64-Bit Vista Kernel Will Be a "Black Box"

ryanskev writes with news from RSA Europe, where a Microsoft VP spoke bluntly about the lock-down that will apply to 64-bit Vista. From the article: "Microsoft will operate 64-bit versions of Windows Vista as a tabernacle, with the kernel as the holy of holies, where only its own high priests of security may venture." While Microsoft has seemed to be making some concessions to the likes of Symantec and McAfee, considerable doubt remains as to their ultimate future.

Comments

Sounds like the right plan

[Zeinfeld]

Sounds like the right approach to me. We will soon find out whether Symantec and McAfee are helping or hindering security.

Re:Sounds like the right plan

[Coopjust]

Either way Mcafee & Symantec will claim that it was needed later, simple business.

If the new model seems to be secure, Mcafee and Symantec will boast about how they've kept the next generation of Windows safe.

If the new model is less secure, McAfee & Symantec will "point out" the need for their products.

Win win for AV companies...

Re:Sounds like the right plan

[PieSquared]

I get the feeling it will end up that Symantec and McAfee products will be able to replace the default windows security, but since the windows version is free and just as good there will be no reason to pay and security vendors will fade into obscurity. About two years later, after the old security vendors are all dead, the windows security will stop getting major updates and ten years later (shortly before they release the next version of windows) free, open source replacements that are disadvantaged from the start due to not being worked into the OS will begin being used because the old windows version does pretty much nothing at this point! Suddenly one of these will break out from the others with massive marketing and slowly people will begin to switch, eventually forcing windows to finally update again.

Re:Sounds like the right plan

[QuantumG]

I'm trying to understand what you're in favour of here (and what the article is all about). As I understand it, Windows Vista 64bit Edition will simply not allow kernel drivers to load unless they are signed with Microsoft's private key. Which means that you'll need to either exploit kernel bugs to load your own code (which they'll plug eventually) or boot off a CD and patch the kernel files on disk to disable this checking (which will be hard to do without destablizing the whole system). If that's what we're talking about (and I have no idea if it is) how can you possibly be in favour of it? I mean, it sounds like The Right To Read all over again.

Re:Sounds like the right plan

[smittyoneeach]

MicroSoft has historically, and cleverly, built the market by putting out, shall we say "minimalist" interfaces and then let third parties do the grunt work of establishing the product category.
If the category becomes profitable, Mr. Softy can "find the principle, and buy him[1]"
You see this in tools, as Redmond pushes a Visual Studio release, and little third-party vendors groan as thier value-added kits have their coolness reduced by new chrome and tailfin on the library widgets. I'm guessing that there will be suffiecient room to put some polish on 'Doze.
Too, there are going to be plenty of people that puke at the odious licensing policies, and stick with the tools that have helped them limp along thus far.

[1] To quote my personal favorite Redmond Sales drone, on the consumption of Groove Networks.

Re:Sounds like the right plan

[Anonymous Coward]

Kernel hooks scare me, if they all disappeared I would be happy to say goodbuy to the likes of hackerdefender and various other rootkits which operate as windows kernel drivers. If a system can be made to prevent userland from installing drivers via driver signing and protecting certain parts of the file system and registry from even administrators in all ways that could be used to load shady drivers or certificate chains on bootup..etc it would have real value from a security point of view.

You don't need to make concessions to security vendors - demand any kernel drivers they install be signed by microsoft and the security vendors both stay in business but they focus more on the application layer and they pay Microsoft. Everyone wins.

Admittantly the devil is in the details as driver weaknesses can be exploited to gain kernel access at some point Microsoft needs to choose the ultimiately high ground / ideal / correct path and stick to it rather than making concessions to some of the leaches who depend on old sillyness (kernel hooks!!) that may very well end up leading to less security for everyone.

Re:Sounds like the right plan

[vmardian]

I can't figure out if you are intentionally or unintentionally describing Netscape vs IE -> Firefox.

Re:Sounds like the right plan

[Zeinfeld]

As I understand it, Windows Vista 64bit Edition will simply not allow kernel drivers to load unless they are signed with Microsoft's private key. Which means that you'll need to either exploit kernel bugs to load your own code (which they'll plug eventually) or boot off a CD and patch the kernel files on disk to disable this checking (which will be hard to do without destablizing the whole system). If that's what we're talking about (and I have no idea if it is) how can you possibly be in favour of it? I mean, it sounds like The Right To Read all over again.

Thats exactly what I want. I do not want to have any software patch the kernel.

If there is no way for the spyware to patch the kernel I don't need McAfee or Symantec there at all. First thing I do with a new home machine is to strip off the AV software provided by Dell as cramware. Machines run so much faster and more reliably without. Then I turn off AutoRun and hook it up to my internal network which has twin SPI firewalls.

I have never had a virus but I have had machines go wonky because of buggy AV code.

I want to have as few kernel mode device drivers as is possible. Printers should not require kernel mode, nor should video cameras etc. Only the bare essentials talking directly to the DMA interfaces should ever use kernel mode.

I don't need to run my code in kernel space and I don't think anyone else does either.

Re:Sounds like the right plan

[gkhan1]

I would rather they went with the linux model of advanced permissions and a (seldom used) root account that had permission to everything, but I see this atleast as a vast improvement over XP. Imagine how much harder it must be to make a rootkit for a kernel that's locked down this way. It's probably not impossible (well, if you modify the system from outside the system, it's certainly possible), but it has to way, way harder.

Re:Sounds like the right plan

[obeythefist]

This is all well and good for Microsoft to say "No access to 64 bit Kernel!".

But two questions come to mind:

1) If other A/V companies can do A/V software without kernel access, why do McAffee (or as some other slashdotter erroneously called it, McCafe) and Symantec need kernel access? Why are they so special?
2) Does Windows Defender/OneCare have kernel access, Microsoft?

I would expect that the clear best answers in a perfect world that we probably won't get are:

1) They don't, they're bastard parasites with no real business model who'll be first up against the wall when the revolution comes
2) It doesn't, because Microsoft works on a level playing field.

Re:Sounds like the right plan

[QuantumG]

Yeah, ok. There's so many things wrong with your world view that I'm having trouble understanding where to start. Hmm.. ok. First off, spyware doesn't typically modify your kernel, and yet, spyware doesn't really have much trouble spying on you. AV software, on the other hand, typically does modify the kernel, because you need that sort of low level stuff to detect spyware reliably. Otherwise the spyware can just hide itself in places you can't look unless you're the kernel. Does that make sense to you? Ok, great. Now let's say that you're quite happy living under the thumb of Microsoft and are quite happy to trust that they are doing a good job. It sounds like you are. What happens when you tell Microsoft they fucked up and they just ignore you? "We'll I'll take my business to some other AV software supplier!" Yah, that ones you just advocated neutering.

Re:Sounds like the right plan

[QuantumG]

kernel overflows.. same way you modify a linux kernel after it's had the "no more modules may be installed" bit turned on. See, it's really easy for hackers, they just grab the latest kernel bug that has been found and plug it in to their rootkit. Same with dodgee spyware people. But legitimate software developers can't do that. It'd be unethical.

Re:Sounds like the right plan

[MrShaggy]

The above replier made a great point.

Either OpenSource or a MAC solution. I think that it will be mac.

We just bought an iMAC and its the best of both worlds, in-my opinion.

reasonably stable, yet pretty enough for the Chicky.

Mac has years of marketing, and a slow build. Maybe if they did forget about the hardware and just license the OS, as some have suggested, it would push MS away.

firefox kicked their assess with the better browser. Mac could do the same with the better platform.

Re:Sounds like the right plan

[Anonymous Coward]

AV does not need kernel access. HIPs and other behavior based technologies do. This is the stuff that actually works without the need for constant signature updates. You know, the type of technology all the slashdot zombies keep harping on AV companies about.

What Microsoft is really doing is leveling the playing field to their advantage. They have technology for security features A, B and C. Whereas McAfee and Symantec have features A, B, C, D, E, F, G, H. Now Microsoft is taking away that competitive advantage by making the OS only work with technologies A, B and C. That was part of the Security Center debate. It only made it easy to manage those three basic features. It made it hard for other companies to compete based on better technology. Once Microsoft develops technology D, they'll probably open up the OS to allow the other vendors to do it as well. So long as they allow their competitors to do all the same things they do (and nothing more), they're not abusing their monopoly, right?

Re:Sounds like the right plan

[omicronish]

1) If other A/V companies can do A/V software without kernel access, why do McAffee (or as some other slashdotter erroneously called it, McCafe) and Symantec need kernel access? Why are they so special?

In case people are wondering, yes, 64-bit Vista anti-virus software exists. See this post for details.

Re:Sounds like the right plan

[DaveWick79]

The problem is, McAfee and Symantec's "security" products don't improve the security of the operating system at all. They are basically open ended coverups for every new problem that comes along.

There are already plenty of free security utilities out there that are equal to or better than the big two's products. As long as Windows has this open architecture that invites malicious software to compromise the OS kernel and it's low level operations, Symantec and McAfee will have plenty of market share. What they are really worried about is if Microsoft actually does a good job of keeping the OS secure to begin with, nobody will have a reason to buy their products. It has nothing to do with replacing built in products or services, because people will do that anyways. Essentially you're going to pay somebody, and most people aren't going to be excited about paying more money to MS.

Why aren't they crying foul about Mac OS and Linux because they have no market share there?

Re:Sounds like the right plan

[gkhan1]

Well, yeah, so you can do it, but it is a hundred times harder. Those kind of bugs do get patched, and the hackers need to constantly look for new ways in, lest their code be obsolete. The XP core you could just modify willy-nilly without anyone caring, but this time it is atleast protected.

This feels like one of those issues that MS just can't win in the geek-community. If they left it open, you'd be complaining that it is insecure. If they lock it down, you complain that their locking third parties out. According to you people, they can't win!

Re:Sounds like the right plan

[QuantumG]

Yeah, that's what happens when you clump people together and claim they all hold the same opinion, you get contradictions like that. Some of us think it should be locked down. Some of us think that's a terrible idea. We're not the fuckin' Borg. What's your opinion? I mean, shit, this is the ancient choice between freedom or security.

Re:Sounds like the right plan

[jZnat]

why do McAffee (or as some other slashdotter erroneously called it, McCafe)

And others misspell McAfee as "McAffee". Your point? ;p

Re:Sounds like the right plan

[Anonymous Coward]

bzzzzzzzzzt thanks for playing but wrong on all points. spyware and anti virus detection has no need or low level kernel access and spyware cannot hide unless it is also exploiting low level kernel access. if spyware does not have the access then the antivirus software also will not require the access.

Most antivirus software does not use unodcumented kernel access the way symantec and mcafee do. This has never been a requirement to be able to detect virus's and spyware.

Re:Sounds like the right plan

[gripen40k]

Yeah, but do you really care about his opinion? Does anyone here really care about anyone's opinion other than those who agree with his/her own opinions? I'm not trying to be cynical, I'm just stating something I've noticed over the years... Well... I guess that is being cynical then.

Re:Sounds like the right plan

[quanticle]

firefox kicked their assess with the better browser. Mac could do the same with the better platform.

How has Firefox "kicked their ass"? I'm not trying to defend IE, but last I saw, it still had nearly 90% of the marketshare. That's the kind of market domination that many companies would kill for.

Re:Sounds like the right plan

[newt0311]

oh yes. no kernel based drivers. now... how do you plan on getting that nice software like openVPN work? or how about those file-system readers such as e2fsd? locking the kernel is a very good thing but only to a certain extent. nobody can tell what a piece of software will ultimately be used for and thus designing it completely is impossible. if you want a kernel which only does the minimum and lets userspace do the rest (thus actually making a black box kernel usable) you need a micro-kernel and last time I checked, no MS OS used a micro-kernel design. The closest the micro-kernel design has come to PCs is in OS X but even that is not really a complete micro-kernel (notably, there are some micro-kernel designs in production uses such as QNX and vxWorks but those are speciality products restricted mostly to embeded products like routers).

Re:Sounds like the right plan

[newt0311]

please see my earlier post about the need for kernel hook thorugh some form of modules.

Re:Sounds like the right plan

[no1nose]

Sounds intentional to me. Very good analogy.

Re:Sounds like the right plan

[Axe]

Run them in userspace, where they belong.

Re:Sounds like the right plan

[Plaid Phantom]

We're not the fuckin' Borg.

We're not!? Dang, and I just got this cool eyepiece, too.

Re:Sounds like the right plan

[crasher35]

That's the kind of market domination that many companies would kill for.

Ah. So that's how IE got there!

Re:Sounds like the right plan

[IamTheRealMike]

Yeah, ok. There's so many things wrong with your world view that I'm having trouble understanding where to start.

No, Zeinfelds world view is entirely sane and very defensible. I agree with him.

Let's review a few facts:

• The collapse of residential computer security has meant that virtually nobody can keep their Windows machine secure anymore. Not even gurus. There are just way too many 0-day exploits for browsers and others out there, even for Firefox.
• The usage of rootkits on Windows is now a common technique, often used to hide spyware. Once the machine has been rootkitted it is impossible to repair short of wiping the system clean and starting from scratch. But because of the first point, this is not practical.
• Thanks to the first and second points doing business on the internet is rapidly becoming difficult or impossible. It started with online casinos and porn sites, but is spreading to "clean" business too. How can you run a company when any 16 year old with a botnet can shut you down at a whim?

The foundation of any security system is the kernel. If the kernel is not running in a known state, you have no security system - period.

There is absolutely zero point in having user accounts, authentication, file permissions and so on if programs can load code into the kernel ... which they can, because for historical reasons Windows programs require admin rights, and even if they didn't, ultimately any program can ask the user to do something on its behalf and most will.

The solution is clear - forbid any unknown code from loading into the kernel. Only then can you have a sane system built on solid foundations. It is not a "right to read" scenario, because you can still mark individual drivers as loadable in Vista IIRC if you put it into developer mode (which makes it clear that you are in a special mode), but even if it wasn't, it'd be a price worth paying to help fix the internet.

Re:Sounds like the right plan

[kerrle]

In fact, rootkits and kernel infesting malware have been on the rise in Windows the last few years, and are much more common than you seem to think.

Having kernel hooks wouldn't help AV programs detect this if the malware was well written and had already attached itself - you often need to get out of the environment to detect such problems, as with a live CD. After it was infected, anything the kernel reported would be suspect.

The trick to catching malware is covering the vectors through which it enters the system. No more, no less. The grandparent is spot on as far as I'm concerned.

Re:Sounds like the right plan

[QuantumG]

If he's capable of articulating it, sure.

Re:Sounds like the right plan

[MrShaggy]

Simply put, the only reason that MS is even doing any upgrades is because of what firefox and others have done. MS has been caught resting on their laurels as it were. The idea was that a smaller set of companies were shining lights on the glaring issues that windows has. MarketShare is only a small meter, compared to it's influence. Netscape was the only browser to seriously challenge MS. Mac only has a small market share as does Linux. Does either of these feel any less important ?

Re:Sounds like the right plan

[Anonymous Coward]

Except the parallel port (which many printers still use) requires access to DMA if they are using the ECP protocol....

Re:Sounds like the right plan

[shird]

I take it youve never installed a starforce protected game?

I am all for this.. only the OS and tested device drivers should be running at ring 0. MS gets a lot of flack about unstable systems due to third party drivers which have no need to be running at that level anyway.

Its not much different to the ActiveX saga in browsers. IE is unstable due to plugins which run in the same process space to do things not really necessary by ActiveX controls.

But, if IE were to supply a rich set of APIs and a good security model, there would be no need, and getting rid of BHOs would stabalise the browser.

in other words, the problem of ActiveX controls in IE, is not unlike the problem of ring 0 drivers in Windows.

Re:Sounds like the right plan

[newt0311]

wtf are you talking about. are the NT network interfaces implemented in userspace? are the NTFS file system drivers implemented in userspace either? NO. are there even facilities to implement them im userspace in windows? to my knowledge, NO. In a monolithic kernel, should device drivers and file system drivers ever really be in userspace, NO. Sometime, it is useful, suh as with a driver with a high chance of faliure but in general, it is not done for root file systems etc. Read my comment for once. In a micro-kernel, what you say would be right but NT and VISTA are NOT MICRO-KERNEL DESIGNS.

Re:Sounds like the right plan

[QuantumG]

Sure. It is a microkernel after all. But some things do need to run in ring 0 and if Microsoft gets to choose which of those things can run then I doubt we'll all be better off.

Re:Sounds like the right plan

[Benaiah]

Hah! I dont think that this will stop companies like starforce. They will just fill out the proper forms to MS and get kernel access. Afterall they are anti piracy. If anti-virus get permission to have kernal access it is anti competitive and thus illegal not to give access to starforce. Guess what... If you have norton on vista you will have starforce. (I just hope that they have pissed off enough consumers that no publishing house will use them anymore.)

Re:Sounds like the right plan

[drsmithy]

The collapse of residential computer security has meant that virtually nobody can keep their Windows machine secure anymore. Not even gurus. There are just way too many 0-day exploits for browsers and others out there, even for Firefox.

Whoa there, cowboy. It's not particularly difficult for knowledgable users (and especially "gurus") to keep a Windows install secure.

* Don't run as Administrator
* Don't use known buggy software
* Don't run unknown binaries
* Avoid the seedier side of the internet unless special precautions are taken (eg: running the browser in a dedicated account with extremely low privileges)

Or, basically, *exactly the same precautions you take on any platform*.

Re:Sounds like the right plan

[drsmithy]

In a micro-kernel, what you say would be right but NT and VISTA are NOT MICRO-KERNEL DESIGNS.

Actually, they are microkernel _designs_, they just aren't microkernel _implementations_.

Re:Sounds like the right plan

[bruno.fatia]

* Don't use known buggy software
* Don't run unknown binaries

Basically the 1st excludes Windows; The second excludes any non-open-source application. Shouldn't you just quit and go take a walk then?

Re:Sounds like the right plan

[Anonymous Coward]

It is a microkernel by marketing only.

In NT 3.x, GDI (and half the video driver) ran in userspace, but filesystems, disk drivers, TCP/IP, ethernet drivers, etc, etc all run in ring0. NT 4 and later moved GDI and the entire video driver into the monolithic kernel.

Vista will move some parts (the compositing engine) back out to userspace, but the D3D drivers it uses to do the actual work are still kernel-side.

Re:Sounds like the right plan

[obeythefist]

In Australia, McCafe is a cafe extension of McDonalds restaurants selling cheap and bland coffee, donuts and cakes of average quality. Quite amusing to liken McAffee to McCafe.

Re:Sounds like the right plan

[greenbird]

The solution is clear - forbid any unknown code from loading into the kernel.

Unfortunately that's not the solution Microsoft chose. What they did is make a kernel that will only load code that has been approved by and paid a toll to Microsoft the amount of which is determined by Microsoft. That's vastly different than what you presented as the solution. On my Linux box unknown code is not permitted to load in the kernel but I'm the one who determines what is loaded into the kernel not Microsoft and there is no required payoff to allow code to load into the kernel.

Re:Sounds like the right plan

[drsmithy]

Basically the 1st excludes Windows; The second excludes any non-open-source application. Shouldn't you just quit and go take a walk then?

Does your computer have an open source BIOS ? How about the various bits of firmware on the hardware - got the source code for that ?

Re:Sounds like the right plan

[Anonymous Coward]

Yah, that ones you just advocated neutering.

Are you OUT OF YOUR FUCKING MIND???

Who the fuck would willingly give a penny to Shitmantec or McAfag? Especially when there's countless other antiviruses out there that actually DON'T suck, DON'T totally destroy your windows install and DON'T make your PC slow like it's a 4.77MHz XT, such as NOD32, Kaspersky et al - some of which are even free.

Yes, those 2 ABSOLUTELY and TOTALLY deserve immediate neutering!

Re:Sounds like the right plan

[QuantumG]

Does your computer have an open source BIOS ? How about the various bits of firmware on the hardware - got the source code for that ?

No. Be nice to though.

Re:Sounds like the right plan

[bruno.fatia]

Never said I only use open sources applications, and right now I'm even using Windows XP Pro.

Re:Sounds like the right plan

[MidnightBrewer]

I think you're wasting time nitpicking semantics when what you really seem to want to do is disgree with him. If someone uses, "some of us," big deal. It's far more unlikely (if not improbable) for absolutely nobody to share your opinion than for somebody to.

If you want to disagree with him, come out and say it. Some of us would prefer it that way.

Re:Sounds like the right plan

[Nikker]

I see your point but I would like to ask, if I as a programmer want to make a program that requires use of your resources that you paid for(CPU,HDD,Sound,Video) why should I pay them for the access?

Keep in mind Windows(TM) is the most deployed software in the world, using a method similar to a spam filter would allow each developer to be given a personal key free of charge. Possibly a small programmatic test (AV type scan) for initial compatibility with OS and basic security principals would be done. Then if users find issues with the software they can "report as spam" type of feed back that would give each software (as well programmer) a rating of desirability. This would range by perception of the functionality but would give specific areas of focus that could be looked at by the developer of the project as well as researchers. This method is not the most secure as verification of the software could be possibly forged, the user could be informed of the possible issues with the product and taken to a site that would outline the issues, and allow the user to 'digg' the ones they associate with.

I would assume 'user space' in Vista will be forgiving with resources but depending on how MS stratagizes the certificate, such as issuing media that associates non-certified software with malware, et al, this may not be acceptable to the small professional developer.

Re:Sounds like the right plan

[Shawn is an Asshole]

The collapse of residential computer security has meant that virtually nobody can keep their Windows machine secure anymore. Not even gurus. There are just way too many 0-day exploits for browsers and others out there, even for Firefox.

I would question their claim of being a guru if that's the case. It's really not that difficult to use Windows without getting compromised.

The thing, though, is I really do not trust Microsoft with that power. I'm sure after Vista this will be expanded and used for DRM.

Re:Sounds like the right plan

[IamTheRealMike]

No, it's subtly different. Microsoft are the gatekeepers because that lets them pull the plug on any kernel code that is found to be malicious. I'm pretty sure the toll isn't that expensive (unless they changed it since I looked) and is there to cover the costs of the scheme. On your Linux box unknown is allowed to load into the kernel - all it has to do is acquire root, which is not terribly difficult on a desktop machine, and then go ahead and start patching code. That is what you cannot (in theory) do on Windows.

Re:Sounds like the right plan

[cheater512]

You assume that the Microsoft equivelants are as good or better than the current solutions and that the current solutions dont improve beyond what MS is doing.

Re:Sounds like the right plan

[IamTheRealMike]

There have been enough zero-day image loader exploits pushed out via advertising networks that you don't have to have done anything wrong or inadvisable to get infected these days.

Re:Sounds like the right plan

[starakurva]

They not-so-much kicked MS's ass as much as kicked MS *in* the ass......

Step two is to kick MS's ass. :)

Re:Sounds like the right plan

[QuantumG]

And neither of them will be getting Microsoft approval to do anything in the kernel. It's really simple, the kernel is a hill, if you're on the hill, you can defend it, if you're not on the hill, all you can do is watch as others take the hill.

Re:Sounds like the right plan

[Anonymous Coward]

..and don't hook your computer into corporate intranet, of course.

Re:Sounds like the right plan

[Allador]

"I would rather they went with the linux model of advanced permissions and a (seldom used) root account that had permission to everything"

Unless I'm misunderstanding what you're saying, thats exactly how windows works, or at least is designed and intended to work. Some corporate shops dont operate that way, and most home users dont, but thats an operational choice.

Our shop has been running all users in non-admin roles since early days of Windows 2000 professional. Those who can be trusted also get local admin accounts (which are different accounts) that have local admin rights on their boxes. This works great, and protects you from 95% of attack vectors with no extra effort on the users part.

We have delegate different aspects of domain and system management to different groups, from those who can reset passwords, to those who are enterprise admins. We use specific ACL modifications and group policy to deliver finely grained control over everything we need to.

I'm saying all this not to disagree with you, but rather to spread some knowledge around. Windows shops that are correctly run work precisely as you describe. Sadly, there are a lot of people out there who dont operate that way.

Re:Sounds like the right plan

[ultranova]

No, it's subtly different. Microsoft are the gatekeepers because that lets them pull the plug on any kernel code that is found to be malicious.

And by "malicious" we mean "Disney doesn't like it".

After all, it's not the user who's being protected here, it's the media corporations Microsoft is trying to sell Windows as a distribution channel to.

Alternatively, it could be "Provides good native OpenGL acceleration". After all, portable applications would be the death of Windows.

Re:Sounds like the right plan

[Tim C]

While I largely agree with you, I have to take issue with this:

The collapse of residential computer security has meant that virtually nobody can keep their Windows machine secure anymore. Not even gurus.

I have a hardware firewall and I keep XP and my AV software (grisoft AVG) up to date, and I've not had a problem in 5+ years. Ditto the other computers that I use. It's hard for most users to keep their machines clean because they simply don't know how to. I even run as admin, I'm just sensible about *what* I run. (Never using IE or Outlook helps)

doing business on the internet is rapidly becoming difficult or impossible

I don't doubt that some companies hae genuine problems, and I've certainly heard about the DDoS extortion scams. However, things aren't nearly as bleak as you paint them.

Apart from that, I pretty much agree with you - I don't want anything to be able to mess with my kernel either. If that and other security improvements make Symantec et al irrelevant, well that's just too bad.

Re:Sounds like the right plan

[AftanGustur]

If there is no way for the spyware to patch the kernel I don't need McAfee or Symantec there at all.

Given the track record of Microsoft and Security, I think we can safely assume that there will be bugs, many, many, many bugs in the code, that will allow foreign code to modify the kernel.

When that happens, without the security companies who have the expertise and workforce to analyse and develope procedures to get rid of that threat, it's basicallty "Game Over" for that particular installation of Vista.

Let's get real, there will be bugs, there will be exploits, and even the mightiest marketing division on the planet is no match against the planets army of malware developers.

This is *not* a "good idea"

Re:Sounds like the right plan

[mgblst]

Why all this pro-Microsoft, anti Symantec and McAfee. Symantec and McAfee came about to add extra security to Microsofts products, starting with MS-DOS. With all microsofts security problems in the past, we are all supposed to believe that now they are perfect, this time it will be right, and there will be no incursions in the kernel? This is ridiculous. Symantec and McAfee are trying to protect there own interests, but I am not ready to believe that Microsoft are capable of providing all the security protection at this time.

Re:Sounds like the right plan

[ajs318]

Printers should not require kernel mode, nor should video cameras etc.

A printer connects to one of the peripheral buses (simple I/O or USB, which ultimately is talked to through simple I/O ports). It needs kernel mode in order to do that. In the minimal case, you have a very simple kernel mode program which blindly passes unchecked data to the physical port (which is shut off from user mode programs) from some virtual port (to which user mode applications are allowed to talk, and which may look like a writable file). In the maximal case, you have an entire PostScript interpreter running in kernel mode.

Re:Sounds like the right plan

[ajs318]

The problem with microkernels is that you're putting the "fence" where it looks pretty -- not where it's practical. The appropriate place for the fence is where the minimum amount of data has to cross it, and that's not necessarily where it contains the minimum amount of code.

Device drivers must, at some level, have a kernel component; because nothing in userland is allowed to talk to I/O ports. Only the kernel can do that. At the very least there must be a kernel component which accepts an instruction to read or write an I/O address and returns a result, via some method which is available to userland software. Of course, if you have a totally generic kernel driver which allows any userland program arbitrary access to any I/O ports without checking, then you have just knocked down the fence altogether. So a kernel driver needs to have at least some sanity-checking built into it.

Re:Sounds like the right plan

[Lorkki]

The problem is that a black box is always running in an unknown state - it's entirely a trust issue between you and the vendor, regarding the solidity of their authentication methods, security protocols and limitations on execution privileges. If a key is compromised, a way is found to bypass the authentication process or there's a suitably buggy driver, all bets are off again.

Of course, proclaiming "no unknown code may run in kernel mode" does make security a much simpler issue; you can bet the farm on how the gate holds, instead of putting locks on doors.

Re:Sounds like the right plan

[Ed Avis]

I do not want to have any software patch the kernel.

That's your choice, and since it is your computer you should have the right to decide what gets loaded into the kernel and what doesn't. But what Microsoft is doing is different to that. They are saying that they get to decide what gets loaded into the kernel and what doesn't. So if you or anybody else want to load your own device drivers, you can't. On the other hand, if Microsoft decide that some kernel feature is needed - say, blocking the ability to record sound output to a file - then they can put it in and you have no say in the matter.

I don't need to run code in kernel space either, but I need to have the right to do so in order not to be held hostage by one particular company that decides what I can and cannot do with my own computer.

Re:Sounds like the right plan

[ettlz]

Microsoft claimed that Windows NT 3.51 was a microkernel. It wasn't. It wasn't even close. Even they dropped the claim with NT 4.0.

— Andrew S. Tanenbaum. The microkernel part of NT is so insignificant (basically it's just a message passer, see the ReactOS people's comments) it might as well not be called anything special. There's so much high-level stuff packed into the Executive that it makes NT look even more monolithic than Linux.

Re:Sounds like the right plan

[Anonymous Coward]

You are so wrong that it is not funny.

There is NO need for kernel to implement virus. Virus can be user-mode all around. They can live in normal .exe files. They can patch explorer.exe. Locking down the kernel does not protect the computer from virus.

What it does, is it protect the software vendor from the users. "Trusted Computing". DRM. This stuff.

It will have no impact on malware. It will not "fix the internet" the way you intend. It will "fix the internet" by controlling what you can look at with your computer.

Re:Sounds like the right plan

[mgblst]

why?

Re:Sounds like the right plan

[bit01]

Not just the media corporations. The US government is sure to have a back door, at least via automatic update, for snooping.

If I was a non-US government or organization I'd be very concerned about that as they've been caught many times in the past snooping commercial and government secrets for their own country's/company's benefit.

And there's always terrorism, the all purpose excuse...

---

I'm not worried about the use of DRM. I'm worried about the abuse.

Re:Sounds like the right plan

[Ginger Unicorn]

i dont know how he could have been more obvious about it

Re:Sounds like the right plan

[Anonymous Coward]

No software should patch the kernel, eh? And what is it that you're going to do when you have to download a security patch for a vulnerability _in_ the kernel? Just leave it hanging around, I suppose.

Slashdot: News for Nerds, Thinking Before Posting Not a Requirement

Re:Sounds like the right plan

[phoenix321]

Aargh, noo, it can NOT patch explorer.exe, because the kernel will not allow that. File permission, user rights, Windows system file protection, system rollback, whatever you like. But you're not going to hack away at any file in the Windows-Subfolders without the kernel noticing. And that's exactly the reason why nobody should have access to it: so he can't patch explorer.exe without the security infrastructure responding.

Re:Sounds like the right plan

[eclectic4]

"How has Firefox "kicked their ass"?"

We can only assume that he meant it was a better browser. Which it is.

Re:Sounds like the right plan

[phoenix321]

You cannot cover all incoming vectors, there's just too many of 'em. And every program you run opens another, no thanks. With the kernel reasonably trustworthy sealed-off from anything, you may have a chance of recovering from any other disaster without re-installing everything but the kitchen sink. Then you can trust the kernel to report processes, file permissions and dir contents correctly, which can then be correctly terminated.

A compromised kernel allows you neither: dir contents are inaccurate, malware has its processes hidden from the taskmanager, its files from the explorer and whatever deletion requests your antivirus software issues, they're not going to be carried out at all. As long as you can't trust the kernel, everything you try is moot and converse, if you can trust the kernel, you can start repairing the system from secure sources (cdrom, intranet etc.). And since nothing can wedge itself too deep anywhere, repairing and cleaning should be feasible, at least.

Re:Sounds like the right plan

[Trelane]

With signed modules and SELinux/AppArmor, having root will get you precious little.

Re:Sounds like the right plan

[newt0311]

I wasn't referring to the capabilities of micro-kernels vs. monolithic kernels but rather referring to how the locked down kernel was going to be a problem. still you make a valid point.

P.S. Device drivers DO NOT need to have a specific kernel component. Look at FUSE where drivers for FS devices like sshfs are entirely in userspace and run through thanks to the kerneluserspace module.

Re:Sounds like the right plan

[patrik609]

well IE asleep at the wheel and yesterday Mozilla released new version http://newsfromanywhere.blogspot.com/ FREE MARKET!!!

Re:Sounds like the right plan

[99BottlesOfBeerInMyF]

I mean, shit, this is the ancient choice between freedom or security.

Except that is a false dichotomy. Reducing freedom does not lead to more security. Let me point out how in this instance. Fast forward a few years and only MS can insert kernel modules without an exploit. Does this mean malware writers can't insert malware into the kernel or have to work harder to do so? Probably not, since they usually use exploits to get code running in the kernel in the first place and MS hasn't shown any way this will change that. So we'll still have malware running in the kernel. Will antivirus detect it? No. Why not? Well right now some worms specifically are designed to hide from some of the common detection tools, but it is really hard because their are so many of them. If only MS is allowed to run in the kernel, then only MS will need to be targeted by the malware to hide from.

It is basically the same monoculture problem Windows battles today. If there is only one defense, it is easy to defeat. If their are a large variety of defenses and you don't know which you will be up against, you might beat some, but not all. With multiple defense solutions, each vendor has direct financial motivation to improve their product. With only one solution there is no competition. Users will pay for it wen they buy Windows, so why bother making it any better than a token gesture?

Personally, I prefer the company writing my anti-virus solution to have a direct, financial interest in it being successful. I want to know that the engineers and managers at that company realize if it doesn't work, they'll be looking for a new job soon and their stock options will be worth jack shit. I basically want the benefits normally brought by capitalism, when competition is not bypassed using illegal, monopolistic tactics.

Re:Sounds like the right plan

[Creepy Crawler]

---No, Zeinfelds world view is entirely sane and very defensible. I agree with him.

Perhaps, as a user Zeinfeld does have a point. More kernel modules loaded = slower system and less memory usable. It's also a stability issue (the more software, the more bugs). However, I want to be able to turn on and off that ability, if it does require rebooting in a special mode. FreeBSD does something like this in the special lock-modes in that certain files become apphend-only, the kernel is locked, and a bunch of other things that root cannot do.

----The collapse of residential computer security has meant that virtually nobody can keep their Windows machine secure anymore. Not even gurus. There are just way too many 0-day exploits for browsers and others out there, even for Firefox.

That's just wrong. You can patch up Windows so that it is usable and stable. Using left-control while double clicking on an app brings up RunAs (equals to su in linux). To make a good, stable browser, go get a newish firefox that works with all the extensions you like, install it on another user account (restricted user, with a X:\tmp file dumping repository). Then make a link to call RunAs to run firefox as that restrcited user. That takes care of your browser. Firewalling certain connections also help a lot in terms of stability.

And in reality, most, if not all attempts of hacks come through port 80 (http). Go get squid, proximitron, or some sort of proxy that can change data in the html stream. Scanning it with a Linux AV program would be rather wise..

----The usage of rootkits on Windows is now a common technique, often used to hide spyware. Once the machine has been rootkitted it is impossible to repair short of wiping the system clean and starting from scratch. But because of the first point, this is not practical.

Same with Linux, and with any other system that gives access to the "metal" with a master account. A way to stop this is with security on those accounts. Examples are the BSD way of locking certain things on higher security settings, and the introduction of SELinux. It's in 2.6 . All you gotta do is use it.

Windows has neither of these.

---Thanks to the first and second points doing business on the internet is rapidly becoming difficult or impossible. It started with online casinos and porn sites, but is spreading to "clean" business too. How can you run a company when any 16 year old with a botnet can shut you down at a whim?

I could say the same about phone lines or the US mail system. If you have enough people using any sort of resource, the receiving end will bog down.Too many phone calls and the network starts going wonky. Too much mail and you lose useful mail (that spammer was targetted with shitloads of ads through the USPS).

This "point" is akin to taking an existing problem and adding an E- on it.

---The foundation of any security system is the kernel. If the kernel is not running in a known state, you have no security system - period.

Agreed.

---There is absolutely zero point in having user accounts, authentication, file permissions and so on if programs can load code into the kernel ... which they can, because for historical reasons Windows programs require admin rights, and even if they didn't, ultimately any program can ask the user to do something on its behalf and most will.

Actually, this is a good reason to eliminate user accounts from Windows XP home. I dont like ceding all power of my computer, but there needs to be channels in which to install stuff that needs installation. I do like the reboot in a certain mode to install a driver. Wait-times like that really do make users question, expessially when you can show randomized scare-pics to show what would happen if you install bad stuff.

You cant make 100% secure computers, but you can make it uncomfortable to do so.

---The solution is clear - forbid any unknown code from loading into the kernel. Only then can you have a sane system built

Re:Sounds like the right plan

[Zeinfeld]

oh yes. no kernel based drivers. now... how do you plan on getting that nice software like openVPN work? or how about those file-system readers such as e2fsd? locking the kernel is a very good thing but only to a certain extent.

Microsoft provides hooks for that very purpose.

There is no longer a performance constraint that requires code to be in the kernel. Modern processors are I/O bound on the vast majority of tasks for which kernel access is traditionally required.

if you want a kernel which only does the minimum and lets userspace do the rest (thus actually making a black box kernel usable) you need a micro-kernel and last time I checked, no MS OS used a micro-kernel design

Micro-kernels are like RISC processing, no modern processor is a RISC design but the principle of RISC inform the design of all modern processors. No second generation processor was ever a pure RISC design. Even the ARM and the Alpha are no longer pure RISC.

Windows NT has always had elements that are Micro-Kernel like. The original PRISM architecture at DEC was much more of a Microkernel. The Windows Kernel will always be much larger than the Micro-Kernel ideal but eliminating third party code is a good step in the right direction.

Re:Sounds like the right plan

[Zeinfeld]

The problem with microkernels is that you're putting the "fence" where it looks pretty -- not where it's practical. The appropriate place for the fence is where the minimum amount of data has to cross it, and that's not necessarily where it contains the minimum amount of code.

That is exactly the point I have heard made by the O/S designers. The other problem is that wherever you put the fence today it is likely to be in the wrong position tommorow. Windows NT and Linux were both developed in an era when a 50MHz workstation was considered fast.

Device drivers must, at some level, have a kernel component; because nothing in userland is allowed to talk to I/O ports. Only the kernel can do that. At the very least there must be a kernel component which accepts an instruction to read or write an I/O address and returns a result, via some method which is available to userland software. Of course, if you have a totally generic kernel driver which allows any userland program arbitrary access to any I/O ports without checking, then you have just knocked down the fence altogether. So a kernel driver needs to have at least some sanity-checking built into it.

It would be relatively easy to avoid this problem. You have a generic driver in the kernel that will accept authenticated requests from any source. The authentication mechanism does not need to be very sophisticated, a simple 128 bit cookie would be enough. The O/S already provides protections that prevents one process observing the memory of another (without appropriate permissions). The cookies are handed out through the security monitor.

Re:Sounds like the right plan

[Zeinfeld]

A printer connects to one of the peripheral buses (simple I/O or USB, which ultimately is talked to through simple I/O ports). It needs kernel mode in order to do that. In the minimal case, you have a very simple kernel mode program which blindly passes unchecked data to the physical port (which is shut off from user mode programs) from some virtual port (to which user mode applications are allowed to talk, and which may look like a writable file). In the maximal case, you have an entire PostScript interpreter running in kernel mode.

That raises another favorite question of mine. Why do I need to tell the computer which printer is there and what driver to use at all?

There are at most 5 significantly different printer page description languages that cover 95% of printers on the market. The variations that the printers support are pretty trivial - number of paper trays, ink colours etc and can easily be described using a declarative script.

In the bad old days it was necessary to edit a file to enter the disk drive geometry into the O/S. Today any sane O/S simply asks the disk drive how it is configured. We should have the same for printers.

Re:Sounds like the right plan

[pclminion]

Device drivers must, at some level, have a kernel component; because nothing in userland is allowed to talk to I/O ports.

Hrm? On Linux, we've had ioperm(2) since... I don't know, but probably forever. A userland process (with the appropriate capabilities, either root or CAP_SYS_RAWIO) can request the kernel to open access to specific ports. This doesn't require the process to run in Ring-0, and on x86 at least it doesn't even require the kernel to trap I/O requests -- they pass straight on through to the device. The CPU does it.

There's no need to put ANY device-specific code into the kernel as long as there is a reasonable way (within the chosen security model) to allow individual processes the access to hardware resources that are required. And I think any reasonably flexible architecture would allow that.

DMA arbitration obviously has to be done by the kernel because synchronization of requests from multiple processes would be impossible without it. But again, nothing about the kernel DMA interface has to be device-specific.

Re:Sounds like the right plan

[ajs318]

Back in the Bad Old Days, you could assume any (dot matrix) printer was an Epson RX80F/T (if you owned a Beeb) or an IBM ProPrinter (if you owned an IBM-compatible). Any that wasn't, mostly used the same control codes anyway. Come to think of it, the IBM was similar to an earlier version of the Epson; except the IBM has a full 256 character set where the Epson used characters 160-255 as italicised versions of 32-127. I never owned a daisy wheel printer but, since they were generally less capable machines, I suspect they didn't have much in the way of control codes.

But I digress. Of course you're right, in a way. The Unix world sort of beat you to it and standardised on PostScript as a page description language. Now, any application for Apple Mac, BSD, Linux or Solaris generates Postscript; and any "printer driver" for such an operating system is a PostScript interpreter. All that's needed now is an extensible standard for describing features like paper trays, duplex &c.

Unfortunately, I don't think manufacturers are likely to want to co-operate. Having different, conflicting standards benefits them. All printers available today (except industrial ones) are crap, designed down to a price -- and often that price is £0, because the manufacturer plans to make the money back by selling ink. The time has come for a manufacturer to enter the marketplace with an industrial-built printer, running from bulk ink (i.e. you fill it from recyclable glass bottles holding a litre each), just as people are twigging onto how awful printers are. This could have all your fancy features. It would have one interface: ethernet. It would use DHCP to try to get an IP address. It would implement a print server on port 9100 and a web server on port 80. The features would be described by an XML document (therefore, human- as well as machine-parseable). It would have a 16-digit LCD and some buttons for a rudimentary user interface in case all else fails.

Re:Sounds like the right plan

[Cid Highwind]

Why all this pro-Microsoft, anti Symantec and McAfee.

Five years of computer "security" product that get slower, more obnoxiously commercial, more expensive, and harder to remove with each mandatory annual update tends to earn one the ire of many geeks, especially when the product doesn't even work well. If there's justice to be had in the federal courts, this case will end with Symantec executives being ordered to spend 10,000 hours of community service uninstalling Norton Internet Security from PCs it's fscked up.

Re:Sounds like the right plan

[newt0311]

oh yes. no kernel based drivers. now... how do you plan on getting that nice software like openVPN work? or how about those file-system readers such as e2fsd? locking the kernel is a very good thing but only to a certain extent.

Microsoft provides hooks for that very purpose.

Mocrosoft provides hooks for arbitrary drivers and hardware I/O? because that is what would be needed to allow the complete functionality to be exported into userspace.

Micro-kernels are like RISC processing, no modern processor is a RISC design but the principle of RISC inform the design of all modern processors. No second generation processor was ever a pure RISC design. Even the ARM and the Alpha are no longer pure RISC.

Windows NT has always had elements that are Micro-Kernel like. The original PRISM architecture at DEC was much more of a Microkernel. The Windows Kernel will always be much larger than the Micro-Kernel ideal but eliminating third party code is a good step in the right direction.

Indeed. NT is not pure micro-kernel and that is exactly why there needs to be a method of inserting kernel hooks.In a pure micro-kernel design there would be no such need. Moving to the micro-kernel design is all good and nice but losing (sometimes crtical) functionality in the process is not.

Re:Sounds like the right plan

[Zeinfeld]

Unfortunately, I don't think manufacturers are likely to want to co-operate

That depends who you are. They are all going to cooperate with Microsoft.

Re:Sounds like the right plan

[throx]

The drivers don't have to be signed by Microsoft's private key (I don't know where people keep getting this idea from - it's never been the case). They have to be signed by any third party that has a key that has Microsoft's key as their root CA - in short, third parties can sign their own drivers so long as they've shelled out the $300 for a Verisign key and then gone to MS as asked for a driver signing key.

You can turn off the driver signing requirement using a boot switch. This is necessary for driver development.

It is actually a good idea for a kernel to have some verification of code that it loads into kernel space. As long as the user has a method to actively turn the verification off (which they do) then it's not such a bad thing as you're making out.

Re:Sounds like the right plan

[obeythefist]

It's reasonably amusing that someone should misname the company McAffee as McCafe, which produces cheap and bland products for the masses that do awful things to your system, because at the same time it is quite true that McAffee also produces cheap and bland products that do awful things to your system.

I think that perhaps you were down in a coal mine at the time I posted the message, thus enabling the joke to soar completely over your head. How's the canary doing?

Re:Sounds like the right plan

[aybiss]

First thing I do with a new home machine is to strip off the AV software provided by Dell as cramware.

Well there's your problem right there. If you want to go out of your way to pay more than you should for a computer with things you don't want, the state of your kernel is the least of your worries. :-)

Re:Sounds like the right plan

[fourchannel]

On your Linux box unknown is allowed to load into the kernel - all it has to do is acquire root, which is not terribly difficult on a desktop machine, and then go ahead and start patching code. That is what you cannot (in theory) do on Windows.

Could you please explain to me how this is a vulnerability in Linux? I mean, just about any exploit that can screw the entire system needs root access. And what's the difference on a "desktop" linux machine, I use the same install of Ubuntu for my desktop as I do for my servers. Granted I don't have a lot of apps on the server as I do with my desktop (Amarok, OpenOffice, Tremulous, etc.), but it's still the same kernel, device manager, packaging system. The underlying structure is no different between my two computers.

On your Linux box unknown [code] is allowed to load into the kernel

Well once I have root access, then sure, Linux will let me run unknown code in the kernel. But, When I become root, Linux will also let me run `rm -rf /`. It won't fight or object, it is expected of the root user to know what it is they are doing to the system.

Giving root access to a person unfamiliar to Linux is a bad approach at security. Using the power of root to point out the vast destruction that could be done with the right commands, all in the attempt to throw a spotlight on the 'vulnerabilities' of Linux is also a bad approach to security.
If the user does not take care to safeguard their password, and they have sudo access, then yeah...you can screw the pooch. But having knowledge of good security practicies on computer systems is a much more effective step than say...Putting an AV scanner on your Linux Box.

Could you, perhaps, be suggesting that a person who uses Linux solely for their desktop use may not understand security as much as a SysOp would?

Re:Sounds like the right plan

[Anonymous Coward]

> But you're not going to hack away at any file in the Windows-Subfolders without the kernel noticing. And that's exactly the reason why nobody should have access to it: so he can't patch explorer.exe without the security infrastructure responding.

I don't beleive so. What is the kernel going to do when an installer will change a file in the Windows subfolders ? Pop a message to the user so he can click yes ? As the original poster said: "ultimately any program can ask the user to do something on its behalf and most will."

Hence, having a crypto-signed kernel and drivers/jump table will /not/ prevent virus.

You are saying that it will help the kernel to notice changes of the Windows subfolders ? What for ? On my quite standard XP, I have a 1.8 Gb Windows folder, with 13745 files.

In the last month 230 of those changed. Great. The kernel knows about those changes. So what ?

(And when I am saying "patch explorer", be sure that it does not mean that I have to change explorer.exe. I can register a DLL to be loaded in explorer. I can have an .exe that starts at login and dynamically loads a DLL in explorer.exe. I can have a service that patches explorer.exe in-core image. Signing the kernel does *nothing* to prevent that)

Be logical. Signing the kernel is only a way to (somewhat) guarantee media vendors that users will not copy DRMed content by building a chain of trust (or more specifically of user-distrust) from the media to the device. The rest is bullshit and kool-aid.

I think MS is right

[Anonymous Coward]

I know this isn't PC to say on Slashdot.. but MS shouldn't allow undocumented hooks to the kernel. Instead they should provide an API for that.

Re:I think MS is right

[Anonymous Coward]

That'll lead to ugly hacks when the developers find that the API either doesn't allow them to do what they need to do, or it's otherwise buggy and needs to be worked around.

It's enough trouble writing solid modules for the Linux or FreeBSD kernels, and the source code to those is open and widely available. When your module code runs into problems, you can easily see what's going on in other portions of the kernel. It's a very, very useful debugging tool.

Now take this Vista kernel API you speak of. It'll end up being just like the Win32 API. Often times developers had to resort to undocumented calls in order to get their application to perform a certain task. This sort of shooting-in-the-dark coding leads to bugs and security glitches. Even if you understand 98% of what an undocumented API does, it's that remaining unknown 2% that'll fuck you, your product, and your customers over in the end.

Reliable and secure software comes from the developers having a complete understanding of the systems they're working with and building upon. By limiting developer access to such knowledge, they'd be directly promoting buggy, insecure software.

Re:I think MS is right

[Watson Ladd]

So why not provide that API to intercept system calls? This is very important when debugging, and pirating software.

Re:I think MS is right

[Aadain2001]

Who says they will provide an API? It's a great way to knock at McAfee et al. and for them to monopolize yet another industry (OS security software).

To me, this just highlights the ever growing differences between Windows and Linux. While MS has to lock everything down to the point that no one but them can perform certain actions, Linux has everything out in the open for all. While that means more bugs will be made public, it also means they will be fixed faster. With MS, they can sit on kernel bug fixes for as long as they want, since only they know about them (and the hackers).

Re:I think MS is right

[Sloppy]

Instead they should provide an API for that.

But how do you design an API that allows scanners to detect malware, without that API also being useful for the user to intercept "content"?

If you do have the API, then malware just needs to masquerade as DRMed content. With Windows' habit of treating data as code, it will still find some way to get executed. Most people will happily click on "click here to run this k00l song."

If you don't have the API, then no more malware-du-jour scanners, and therefore no more subscription revenue for Symantec.

Re:I think MS is right

[kasperd]

But how do you design an API that allows scanners to detect malware, without that API also being useful for the user to intercept "content"?

An API should be useful, at least that is my oppinion, and I believe I share it with some people. I think the right question to be asking is, how can you design an API that can be used by malware scanners, but is not equally usable by malware. My suggestion for a solution to that problem would be to run the scanner in a sandbox. The kernel provides an API through which the virus scanner can register its code. That code needs to be able to read a few files from the disk as well as being given read access to each individual file being attempted executed. It must not be allowed to do communicate anything back to the environment, just provide a simple boolean as return code on exit. That would certainly be possible, and shouldn't be too hard to implement. (Disclaimer: I don't know the internals of Windows, so I cannot say if this is for some reasons impossible to do with Windows. But I'm sure it could be done on other systems where I do know the internals).

An interesting question is, whether the real reason for Microsoft to do this is to improve security or to lock out security software vendors. Another interesting question is, why the security software vendors complain. Do they complain because a secure version of Windows would obsolete their own product, or do they complain because they are really being locked out. The answer to those two questions might be related, except that I'm not sure the security software vendors know the answer to the first question.

If you do have the API, then malware just needs to masquerade as DRMed content.

DRM has been used as excuse to do a lot of bad things. Basically I don't believe in DRM (in much the same way as some people don't believe in Santa Claus). Of course that leads me to consider most changes done to support DRM as being bad, because they will not make DRM possible, but they do cause a lot of problems. In reallity I think the reason for many of those meassures are in fact anticompetitive meassures just using DRM as an excuse.

Hardening a kernel is different. There are legitimate reasons for hardening a kernel. And though hardening a kernel is a hard task, it is not an impossible task.

Re:I think MS is right

[Allador]

"... Linux has everything out in the open for all."

Really? So you're saying its a supported way to write Linux kernel modules, where you have third party software not using kernel apis, and rather just making changes to in-memory kernel structures and data?

IANALKH (Linux Kernel Hacker) but I very seriously doubt this. All MS is doing is stopping 3rd parties from doing things that no one should ever do. I've used the analogy before, but this is the rough equivalent of using a database server (ie, Oracle) and instead of going through the Oracle server and API, some companies do direct byte manipulation of the data-files and index-files. After all, everyone should have open access, right?

Re:I think MS is right

[Aadain2001]

And you think what MS is doing will prevent that? If anything, it'll take 2 months for the exploit methods to begin circulating around the piracy/hacking groups instead of 1 month. There is nothing MS can make that some smart hacker can't tear down. If you don't believe that, I have a bridge I'd like to sell you.

Re:I think MS is right

[Allador]

MS' change removed the easy way to do it. Now it gets alot harder. The pagefile attack is the one with all the publicity. And that hole has been closed (though not in the most elegant way at the moment). But now its much, much, much harder to do so than it was before.

So another attack vector is found, and then MS patches the holes that are found by the communities. And the cycle continues.

But with each iteration, it gets harder and harder to do this easily on a random remote machine.

So the net result is never perfect security, but the overall level of security goes up. And more importantly, as 'kernel patching' becomes such a PITA, people will move elsewhere to other vulnerabilities.

Everyone wins with this, except for McAfee and Symantec's broken business models. But the most important thing is that the consumer wins, as they end up with a more stable system that is harder to root and trojanize.

Re:I think MS is right

[Aadain2001]

I think it is too early to make any predictions on the relative security level of the Vista kernel. In previous Windows generations, the new version was built on top of an already existing code base. While this did make things harder to add (thus opening new security holes), it also had the advantage of all the security patches given to the previous generations. The net result was a kernel that was getting more secure (until new features were added and then the new holes patched). With Vista, they started from scratch (that's why it's been 5+ years between XP and Vista). Therefore, even if security was at the forefront of the design and development of the new kernel + APIs, it still hasn't gone through the 'baptism by fire' that XP/Win2k/etc has gone through.

So, while what you say is true in the general sense, Vista is a new battleground between hackers and MS. I will put my money on the hackers for a few years since they will be constantly finding the cracks in the new shiny Vista kernel and exploiting them. In the end, we all loose as we must now wait for MS both for patches and tools to protect our systems until they are patched. I for one am not very optimistic of MS's ability to keep a Vista system secure.

Re:I think MS is right

[Allador]

Good points.

However, I dont believe that the kernel is 'from scratch'. I believe they started that way, then had to abanadon a large amount of work because it was going to take too long, and went back to the win2003 server kernel as their base.

This is the only thing I could find at a quick search:
http://en.wikipedia.org/wiki/Windows_Vista#Develop ment

"Faced with ongoing delays and concerns about feature creep, Microsoft announced on August 27, 2004 that it was making significant changes. "Longhorn" development basically started afresh, building on the Windows Server 2003 codebase, and re-incorporating only the features that would be intended for an actual operating system release."

Worth mentioning ...

[tomstdenis]

There are other 64-bit OSes ... out .... ALREADY ... that don't have these problems...

Just saying ...

STOP BEING SHEEP PEOPLE!!!

BAHAHAHAHA

Tom

Re:Worth mentioning ...

[QuantumG]

Yeah, and no-one really needs more than 640k of ram.

Re:Worth mentioning ...

[Skowronek]

I'm running some applications (logic synthesis) that need a few gigabytes of RAM. It's really nice to be address that linearly instead of stuff like highmem.

So, it's not about the integers, it's about the pointers (logically).

Re:Worth mentioning ...

[ehrichweiss]

Maybe so but if you're trying to imply that was Bill Gates who said that, sorry to tell you it's an urban myth.

Re:Worth mentioning ...

[QuantumG]

Actually, I was trying to imply that the dude I replied to was being short sighted.. I didn't say anything about Bill Gates (and typically don't).

Re:Worth mentioning ...

[Anonymous Coward]

And the pointers don't need to be 64 bits either. 48 would be a very nice middle ground. 64 bit machines waste a great deal of power moving around and adding a bunch of zeros.

Re:Worth mentioning ...

[Anonymous Coward]

Who the fuck modded this idiot up? Are you moderators all smoking crack?

Re:Worth mentioning ...

[WhoBeDaPlaya]

Have you considered partitioning that synthesis process? Then again, the partitioning problem is also NP :P

Re:Worth mentioning ...

[Anonymous Coward]

Yeah, I'll get right on designing that 48-bit computing architecture for ya. Screw powers of 2.

Re:Worth mentioning ...

[SmurfButcher Bob]

> with the kernel as the holy of holies,

Am I the only one who read that as,
"The kernel will be the holiest of holy kernels in history, spouting more holes per square inch than any preceding set of kernel holes in history."

Something tells me he used a bad phrase.

Re:Worth mentioning ...

[Skowronek]

Unfortunately, I don't have certain FPGA vendor's synthesis tool source code, and - in any case - I don't want to spend the rest of my life editing it. I'd rather have my Verilog fun than this :)

Re:Worth mentioning ...

[tomstdenis]

Probably people who are not preparing to run Windows vista64 as they already have A F'ING CLUE and are already enjoying the benefits of the x86_64 instruction set.

Tom

Re:Worth mentioning ...

[Skowronek]

Moving around zeros doesn't really cost as much, as long as the value is constant (no dynamic power on those wires). Increased area consumption is related to leakage power, which is not as critical on SOI process as it is on bulk.

As to using 48-bit values - have you actually considered the implication of either wasting 25% of memory, or having a natural alignment not being a power of 2? All those cute divide-by-3 circuits everywhere...

Re:Worth mentioning ...

[Anonymous Coward]

1st This is the register reporting this..
2nd Read the article...he didn't say it, the article author did in the very fisrt line of the article/STORY.

Re:Worth mentioning ...

[lifebouy]

Heh, When I read it, my brain said "Lets hope the "high priests" are in the "tabernacle" when it gets ransacked." 3rd party antivirus programs have been the only thing preventing total internet meltdown for years. Because A/V is what they do, they have incentive to do a good job. It's their business. Microsoft hasn't been in that business, really, until now. The first time some cracker says, "I love you, Melissa!" I'll be laughing my ass off, happily using Linux.

Re:Worth mentioning ...

[Anonymous Coward]

*generic knee-jerk argument about how you can't run games or MS office on linux*

Re:Worth mentioning ...

[tomstdenis]

I run open office and play doom3/EnemyTerritory all the time...

What's your point? Oh you mean I can't play "office" and run the random assortment of last years games with the same graphics... I got a PS2 and xbox for that. Actually I spend more time playing NES games on my GBA then anything else...

I guess I'm more productive and resourceful than you is all...

Tom

Re:Worth mentioning ...

[everphilski]

Meant real games like World of Warcrap or Everquest or KOTOR... you know, stuff linux can't handle. Doom/ET is so old...

Anyways, I *do* have a 64 bit OS that can handle it and MS word and the engineering work I do... WinXP 64 bit... works wonderfully.

Re:Worth mentioning ...

[tomstdenis]

Linux can handle the games just fine. Just they don't write portable games [mostly because the assclown developers who write these games couldn't care less, which is there perogative I guess...].

I don't measure the quality of my OS by which badly written games can run on it. I can get real work done with UNIX[-like] tools that have real power behind them. "cmd.exe"? I think not...

To each their own ... my point of posting was to reassure people that Vista is not the only 64-bit OS. That there REALLY IS choice and that if people just open their eyes they can take back what little precious control they really have over how they use technology...

Tom

Re:Worth mentioning ...

[newt0311]

flamebait but i'll bite. 64 bit isn't just about the larger numbers that could be stored. heck, that could already be done through the use of the x87 ISA (upto nearly 80 bit I think actually) and the vector registers (think sse1,2,3 and 3dnow) could all work with 64 bit numbers. that wasn't the issue at all. what is great about 64bit is

1)the amount of register space literally doubles. Optimized properly, that can go a long ways.

2)simpler memory model: 52 physical bits for physical RAM (don't believe me, look at http://www.amd.com/us-en/Processors/DevelopWithAMD /0,,30_2252_869_875%5E7044,00.html) and 64 bits of virtual addressing space. No segments, just a flat memory model.

3) removal of the old priveledge system and intro of a new user/kernel page allocation scheme to simplify the memory model.

4)Direct addressing of a very large amount of ram directly accessible.

Those are just some of the advantages. if you want to look them up in detail, go look at the link that I have given in this post to the AMD64 manuals.

Re:Worth mentioning ...

[I'm Don Giovanni]

Actually, the statement you "quoted" (whoever allegedly said it, urban myth or not), wasn't really shortsighted. "no-one really needs more than 640k of ram" was true at the time that it was (allegedly) said.

Re:Worth mentioning ...

[Tim C]

And then quite quickly became untrue. That's pretty-much the definition of short-sighted in that context - unable to see beyond the immediate situation.

Re:Worth mentioning ...

[quazee]

When you buy your new 1GB video card (and they already exist), and wonder why only less than 3GB of 4GB of your physical memory is usable, you will really need an x64 OS.
(The fourth gigabyte can still be accessed with PAE if motherboard supports >32bit physical addresses, but PAE itself is an ugly kludge.)

Re:Worth mentioning ...

[Anonymous Coward]

Damn right, bro!

Microsoft are an OS shop, and an applications shop. It's their business if they want to tighten up their kernel so only their apps run properly on it - if you want to run, say, a database app, then look for another OS that has a proper security model, reliable code, and open standards.

It's Microsoft's right to do this, and it's our right to say "fuck 'em - we'll use *nix".

Given that all server apps run over networks, it doesn't matter that Billy boy won't let you at his kernel - use Vista on the desktop if you must, but let the servers running proper OS's take the strain! OK, so all this Web2.0 stuff is mainly marketing bollocks, but there will be a move to more web-based apps as we grow older, simply because they are cheaper and easier to maintain ;).

(Remembering old times - 15 years or so ago, the fastest platform for Oracle was Netware on a 486, because it allowed the DB server to run on ring 0. Now Vista won't let you near her ring!)

Bri.

Re:Worth mentioning ...

[hotdiggitydawg]

I must admit I didn't read it that way, but when I hit:

"where only its own high priests of security may venture" ... I immediately had horrible visions of Steve Ballmer dressed up as the archbishop, hurling church pews around and doing unspeakable things to the altarboys...

Re:Worth mentioning ...

[Anonymous Coward]

Meant real games like World of Warcrap or Everquest or KOTOR... you know, stuff linux can't handle.

Gee, I'd better stop playing WoW on Linux then. No one told me Linux couldn't handle it.

I'm confused

[maynard]

Fathi conceeded for 32-bit systems the firm will never have the amount of control over security. He said: "That train has left the station."

For 32-bit versions of Vista, it'll be mostly as you were on security. Developers will be able to patch the kernel, only now they'll have to compete with Microsoft's own brand anti-spyware, encryption, and anti-spam offerings. Fathi lamented Microsoft had "missed a great opportunity" last time round.

What's the difference between the 32 bit and 64 bit kernel? And what does a 'tabernacle of security' mean?

I don't think there's a significant difference in DRM hardware between 32bit and 64bit systems. Why make the distinction? If they're going to secure Windows - why not secure Windows?

Re:I'm confused

[Sqwubbsy]

I am *so* not a kernel developer, but aren't there chip extensions on 64-bit systems, flags or something, that can be addressed to prevent 'mucking' which was not the case, or at least, not such that Microsoft utilized it.
I'm sure someone much smarter than me can say this better than what I think I'm saying.

*sips Scotch*

(And don't look at me, I'm just waiting for 64-bit MEPIS.)

Re:I'm confused

[MindStalker]

Mainly that it being 64-bit they are garunteed its a newer system and that they don't have to support a lot of legacy junk.

Re:I'm confused

[phantomcircuit]

The only way to run kernel code is drivers, 32 bit drivers are currently only sometimes signed. ALL 64 bit drivers must be signed, or they won't be loaded. This is why there is a distinction between 32 bit and 64 bit Vista.

Re:I'm confused

[ameline]

> And what does a 'tabernacle of security' mean?

It makes sense if you think of it in the typical French Canadian usage of the word Tabernac! :-)

Re:I'm confused

[maynard]

No. There are certainly register extensions to support 64 bit registers. And both AMD and Intel chips support greater than 32 bits of address space (neither support full 64 bit addresses - which would be gargantuan and unnecessary right now). The real issue is what DRM support is on the motherboard in order to hardware verify the signatures of whatever drivers are inserted into the kernel. This does not need 64 bits.

However -- I too -- am not a kernel developer. I've read through the linux and BSD kernel sources. And I've read the Tannenbaum book. But I don't claim to be able to write the stuff.

OTOH: I could use a scotch. (nudge nudge) :)

Re:I'm confused

[Foolhardy]

The main reasons they aren't implementing the same thing in 32-bit Windows is because of "limitations of the 32-bit architecture" that apparently don't let them do what they want, and since a lot of programs already patch the syscall table in 32-bit windows, it'd break compatibility with a lot of software to change it now. Binary compatibility for drivers that patch the syscall table on 64-bit Windows isn't an issue because 64-bit Windows for AMD64 has always prevented syscall patching. They figure that the 32->64 bit change is big enough to pile on some more changes, like this.

This has more to do with system stability than it does for security. Many syscall interceptors are not multiproc safe or do bad things: if the computer bluescreens because of a poorly written syscall interceptor, Microsoft gets blamed for writing unstable software. The syscall interface is considered an internal interface, not to be tampered with by outside parties because its behavior has subtleties not documented, and could change. This is a technical enforcement of that policy.

Re:I'm confused

[merreborn]

I think the answer is backwards compatibility. These changes will break backwards compatibility with many legacy 32-bit apps. However, I believe the assumption is that 64-bit users aren't expecting backwards compatibility anyway.

Re:I'm confused

[NeoSkandranon]

JMR's Rich Spicy One for myself. What's your pour?

Re:I'm confused

[TheRaven64]

Actually, the 32-bit model is better in a lot of ways. One of the ways AMD 'tidied up' the x86 instruction set with x86-64 was to get rid of the four ring model and move to a privileged/unprivileged model. They also threw away the segmented addressing[1]. This means you can't run a driver in ring-1 or 2 with its own segment and prevent it from accessing the kernel's segment but still let it have direct access to a device, which is possible with IA32. Of course, Windows NT didn't use this model in recent releases (it might have done in the 3.5 days; I can't remember), but OS/2 and later versions of Netware did.

[1] By the way, the Wikipedia x86-64 article is horrendously biased, and just plain wrong in this area to such an extent that I can't even be bothered to fix it. Apparently Minix 3 is not a 'modern operating system,' and the creators of Xen do not fall into the category of 'modern' in terms of operating system thought.

Re:I'm confused

[maynard]

Isn't address segmenting a throwback to the old 8086 days anyway? I used to have to deal with 64kb segmented addresses back in the day, and I can say it was a horrible PITA. Or are you speaking to traditional paging segments?

Also, on the difference between privileged and unprivileged vs. multi-ring privileges, one could argue that bifurcated privileges are all that's needed.

(though I realize that you are arguing in opposition to that position)

Re:I'm confused

[WhoBeDaPlaya]

http://dictionary.reference.com/search?r=2&q=Taber nacle

Re:I'm confused

[Anonymous Coward]

> Apparently Minix 3 is not a 'modern operating system,'

When it comes to memory models and linkers, it isn't. It's not that Minix has do do everything the way Unix does, but it really fails to offer anything reasonably equivalent. As for Xen, virtualization through rings alone is no longer necessary due to the virtualization support that's built in -- having only unpriveleged/supervisor modes never stopped IBM from becoming the king of virtualization, and that's because they also supported it at at a much lower level.

That the 32 bit architecture enabled some gross hacks the likes of which were used by netware is hardly an intrinsic benefit. Any modern microkernel gets the same benefit as segments from page protection.

Re:I'm confused

[Watson Ladd]

Well, you want an additional layer of containment between device drivers and the Operating System, but you also want to bar apps from sending things to devices directly.

Re:I'm confused

[Foolhardy]

Windows NT didn't use this model in recent releases (it might have done in the 3.5 days; I can't remember)

It never did, and there were never plans to. NT 3.5 was written in C (minus the HAL and a few parts of the kernel, which are assembly), and was source-compatible with Alpha and MIPS, neither of which support more than two privilege modes. Cutler wouldn't let the kernel become non-portable enough to depend on multiple CPU privilege levels. The kernel is designed such that any kernel mode code can dereference pointers anywhere in the kernel's address space (at PASSIVE_LEVEL anyway), and the current thread's user address space (if any). Drivers often operate in the calling thread's context (from user mode), an arbitrary context or in a system worker thread. Most data is stored in the kernel's heaps, and when an object is created, there's no telling which drivers may need to access it in the future. It'd be quite a lot of work to marshall those arbitrary pointers across driver-segment boundries. Apparently, the current kernel designers thought it'd about as much work as just running the drivers in user mode, hence the new User Mode Driver Framework.

Re:I'm confused

[Joebert]

And what does a 'tabernacle of security' mean?

Well, according to Google,

Definitions of tabernacle on the Web:
the Mormon temple

Which brings us to,

Definitions of Mormon on the Web:
the ancient prophet whose writings were revealed to Joseph Smith who founded the Church of Jesus Christ of Latter-Day Saints

Now, when I look at all of that, it starts to look like Microsoft is going to keep the secrets of their security locked up as tight as tight can be, BUT, some anonymous person with the last name Smith is going to get ahold of them via a rastafarian who wants mor-mon & spread them across the web.

In other words, Vista-64 is already doomed.

Re:I'm confused

[rts008]

I think the move from backwards compatibility and legacy support has a lot to do with this.
As painful as it may be for a lot of folks, at some point in time they have to get out of the hole they have dug theirselves into. I hear a lot on /. about how MS has to change their coding to make it more secure/better, often in direct comparison to Linux.

I'm not an MS fanboy, but at least they are trying to do just that. IMHO, application installs should not mod/join the kernal. I like they way this is implemented in my FC5 install-MS is getting closer to this.
There is one thing though; With Linux, you can look at/modify the source, compile it, then run it, even if it's a change that Linus doesn't approve of- not so with Windows.

I see this as more of one of those "You gotta break a few eggs to make an omelet." situations.

Where their eivilness will show up is how they treat third party app developers.

Re:I'm confused

[Anonymous Coward]

Actually, most people say tabarnac (no e)

Re:I'm confused

[QuantumG]

Signed by who though? I have no idea. Is it signed by any code signing certificate issued by Microsoft? How hard is it to get one of those? Sounds like a nice thing for hackers to steal and sell to spyware makers.

Re:I'm confused

[phantomcircuit]

All drivers in 64 bit Vista will be signed by Microsoft (yes this does give them the exclusive right to choose hardware that will or will not work with Vista).

Re:I'm confused

[zhiwenchong]

Haha.....
However, I think non-Quebecers need an explanation, so here goes:
Quebec French Profanity

Re:I'm confused

[Gryle]

This is the tabernacle. More proof that Microsoft considers itsself godlike and worthy of worship.

Re:I'm confused

[jZnat]

In Catholicism at least, the Tabernacle is where the Body of Christ is stored after the Eucharist, so that makes a bit more sense in regards to what Microsoft is trying to say.

Re:I'm confused

[Joebert]

So, does that make the "Black Box" a "Bread Box" ?

Re:I'm confused

[Jah-Wren Ryel]

Isn't address segmenting a throwback to the old 8086 days anyway? I used to have to deal with 64kb segmented addresses back in the day, and I can say it was a horrible PITA.

Not necessarily. HP-UX on PA and presumably Itanic uses segments (they call them quadrants because they divide the address space into 4 equally sized segments) which makes some things a lot simpler and faster in the kernel. For example, quadrants usually break down as text vs data or shared vs private. By limiting shared pages to a specific quadrant, the kernel can "know" if a page is shared just by looking at its virtual address. That's a lot less record keeping required and thus some operations are a lot faster. When you have 64-bit processes and each segment is up in the terabyte size, almost all of the nightmarish segmentation problems from the old 16-bit days go away but you still get to keep most of the benefits.

Re:I'm confused

[Blakey Rat]

The tabernacle was the name of the computer in the Sean Connery classic movie "Zardoz": http://video.google.com/videoplay?docid=7328510519 873373264&q=zardoz

As you can see from the trailer, the Tabernacle is indestructible and ever-lasting. So it's a good choice.

Re:I'm confused

[Anonymous Coward]

And what does a 'tabernacle of security' mean?

It means the Vista kernel will be like that Hebrew National hotdog you just ate, you won't know what's in it, but trust us it's Kosher!

Re:I'm confused

[SpiritGod21]

I suspect they're referring to the tabernacle of Judaism, due to the reference to the "Holy of Holies," or the inner sanctum of the temple. Prior to the building of the temple, the "tabernacle" was a tent the Israelites carried and inside of which they stored the Ark of the Covenant, which was the container for the Ten Commmandments. After the temple was built, the Ark was stored behind a covering in the Holy of Holies AKA The Most Holy Place (the area directly outside this was the Holy Place) and it was only entered once a year by the high priest on Yom Kippur, or the Day of Atonement, when sacrifices were presented to God for the forgiveness of the entire nation's sins.

Anyone who entered the Holy of Holies or touched the Ark (who wasn't the high priest on Yom Kippur who had undergone rituals of cleansing) was said to die instantly. Even the high priest couldn't be sure he would live: they tied bells to his shawl so they could hear him moving once he was inside and a rope to his ankle so they could pull him out if he died while inside the Most Holy Place.

So the lesson is, I suppose, that if you screw with Vista 64's kernel, prepare to die :-P

Re:I'm confused

[Anonymous Coward]

NT has never used the 4-ring/mode security privelege model, because it was meant to compile on architectures (MIPS, PowerPC, Alpha, etc) that followed the 2-mode model (kernel/user).

As you pointed out, though, OS/2 and Netware did.

Re:I'm confused

[IamTheRealMike]

You can't load 32 bit drivers into a 64 bit kernel, that doesn't work, no more than you can load a 32 bit DLL into a 64 bit Internet Explorer. Well, maybe it could work with a massive amount of effort, but MS didn't do that. So you lose backwards compatibility with 64 bit anyway - having lost that, they can now make backwards incompatible changes to improve security of the system. Just what people always wanted ... right?

Re:I'm confused

[Shawn is an Asshole]

OTOH: I could use a scotch. (nudge nudge) :)

Here you go...

Re:I'm confused

[Allador]

Microsoft is not the certificate authority here. You can get a code signing cert from a number of vendors.

Here's some more information from a 30-second google search:

http://www.microsoft.com/whdc/winlogo/drvsign/cros scert.mspx

http://www.microsoft.com/whdc/system/platform/64bi t/kmsigning.mspx

Re:I'm confused

[Allador]

The word 'tabernacle' is a semi-sarcastic word, meaning that the kernel is sacrosanct, untouchable, etc.

The read MS made this change on the x64 version was 100% purely an issue of backwards compatibility.

MS has been discussing this internally for many many years, but they have such a history of not stopping this on the 32-bit systems, that if they implemented patchguard on x32, a very large numbers of apps (which are abusing kernel patching) would not work.

With x64 version of windows, you're already forcing an incompatibility, since so much software needs to be at least recompiled, and nearly all drivers need to be re-done.

So the thinking was that since they're already going to break all backwards compatibility with the x64 versions, they might as well put in all the security improvements they've wanted to for years, and take all of the no-backwards-compatibility hit at once.

This is a very smart approach. MS is between a rock and a hard place on x32 windows. If they break backwards compatibility for security, they get railroaded in the press. If they dont, and let some of the security issues persist, they get railroaded in the press.

But the x64 versions have no expectation of backwards compatibility. Also, 32-bit vista may be the last 32-bit desktop OS from MS. So after the Vista timeframe, all the mainstream OSs will be 64-bit from MS, and they'll have successfully made their very painful for compatibility security improvements.

Re:I'm confused

[master_p]

Maybe it is a new Microsoft policy: 32-bit Windows is the 'consumer' Windows, which is not very secure; 64-bit Windows is the flagship of operating systems, totally secure and all that, and of course much more expensive...if you want 64-bit and 100% security, you have to pay.

Re:I'm confused

[Lord_Breetai]

So the lesson is, I suppose, that if you screw with Vista 64's kernel, prepare to die :-P

Yes, but will it melt faces?

Re:I'm confused

[QuantumG]

Yeah, but as for which signatures the kernel will actually accept, that's a totally different matter.. I wasn't claiming that Microsoft won't accept any old code signing certificate, but it would appear that, if they do, this isn't much of a barrier.

Re:I'm confused

[mr_da3m0n]

Actually, being french canadian and all, it's the first thing that I thought about.

"How fitting..."

Re:I'm confused

[lowe0]

Vista 32-bit and 64-bit come in the same box - there's no price difference.

So much for that brilliant theory, huh?

Re:I'm confused

[Anonymous Coward]

Ok, so its some kind of profanity.

That really hasn't cleared things up at all.

Re:I'm confused

[Anonymous Coward]

From a support standpoint this sounds like it's going to be a problem. Not only do you have 7 versions of windows, you have the 64bit equivalent for them all - complete with a different driver model.

Re:I'm confused

[ichigo 2.0]

I think the GP is referring to the NX bit. It works on 32-bit WinXP though, so I don't think it is the reason for the kernel protection being 64-bit Vista exclusive.

Re:I'm confused

[Foolhardy]

The driver model isn't THAT different; it's not hard to write drivers that are source-compatible with both the 64 and 32 bit archs with only a tiny amount of conditional compilation. Drivers that used to patch the syscall table and can't now in x64 should never have been doing it in the first place. All the Vista flavors (and I agree that there are about 6 too many) use the exactly the same kernel and drivers.

Re:I'm confused

[throx]

The process to get a key accepted by the kernel is simple. You go to Verisign and get a Class 3 code signing cert. You give that cert to Microsoft. They give you a cert signed by their CA that the Vista kernel will accept. You can then sign whatever code you want with that cert and Vista will load it.

Re:I'm confused

[sholodak]

I sincerely doubt it's going to work like that. Yes, you can get your code signing cert from Verisign. But is MS planning on signing your cert or are they planning on signing each build of your drivers after testing them for stability in their labs?

If MS is going to just sign your cert, some questions follow. How much is it going to cost to get MS to sign your cert? Why should MS trust your company to sign your own drivers? How do they know your company doesn't have malicious motives? Can you seriously see MS signing the Alcohol Soft or Daemon Tools code signing certificate so they can get their drivers running in 64-bit Vista, enabling kids to play the DRM'd video games they downloaded off a torrent somewhere? Would they sign the SlySoft certificate that makes it easier to duplicate commercial DVDs? All three of these applications do have legitimite uses, but in each case, they can be abused. What standards are they holding the developers to?

In the latter case, you have a scenario much like the current, except that users have no choice but to install certified drivers. That's all well and good in a perfect world, but nowadays most developers will advise you to install their un-certified driver, replacing the certified one that came with Windows. Why? Because it's going to cost them another couple/tens of thousands of dollars to get MS to certify the new build. Consider the negatives here... One: hardware manufacturers release drivers less often. New features and capabilities of existing hardware get delayed until they've been QC'd to death. End users suffer as a result.

I like the idea that you get a code signing cert, MS signs it, and you can sign whatever kernel-mode drivers you build... In my opinion, it should be free... and it's only purpose should be to attach legal accountability to code installed in kernel mode. You should write your code, agree to a license when you download the DDK that stipulates that you can't conduct any of the following x, y, and z things (i.e., adware, spyware, secretive data collection, keylogging, etc.). If you sign your driver & release it in the wild and it turns out that you violated the license, you get sued. In my opinion, this is the only decision they could make that doesn't squash fair competition between the big players. Why shouldn't my tiny software shop have the same rights to develop and antivirus solution as Symantec, Trend, McAfee? Because we don't have millions of dollars yet? Bullshit.

Do I think this will **ever** happen? Ha. No. This is Microsoft.

Re:I'm confused

[Anonymous Coward]

MS has a way with the French Canadians... First Zune (zoune) then Tabernac!...

Re:I'm confused

[Allador]

"I sincerely doubt it's going to work like that. Yes, you can get your code signing cert from Verisign. But is MS planning on signing your cert or are they planning on signing each build of your drivers after testing them for stability in their labs?"

Did you not read the links I posted above? You should before making the post, as the documents answer the questions in great detail.

For non-WindowsLogo certified drivers, Ms doesnt sign your driver at all. They created the root authority, and then created signing certs for the various certificate authorities. Once you have a code-signing cert from Verisign (or whomever you choose) and you create your .cat file, you require no further action. MS does not then in turn directly sign your driver or kernel component. They signed the root cert, and if the chain of trust isnt broken, its all good.

Now, if you're participating in the Windows Logo certification process, those drivers _are_ tested by the MS labs, and new versions get signed by MS. But participating in the Windows Logo program is optional.

And for testing, you can roll your own test cert, or temporarily turn off signed driver checking, or attach a kernel debugger.

Again, this is all in the documents linked above.

"If MS is going to just sign your cert, some questions follow. How much is it going to cost to get MS to sign your cert?"

Approx $500 per year through Verisign, which is typically the most expensive CA out there. And note that your signatures wont expire if you dont renew, you just lose the ability to sign new code.

"Why should MS trust your company to sign your own drivers? How do they know your company doesn't have malicious motives? Can you seriously see MS signing the Alcohol Soft or Daemon Tools code signing certificate so they can get their drivers running in 64-bit Vista, enabling kids to play the DRM'd video games they downloaded off a torrent somewhere? Would they sign the SlySoft certificate that makes it easier to duplicate commercial DVDs? All three of these applications do have legitimite uses, but in each case, they can be abused. What standards are they holding the developers to?"

MS doesnt sign any drivers. MS created the root authority, and delegated to the other commercial CAs.

The whole point of signed code is not to stop bad people ahead of time, its to create an audit trail, so that if someone does release bad signed code, then you know who to go after. And its also for the ability to revoke. If some black hats start releasing signed drivers that trojanize your systems, MS will release a revocation as part of automatic updates that revokes the code-signing cert that the company got.

"Consider the negatives here... One: hardware manufacturers release drivers less often. New features and capabilities of existing hardware get delayed until they've been QC'd to death. End users suffer as a result."

Again, thats why you have both the generic code signing ability as well as the Windows Logo program. The former doesnt guarantee quality, it just makes it so that you have someone to come back to if there are problems. The latter guarantees a certain level of quality, because they are QC'd by MS. So consider one a stable variant, and one a more dev level component.

"I like the idea that you get a code signing cert, MS signs it, and you can sign whatever kernel-mode drivers you build... In my opinion, it should be free... and it's only purpose should be to attach legal accountability to code installed in kernel mode."

Yes, thats exactly how it works. Of course, as I've said before, MS doesnt actually sign your cert, you get a code signing cert from a CA that is part of a chain of trust from the root authority that MS created.

The only thing that is different from what you're asking is that its not free, but its not expensive at all ($500 per year), even for a very small business.

Now the Windows Logo program is likely much more expensive, though I dont part

Re:I'm confused

[QuantumG]

Uhhhh.. this is my point, and I'll reiterate it: either Microsoft is vetting every single driver and only signing the ones that are safe or they are handing out code signing certificates and anyone who has one can sign whatever they like. If it's the former then that is a totally unacceptable situation we find ourselves in - it gives way too much power to Microsoft. If it's the later then this is all pointless because every man and his dog will have a code signing certificate.. you'll be able to pick them up on ebay.. they will get stolen off computers by hackers and sold to spyware companies. So which is it?

Re:I'm confused

[Douglas Goodall]

This is more or less what went wrong with the active x security. Verisign gave a code signing certificate to someone who identified themselves as a Microsoft contractor, and bleui, there goes the security layer. Microsoft will try to keep the rabit in the hat this time, but isn't this just another case of security throough obscurity, with the certificate as the obscurity. There will always be a chance for human error and with the stakes as high as all the Windows systems crashing quickly from a wild virus crusing the internet, that is a reason in and of itself to spread the key infrastructure across a number of platforms so everything doesn't die at once. There are a lot of smart people with the responsibility to keep the structure of the internet running, and I don't think they entirely trust Microsoft with their jobs. Also If Microsoft has control over which driver's get signed, that's a way for them to force all hardware vendor's to disclose their driver source code in the Windows Hardware Compatibility certification process. And it they don't like you, they make it hard to certify. The same way the open source people don't like binary only drivers, I don't want any part of Microsoft's totally closed system. This will assure that Microsoft written applications always run better on Windows because they know what's really going on with the system and which interfaces are the most efficient for applications to use. The agreement by which they have to share their api's expires next year, just in time for Vista.

Re:I'm confused

[Douglas Goodall]

Does that mean Bill Gates is going to have he body decomosed and transmitted into the kernel and them we will worship him?

Re:I'm confused

[throx]

Your point misses the mark because you are misunderstanding the purpose of signing, and misunderstand what's happening:

i) The Windows Logo Program means Microsoft is signing off on a driver saying it's safe to run. This is just something that is a marketing bullet and isn't something required for the system to load the driver.

ii) The driver signing program allows anyone to sign the driver if they've ponied up the cash and identification requirements. It is NOT an indication the driver is safe, but it is an indication that you know who made the driver. Remember, if you really want to trust "Bill's Backdoors" as a software company that produces drivers then it's perfectly within your rights to do so and Microsoft isn't about to try to stop you. All they are doing here is making sure that the people writing drivers are actually signing their name to them.

They whole "eBay" thing is silly because of the levels of identification you need to go through to get the certificate in the first place, only to have it revoked on the next update Vista pulls down from the web. You don't see code signing certs on eBay now, what makes you think they'll be up there when Vista releases given nothing is actually changing in the certificate infrastructure?

It's exactly the same level of security you get in signed Java applications, or https, or any number of public key schemes on the internet now. You're just overdramatizing the possibilities.

Re:I'm confused

[Anonymous Coward]

"It's a cute product but the price point is all wrong to make any market penetration." - throx, speaking of the ipod's introduction.

Re:I'm confused

[throx]

Yep. I was wrong (and they also changed the price point). Do you want me to show you the number of times "Anonymous Coward" was wrong?

Jim Allchin of Microsoft responds

[Foolhardy]

Microsoft executive clarifies recent market confusion about Vista Security

"Concessions to.."

[MoriaOrc]

Am I the only one who read the line "Making concessions to Symantec and McAffee," and the first concessions that popped into my mind were "Just a little security hole here, buffer overflow there, ect."

I'm no fan of MS, especially when it comes to their horrible security track record. However, if they really can manage to get it right (or even significantly better) in Vista, they shouldn't be going and making concessions to the people who've been making a living off the things that were broken in their last OS.

Re:"Concessions to.."

[Anonymous Coward]

Except that they also sell the "OneCare" program.

Did you Care about your Os today? Will Care fore you ...

Re:"Concessions to.."

[Anonymous Coward]

"However, if they really can manage to get it right (or even significantly better) in Vista, they shouldn't be going and making concessions to the people who've been making a living off the things that were broken in their last OS."

This sounds all well and good in a post, but keep in mind that MS has been bleeding by the nose when it comes to anticompetitive litigation. You can't expect any company to stick its neck out to do what you believe to be the right thing in respect to security if they fear this is going to be twisted into the same argument that is making them pay whatever gobs of money per day they EU is demanding. MS is probably figuring it spent as much money as it's going to on its legal defense for a while and is not looking to justify to the courts why Norton et al is in the wrong in this case.

Just asking for more trouble

[Revek]

I remember back in the day I could always find a hole in any computer system microsofts black box policy wont prevent the determined hacker from finding a hole. The only question is will he just cause mayhem or will he sell it to someone who will profit off it.

Should surprise no one.....

[ezratrumpet]

Microsoft wants to be responsible for its own security - more importantly, Microsoft wants to reap the financial rewards for becoming responsible for its own security. The personal home user will end up paying a bit more for lack of competition in security software, which won't matter to Microsoft - the real market is corporate sales.

Priests huh?

[TubeSteak]

Microsoft will operate 64-bit versions of Windows Vista as a tabernacle, with the kernel as the holy of holies, where only its own high priests of security may venture.

There's going to be a kybosh on naughty developers mucking about with the 64-bit kernel; patching will be banned.

MS doesn't want any outsiders to see the priests molesting the kernel.

/Yes, I went there.

Re:Priests huh?

[amRadioHed]

That joke probably would have worked better if they were referring to Catholic priests.

Re:Priests huh?

[Anonymous Coward]

Well the kernel is getting kinda old now... 1987... so 19 going on 20. Frankly, the priests have probably moved on to fresher meat!

Good luck

[gweihir]

Others have tried this before. Never works. Unless it uses trusted hardware, it can allways be run in emulation to facilitate analysis.

If it uses trusted hardware, then it will have other serious problems, like making virtualisation hard or impossible, something that could make it fail entirely in the market.

This tough act is just a smokescreen for something else. Hmmm. Do they think they could get around some (e.g. EU) interoperability requirements that way?

Sounds like security by obscurity

[49152]

Isn't this just another variation of security by obscurity?

Which everyone by now should have learned does *not* work.

Re:Sounds like security by obscurity

[gweihir]

Isn't this just another variation of security by obscurity?

Which everyone by now should have learned does *not* work.

Looks very much like it. Reinforced by some chest-thumping and bluster. Maybe they hope they can scare hackers off....

Re:Sounds like security by obscurity

[Keeper]

Since when is implementing logic which prevents mucking with internal kernel structures "security by obscurity?"

Re:Sounds like security by obscurity

[KarmaMB84]

Combined with active protections from tampering...no. I really wish the zomg "security by obscurity" buzz phrase would just die. If you think about it, anything but blocking physical access or requiring bullet proof biometric authentication is security by obscurity. Hiding behind passwords and encryption keys is no different.

Re:Sounds like security by obscurity

[misleb]

Preventing programs and drivers from tampering with internal OS structures is not security through obscurity any more than preventing people on the internet from accessing your computer directly (firewall) is security through obscurity.

-matthew

Re:Sounds like security by obscurity

[49152]

Bullshit. If this is what you come up with by "thinking about it", one can only hope you do not work in an area where security actually matters.

There is an enormous difference between for instance an encrypted password algorithm where it is well understood (usually on a mathematic basis) *why* it will take an exceedingly long time to crack it and simply trusting on the bad guys not to discover where we hid the password.

Re:Sounds like security by obscurity

[49152]

If that is what they are doing, then yes you are correct.

Assuming they do not botch the implementation as they have done before (see the Xbox boot loader for a good example). However I find the article very vague on the actual technical details.

Re:Sounds like security by obscurity

[snitmo]

You are absolutel right. This isn't really about security, though. It's just another attempt by Microsoft to keep superior competitors such as McAfee and Symantec from, well, competing with them. Now Microsoft is the only security vendor that can fix security holes in the kernel. I'm sure the patching process makes you go through the phone-home process called Microsoft genuine advantage or whatever. It's all about making money.

I'll stick to XP 32 bit as long as possible.

Re:Sounds like security by obscurity

[Anonymous Coward]

well there still must be a API to do it, or else even MS couldent implement kernel drivers outside the kernel. All that protects the kernel is the "signed" thing, i have no clue what it is, how it works, but it sounds more like obscurity, if some cracker did get their hands on the ability to sign software, then you would be in big trouble (bigger, anyways).

Re:Sounds like security by obscurity

[Keeper]

There is actual logic in the 64bit windows kernel which is designed to detect modifications to internal kernel structures. If a change is detected, it crashes the box (calls bugcheckex).

The kind of structure we're talking about are rather static, and no API currently exists to manipulate those structures -- the changes are done as part of other (legitimate) operations.

Re:Sounds like security by obscurity

[Keeper]

Google "kernel patch protection" if you're interesting in looking up technical details. Somewhere out there you'll discover details regarding how this is actually implemented in x64 XP/2k3.

Re:Sounds like security by obscurity

[Paradise Pete]

I sure wish nobody had thought up that rhyme. It's turned an idea into a mindless mantra. Now in place of actual thinking people can, as soon as they see that something is hidden, pigeon-hole it as "security through obscurity," and then shut down their brains. The brain strives to do that - it goes out of its way to avoid that pesky actual thinking, and tries to categorize everything it sees. This is the root of prejudice, for instance.

For God's sake...

[$RANDOMLUSER]

Don't open it! Remember what happened to Pandora!

Re:For God's sake...

[Anonymous Coward]

I once knew a girl named Pandora, but she never let me see her box.

(great movie if you can ignore the "stars" and main plot line, btw. The supporting cast and side stories were great)

Re:For God's sake...

[winomonkey]

What, it became a pretty nifty streaming media service?

Let evolution take it's course

[Anonymous Coward]

Symantec and McAfee should just concentrate on other OS's and leave MS to the wolves as they seek obscurity by security.

Thank you!

[maynard]

Somebody mod that post informative. It actually answered my question!

Re:Thank you!

[Viper Daimao]

GP must be new here.

Re:Thank you!

[Anonymous Coward]

you know, sometimes /. mods do the right thing. In this case, the dude with Win coding chops provided a technical answer. He deserved a +5, Informative for that.

Joe Blow

[Ice Wewe]

64-Bit Vista Kernel Will Be a "Black Box"

Microsoft also warned 32-Bit users to be careful, because if you run the 32-Bit version, you're screwed

Re:Joe Blow

[badman99]

Yeah and I thought the only way you could be screwed by a black box would be if you were running Ubuntu......Or is that brown box

except that tabernacles are open

[Anonymous Coward]

In the past, the church tightly controlled access to religious texts.

Of course such suppression can not live forever. ... someone please finish this post.

Re:except that tabernacles are open

[AHumbleOpinion]

In the past, the church tightly controlled access to religious texts. Of course such suppression can not live forever. ... someone please finish this post.

Of course such suppression can not live forever, but if the information being protect has a short enough lifespan/relevance then suppression works. The "freeing" of the information being merely academic rather than effective.

Hey, one vague tangent deserves another. :-)

Nabbersnackles

[Ungrounded Lightning]

what does a 'tabernacle of security' mean?

Only the priesthood and those among the flock that they approve are allowed in.

"Sounds like security by obscurity" is good

[AHumbleOpinion]

Isn't this just another variation of security by obscurity? Which everyone by now should have learned does *not* work.

Actually it does work. Where people go wrong is using it as their sole security measure. In concert with various other good practices obscurity is good.

Re:"Sounds like security by obscurity" is good

[49152]

Depends on how you define "it does work".

If you define it as "would prevent black hats from finding security holes" then computer history proves you to be horribly wrong. It may in some circumstances make the job harder and slow down the attackers but it WILL NOT prevent them.

The opposite model "disclose everything" - has a much larger chance of succeeding in the long run. Simply because if the security model is well understood and scrutinized by a large number of professionals it has a much bigger chance of getting implemented correct (eventually).

The cryptographers have understood this a long long time ago, that is why no serious cryptographic systems are based on the premise that the algorithm must be kept secret.

Re:"Sounds like security by obscurity" is good

[AHumbleOpinion]

If you define it as "would prevent black hats from finding security holes" then computer history proves you to be horribly wrong.

Firewalls, packet filtering, user/group based access to resources, requiring "good" passwords, not allowing code to execute from the heap, ... None of these would meet this definition, yet they are all good things, as is obscurity when used properly and in concert with other good practices.

The cryptographers have understood this a long long time ago, that is why no serious cryptographic systems are based on the premise that the algorithm must be kept secret.

If we were discussing a cryptographic system rather than an operating system you would have had a point.

Re:"Sounds like security by obscurity" is good

[Chris Burke]

That's partly true*, but the reason that security through obscurity is derided is because it is typical of a mindset that has implications beyond just using obscurity as a security mechanism on top of other well-formed policies. Very often, obscurity is the only measure used, in large part because of a lack of substantive review of the other security policies that would reveal their endimic flaws. The belief is "what others don't know can't hurt us". Even worse is that "others" is often not "black hats" but "customers".

The NSA is a good example of an organization that uses security through obscurity well. They employ the best cryptographers and system designers around, but they are also not about to tell anyone how those systems work. If you did know exactly what they were doing, though, you would still find them to be some of the most secure systems anywhere.

Microsoft, on the other hand, has a history of using obscurity as a method of covering up embarassing security flaws. They do not have a history of having the best security. Do I think that Microsoft intends to hide the internals of their kernel as part of a comprehensive security regime in which obscurity is only the last layer thus making Vista an impregnable fortress, or is this an attempt by Microsoft to squelch competition from other AV vendors under the guise of fixing their tarnished security image? Well, it's obvious what I think. Which do you think it is?

* The fundamental problem with security through obscurity is that you can't count on it. Either a clever hacker will figure it out, or an insider will leak or exploit information about the system. Your system must be as secure as you know how to make it assuming that your enemy has full knowledge of the system. Only then does layering obscurity on top of that make sense as an additional mechanism. Otherwise it's a false sense of security.

Re:"Sounds like security by obscurity" is good

[Achromatic1978]

Oh, man, could you misread his words any more. You belittle him for being wrong, when in fact he explicitly says:

Where people go wrong is using it as their sole security measure. In concert with various other good practices obscurity is good.

Slow down with the condescending reply next time, cowboy.

Re:"Sounds like security by obscurity" is good

[demallien2]

I couldn't agree more. I work in DRM, and one of my "duties" is to try and reverse engineer competitors' products to say what makes them tick, see what tricks they have used to make hackers' lives difficult etc etc etc. Most people have never tried to reverse engineer an encryption scheme. I have. I promise you that obscurity makes everyone hacker's life miserable.

To give an example - if you hand me some unobfuscated code in native binary, I will have retrieved the keys used to decrypt in less than a week. If you put some of your code in a popular VM (VMs being a popular obfuscation technique) such as Java, I have a whole series of tools freely available to me, and it won't take long to reverse engineer that either (in fact Java is easier than native byte-code). If you use a proprietary VM such as OpenTV, you're going to slow me down quite a bit. Dissassemblers/debuggers don't exist, and even the documentation for the bytecodes used by the VM are difficult to track down. To reverse engineer efficiently, you are obliged to start by writing your own debugger - and depending on your success in tracking down documentation, these may mean starting by reverse engineering the entire virtual machine. With a product like OpenTV, you can cheat a little by writing your own programs and compiling them with the easily available compilers. This makes the reverse engineering a bit simpler.

And then there is the all time pain in the butt, the custom-rolled virtual machine, designed to work in ways not normally seen in virtual machines, using screwed up addressing schemes, real-time decryption of programs etc etc etc. Worse, you have no tools, not even the compiler/assembler that goes with it. It's the ultimate security by obscurity. Your only attack is to reverse engineer the virtual machine. Worse, if the company has decided to obfuscate the virtual machine itself by another technique, you are in a world of hurt. Picking out the decrypt keys, or even just identifying the encryption algorithm used, is next to impossible. You're going to spend a good chunk of your life trying to sort this baby out.

Encryption is only as good as the security of the keys. And the keys are only as secure as the quality of obfuscation used to hide them. In other words, in most computer environments, the security _is_ the obscurity.

Are you allowed to modify your house wiring?

[EmbeddedJanitor]

Just because it is "yours" (debatable point in the case of software), does that mean you should be allowed to modify it? Depending on where you live, you probably are not allowed to do tweaks/mods on various things that you own - including the wiring in your house.

Re:Are you allowed to modify your house wiring?

[WhodoVoodoo]

The wiring on your house can create a fire hazard, the bits on that disk can't generally hurt anybody.

Re:Are you allowed to modify your house wiring?

[Anonymous Coward]

What kind of communist jurisdiction do you live in? You flip the circuit breaker, and you go ahead and change the light socket/switches/run new wiring/whatever.

Re:Are you allowed to modify your house wiring?

[LifeNLiberty]

Um... Where the hell do you live? I've rewired things in my house countless times.

Re:Are you allowed to modify your house wiring?

[Anonymous Coward]

It depends on how your local laws are -- where I live (small town in Colorado) you CAN do your own wiring, plumbing, etc. There is just a specific procedure that you have to follow to ensure that 1. you are still within building code, and 2. anyone that works on it knows you modified it yourself.

Re:Are you allowed to modify your house wiring?

[Chirs]

Nah, I can rewire my house if I want. It's even covered under my insurance.

If you want to sell the house the wiring needs to be up to code, but you can easily pay the $40 and get a permit and get the inspector over to double-check your work.

Re:Are you allowed to modify your house wiring?

[Shawn is an Asshole]

Unless by modifying those bits you open a hole allowing your computer to become part of a botnet. Then your machine will be doing harm to servers around the world...

Re:Are you allowed to modify your house wiring?

[WhodoVoodoo]

that never killed anybody. Fires however, do.

"Our old stuff was crap"

[EmbeddedJanitor]

Yup. Like parent, I detect MS putting a PR spin on this. They've done this often enough in the past - telling people that the old stuff was crap to get people to but the new.

Given that Joe Public no longer believes MS has control over security, they need to build some new mental images to sell. 64-bit black boxes sound pretty solid.

Not trying to be a troll...

[AltGrendel]

...but could you cite some examples?

TIA!

Re:Not trying to be a troll...

[gweihir]

...but could you cite some examples?

One thing would be the Xbox hack, although that involved an attack on the hardware as well.

There are counless successful projects to port Linux to some closed (i.e. black-box) hardware.

Sayonara, Symantec

[Cid Highwind]

There's going to be a kybosh on naughty developers mucking about with the 64-bit kernel; patching will be banned.

If it will stop crapware like StarForce and the Sony rootkit from sneaking extra drivers in, bring on the kibosh. People who want to tinker can use one of the fine Open Source operating system kernels that run on 64-bit Intel machines. Those that just want to play games or run Office can feel a little bit safer from malware.

Sorry Symantec, but after dealing with the disaster that is Norton Internet Security, I won't shed a tear when I read that you've filed for Chapter 7.

Re:Sayonara, Symantec

[drsmithy]

If it will stop crapware like StarForce and the Sony rootkit from sneaking extra drivers in, bring on the kibosh.

Unlikely. Those developers will simply get their drivers signed so they are allowed to load.

Re:Sayonara, Symantec

[Allador]

Having signed drivers has nothing to do with the discussion at hand.

What PatchGuard stops (PG is what Symantec and McAfee are complaining about) is bypassing kernel APIs and directly modifying in-memory kernel data structures. This is never a good thing.

Whether a driver is signed or not has nothing to do with PatchGuard ... signed drivers are blocked too from doing kernel data structure patching. And rightly so, as its a horribly destabilizing thing to do.

Common rootkits (and Norton/McAfee anti-virus) patch the kernels to introduce their own callbacks into the function tables, so that their code gets called before or instead of MS kernel code. This has been widely known and documented as unsupported, dangerous, and a very bad idea, as it causes as many problems as it solves, by destabilizing the kernel.

Re:Sayonara, Symantec

[Anonymous Coward]

Wonder what will happen with the StarForce games that are out now...

Adoption of Vista 64-bit

[postmortem]

Will not go very well, at least in beginning. This enhanced security won't sell it. There won't be drivers for some existing stuff ever. Seems that MS wants to push this version and keep 32-bit as legacy, but in the end when end user can't make it work as well as 32-bit, it is just going to slip and create confusion. In long run it may pay off, when systems and components are designed for 64-bit, until then, 32-bit will be preference. I wonder if any of corporate users are going to put 64-bit on employeees workstations in upcoming months -it seems as a big risk without much gain.

Re:Adoption of Vista 64-bit

[Joe The Dragon]

Try telling that to people who got new core duo systems that are only 32 bit. The core 2 duo is 64 bit.

Re:Adoption of Vista 64-bit

[postmortem]

I have such system, I bought it month or so before Core 2 Duo was available. And I made that decision believing that when 64-bit is worth my time, I will be on a different machine.

Core Duo is great 32-bit CPU. So is Core 2 Duo. Is it great 64-bit CPU? I don't think so. Intel's implementation of AMD64 is more like emulation - AMD wrote AMD64 to work together with its architecture, not with Intel's. There are benchmarks on AnandTech that confirm that Intel's performance advantage is gone in 64-bit mode.

Re:Adoption of Vista 64-bit

[Allador]

"I wonder if any of corporate users are going to put 64-bit on employeees workstations in upcoming months ..."

This has already been happening with the 64-bit version of Windows XP. For certain classes of users, like engineers (pro-e), cad/cam, multimedia, and developers, x64 XP is the _only_ way on windows to get past the 3GB point.

And since Dell/HP/IBM/etc have been selling the workstations with fully supported x64 driver sets, its been working for years.

Granted, it'll take a while to move into business mainstream users (accountants, secretaries, etc). But once all the Intel processors are post-Core2Duo, then all systems will have 64-bit hardware. At that point, its just a matter of drivers catching up and software being modified to work in it. It'll take a few years, and you probably wont see the breakover until the next desktop OS after Vista.

Re:Adoption of Vista 64-bit

[Spiked_Three]

yeah, no one will ever upgrade from win16 to win32 either. Or why in the world will anyone upgrade to WindowsNT from Windows98.

Jeesh, how long do we have to listen to the same babble?

Why is Microsoft even bothering..

[flummoxd]

..to release a 32-bit version of Vista?

Every week, I hear about a new thing that will "only be in 64-bit Vista". First it was HDTV content only on 64-bit for DRM reasons. Now, we're hearing the reasoning that Windows will be more secure if we don't let third parties in the kernel. Fine, whatever. If we were to assume that makes it more secure, then so be it.

But why bother to release an inferior 32-bit version? Under the presumption that closing the 64-bit kernel off will make things better, why not use the same strict security policies in 32-bit? Surely, there can't be any technical reason for all of this. It's all marketing, right? ("Microsoft recommends a 64-bit PC.")

Or is there some real reason why it feels like 32-bit Vista and 64-bit Vista are two entirely different operating systems?

Re:Why is Microsoft even bothering..

[tkrotchko]

Probably because the 64 bit version will break a lot of code. For example a lot of TV boards write their own drivers (for better or worse) and these won't work. Anything that writes it's own driver or have to get to ring 0 will break.

So the 32 bit will be if you want anything to run, the 64 bit will be for people who want to play DRM'd content on their PC. Maybe an exaggeration, but I think that's about it.

Re:Why is Microsoft even bothering..

[maxume]

64 bit hardware is going to tend to be newer. 32 bit hardware is going to tend to be older. Putting higher requirements on the newer hardware is going to tend to be easier. People will still want to run Vista on older hardware.

64 bit brings benefits, 32 bit keeps people who want to run Vista on older hardware happy.

Re:Why is Microsoft even bothering..

[Agripa]

A majority of x86 PCs still use processors that do not support x86-64 and even now x64-32 processors are still manufactured and in the sales channel. Without a 32 bit version of Vista, not only would these older systems be left without a Windows upgrade earlier then neccessary but both these systems and some applications would be lost to alternative non Windows operating systems.

Re:Why is Microsoft even bothering..

[westlake]

Every week, I hear about a new thing that will "only be in 64-bit Vista". First it was HDTV content only on 64-bit for DRM reasons.

HDTV will run in 32-bit Vista using third-party drivers. MS got tired of waiting for the rival HD camps to agree on DRM standards for HD media.

Re:Why is Microsoft even bothering..

[David Off]

or to paraphrase: Marketing

How to patch the kernel anyway

[Beryllium Sphere(tm)]

Joanna Rutkowska gave a talk about this at Blackhat. Take a program in usermode but with administrative privileges, force the kernel to get paged out, edit the pagefile.

In a recent blog entry, Rutkowska criticizes Microsoft's response to the pagefile attack. Boiled down, it amounts to the problem that as long as a disk utility can run, someone can still edit the pagefile. Her preferred fixes would have been encrypting the pagefile or simply not swapping the kernel. NetBSD's Elad Efrat suggested simply hashing the kernel for integrity checking.

Re:How to patch the kernel anyway

[Allador]

Keep in mind though that this is just Microsoft's very initial, public response. And Joanna even admits in the comments that she's not sure if MS public response is all that was done, or is all that will be done, to combat this technique.

Honestly, the final solution will probably be to just not let the kernel page out. This is a not-uncommon performance enhancing tweak you can do with a registry modification on your machine now.

Make sure you read through the comments on the blog, there's lots of good discussion there as well.

PatchGuard will continue to evolve as the attackers evolve, this is the nature of the business. As long as MS continues to close these holes as they're found, and the strengthening continues, I dont see this as a big problem.

Re:How to patch the kernel anyway

[Anonymous Coward]

Hashing the system call table is essentially how "patchguard" on Vista works.

The article is filled with such great lines!

[Psykechan]

For 32-bit versions of Vista, it'll be mostly as you were on security
Translation: You're screwed! Upgrade to 64 bit ASAP (P.S. some of your software won't work)

Defender has already become the most popular download ever from Microsoft
If I was MS, I certainly wouldn't brag about anti-malware being the most popular application.

referring to third parties being able to patch 64 bit Vista - "It's just not the way the box was designed...we're putting a stop to that."
Great. What happens when MS doesn't quickly put out a patch... no choice on using the good samaritan patches anymore, you just have to sit and twiddle your thumbs.

referring to ever being able to secure 32 bit Windows - "That train has left the station."
I think it's more like the Windows train has left the station. Why bother to convert to 64 bit Windows? Switch to something else as soon as possible.

Re:The article is filled with such great lines!

[dedazo]

If I was MS, I certainly wouldn't brag about anti-malware being the most popular application.

Which is interesting of course, given the fact that the vast majority of "malware" in people's computers gets there thanks to their own intervention. So I don't see how Microsoft would have a problem with giving them something to fix their own mistakes.

There are certainly worms and trojans that make it into a Windows box via vulnerabilities (and dumb ones at that), but I don't think they represent the primary infection vector - not by a long shot. One of the fastest-spreading email worms in history required user intervention to activate.

Re:The article is filled with such great lines!

[Anonymous Coward]

What happens when MS doesn't quickly put out a patch...
no choice on using the good samaritan patches anymore,
you just have to sit and twiddle your thumbs.

Actually, the proper phrase when dealing with an unpatched kernel flaw is "Grab your ankles."

Re:The article is filled with such great lines!

[Allador]

"Great. What happens when MS doesn't quickly put out a patch... no choice on using the good samaritan patches anymore, you just have to sit and twiddle your thumbs."

I dont think you read TFA.

The 'kernel patching' referred to here has nothing to do with what we normally call 'patching', which is updating files to newer, more improved versions.

What is being talked about is PatchGuard, which prevents something called 'kernel patching'. Kernel patching is the act of, without using any windows APIs, modifying in-memory data structures used by the kernel. This is never a good idea, as these data structures sitting in memory are not designed to be modified this way, and it destabilizes the system. It's also how many rootkits and poorly written A/V software (McAfee and Norton) do their work. It's a technique that has been publicly documented as bad and unsupported for 10 years now.

"Referring to ever being able to secure 32 bit Windows - "That train has left the station."
I think it's more like the Windows train has left the station. Why bother to convert to 64 bit Windows? Switch to something else as soon as possible."

Backwards compatibility is what they're referring to here. See how bad McAfee and Symantec are screaming and yelling about MS doing the right thing here by closing this decade old security hole? If they did this on x32 windows, you'd have thousands of ISVs doing the same thing.

It's a matter of trust

[UnknowingFool]

Microsoft will operate 64-bit versions of Windows Vista as a tabernacle, with the kernel as the holy of holies, where only its own high priests of security may venture."

I think the crux of debate will be what MS considers its own high priests. If that means MS security products that compete with Symantec and McAfee, then the two vendors have a legitimate gripe that MS is using its monopoly power to lock them out. MS has said that its security products will not have access to undocumented APIs, but how much do you trust MS at their word? I don't trust them that much because I think MS still plays dirty. As recently as the Burst lawsuit in 2004, you can still see MS is refusing not only play fair but abide by court orders: Both parties were told to disclose emails as part of discovery. Burst.net discovered that not only did MS destroy emails but it was the policy of a multi-billion dollar company not to retain any emails over 30 days. And Burst listed out the many ways the company actively followed this policy.

Re:It's a matter of trust

[Anonymous Coward]

hate to burst your bubble but not retaining emails is the policy of MANY large companies. It is not done purely because they are trying to play dirty, people say stupid things in emails that can easily be taken out of context if you don't know the receiving and sending parties. By ensuring the policy is that old mail MUST be deleted they also don't have a huge burden of searching massive terabytes of mail stores everytime some company or person wants to order them to hand over XYZ emails. PS the burst lawsuit is just yet another example of leech like companies using the law to tie up other companies resources in the hope they will settle. I have no sympathy for scum like them.

Re:It's a matter of trust

[UnknowingFool]

hate to burst your bubble but not retaining emails is the policy of MANY large companies.

Not quite, it is the policy of many large companies not to retain emails of all employees to save space. For the most part, employees are usually allocated some amount of space. And frankly nobody cares about the emails of most low level employees. However, the emails of management and executives are usually kept. MS policy was that no emails are kept. Not even Bill Gates' email. Besides that fact, MS was told to disclose emails by the court. All the while they were destroying them before Burst could get them. This situation is exactly like the Enron and Arthur Andersen where they were shredding documents despite a court order to retain them. Were some of the documents useless? Probably. But that's not the point. A court ordered them to keep the documents.

finished

[GeorgeS069]

...and they all lived happily ever after...The End

Agree with parent, why all the fuss?

[nobodyman]

Correct me if I'm wrong, this lockdown only applies to the 64-bit versionof Vista, and that in the 64-bit version of XP the kernel is locked down in a similar fashion? If so, I don't see why Symantec and Mcaffe are making such a fuss?

Furthermore, 64-bit vista looks like it will have the same enterprise level demographic (db/web servers and such). So it's not like Symantec's core business is being threatened. It looks like they're just playing this up so for the EC to leverage over MSFT.

Great

[SQLz]

Now even Microsoft is catering to the right wing religous fanatics.

Re:Great

[Anonymous Coward]

Why??? Why must a political comment ALWAYS be posted?? There is nothing remotely political about this article yet some jacka** has to post a political comment. I swear, this is why I hardly ever come around slashdot anymore. Not EVERYTHING is political guys! Get over yourselves.

Re:Great

[HornWumpus]

I think the grandparent was trying to make a joke.

Re:Great

[Anonymous Coward]

How is that even remotely a joke, much less humorous?

no, no, no

[circletimessquare]

everyone got it all wrong

the os isn't a black box, the os needs a black box

you know, for when it crashes

Re:no, no, no

[johnmorganjr]

Don't most premade computers that have microsoft already installed come in their own handy black box??

Quite right

[Anonymous Coward]

No-one would just give away the recipe to the Kernel's Secret Source

The holy of holies!

[Anonymous Coward]

I wonder if the "holy of holies" reference is a deliberate evocation of "The Cathedral and the Bazaar"? http://en.wikipedia.org/wiki/The_Cathedral_and_the _Bazaar

The Cathedral and the Bazaar is an extended essay that says that the proprietary development model (the cathedral) cannot compete with the open source model (the bazaar). The reason is not price, it is quality. Because of the number of eyes available to look at open source code, it will be less buggy than its proprietary cousin.

Given the delays in the introduction of Vista, I would say there is some evidence that ESR (Eric S. Raymond the author of CatB) is right.

Re:The holy of holies!

[Anonymous Coward]

Given the delays in the introduction of Vista, I would say there is some evidence that ESR (Eric S. Raymond the author of CatB) is right.

  Well, broken clock, and all that.... ;)

Re:Agree with parent, why all the fuss?

[3770]

They are making a fuss because their livelihood is on the line. Not necessarily because they are right.

More things change...

[djupedal]

...the more they stay the same.

"...where only its own high priests of security may venture."

The concept of 'programmer priest' came about when mainframes ruled. You were not allowed direct access to your data. You had to present your request to the men in white lab coats and wait for the proper circumstances to occur before, even frequently if, you were deemed worthy of receiving an 'output'.

Today, we continue to hear the phrase 'information wants to be free'. MS, having yet again painting itself into a business model corner, simply shows it hasn't learned how to play nice outside the sacred shelter of the priests private club.

Aw, yeah, it's time for the Ballmer Boogy!

[XNine]

DEVELOPERS! DEVELOPERS! DEVELOPERS! DEVELOPERS! DEVELOPERS! *gasp!* DEVELOPERS! *cough cough cough* *gaaaaaasp cough* can't... breath... must.... go on....

oh yeah, thank you

[Anonymous Coward]

that was a *big* help

Using linux kernel src code ;)

[SuurMyy]

They Have To keep that a secret... ;)

lol!

[maynard]

I'll go search for the golden tablets right now!!!

Black Box

[TheSHAD0W]

Dear Slashdot:

I recently purchased a new computer with Windows Vista installed, and I'm having problems switching over to Debian Linux. I've opened up the case and looked everywhere, even inside the power supply, but I can't find any black boxes inside. I know it's there, Microsoft keeps talking about it, but I'm having the darnedest time locating it. Where is it and how do I disconnect it?

Is the kernel really the issue?

[Y-Crate]

Correct me if I'm wrong, but I was always under the impression that the NT kernel and its later variants was actually put together quite well with the input of the ex-VMS team, and that everything Microsoft dumped on top of it was the primary weak point in the OS.

Re:Is the kernel really the issue?

[Ruie]

Correct me if I'm wrong, but I was always under the impression that the NT kernel and its later variants was actually put together quite well with the input of the ex-VMS team, and that everything Microsoft dumped on top of it was the primary weak point in the OS.

They decided to use the opportunity of porting to 64-bit to install a new component - the Holy of Holes. I am not certain yet whether they mean one or many.

Sorry, couldn't resist..

Black box for video and audio devices...

[(H)elix1]

You can bet this is going to make life very hard for the folks like VLC or anyone who wants to do something clever with the audio system. Wonder how they are going to push it, however? Sure, they can go for attrition, and make sure all new machines come with Vista, but there are a lot of Win32 machines out there that have more than enough CPU. There were some big jumps from the 200mhz-600mhz range, but now with 2-3ghz more or less normal and no 'got to have it' devices like USB3 this is going to be a tough sell. Heck, even with DirectX 10 being reserved for Vista, game publishers would be suicide to go after that market for a couple years. While it might give a few more FPS, you can bet the vice-like grip on hardware will doom any of the older games from running on the system... I mean, heck, if you could access the video, you might just try to display content without the secret hardware handshake.

Re:Black box for video and audio devices...

[inKubus]

Why would audio be kernel level? Just because it HAS doesn't mean it SHOULD. There should be a nice open interface that lets me makeSound(*sound) without having to worry about ANYTHING. That's why they call it an OPERATING SYSTEM. Hardware manufacturers and game developers won't risk it?

That's a negative. M$FT got big because they made an industry. Your beloved AMD and nVidia are going to love the excuse to push new "certified" hardware, and keep a step ahead of the generic makers. Your game publishers love to release an "exclusive"--they can charge more for it!

What makes you think the industry likes moving millions of units of commodity hardware? They can make as much money moving fewer units of the newest stuff. And since there is one "got to have it" involved in the equation, so much the better. What is it, you ask? Windows Vista. That's right, your PHB already has his name on the preorder and you know it's coming on every new Dell your company orders. And when the CEO ships out a special memo with his shiny new version of Outlook, the rest of the company has to upgrade to read it.

This Sucks

[snitmo]

IMHO this really sucks. Security by obscurity never works and MS is smart enough to know that. Maybe not this VP guy, but I'm sure the engineers over there do. That means this isn't really a moved aimed at security. It's aimed at slowing down competitors such as McAfee, Symantec, and my favorite AVG Anti Virus. Now they aren't allowed to either know about the kernel, or touch the kernel. How are they gonna compete??

This will slowly kill the security products by the companies above, and we will all need to use MS anti virus software, which, I'm sure, they'll force you to subscribe for $100 / year or something.

Security Through Obscurity != Security

[fernandoh26]

Security Through Obscurity != Security

Security Not Needed

[the eric conspiracy]

This makes me think of Kid-Proof caps. Only the kids will be able to open the cap to get into the kernel. Users who want to install legit stuff, forget it.

Re:Security Not Needed

[mr_da3m0n]

Interesting analogy. It always bothered me, the kid-proof caps on pill bottles. Tylenol, maybe. Potentially lethal medecine, all right. But pills for arthrite?! I keep picturing grandma trying to open them while writhing in pain.

eh?

[Zashi]

Security through obscurity? I think not.

"Black Box" will contain ...

[fahrbot-bot]

"Microsoft will operate ... Vista as a tabernacle, with the kernel as the holy of holies, where only its own high priests of security may venture."

Meaning that the kernel itself will actually be a port of OpenBSD, but (shhh) don't tell anyone.

Black box? Bloody bastards....

[cnerd2025]

Ya know, this is why I hate Microsoft. There they go, using buzzwords like "black box". I guess the old-school word "log" was just too common for them... oh...wait...never mind...

Re:Black box? Bloody bastards....

[Anonymous Coward]

Log? How is this a log, it is a black box, you're not allowed to see how it functions. Black box is an old term, it's not even trendy. They want you to pay for something that you can't even open up or tweak.

Re:Priests huh? - Aztec/Inca

[fahrbot-bot]

...where only its own high priests of security may venture.

Actually, their metaphor is making me think Aztec/Inca monuments and sacrificial altars with blood and human hearts... After all, it is Microsoft. Or perhaps I'm thinkin' Arby's.

Oh yes, I went there and there.

potential issue?

[Anonymous Coward]

This might be a dumb question, but what happens when some kind of malware DOES manage to infect the kernel, or some other off-limits component? How would you get rid of it?

With anti-virus apps and the user locked out, the only thing a rootkit would need to do is prevent the updater from downloading Microsoft's patch...

Whatever you want it to mean

[Gracenotes]

from the abandon-all-hope-ye-who-ener-here dept.

I have a confession: I enered my best friend the other day. (Ener, of course, meaning e-mailed. Dante is obviously afraid of all those daemons.)

Kernel Hackers

[Digital Vomit]

"Microsoft will operate 64-bit versions of Windows Vista as a tabernacle, with the kernel as the holy of holies, where only its own high priests of security may venture."

But, what happens if a hacker sacrifices a spotless bull and two perfect rams and then attempts to hack the kernel while wearing the appropriate ephod and bejewelled chestpiece? Will the glory of the LORD Gates that dwells within the kernel strike him dead, or will the false priest be allowed full access to my OS?

And what if I don't have enough faith in this OS? Will it still run?

What if I commit adultery against the LORD Gates by dual booting Linux?

What if my wife touches the computer while she is unclean?

(oh, the possibility for jokes is endless)

Tabernacle and the holy of holies

[Anonymous Coward]

Nice analogy, considering what happened to the original tabernacle and holy of holies.

Nebuchadnezzar?

[spotter]

So is all we need is a Nebuchadnezzar to burn down the temple?

You keep holding on to that raft ..

[Anonymous Coward]

"Microsoft will operate 64-bit versions of Windows Vista as a tabernacle, with the kernel as the holy of holies, where only its own high priests of security may venture."

And there are thousands of Philistines, including some very 1337 H4x0r5, at the gates ...

Just to be pedantic...

[jZnat]

It's "Mac", not "MAC". MAC is an acronym: Media Access Control [address]. Mac is short for Macintosh.

And Apple makes most of its money from selling hardware, so I sincerely doubt they'll drop that and try to squeeze money out of selling an operating system exclusively.

Re:Just to be pedantic...

[Villageidiot9390]

Off Topic Completely, but that's an amazing sig

Re:Just to be pedantic...

[Eideewt]

I just can't figure out why some people decide TO capitalize that word. LISP I can understand; FORTRAN too -- those just mean you're hopelessly out of date. But MAC? Did they hear someone pronounce it in all caps or something before seeing in print?

Re:Just to be pedantic...

[Tharkban]

Yeah, caps is so old school. XML all the way....oh wait...

Re:Just to be pedantic...

[ajs318]

When you're editing someone else's badly-built web pages right there on the server using busybox vi, you'll be glad of capitalised HTML tags.

Re:Just to be pedantic...

[joto]

Of course the most annoying thing is people who decide to write C instead of c.

Re:Just to be pedantic...

[Dun Malg]

Of course the most annoying thing is people who decide to write C instead of c.

The names of programming languages are proper names, and as such should have the first letter capitalized.

Re:Just to be pedantic...

[Angostura]

Not as annoying as the people who cannot distinguish between Kelvin (K) and kilo (k)

Please post your home address

[Anonymous Coward]

So I can send you a key. No charge - consider it a gift to you, and the whole of the Slashdot community!

Cheers,
AC

Re:Please post your home address

[Anonymous Coward]

My mistake - the phrase should have referred to the 'shift' key. (I was making a lame joke about the OPs lack of capitalization).

Does it come in Green?

[Bo'Bob'O]

Black dosn't go with my sheets.

Why the kernel is an issue

[Sloppy]

The kernel has a reputation for being not particularly bad.

The reason the kernel is an issue, is that the new "threat" against Windows security is the owner/administrator of the machine. Microsoft needs to try to implement DRM, in order to get into bed with the media companies and sell music and Zunes to play it. You can't implement DRM if the user can patch the kernel to work around the DRM. Thus, they're going to try to prevent end-users from having the capacity to modify this behavior of their own computer.

The "security companies" are taking collateral damage from this, because their applications have to intercept all reads/writes (to files, the network, whatever) in order to scan all data against a blacklist of known malware in order to try to protect the comically fragile userspace. This scanning is implemented through kernel patches, I guess.

Re:Why the kernel is an issue

[Allador]

You've got it backwards.

"You can't implement DRM if the user can patch the kernel to work around the DRM. Thus, they're going to try to prevent end-users from having the capacity to modify this behavior of their own computer."

Kernel patching is what Sony's rootkit, Starforce, and many other malware use to _enforce_ DRM on you. PatchGuard would have prevented these from the start.

Now there are things like Protected Audio Path and the like that probably benefit from PG, but these are minor, and you can opt out of using them if you like (just dont use the DRM content). But when any random software company (like sony) can patch the kernel of user's machines, then THEY get to decide how your system runs, and what works.

"The "security companies" are taking collateral damage from this, because their applications have to intercept all reads/writes (to files, the network, whatever) in order to scan all data against a blacklist of known malware in order to try to protect the comically fragile userspace. This scanning is implemented through kernel patches, I guess."

Only the incompetent ones. Sophos, TrendNet, AVG and others are all having zero problems working with PatchGuard.

Here's some good discussion on these topics:

http://www.informationweek.com/news/showArticle.jh tml?articleID=193401506

http://www.sophos.com/pressoffice/news/articles/20 06/10/vista-admins.html

http://www.sophos.com/pressoffice/news/articles/20 06/10/sophos-vista.html

Re:Why the kernel is an issue

[Sloppy]

Yes, better Windows security would have prevented Sony's rootkit, but Sony's rootkit wasn't really serious DRM; it was really just malware and little else. The music was accessible on non-infected machines. Contrast that to the situation with CSS-protected DVDs, where if you put the DVD in a machine that doesn't have CSS, the DVD isn't playable.

Sony's idea was really quite bizarre and fucked up, and shouldn't be confused with DRM.

Now there are things like Protected Audio Path and the like that probably benefit from PG, but these are minor, and you can opt out of using them if you like (just dont use the DRM content).

Microsoft is thinking about the situation where users decide to not opt out of using the content, and instead try to get around the DRM. A Protected Audio Path where the owner of the machine able to modify the code, becomes an Unprotected Audio Path.

Only the incompetent ones [implement scanning by patching kernel]. Sophos, TrendNet, AVG and others are all having zero problems working with PatchGuard.

I guess incompetence doesn't keep people from complaining, which is one of the reasons we're hearing about this. But the broader issue is that, virus scanning aside, there are lots of good reasons someone might want to modify a kernel (read LKML on any given day) and it just got harder on Windows.

Re:Why the kernel is an issue

[Anonymous Coward]

You can't implement DRM if the user can patch the kernel to work around the DRM.

Funny, Apple managed to implement enough to satisfy record companies, even without any hardware assistance or kernel lockdowns.

Re:Why the kernel is an issue

[Allador]

"Microsoft is thinking about the situation where users decide to not opt out of using the content, and instead try to get around the DRM. A Protected Audio Path where the owner of the machine able to modify the code, becomes an Unprotected Audio Path."

Thats very true. But I'm not sure there was an alternative. The companies that own the content and delivery systems have made that kind of thing a requirement for MS to get a license to decode/play content like that. Without it, your regular non-technical consumer folks wouldnt have been able to play HD-DVD.

But, no one is requiring you to support content producers/distributors that use these kinds of techniques. MS is forced to make a choice or get sued. They chose to provide for the vast majority of their users, who want stuff to 'just work' as often as possible, without being restricted for non-DRM content.

"But the broader issue is that, virus scanning aside, there are lots of good reasons someone might want to modify a kernel (read LKML on any given day) and it just got harder on Windows."

Well, it got harder to distribute software to the world that uses known-dangerous and inappropriate methods to modify kernel data structures. You can still do this all you want on your own machine, just disable patchguard. There are a number of ways to do this, including just attaching a kernel debugger.

So PG doesnt in any way stop people from experimenting with the kernel or poking and prodding it. It does make it a _lot_ harder to distribute software (legitimately or illegitimately) that modifies kernel memory structures at runtime.

And to be honest, this whole issue is a red herring. The reason MS blocked this and introduced PatchGuard is that making changes to those structures is a really bad idea. It tends to slow and destabilize the system. You can basically thing of 'kernel patching' as a security hole. It's a gaping security hole that has been in windows for the entire history of the NT line, and they were finally able to close it with the change to x64 (due to the backwards compatibility story there).

Bullshit

[NineNine]

I can't help but disagree. XP has a firewall built in. Windows 2000 did not. Are personal home use"rs paying a bit more for lack of competition" in firewall software? I'm actually saving money because I cancelled my zone alarm subscription.

Re:Bullshit

[db32]

XP had no such thing, XP SP2 had a firewall built in. Windows 2000 at release had IP Security Filters, which while not exactly a very robust firewall, it was capable of getting things done. If you are paying protection money to anyone AV/Firewall/Otherwise you are in the trap that MS is trying to exploit with this move. Crappy OS, no choice but to use AV etc, and now you have to use THEIR AV/Malware detection, which they have sold lower scores to Claria and whatever scumware company shells out more money than you shell out for protection.

Re:Not to worry.

[Anonymous Coward]

Your ideas intrigue me and I wish to subscribe to your newsletter.

Captcha : rectum

LOL!

Re:Getting It Right THIS Time?

[mpapet]

I'm not sure why it is you want to believe that Microsoft will "fix" anything.

They haven't and they won't. Ever.

There is only money to lose if they actually had a legitimate security model built-in from the kernel upward.

Furthermore, signed drivers is not an enhanced security model.

Like every monopoly ever studied, they are destroying wealth (long and boring explanation), putting out an inferior product and making you pay extra for it.

I am asking the following question honestly.

Why do you believe after 95/ME/XP "security" they will do anything to improve when there's absolutely no evidence to support this belief?

What about devs?

[Teppic_52]

So, if your writing (alpha) drivers for a new piece of hardware, how do you get them into the kernel to test them? Do you have to get MS to approve your H/W as pretty enough to make it in to Vista first?

Better accountability

[Axe]

Honestly, I would rather have a late patch from MS, then a rootkit from Sony. 99% of users are not hackers. They will click and istall anything. At least now they will not be able to install a rootkit easily - so there will be one company to be kept accountable. Better Microsoft then RIAA.

Re:Better accountability

[KwKSilver]

there will be one company to be kept accountable.

Refresh my memory. I'm trying to recall any time whem MS took responsibility for any flaw in any of their products, and I'm drawing a blank. Problems have always been blamed on 3rd party hardware, software, hackers, or users. MS has always presented itself as being perfect, no flaws or faults.

Better Microsoft then RIAA.

And when it comes to a bidding war, how do you propose to personally outbid the RIAA or the MPAA? Or, for that matter, any corporate or governmental entity which is willing to pay MS to spy on and/or control aspects of your system? I mean the ones MS is not going to control absolutely?

Re:Better accountability

[mrchaotica]

Better Microsoft then RIAA.

What makes you think they're any different?

I've said it before, and I'll say it again: Microsoft doesn't give a damn about security. All it cares about is control. Therefore, unsigned drivers are disallowed from the kernel for exactly one reason: to enforce DRM. This is done partially to limit copyright infringment of Windows, but mostly to make Microsoft the "standard" DRM system for media, so that it can extend its control over the PC into control over media in general.

Re:Better accountability

[Weedlekin]

"Microsoft doesn't give a damn about security"

They do, but not because it's a good thing to have per se. One of the problems a new MS OS has (on the desktop at any rate) is the fact that its only real competition is older ones from Microsoft themselves. Despite their best marketing efforts, Windows XP has still only achieved around 50% penetration in the Windows sector after five years, with a good deal of the other 50% consisting of corporate customers who are still using (and indeed deploying to new hardware) Windows 2000. Obviously, MS would be delighted if both these users and their corporate XP customers would upgrade any existing Vista-capable hardware, and the promise of greater security is a good hook here, because global news coverage of certain wide-ranging attacks has meant that Windows' vulnerability to such things is well known to even the least technical corporate IT chiefs. Add in the fact that the extra security is one of the few things still in Vista that is potentially an easy sell to management types with control over big IT budgets, and it should be obvious why MS are making such a song-and-dance about it.

Re:Better accountability

[mrchaotica]

the promise of greater security is a good hook here, because global news coverage of certain wide-ranging attacks has meant that Windows' vulnerability to such things is well known to even the least technical corporate IT chiefs.

Yeah, that's another mentality I don't understand: If you know the product sucks, why the heck would you keep buying more of it?! In any other industry, all these companies would be looking for a new vendor, yet Microsoft magically gets a free pass. Any IT manager that's not a drooling moron ought to be able to realize that the way to get better security is to go find a vendor other than Microsoft!

Re:Better accountability

[Axe]

>Refresh my memory. I'm trying to recall any time whem MS took responsibility for any flaw in any of their products, and I'm drawing a blank.

How about every frigging time they issue a bunch of patches that you can download and install.
At least monthly, and it works pretty darn good.

Re:Better accountability

[Axe]

>why the heck would you keep buying more of it?!

Try hiring few thousands of non-technical workers who have any experience with one particular (out of a few zillions) versions of a Linux desktop that you may plan to roll out. Or try dealing with your shareholders afer overpaying Apple for such a rollout. I recently briefly worked with a small company that used Gnome desktop on most their available desktops (science types like to suffer)- I could hardly tolerate this, as I always used KDE. With Windows - it is always a known thing, and when I hire a secretary, she is likely to know Excel, not some particular of a zillion spread sheet wannabies.

Well, that is until the new Office and Vista start rolling out..

Re:Better accountability

[mrchaotica]

Or try dealing with your shareholders afer overpaying Apple for such a rollout.

This raises an interesting question: we always here about various FUD-filled "TCO studies" about Linux and Windows, but what's the TCO of OS X? I'm actually willing to bet that it's less than Windows, because Macs require so much less maintenance. Besides, a "Dell OptiPlex 745 Ultra Small Form Factor" is $1,036 with a Pentium D and no monitor, while an equivalent Mac Mini would come with a Core Duo, built-in wireless and Superdrive, and cost several hundred dollers less. Surprisingly competitive, eh? (It certainly surprised me!)

Well, that is until the new Office and Vista start rolling out..

And that's another thing I don't understand: Why do companies complain about having to re-train employees for Linux, when they have to re-train them for each new version of Windows and Office anyway? Hell, if they picked Linux, they could use a desktop environment that works like Windows 2000 and have to do less training then they would with upgrading Windows!

Re:Better accountability

[Weedlekin]

"If you know the product sucks, why the heck would you keep buying more of it?! In any other industry, all these companies would be looking for a new vendor, yet Microsoft magically gets a free pass."

Microsoft don't need a free pass because they've been using a very clever lock-in strategy which ensures that big corporate customers in particular now depend on them for everything. Their documents are stored in MS-specific formats that contain macros etc. which won't work with anything else; in-house custom software has been developed with Windows-specific tools that make porting to another platform very difficult indeed; corporate intranets contain vast quantities of IE-specific code that frequently depends on all manner of custom ActiveX controls; and staff have been trained to administer and use MS software and operating systems, so they would have to be re-trained if something else was used instead. The expense and disruption for a big organisation with thousands of computers in disparate locations (some of which may be in different countries) would be considerable, as would the risks for whoever came up with the idea if something goes badly wrong.

"Any IT manager that's not a drooling moron ought to be able to realize that the way to get better security is to go find a vendor other than Microsoft!"

No IT manager who isn't a complete moron would even consider embarking on a long, complex , and massively costly migration of a big company's IT resources unless they were left with no other alternative. So they patch, lock down, isolate, and vaccinate every Windows machine in an attempt to prevent disasters, because applying all these measures is still cheaper and easier than embarking on a long, costly, and above all risky migration to some other system that (from their POV) might cure some existing, known problems, but introduce a whole slew of new and unfamiliar ones.

Re:Better accountability

[mrchaotica]

So they patch, lock down, isolate, and vaccinate every Windows machine in an attempt to prevent disasters, because applying all these measures is still cheaper and easier than embarking on a long, costly, and above all risky migration to some other system that (from their POV) might cure some existing, known problems, but introduce a whole slew of new and unfamiliar ones.

In the long run, trying to limp along with Windows would be more expensive than switching.

Re:Better accountability

[Weedlekin]

"In the long run, trying to limp along with Windows would be more expensive than switching."

I'm not defending Windows in any way at all, but the truth of the matter is that I've yet to see any convincing arguments which show that its TCO is significantly higher on _business_ desktops than anything else, especially when one considers how much software is available for it. Consider the following:

-- Small business users receive it on their machines, so it is effectively free (I know it's not really free, but I've not seen any machines from major vendors with another OS that are cheaper than a PC with Windows). The only extra cost they're likely to see when compared with other OS offerings is an annual AV software subscription, and those aren't particularly expensive. Add in the fact that people with Windows skills are much easier to find than those with other IT skills (and therefore cheaper) plus the fact that they can use the same software that their suppliers, customers, and accountant will probably be using, and you end up with a net TCO gain that more than offsets the small extra cost of an AV subscription.

-- Bigger companies have corporate licenses which are again much cheaper per machine than the Windows RRP. They will also have corporate licenses for AV products, and as most who have experienced these know, the corporate versions are far superior to single-user packages from the same vendors. Development needs are supplied by a range of world-class tools that are easy to find programmers for (and also get training for existing employees), and all the other factors that apply to small businesses viz. employee availability and compatibility with customer / supplier software are equally true for larger companies.

Remember also that a lot of big companies have been using IT for long enough to remember a time when the IBM system used by the accounting department wouldn't talk to the DEC that was running the production line, which in its turn wouldn't talk to the Prime that was used for warehouse inventory control. When compared to that, Windows is, for all its mediocrity and vulnerability, a veritable utopia of cooperating systems and software packages that can share data both internally and with their suppliers, customers, government, and anyone else that matters, so those trying to recommend (for example) Linux, with its panoply of at best partially compatible distros, may end up being teated less politely than they would like.

Re:Better accountability

[Axe]

>And that's another thing I don't understand: Why do companies complain about having to re-train employees for Linux, when they have to re-train them for each new version of Windows and Office anyway?

Well, retraining is much easier, tehre is actually quite some decent continuity, and more important - there is one thing to learn, and most new hires will know it.

Office works quite well. Alternatives are just approaching its functionality, and they are much more in flux, and frankly there is NO advantage on switching. Support contracts for Linux based alternatives are far from cheap, experts are not cheap, and finding and hiring anybody who is familiar with it is not easy or cheap.

Trust me - if it was actually obviously beneficial to business, people would be doing it. Nobody holds on to Microsoft for nastalgic reasons.

Something doesn't add up here

[Anonymous Coward]

Something smells fishy here. How will hardware companies, let alone hobbyists, write and debug device drivers, if every time that they change the tiniest bit of code, during development, or to fix a bug, or test out a new approach, they have to wait for Microsoft to sign off on the code? Unless Microsoft is going to write all of NVidia's drivers, from now on, there must be a way to bi-pass these restrictions.

It's not about security it's about compliance

[gelfling]

64bit Windows will see deployment in the server room on corporate data centers. In this area security is secondary to audit compliance. Server ops will turn on the default Win64 kernel security and it will do whatever it does. Auditors will check the AV box and move on to the next server. Everyone is happy. Server ops has one less thing to do and auditors have an easier job of auditing. I know that's cynical but that's how it works.

Let's remember that the reason Windows is in the server room in the first place is because MS sold it on the premise that's easier to run. Not faster, not with less hardware, not even with fewer people but with a lower skill set. Cheaper. So embedded security is not about security, it's about skill sets. Set it, forget it, hope for the best. If it smashes on the rocks then everyone did their best anyway and no one can be held accountable.

All CPU's going 64-bit

[TheConfusedOne]

I think the big issue/deal is that the number of main stream boxes that support x86-64 is just increasing. Also, the pick-up on Vista will probably be largely new boxes because of the questions of hardware requirements and cost of a new box versus time and expense to open and upgrade a current box (especially in the corporate world).

XP 64 is more of an oddity than anything else. The question will be what percentage of home users will have a 64-bit version of Windows shipping on their new boxes.

Re:All CPU's going 64-bit

[nobodyman]

Those are good points, but I"m still somewhat surprised of the attention this is getting, given that Vista is so close to release. I believe the that the whole kernel-lockout thing in 64-bit Vista is not new information.

Besides, in spite of what Symantec says, I'd argue that not allowing kernel patches *increases* security rather than weakens it. The infamous Sony rootkit used kernal patches, after all.

XP 64 is more of an oddity than anything else. The question will be what percentage of home users will have a 64-bit version of Windows shipping on their new boxes.

Windows 2003 Server is much more popular and also prohibits kernel patches. Still, I agree with your point that it's all about what version home users buy. My hunch howeveris most home users, even power users, will shy away from the 64bit windows as it is still more geared at the enterprise/server level. In fact, one of the other aspects of the 64-bit versions is that you MUST use signed device drivers. The implications are much more profound to the end-user than, say, blocking kernel patches. I'm surprised people aren't worked up about that instead.

Re:All CPU's going 64-bit

[Anonymous Coward]

This isn't about NOT ALLOWING KERNEL ACCESS to anyone. No sane operating system has ever done that.

This is about Microsoft moving to a system whereby YOU don't get to decide. It's more to do with DRM than anything else. A Microsoft exec let it slip recently -- device signing (and the enforcement) is about reducing the number of device makers to a more manageable level. Every device will be require to honour digital restrictions, or not get a signing key... and, of course, the NGSB (palladium as it was once called) will call home to ask which key should be revoked on a regular basis.

Good feature or malicious?

[quinnharris]

Can this be disabled? Not after the system boots but with some boot option, much as SELinux can be disabled. It is relatively trivial to provide a boot option to disable this that can not be circumvented once the system boots. In doing this, you would ensure the average user only uses signed quality drivers while enabling a developer to write drivers if they need to. If this can't be disabled it this would just be one more reason to use Linux/BSD's.

This use of cryptography is a good thing if the user is given the final say. Otherwise its downright tyrannical.

If the kernel wasn't so big, this would be good

[Animats]

If Microsoft actually had a microkernel (and NT 3.51 was close), this would be reasonable. At NT 4, a vast amount of crap from Windows 95 was put in the NT kernel for "compatibility", which is how we got to the mess we have today.

QNX has a closed microkenel. It does timers, memory management, CPU dispatching, and interprocess communication. That's it. All drivers, networking, file systems, etc. are outside the kernel as user processes. Nothing other than the stock kernel runs in kernel space. So the kernel changes very little over the years, leading to very good reliability. (It can even be put in ROM, and often is on embedded systems). Sometimes system components outside the kernel break; they crash, an ordinary process core dump is taken, and it can be examined in an ordinary debugger. Drivers are such components. So there's a clear separation between the stuff you don't need to change, and the stuff you might want to change. Even driver developers don't need to see inside the kernel; interaction with the kernel is through the regular user program APIs, with a few extra calls for privileged drivers allowed to map physical memory and access device hardware. Much the same is true of IBM's VM. So this can be done right.

But with Microsoft's bloated kernel, locking down the kernel has much stronger implications. Many functions are in the kernel because Microsoft wants to control them. Far more is there for legacy reasons. (My favorite is the decompresser for .RLE images, which has an exploitable bug.) There's also too much in there because it seems to be needed during the boot process. (One big lesson of OS design: use a boot loader that lets you load both the kernel and various support programs and libraries before the kernel starts. This reduces the temptation to put everything needed at startup in the kernel. Linux now has this, but got it late, so too much went into the Linux kernel too.)

Another issue is the DRM problem, or how to protect DRM code without putting it in the kernel. Microsoft doesn't seem to have a good solution for that. The right answer is probably rings of protection, like Multics or VMS, but Microsoft didn't go that route.

Re:If the kernel wasn't so big, this would be good

[TCP_NODELAY]

We're seeing more and more stuff getting booted out of the kernel to initrd as time goes by, and new drivers are under intense pressure to get the hell out of kernel mode for init. So yes, Linux learned this lesson too late, but it's not "stay the course" even for incumbent drivers. The weird thing is that if Microsoft had just decided to go all-TPM for 64-bit Vista and then only-64-bit for Vista+1, their alien overlords would still win and nobody would have spooked the suckers for a product cycle. Oh, and as you can tell from my username, I *will* kill you.

Alpha supported 4 privilege modes

[tlambert]

Alpha supported 4 privilege modes

Sorry to contradict you, but the DEC Alpha supported 4 privilege modes, and they were used extensively by OpenVMS; it would not have been possible to port VMS to the Alpha architecture without them:

o User mode - User programs, compilers, editors, linkers, etc.
o Supervisor mode - Command language interpreters
o Executive mode - Privilege management
o Kernel mode - The kernel

These are primarily used to protect stack regions so that, for example, the system can call ASTs back in user space on completion of system calls. See the "OpenVMS HACK FAQ" for more information on why stack smashing attacks don't result in escalated privilege on OpenVMS.

-- Terry

Re:Alpha supported 4 privilege modes

[TheRaven64]

Actually, the Alpha was rather more clever than that. It had only had two privilege modes, and no privileged instructions. One instruction was 'switch to a special mode where some hidden registers and then jump to an address in firmware' The instructions in the firmware (known as 'PALCode') could then check values in the (six, if I remember correctly) shadowed register to implement different privileged modes. Once entering the PALCode, the instruction sequence could not be pre-empted. This allowed the addition of atomic operations to the Alpha trivially. The VMS PALCode, for example, contained instructions defined in PALCode for appending numbers to queues, which could be used to implement inter-thread message passing easily.

Different operating systems had different firmware images. The VMS PALCode implemented a load of privileged instructions that corresponded to those found in the VAX. The NT PALCode implemented x86-style operations.

So, while VMS may have required four privilege modes, these were not intrinsically an attribute of the Alpha. Instead, various instructions defined in PALCode would check the status of a shadow register and refuse to operate if it had the wrong value. PALCode was an incredible concept, and it was a very sad day for the industry when the promise of the Itanium killed the Alpha.

Nice deflection, but it doesn't wash

[Anonymous Coward]

There are plenty of people on Slashdot who hold contradictory opinions in order to blame MS in all possible situations even if you aren't one of them. There's certainly a diversity of opinions on Slashdot, but the majority opinion is anti-MS.

Re:Getting It Right THIS Time?

[drsmithy]

There is only money to lose if they actually had a legitimate security model built-in from the kernel upward.

You are clueless.

MS is missing the point

[Anonymous Coward]

The simple fact is that no matter how brilliant these jokers at Redmond think they are, and no matter how brilliant they *really* are, Microsoft cannot win.

It's a simple game of numbers: For every trained professional that Microsoft hires to keep Windows secure, there are 10,000 unemployed and otherwise frustrated but equally brilliant home users who will subvert Microsoft's efforts *of their own volition, on their own time, for no pay what-so-ever*.

They'll do it because they're pissed at Microsoft, or they're pissed at Windows, or they're just plain bored.

You cannot win when you're fighting against those odds. It's simple math.

Not one of Microsoft's strong suits, it seems.

Re:MS is missing the point

[lowe0]

What would you suggest they do then, just give up on improving the security of their product? The customers (and shareholders) will love that.

And something people need to realise

[Sycraft-fu]

This does not mean you can't mess with the kernel. It just means you can't mess with the kernel on a normal, production, system. To quote MS:

"...patch protection is automatically disabled when a kernel debugger is attached to the system. This allows the kernel to be patched during a debugging session, for example, to enable setting breakpoints during the development, test, and diagnostic phase of kernel software development."

So you are free to screw with the kernel all you like if you want to debug it. Go ahead, attach kd and play around, have fun. However you just can't have an app that makes modifications to it that is then distributed to people.

Also as far as I can tell this applies only to messing with the kernel memory itself, not to kernel mode. MS isn't saying nothing else can run in kernel mode (Ring 0), they are just saying you can't modify the kernel itself. For example you can't modify the interrupt table to have your interrupt code execute instead of the normal stuff.

I reserve judgement at this point until Vista is rolled out (since it could be different), but I have used XP 64-bit and I saw nothing that wouldn't function. My hardware worked, my virus scanner (AVG) worked, my software (32 and 64-bit) worked. Basically to me it sounds like Symantec and Mcafee do things the wrong way, and mess with things they really shouldn't, and AVG, KAspersky and so on do things the right way, and thus don't have problems.

64 bit Vista == Palladium without the hardware

[radux]

Microsoft has been attempting to deploy an architecture like this for some time. Check out Microsoft's NGSCB/Paladium/TCPA initiatives (http://en.wikipedia.org/wiki/Palladium_operating_ system). This is a paper tiger without the special hardware. In a few years a push will be made to get people to adopt the hardware. It will be interesting to see how they sell it.

Why would it affect VLC?

[Sycraft-fu]

VLC is entirely user mode (Ring 3) software, you know that right? It runs just fine on XP 64-bit, which also has this. This only affects things that run in kernel mode (Ring 0) and more specifically only things that want to modify the Windows kernel memory itself. This is of no concern to VLC, it does all it's processing in user space and just hands the video output to Windows via documented APIs. The only change VLC will need to make for Vista is in relation to the video overlay. Many video players use the video overlay layer to render their output. Problem is that's mutually exclusive with Vista's new shiny UI. It still works, but Vista shuts the UI off while it's going on. However there's a new method of doing it (I don't know the details) that works just fine with the shiny UI.

This really affects only a very small subset of things. Any app that doesn't have a kernel mode component won't know the difference (and that's most of them). If your app DOES have a kernel mode component, well you are rewriting it to some extent anyhow since 32-bit code can't run in the 64-bit kernel space. The 32-bit compatibility applies only to user mode stuff. Thus you find things like AVG which has it's kernel component made for 64-bit, but the UI still 32-bit since that runs fine in the WoW64 emulator.

A phrase with "the power to cloud men's minds"

[Beryllium Sphere(tm)]

It doesn't rhyme, but "depending on indefensible secrets" is a clearer way to put it.

Defensible secrets, more or less: my PGP passphrase, Microsoft's driver signing key. Combination to your safe.

Indefensible secrets: how the Enigma machine is wired, any Social Security number, your product's undisclosed security holes. Mechanics of your safe.

"Defense" can include the ability to make changes. A secret that is quick to change, e.g. a password, is a safer foundation than a secret that is impractical to change (how the Enigma machine is wired, any Social Security number ...).

Viewed that way, it's easy to see that locking a kernel against unsigned extensions (KEXTs, LKMs, or drivers depending on your religion) has nothing to do with "security by obscurity".

You sign your driver, silly

[Anonymous Coward]

http://www.microsoft.com/whdc/system/platform/64bi t/kmsigning.mspx

There's 4 ways to sign your bits for kernel mode running on x64- all the way from making your own test cert and booting windows in a test mode to getting a commercial CA to sign with.

Re:You sign your driver, silly

[Anonymous Coward]

In other words, all that a hacker needs is to get hold of an authorized code publisher's certificate, and they can then sign any code that they want, and have it accepted by the kernel.

Re:You sign your driver, silly

[Allador]

Thats not how code-signing certs work.

MS creates a root certificate, and produces signing certs for all the CA's who want to play. They then lock the root cert in a safe and bury it in concrete.

Company X then wants to create signed drivers, so they obtain a code-signing cert from the CA. They then use their code-signing cert to sign their driver. The signature shows clearly the identity of the company who purchased the code-signing cert from the CA.

In the off chance that a rogue code-signing cert gets out in the wild, windows can be updated to not trust that code-signing certificate anymore. In reality, this almost never happens, but the capability is there.

but...

[wardk]

So lets just say that microsoft really locks this thing down, lets say IE stops being a malware client and well, maybe pigs fly.

but when you wake up in the morning you still are using Windows

and 'on the internet, no one knows you're running Windows NT', wasn't true then either.

Drivers for assistive input devices?

[tepples]

I want to have as few kernel mode device drivers as is possible. Printers should not require kernel mode, nor should video cameras etc. Only the bare essentials talking directly to the DMA interfaces should ever use kernel mode.

However, because of the architecture of the Windows input device framework, input device drivers do need to run in kernel mode and thus must be signed on 64-bit versions of Windows Vista OS. From FAQ: User-Mode Device Framework:

What are the constraints on user-mode drivers?
A user-mode driver cannot have kernel-mode clients because Windows does not allow calls from kernel mode to user mode. The majority of drivers for input, display, and most network and storage devices cannot be migrated to user mode because they have kernel-mode clients. For the same reason, user-mode drivers must be at the top of the device stack; they cannot attach to the middle of the stack. However, a stack can contain more than one user-mode driver; that is, a user-mode driver can have user-mode children.

This has nasty implications for hobbyists who design custom assistive input devices for people with disabilities, as many cannot afford the $500 annual fee (plus whatever the state charge to establish and maintain a corporation) to get a VeriSign code signing certificate. Should such hobbyists band together and form a charity to administer code signing?

Re:Drivers for assistive input devices?

[Anonymous Coward]

This has nasty implications for hobbyists who design custom assistive input devices for people with disabilities, as many cannot afford the $500 annual fee (plus whatever the state charge to establish and maintain a corporation) to get a VeriSign code signing certificate. Should such hobbyists band together and form a charity to administer code signing?

No. Join the rest hobby programmers and go Ubuntu. Free as in freedom to write whatever you want.

Re:Drivers for assistive input devices?

[tepples]

Join the rest hobby programmers and go Ubuntu. Free as in freedom to write whatever you want.

Then how does a home based business provide device drivers for a custom input device intended for a client with a disability whose job requires running a vertical market application available only for Microsoft Windows? Should they demand that the employer purchase the code signing certificate as part of the accommodation for the disability?

Re:Drivers for assistive input devices?

[ciggieposeur]

Should they demand that the employer purchase the code signing certificate as part of the accommodation for the disability?

That would be an excellent idea. Another is simply not to upgrade to Vista.

Re:Drivers for assistive input devices?

[Zeinfeld]

This has nasty implications for hobbyists who design custom assistive input devices for people with disabilities, as many cannot afford the $500 annual fee (plus whatever the state charge to establish and maintain a corporation) to get a VeriSign code signing certificate. Should such hobbyists band together and form a charity to administer code signing?

I don't think you get the proposal here. The idea seems to be that the only party that adds code to the kernel is Microsoft. Otherwise Symantec and McAfee would simply have bought the relevant cert.

I strongly suspect that most of the assistive devices simply emulate the existing keyboard serial interface and do not require any special device driver whatsoever. Its like the constant refrain heard in the IETF that we have to continue to support protocol X because it is still used in remote parts of Africa. People who have actually visited said parts of Africa then report back that the protocol is utterly irrelevant there because it was never deployed.

Unless the device is using some particularly exotic I/O system it should not be necessary for it to require a kernel mode driver.

Clearly Microsoft does not intend to write every device driver for every device imaginable. Ergo there will be device drivers but just not kernel mode.

Re:Drivers for assistive input devices?

[Dun Malg]

This has nasty implications for hobbyists who design custom assistive input devices for people with disabilities

No. Join the rest hobby programmers and go Ubuntu. Free as in freedom to write whatever you want.

Hey fucktard, he's talking about people who make hardware for third parties who are using windows. The developer switching to linux isn't going to get linux installed on the computers his clients are trying to use. Learn to fucking read.

Re:Drivers for assistive input devices?

[Dun Malg]

Should they demand that the employer purchase the code signing certificate as part of the accommodation for the disability?

That would be an excellent idea.

Bullshit. That requires the customer to supply a signing key for the product, but the product cannot even be created and tested until the developer has a signing key. Catch-22.

Another is simply not to upgrade to Vista.

This is a vacuous and impertinent answer, like the doctor saying "well then don't turn your arm that way if it hurts". What do you do when the vertical market software requires Vista? Or when the entire company has already upgraded to Vista? You're not answering the question, you're just avoiding it with handwaves.

Re:Drivers for assistive input devices?

[tepples]

Bullshit. That requires the customer to supply a signing key for the product, but the product cannot even be created and tested until the developer has a signing key. Catch-22.

As I understand it, the "allow" button appears if F8 is pressed on startup or if a kernel debugger is loaded. However, neither workaround is appropriate for the final product shipped to the client.

LinuxBIOS in OLPC

[tepples]

Does your computer have an open source BIOS ?

Mine doesn't, but some other computers run LinuxBIOS, including the laptop computers that will be distributed to children in developing countries.

Driver signing

[tepples]

If we were discussing a cryptographic system rather than an operating system you would have had a point.

What else is driver signing?

Re:Driver signing

[AHumbleOpinion]

"If we were discussing a cryptographic system rather than an operating system you would have had a point."

What else is driver signing?

Driver signing is one of many pieces of Vista's security, but in general it seems a digression from the security through obscurity topic. It is only tangentially relevant in that encryption is an implementation detail with respect to obscuring code on disk. Something that would actually be relevant to this topic would be, oh, something like not letting 3rd parties have access to the kernel. At this point you may want to reconsider the topic of the slashdot article, "64-Bit Vista Kernel Will Be a Black Box".

Limiting access to sites/programs in XP

[jadebellant1]

Is there a setting in XP to limit what other profiles can access? Sites and applications? Limited accounts are still able to install applications etc...

A flaw in your argument?

[Ibag]

The NSA is a good example of an organization that uses security through obscurity well. They employ the best cryptographers and system designers around, but they are also not about to tell anyone how those systems work. If you did know exactly what they were doing, though, you would still find them to be some of the most secure systems anywhere.

If the NSA were a good example of an organization using security through obscurity well, you would have no idea how secure their systems actually were. No, something isn't right here...

Re:A flaw in your argument?

[Chris Burke]

If the NSA were a good example of an organization using security through obscurity well, you would have no idea how secure their systems actually were. No, something isn't right here...

In the context of my post, "well" does not mean "keeping things obscured well" it means "using the strategy of obscurity well", meaning that you don't rely on it. The NSA uses security through obscurity well in the sense that they focus on real security through design first, and obscurity second. They cannot and have not kept every detail of their systems secret, and it is from those learned details that we know their systems are designed secure first, and kept secret second. That is how you use security through obscurity well.

wow

[JustNiz]

Microsoft are already feeling the pain from Linux and OS/X. It seems that they're getting more radical not less in response, what with all the DRM and crappy performance and other limitations vista has over XP, now this.

It make me wonder just how anti-user Microsoft can afford to get before people just say 'no more'. I don't even know who their target market for vista will be. I mean, home users won't want vista because of all the DRM and the fact that min. spec is too high for the average 3 or 4 year old home dell box. As for businesses, vista has a new-look gui and some extra bloatware, but doesn't really bring anything tangible to the table that would cause companies to want to upgrade all their workstations to vista min. spec. and switch over either.

I guess its just down to the fact that you'll get vista installed by default whether you want it or not when you buy a dell or something.

Re:wow

[SwashbucklingCowboy]

Microsoft are already feeling the pain from Linux and OS/X.

This ain't got nuthin' to do with Linux or OS/X. It's got everything to do with McAfee, Symantec and Trend Micro...

Re:Getting It Right THIS Time?

[Allador]

"I'm not sure why it is you want to believe that Microsoft will "fix" anything.

They haven't and they won't. Ever."

Hmmm. How about every single OS and systems improvement over the past 5-10 years? Every version of the OS since NT4 being radically improved? Abandoning the 9x lines due to them being completely broken? Finally taking a first step at cleaning up the RPC mess in xpsp2, continuing into Vista? Hundreds of patches a year? Going from IIS4 and IIS5 which were wide open, defaulted to everything on, and being a horrible mess, to IIS6 and 7 which are minimal on install, very well locked down, and having nearly zero security holes? How about in Vista moving a large segment of hardware and driver code out of the kernel into userspace to improve reliability?

Now granted, I couldnt come up with very many here in the 30 seconds I spent thinking about it.

"There is only money to lose if they actually had a legitimate security model built-in from the kernel upward."

This is a pretty out-there statement, care to elaborate or explain? And what is it about their current security model that is illegitimate? Process separation, mandatory security roles, and a robust ACL system is pretty standard stuff in secure designs/models.

"Like every monopoly ever studied, they are destroying wealth (long and boring explanation), putting out an inferior product and making you pay extra for it."

Well, there is quite a bit of successful competition in the space they supposedly have a monopoly in. There's Apple, which sells competitive products that are at or above the MS price point. They're not doing too badly and are making strong inroads (albeit into a niche market). And dont forget Linux on the desktop, which is free and Free. They've had some moderate success.

How exactly are they 'making you pay extra for it'?

"Why do you believe after 95/ME/XP "security" they will do anything to improve when there's absolutely no evidence to support this belief?"

I think your statement shows pretty clearly what the evidence is to support this belief. Look at the difference in security, reliability and manageability between 9x and XP. It's like night and day, with XP and the NT kernel line having made massive improvements.

Microsoft Translation

[Slaryn]

For those of you who don't speak "Microsoft"... "Microsoft will operate 64-bit versions of Windows Vista as a tabernacle, with the kernel as the holy of holies, where only its own high priests of security may venture." roughly translates to "It will have a password."

Stupidity trough obscurity type

[Tei]

I think this is stupid. Security trough obscurity... again?... I do think the crackers are mostly assemblers coders that dont need the manual or the c++ source code. So the bad guys will know the internals of the kernel anyway, and If this obscurity is to hidden bad practices, this will harm anyway.

This is why they're doing digital signatures

[Myria]

They know that the only way to win is to use mathematics, because it simply does not matter how smart you are.

Melissa

Re:This is why they're doing digital signatures

[the eric conspiracy]

Mathematics really doesn't help because sooner or later somebody finds an implementation flaw.

Welcome to the human race

[Moraelin]

There are plenty of people on Slashdot who hold contradictory opinions in order to blame MS in all possible situations even if you aren't one of them.

Sadly, this isn't slashdot-speciffic, but a general tendency of most people. People tend to not juggle too many variables about someone or something. ("John is a great coder, but he's an asshole, he's too introverted to manage a team well, and he's an average driver, and...") Even if they acknowledge such things as different factors, the subconscious tendency is to take the overall impression and apply it to everything. So if they like John a lot, they'll tend to view everything about him in that positive light. ("John is a great coder, and refreshingly frank and honest in dealing with people, even if that annoys some, has a refreshing hands-off approach to managing his team, and drives great, and...") If they dislike John a lot, they'll view everything about him in that negative light. ("John is an asshole who couldn't code his way out of a brown paper bag, is the most clueless PHB ever, and drives like a retard on hard drugs.")

People who look good and are well spoken tend to get the promotion, and as at least one study showed, they don't end up in prison as often. If you're in the jury and like that guy a lot, your natural tendency is to extrapolate that positive impression to everything about him. Such a nice guy _must_ be a honest and hard working guy, and probably got framed for that crime. If he's an ugly guy with a bad accent, well, the opposite applies. The motherfucker must be a no-good bum, and thank goodness we can put him behind bars.

The same applies to products. If they were made on the same chasis, with the same engine, and handled exactly the same, you'd probably still be inclined to say that a BMW handles better than Homer Simpson's dream car.

The same applies to companies. If you like a company a lot, then their products must also be the best of the best, their salesmen are honest, their employees are the most brilliant guys that ever walked the Earth, their patents are breakthroughs comparable to inventing the wheel, the waste they dump in the river is just pure water, their factories don't cause global warming, and their lawsuits are right and justified. That's why marketting and PR departments try to create a good image for the company as a whole.

And conversely, the same applies if you really don't like a company. Then their products by definition suck, their salesmen are backstabbing snake-oil salesmen, their employees are the rejects of vendor-machine-refilling school, etc.

It's not trolling, it's just extrapolating the general impression to each of the components. If someone would get a B grade on the whole, the tendency is to act as if every single component is the same B grade as the average.

It's not logical, but that's how humans work.

So some people apply that to MS. Whop-de-do. Humans acting like they're human on Slashdot. Who would have guessed?

Re:Welcome to the human race

[Anonymous Coward]

You certainly wrote a lot just to say that illogical thinking isn't limited to Slashdotters.

Walkman Analogy

[nurb432]

Thats a pretty bad analogy they gave there, about violatng warranty.

So what if i want to violate my warranty? i can if its my walkman, with vista, i cant. I cant do anything that isnt blessed by microsoft ( basically all that is blessed is to feed the beast with more cash )

I paid for it, it on my computer. If i want to totally trash it its my right. Can i call them for help afterwards? No of course not, but it should be my right to do what i want with it.

Security Through Obscurity

[ajs318]

Oh, the horror! Imagine if any Theo, Dick or Linus could modify the precious kernel!

Bu that is no *rason* for the split

[Anonymous Coward]

Vista is all new code. Both 32 and 64 bit. So BOTH could require only MS signed drivers.

It may be that because of the dearth of 64-bit XP code, it may be that backward compatability in 64-bit vista is broken so that they can enforce this and not get *too* loud an outcry.

If the 32-bit version required it, then Vista may sink because nobody will move to it until there are ALL vista versions of their software (the reason why Linux isn't dominating is for the same chicken-and-egg situation).

However, MS isn't saying. So all we have is conjecture.

Re:Bu that is no *rason* for the split

[phantomcircuit]

There is already a massive number of 32 bit drivers written for XP which will continue to work in Vista, which is why it is only the 64 bit drivers which must be signed.

Misrepresenting obscurity

[Anonymous Coward]

You and others posting in this thread are misrepresenting obscurity.

The passwords aren't "obscure". They are secret.

If the password is compared to a ROT13 encrypt then this can be osbcure (that you used ROT13). However, cryptanalysis tools will pick that parart quickly. Obscurity has not helped security. Except in requiring some crypto tools.

If the ROT13 technique was known, then the security is gone, but the level to bypass wasn't all that high.

Now, if you used the latest encrpyt algorithm, that COULD be known, the IMPLEMENTATION of the code that makes this encrypt could be open and the password is safe as long as it hasn't been divulged.

Now, it could turn out that for this encrypt an even number of letters is easier to crack. This will be known about if you've not used obfuscation on the algorithm and either your application could append a non-ascii char encypt on the end of an even password.

Your system is now more secure because lots of people know the algorithm.

If you didn't send out the algorithm, you would have to find that even character passwords are easier to crack. Unlikely. However, black hats are more numerous than you and they will crack passwords maybe using brute force/cryptanalysis attacks. They will find that half of the accounts are easier to attack but, since they don't know the password (just the encrypt), they don't know why (and don't care, really). They've cracked it and your system is less secure.

So obscurity can *hinder* your security.

Same with the code implementing the crypt. If you happen to find a bug or program structure that weakens security, you can fix it. Black hats will still brute-force your passwords and may find the problem before you do (if you find it at all, since you aren't the top-notch crypto experts and if you are, you can't spend all your time going through old code). Keeping code obscure has probably weakened your security.

Rmember, the password is SECRET. That isn't the same as OBSCURE.

If your password secrecy is broken, it should (given the right security policy - not ROT13!) only compromise THAT ONE PASSWORD. Other passwords are OK as long as they are secret.

If your password is OBSCURE (e.g. corporate requires first letter of last name, third character of the desk you sit at, 8th number from your SSN...) then once the algorithm is broken or found out (lost obscurity), you can compromise ALL passwords.

Not backwards

[Anonymous Coward]

Starforce keep getting cracked. Sony's rootkit was discovered and could be removed.

With the New And Improved Black Box Kernel, you don't need either of them (and MS gets the money that Starforce or Sony's supplier got) and you can't patch or remove unless MS say you can (and give you a new replacement).

And if someone leaks MS's private key?

[Viol8]

Ok , so Vista 64 won't load a driver unless its signed. How long do you
think it'll be before some employee in the thousands that work at MS
gets hold of said key and sells it to some crooks or even just leaks
it for the hell of it? What happens then? They revoke the key and
EVERY single driver manufacturer has to get their drivers resigned??
Sounds like a disaster waiting to happen.

not without blood...

[jonadab]

> Microsoft will operate 64-bit versions of Windows Vista as a tabernacle,
> with the kernel as the holy of holies, where only its own high priests
> of security may venture.

And that only once a year, and not without blood, which he offers for himself and for the sins the people have committed in ignorance?

Or perhaps we are stretching the metaphor too far. Perhaps after all computer security is not very much like a temple sacrifice religion, but more like a military installation. Yes, there may be authorization checks at the entrances, but the security of the area within is protected from unauthorized entry due to practical concerns. Granted, not everyone agrees with all of the practical concerns or the level of security involved, but nonetheless I don't think it's fair to imply that the protection of the inner sanctum is purely religious.

Obscurity?

[nuintari]

Sooooo, Microsoft can't fix their OS by cleaning up there code, so they are going for the security through obscurity approach? And while they are at it, taking swipes at Mcafee and Symantec marketshare? Great idea, cause yeah, that works. Anyone who knows anything about security, knows that obscurity is _not_ part of it.

More Bullshit

[NineNine]

I certainly don't have to use XP's built in firewall. I could still buy a 3rd party firewall. But, why would I? I'm happy that Windows is improving. Sounds like you're just interested in spreading FUD.

Re:More Bullshit

[db32]

I have no idea what you are talking about. You say bullshit FUD because "XP has a built in firewall and 2000 didn't" I just explained that you are wrong. 2000 DID have built in firewalling capabilities and XP didn't, Service Pack 2 is what brought the firewall to XP. Sounds like you are very confused about what you are talking about and what I am explaining.

Beyond that I have no idea what you are going on about with the 3rd party stuff, it sounds like you are upset at me for telling you to use a 3rd party product, I'm telling you that ANY protection product that you have to PAY for is bullshit. I don't mind the XP Firewall, I don't use it because I have a better firewall in front of the few windows boxes I deal with. It is about time they put it in there for the consumer. However, I have a huge problem with their malware crap that you have to pay for that they also make deals with scumware vendors to give lower scores. So again it sounds like you are trying to spout some pro MS nonsense with skewed or no facts at all, and then just calling FUD whan anyone disagrees with you. Which is stupid because ultimately I agreed with you that XP firewall was a good thing, but your point was wrong because 2000 had it long before XP did.

So MS people are priests now?

[Unit3]

This actually kind of makes sense, considering their technical decisions seem to be made without any logic or reason, and considering the ass raping they've been giving consumers for years now. ;)

Re:Do the Microsoft Hustle!

[mpapet]

Hmmm. How about every single OS and systems improvement over the past 5-10 years?
Ten years have passed and I still need antivirus, anti-malware and clean out activex nasties from the default browser. Dog forbid I give a Windows OS a public IP address. It's a fembot in mere minutes.

In all fairness, in ten years, what -has- changed is the OS doesn't need the regular rebooting.

"There is only money to lose if they actually had a legitimate security model built-in from the kernel upward."
The revenue lost by marketing an OS with an improved security design can easily be quantified. A conservative estimate may be about half of Symantec's market capitalization which stands at USD $10 billion and estimate 2 billion in annual revenue.

There is a disincentive for Microsoft to actually address the issue or provide an API for other developers to profit.

Well, there is quite a bit of successful competition in the space they supposedly have a monopoly in.
You mean another OS with a miniscule and relatively unchanged market share in over a decade is "competition?" When the consumer's wallet opens, the money (and much more than a competitive OS market would demand) goes to Microsoft. You are pretending there is competition.

How exactly are they 'making you pay extra for it'?
There's rent seeking. http://en.wikipedia.org/wiki/Rent-seeking
There's coercive monopoly. http://en.wikipedia.org/wiki/Coercive_monopoly
There's monopoly profits. http://en.wikipedia.org/wiki/Monopoly_profit
Those are good starters.

It's obvious I have a strong opinion on the matter and I appreciate your response because it's reasonable, asks good questions and generates discussion. Keep up the good work citizen!

Typo

[Anonymous Coward]

"with the kernel as the holy of holies" should read "with the kernel as the holy of holes".

Windows only gets better by

[nebulous_afterthough]

becoming more like UNIX. Heck, Microsoft even built their "UNIX Services for Windows" using OpenBSD source code.

I cut out the middle man and just run OpenBSD natively. Why let microsoft screw it up?

Black Box until the next round of EU rulings...

[oldwarrior]

State's Attny's General and the EU have gotten enough concessions from Big Black recently to enable one to reasonably predict they will go after and be successful at cashing in on Vista in some legal campaign and possibly crowbarring open the kernel. Bet me.

osr coverage on driver signing for 64-bit vista

[soldack]

Check here:
http://www.osronline.com/article.cfm?article=476

Yet another reason.

[Anonymous Coward]

Sounds like yet another excellent reason not to buy Vista. After all, Microsoft has SUCH a good record as far as Windows security goes.

I was paraphrasing the 21164 reference manual

[tlambert]

I was paraphrasing the 21164 reference manual there... FWIW. You can download it from:

http://ftp.digital.com/pub/Digital/info/semiconduc tor/literature/dsc-library.html

-- Terry

Re:I was paraphrasing the 21164 reference manual

[TheRaven64]

I already had a copy, but thanks for posting the link. It's a good resource. Even thought I doubt many people will need to do Alpha development again, you can't really appreciate how badly x86 sucks until you've read it.

Another Case of Microsoft Monopolism run amok

[FractalZone]

Thats exactly what I want. I do not want to have any software patch the kernel.

If there is no way for the spyware to patch the kernel I don't need McAfee or Symantec there at all. First thing I do with a new home machine is to strip off the AV software provided by Dell as cramware. Machines run so much faster and more reliably without. Then I turn off AutoRun and hook it up to my internal network which has twin SPI firewalls.

OK. So you aren't a programmer, at last not a gifted systems programmer. Many, many people are...and Microsoft can't seem to hire the best ones, or even mostly good ones, judging by the glaring flaws in Microsoft Buggy Bloatware(tm) such as Vista, Office, and Internet Explorer.

The facts PROVE that Microsoft can't write small and fast code, much less secure, relatively bugfree, and very tight code like the kernel of a modern OS calls for.

Any intelligent, sane person prefers to have important things on his/her computer be repairable or replaceable quickly and easily by more than one vendor, especially if the original manufacturer has a long history of lousy quality control and bad service, as Microsoft does.

I want independent third party experts to be able to exterminate the bugs and patch the security holes that Microsoft blithly includes in its crapware...crapware it would never be able to sell much of without abusing its monopoly over the desktop OS and office suite. What I would really like to see happen is a group get together and come up with a swap-in replacement for MS's 64-bit kernel, and a lot of other broken-by-design parts of Windoze. A lot of companies have been somewhat over very successful in creating drop-in replacements for factory hardware (think Intel CPUs, graphics cards that run circles around the GPUs built into most mobos, improved sound cards, etc.) Software vendors have often improved upon common apps via add-ins or add-ons, some of which definitely alter the way core code in the base app works.

Would you by a car that could only be repaired by a the factory, whenever the company happened to feel in the mood to come up with fixes for its numerous design flaws? That's what Microsoft is trying to do by preventing anyone else from fixing, or heaven forbid, improving upon its crappy code by locking them out of it.

In the spirit of Microsoft's OS Here is my opinion

[Douglas Goodall]

372487324872373429873243FE798327277A798797977E8989 877FF7D87987987987972279873838798738738973983983 734897434897389478973490834FF3289748927349879387E7 8298729387987E92798E279287987E7E27EE7978792879737 828374728378492374823794872938778987987E778979A8A7 A978798798C7C979879D8798798E7987F98798798797888 He he he :)

One of two things

[trigggl]

Either they are letting them in on the security holes that are already there, that there is a MS Product you have to pay more for or a subscription for, or...Wait. Was there a second one?

It's as simple as this, if the owner of the computer is allowed to install programs, then the computer will fill up with spyware. I refuse to believe that spyware(marketing) will ever go away, so it's as simple as this. You're going to have to pay $500 for an operating system, then it will only run on the hardware that comes with DRM. Big business has control of your computer, you don't.

What scares me is that I've seen signs of some distros conforming to DRM and other laws that place the control of your computer into the hands of the corporations. I remember paying for all of my hardware and I remember all of my hard drives coming empty of anyones OS. I don't need an OS babysitting me.

My Windows XP install is so full of spyware that it has become unuseable. Debian works just fine. There are only a couple of things it doesn't yet support, but will eventually. I think I can hang on to my P3 a little longer. 1 GHz is enough to play DVD's and to burn recordings onto DVD. It's a little slow, but faster than Windows.