especially a security feature, out of windows because it might step on someone else's toes.
What is Microsoft's other choice? Leave out security software and be roasted for leaving it out? What makes you think 3rd party vendors could provide security packages that are better than Microsoft's? You'd just end up with multiple patches and multiple serious problems down the road. What happens when Joe user installs patch 1 from Vendor A, then 6 months later switches to Vendor B and installs their patch 2? What a mess.
The comparison of MS Word being used because it comes bundled is not realistic at all. If Word is not bundled on a machine (which much of the time it is not unless the user specifically chooses to have it pre-installed), that user will still have to find a product to use and install it. How does that differ from having Word and not being happy with it - all he has to do is find a different product to use and install it.
I absolutely agree that I'd rather not have to use third party software to keep my system secure. If they indeed do a good job. As long as you have the option to turn the default built in tools off and install your tool of choice, I think MS has done their best job. They would be seriously amiss to just ignore the issue and count on the end user to implement their own software - much of the time it's not going to be done and the system will be left vulnerable.