Slashdot Mirror
AV Software Isn't Dead, But It's Not Healthy
dasButcher writes "Is a conventional signature-based antivirus technology dead? Trend Micro CEO Eva Chen says no, but more is needed. Her answer: reputational analysis. Not a bad idea, but many have tried and failed to make this type of approach work. We've seen it all before: RBLs, integrity grading, etc. What will make this different? If we're not careful, Trend Micro might give us all a bad Web reputation.
"
...it's just pining for the fjords.
I sure am not a big security expert, so forgive my n00bish words here.
I don't remember where, but at some point I read somebody, probably a sys-admin, saying that if you really want security then what you need to do is disable all the things you do not need. Not by default to allow everything and then pick the things you do not want, but go the other way around and make the default to not allow anything and then enable the things you need.
I guess this is one of the reasons I like Gentoo so much, I know everything that is installed on the system and I can remove it if I don't like it.
I don't like to install all kinds of things that I do not know what is and do not know if I can trust. The more things I have installed the more vulnerabilities I also have.
One of my friends once ran a version of Windows XP that he had pretty much scraped everything of that didn't need to be there, I think he was a lot more secure than he would have been had he filled his computer with all kinds of AV and anti-malware programs, some of them seem to be causing more problems than they solve anyhow.
We need a new word to deal with this technology:
Webutation; The reputation an entity has, stemming from its web presence.
Support NYCountryLawyer RIAA vs People
If we're not careful, Trend Micro might give us all a bad Web reputation.
Who is Trend Micro and why should I care if they give me "a bad Web reputation"? Considering that this is Slashdot, I'm not sure how someone's Web reputation can get any worse.
AV software?
Why should someone use something else than MPlayer http://www.mplayerhq.hu/ for Audio/Video playback?
Maybe Computers will never be as intelligent as Humans.
For sure they won't ever become so stupid. [VR-1988]
If eople want to use reutational analysis on this roblem, there's lenty of others I'd ersonally trust over Trend Micro.
Oh the stories I could tell as a former emloyee of this comany. Not only the missing "p" problem; there was the time they used a telephone number as a phishing signature (too bad it was the actual phone number of one of the largest banks in the US--and that all that bank's legitimate email to customers was trashed)--that was one big account they lost the next day. Or what about the time that a bad signature file took down about 80% of PCs in Japan. Or when it turned out that the library that scans for viruses was actually a vulnerability. Or the time...
Soooo glad I don't work for those guys any more.
I said, "Mom, what are you doin'? You'll ruin my rep."
She said, "You're only 16, you don't have a rep yet."
AV software is alive more than ever thanks to crackers on the internet and buffer overflow malware ads on webpages.
PRoblem is the software is not healthy indeed and can screw up a whole system. ITs like their approach to neutralizing a hammer is to encapsulate the whole thing. Every i/o transaction is read and maybe even virtualized.
Does it stop virii? Hell no. I worked help desk at a gaming company which uses the IE sdk for some code on the logon screen. Anyway it wont load if any viruses or keyboard monitoring programs are installing which use the IE sdk. I get many callers saying "WTF. I have norton. What do you mean my system is infected!?". I then clean the system with some cheesy app that is not an antivirus program.
http://saveie6.com/
#1. There is no security without physical security.
... rather long. Follow along for a moment.
#2. Run only what you absolutely need.
#3. Run it with the minimum rights possible.
The reason that Trend Micro's "new" approach will fail is
a. Vulnerability is found and exploit is written.
b. Exploit needs to be distributed.
c. Exploit is distributed via a quick spam flood - they have no protection against this.
d. Exploit is posted on a web site - how do the bad people drive traffic to that site?
e. They use a compromised site. They hide the exploit in a directory that robots.txt says not to scan. Either Trend Micro violated robots.txt or it cannot find the exploit.
f. So Trend Micro will have to violate robots.txt and that behaviour should be noticeable. So the bad guys would hide that file from something that looks like a webcrawler that doesn't respect robots.txt.
And we're back at the beginning.
Funnily enough, I just wrote about this:
http://slashdot.org/~Alioth/journal/167405 - includes a link to a major study of a piece of malware which went undetected by the AV companies for months.
Or just go to http://www.secureworks.com/research/threats/gozi/ if you don't want to read my crap.
I've personally witnessed two malware infections where the malware arrived up to a week before the AV companies had updated their definitions.
Oolite: Elite-like game. For Mac, Linux and Windows
is the ABSOLUTE CRAP that is either norton/symantec or mcaffee.
I'm old enough to remember when both softwares were fantastic, it sucks to see what they have become. They cause more problems than they fix, bloated crapware. And don't even think about trying to un-install them, your better off reformatting and reloading.
rant over.
So to defend against botnets, Trend Micro will make a massive spidering botnet capable of indexing and cataloging 100 million domains. If Morissette were available, I'd quiz her if this situation qualifies as ironic.
So help me if they don't honor robots.txt.
At a certain point, networking requires trust in order to realise it's potential benefits. Open source wouldn't work if everyone had to read every line of source code before running a program, so various organizations and projects develop trust and reputations. We know Debian, Fedora, Gentoo, etc. are OK and can proceed to use them with minimal trouble. A brand new Linux distribution must climb that hill, in addition to providing sufficient incentive for people to find out if they can be trusted. That's tough.
The anonymous nature of the web is what allows things like virus writers to succeed - if they couldn't hide, they wouldn't assume the responsibility for what they're doing (well OK a few nut cases would, but the same is true in real life.) However, forcing unique identities on people opens up a host of other problems, some of them more serious than the ones we have today.
So we must operate in the twilight world of making networks which cannot be successfully attacked by bad actors. There are a wide variety of intermediate solutions, like today's anti-spam techniques, wikipedia's system and even slashdot's own moderation system. But none are perfect and none can be perfect - the problem is not solvable in general. Open source actually helps this in one major way - the community controls that operate in the real world to keep human social systems functional also operate (to some degree) in small scale projects. There the individual traits of interested parties become known over time, and recognition and trust can be built up based on more than just a name or email address. It is not perfectly robust, but then no system to date has been.
Virus problems will continue as long as there are people wanting to write viruses, as they are simply an electronic version of spray painting walls, defacing monuments, or other useless and harmful activities that have persisted since the beginnings of civilization. We must rely on community, the most robust tools we can devise, and (finally) building our own web of trust based on things we have found to work. These issues are fundamental to the human condition and (like all social problems) cannot be resolved by technology. The fact that spam emails can be identified at all, for example, is really just an indication of the lack of skill of spam writers. Likewise, someone really wanting to distribute a virus can just make a freeware program that actually does something real and useful long enough to build a reputation, and then when it is widely distributed trashes every system it is installed on. There are always ways to attack a target, if enough effort is put into the planning. The trick is to be fault tolerent and recover quickly. In specific cases better security can be achieved (classified information, etc.) but for the general case it will always come down to dealing with the consequences of antisocial behavior as it happens.
"I object to doing things that computers can do." -- Olin Shivers, lispers.org
Considering the fact that the infestation could be due to either a worm infection, or could come about by accessing a webserver that is in actuality a compromised botnet drone, how on earth is such a reputation system supposed to be effective?
Most of your issues will not come from the same sites over and over. The only exception to this is crack and warez sites, but we already have similar reputation systems implemented.
for sale
I'm a self-modifying sig virus
Please tell me that the AV companies don't also own a crazed lunatic world mis-leader!
I can't name vendors as I work for one, but Google is your friend.
The main reasons this works better than traditional end-point a/v:
Of course this isn't a silver bullet for all malware, but it kills spam virtually stone dead, and cleans a lot of crap from your inbound mail feed.
This is the only way to be sure.
The old barn door begins to give way under the weight of all the locks.
All it takes is for a user to get pissed off at your software and mark it down on the list for the ball to get rolling. Same thing applies to spam. I know people who cannot be bothered to unsubscribe from mailing lists. Instead, they just mark it all as spam, not even caring that they signed up for the stuff in the first place!
... otherwise there would be no syphilis in the world.
Seriously, there is a pretty direct analogy between (digital epidemiology, computer viruses) and (real epidemiology, real germs). If there were a simple answer to the digital problem, it's a good bet that some population or other would have adopted the analogous strategy to the real epidemiology problem.
STDs offer a good analogy for digital viruses with a Trojan-style (no snickers, please) strategy. In both cases sharing of {data|fluids} yields immediate benefit at some risk. In both cases, populations have adopted reputational strategies to avoid spreading/contracting viruses. In neither case do those strategies work.
Even with near-perfect "antivirus software" (the antibiotic penicillin), the old monsters of syphilis and gonorrhea still remain on the planet, and penicillin-resistant strains have even evolved. One problem is that reputations are hard to establish and not necessarily accurate; another is that most humans tend to discount future risks in favor of immediate benefits.
Interestingly, the reason that the traditional venereal diseases are treated with penicillin injections (and not an oral course) is that, statistically, patients are unlikely to finish the oral course -- a properly completed oral course of penicillin is as effective as the traditional three injections. There is perhaps a lesson to be learned there about how effective corporate data-hygiene strategies are likely to be.
(Sung to the tune of "Bad Reputation", by Freedy Johnston)
I know, I've got a bad reputation:
and it isn't just W32/Delbot.
If I could only keep this damn malware
out of my inbox.
I could have had a normal conversation,
if it wasn't for this firewall.
If it deletes zip files with passwords,
then they're worth fuck-all.
Suddenly, my mail gateway is hosed,
malware is being
installed by the truckload,
keeps breaking down.
Can you help me now? Can you help me now?
Why, in this day and age, are we having a conversation about anti-virus anything?
Instead of accommodating Microsoft's severely broken security model, now updated with "are you sure you want to do this?" Just flush that windows partition and install your linux distro of choice, or install linux on the PC and give it away, or get a Mac.
No, sysadmins like me won't be doing this at work anytime soon. Ever since I told family and friends who needed computer support I won't fix windows and gave them the option of buying a mac or switching to Linux, I'm having much more fun on my days off.
The extra benefit is I don't have to discover some of the ummm, unusual, tastes-and-preferences in my friends cache.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
I stopped realtime scanning when I realized that over 50% of my CPU was going to scanning virus's. Now that it is turned off, things run much faster. E-mail seems to be the main source of virus's, but most email servers scan for virus's so doing a local realtime scan is just a waste of time. Otherwise just avoid memory keys, and disks which is fairly easy. I find Spyware a bigger problem than virus's but just running Spybot every now and then to clean off things installed by other software like webcams seems good enough. Certainly my PC runs much faster and more reliably with AV turned off. Still do a system scan now and then, but haven't found a virus in like five years.
Wow, this is the same thing as Site Advisor; except it doesn't warn you about bad websites, it just tells you to fuck off. How hard could it be to modify the site advisor extension to do that?
Two times, I've observed that the opensource AV software ClamAV nailed new email virii
about 6 and 12 hours before the commercial alternatives got signatures for them (3-4 examples, names left out to protect the guilty).
Of course, this doesn't always happen, but it's still an interesting observation.
Queue PC-cillin bashing.
A more naive self once had it as virus protection several years ago.
Ended up causing a multitude of problems that it shouldn't have.
And here is where you think that if people would not take care of their own bodies how could you expect for them to care about a darn computer...
As you said, the main issue is the "immediate benefits." whereas it is a nice orgasm, or winning the Nigerian lottery or anything else, lots of people do not know the risks, and lots of people do not care about the risks even if they know them.
Ubuntu is an African word meaning 'I can't configure Debian'
At http://www.calyptix.com/ we have a lot of success with our signature less inspection engine, DyVax. This includes stopping the Storm Trojan and Nuwar malware hours before the big vendors saw samples on their honeypots. Reliance on signatures creates costly downtime, we are trying to eliminate that.
Two times, I've observed that the opensource AV software ClamAV nailed new email virii about 6 and 12 hours before the commercial alternatives got signatures for them (3-4 examples, names left out to protect the guilty).
So for every new virus but two the commercial alternatives got their signatures updated quicker? Guess I know which I'd choose...
> virii
I just though you should know that no one on either side of the virus industry calls them "virii", only poseur faux-intellectuals.
The reason that Trend Micro's "new" approach will fail is ... rather long. Follow along for a moment.
a. Vulnerability is found and exploit is written.
b. Exploit needs to be distributed.
c. Exploit is distributed via a quick spam flood - they have no protection against this.
Actually, they do. That's part of why the approach is novel.
d. Exploit is posted on a web site - how do the bad people drive traffic to that site?
e. They use a compromised site. They hide the exploit in a directory that robots.txt says not to scan. Either Trend Micro violated robots.txt or it cannot find the exploit.
f. So Trend Micro will have to violate robots.txt and that behaviour should be noticeable. So the bad guys would hide that file from something that looks like a webcrawler that doesn't respect robots.txt.
Actually, they can do this without scanning directories forbidden by robots.txt. Again, it's why the approach is novel.
Sorry, I can't say more as I'm under NDA. I'm sure the details will emerge soon.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
Sys admins like *me* prefer variety and get a little tired of the messiah complex some people have regarding religious OS of [choice].
Blaming Windows on security problems cart-blanc seems pretty ridiculous (they get credit, but all the credit?). Especially right before jabbing them for improving it a little (it's annoying, but *as* a systems admin I'm sure you know the security/usability trade-off).
Do you think because Linux distro's do things slightly differently that with mainstream adoption they would have such an easier time or simply become a more mainstream target? Sounds kind a cavalier to me. *If* Linux picked up steam or Windows suddenly ceased to be, whatever replaced it would be the new focus of script kiddies and security experts. I'd probably move straight to OpenBSD or Solaris. But until that happens (I don't see why it would) I certainly won't start trying to strong-arm my friends and family into using *my* operating system of choice. I'd rather have them follow a few basic security measures that they can take with them across operating systems (say, like how AV products are good and keeping them up-to-date can help or using anti-adware software...).
But if you're friends/family like being brow-beat, what the hell. I should try that here at the office (of course the CEO would probably get cranky, but hey, it's Monday!).
Quack, quack.
Is your desire to surf the web as great as your sex drive? Your analogy is deeply flawed.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
If all the effort spent on security approaches we know won't work, like looking for known attacks, were spent on approaches that can work, like fixing operating systems and applications so external content runs in jails that work, and developing reliable means for sanitizing content, we'd be much further along.
Think about it. Symantec is a billion dollar company selling a product that barely works. Nobody is spending that kind of money making operating systems more secure.
The problem with all this so-called "virus security" is that it's aimed against bulk attacks that are mostly annoyances. It won't detect focused attacks aimed at a business or government site intended to steal serious money or information.
Military security people are trained to make that distinction. Some effort has to be devoted to chasing off kids throwing rocks over the fence, but they're not a real threat. The real threats are subtle, until it's too late. The commercial computer security industry does not get this at all, and doesn't want to.
AV should seriously die a horrible death in my opinion because there's always going to be the need for bigger and better security, and the low-end computers that everyone buys because they're $300 at Walmart, aren't going to be able to handle it.. leave it up to the operating system to be secure, and leave it up to the computer experts to remove bad viruses if and when they do come around.. face it, when is the last time your AV software actually got rid of bad virus? the only program that even comes close to operating correctly without hogging up tons and tons worth of precious resources is Panda AV anyway..
People that have a decent expert opinion with computers typically don't even use AV software.. and if you do, you must be one lazy bastard and don't care how fast your system operates.. you should be using hijackthis, autoruns, killbox, and some of the other nifty utilities out there..
I will say that I've been a little impressed with Vista's CPU prioritization of certain tasks.. Maybe if they make new AV software that operates similarly to the way Vista indexes, and can scan your computer all the time using a lower CPU priority, then I think it will be more worth while for the regular user..
as for now, customers rather pay me $40 in-shop labor for removing all the horrible spyware and viruses from their computers every few months, than have to deal with slow computers running AV software and having them prompt them every 10 seconds regarding something they don't even understand..
*plays the Apogee theme song music*
They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock
Screw AV it's dead end. Take all that time and resource and brainpower and focus on making the OS stronger and hackproof. Windows has become a titanium armored soldier with seriously bad heart disease. Making the armor stronger isn't going to help anything in the end.
The biggest security advantage wrt viruses etc that Linux has now is small market share.
Wrong.
Windows security model and the *nix security model is a false analogy. In no way are they comparable.
Instead of making false analogies, why don't you install a Linux distro and discover all of the benefits of running a sensibly designed, though hardly perfect, OS. Yes, you trade anti-virus subscriptions, anti-spyware software and Microsoft treating you like a criminal with their WGA software for some hardware incompatibility.
Overall, you get to concentrate much more on using rather than taking care of the PC.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Last i checked AV software was doing fine in Japan. Just look at the H game section..
The war with islam is a war on the beast
The war on terror is a war for peace
You can get all pissy with me if you want. My horizons won't be hurt. I work with what you advocate every day. I just don't particularly care for that unrealistly cavalier attitude. It reminds me of myself when Linux was new to me. After 8 or 9 years Linux is good, but things don't seem so black and white anymore.
Sure. Because I hate Linux/Mac/Solaris/BSD...oh snap! I don't. My motives are simple: let people work on whatever they find productive. Maybe I don't mind helping the friend/family member as much? (wasn't that your motive?)
Basic security is still your best bet. But you can argue with me all you like.
Quack, quack.
I'd go with that. But the problem I have here is the simple fact that *this* is the current reality. The previous poster seemed to believe that forcing people not to use Windows/Vista was the solution. But people are using it and will continue to.
You are probably correct to assume there would be a different response to security if it was in the hands of the larger community. But things can get thorny there too. Q&A (which slows down the release cycle). Project forking. Compatibility. Right now Linux is good, but it's hard to know what the mainstreaming (if Linux was ready) of Linux would result in. Dumbing down? Certainly. Some concessions to security for convenience? Likely.
I agree the 1-1 security/usability argument is lame. I wasn't exactly trying to say that though. It's just a broad rule of thumb.
As a Linux user I'm accustomed to logging in as an unprivileged user and performing upgrades/configuration/installation via sudo or su. But I'm not your average user. My friends and family are. Linux mostly follows a what? 20 or 30 year old security model? I just don't like people banging on something when the problem is almost *always* more complicated then they want to make it out to be. If we saw widespread Linux adoption *today* the most interesting thing about it would not be how it is, but how it would adapt. Because honestly for that kind of use, Linux and the existing security model isn't good enough either.
On the server? Sure. With a reasonably technical person? No problem. But locking down a system *still* requires you know more about the software then most people should care to (default services/software patching/configuration/basic use).
Anyway, I'm not saying I don't care or that I think everything's fine as it is. I'd love to see things improve. I just think it's kind of childish to say A is better then B. A has qualities and B has qualities. But I especially hate dogmatic arguments. It accomplishes nothing believing without questioning (which I'm not accusing you of doing). The previous posters hard-line approach is unrealistic and frankly, lazy. I can lock down a Windows system with *almost* as good results as a Linux system. More importantly, I can treat my users with respect and help them have the best possible experience even under somewhat adverse circumstances. How frequently do you think my XP system has been compromised? Or yours for that matter?
Quack, quack.
Walking my family through command line installs of libraries
Your printer remarks are equally suspect.
THOUSANDS of dollars on software for the typical email/browser/occasional document machine? Are you serious? If you are, then it's not my fault they overpaid.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
... Default Deny.
... economics. Anti-[threat du jour] vendors work on subscriptions because they can check for subscriptions before issuing malware signatures (it's the whole incentive concept we see all over again). But, there is no incentive for the customer to check in with the vendor if their tool is just installed and doesn't need re-configuring until the next time a new application is installed (presumably to update the inventory).
... and at that point it would no longer be a problem (as in a "social problem")).
...
We have seen it in firewalls. We have seen it in military-grade physical security. We have seen it in banking. But, why, oh why, do we not see it with malware?
[Analogy warning] About the best analogy I can come up with that describes just exactly how modern anti-[virus, spyware, threat du jour, or just plain "malware"] is this: Enterprises and home users are outsourcing the task of determining the trustworthiness of software applications that reside on their computers. However, they are forcing the outsourcers (the AV companies) to work both backwards and blind. "Blind" in that the outsourcers are not allowed access to see what applications are actually running within the trusted computing environments (or how well those applications play with others (do they run with scissors?)) and "Backwards" in that the outsourcers are not allowed to simply identify trustworthy software applications-- they're forced to identify the good by ruling out everything that is bad. And we all know that "good" and "bad" are in the eyes of the (ahem) beclicker. [End analogy]
What we need instead is a serious set of solutions (and some are starting to crop up, but I won't cite any because I cannot vouch for their quality) that work in the POSITIVE direction, and not the NEGATIVE direction. In other words, we need anti-malware that simply inventories known good applications, comparing all code execution requests against the guest list before letting them get CPU resident. Assuming that code injection techniques (e.g. buffer overruns) can be quelled by other means (microkernels, randomized memory addressing, read only data memory, etc.), then the likelihood of malware infection with a Default-Deny approach (deny all applications except those on the guest-list/inventory) would dramatically approach zero.
The real problem is
And, like many other comments here have already noted, privilege escalation cannot be overlooked. Supposing a default-deny-anti-malware approach exists (and is worth using), if I operate the computer at the same privilege level of the tool itself [regardless of OS], it is possible for malware to disable the controls. And for the clever readers out there, yes, a set of default deny application inventory controls does seem similar to file system level controls--only execution controls further extend the FS permissions to cover the missing gap.
Who cares about behavioral analysis? What behavior I dislike another will certainly like! Who cares about reputational analysis? What you trust, I may not! But, if we all just stop assuming that we can never speak intelligently about the inventory of "good" applications, then we might finally arrive at a solution that ends malware once and for all (well 99.999% anyway, we'd still have to worry about insider-threat
I guess I went over my two words. Apologies
Dang. I guess that means I'm preaching abstinence.
And here I thought this article was about the OTHER kind of AV... ...
*fap fap fap*
Have you ever tried to give support to a technical newbie who decided to "try Linux out" on a suggestion from one of his geek friends?? I have, and it was hell - much more hell than any of my "Windows people" ever throw at me. As stated in my post, Linux is great if you really like knowing the inner workings of an OS and you like to tinker. But 99% of the people could care less how it works and hate to tinker. Windows (or even OS X) are the more logical choice for such people. Claiming anything else is flamebait as well.
"But this one goes to 11!"
(Sung to the tune of "Old MacDonald", traditional folk song)
sammy baby put too many syllables
In the lines of the parody lyrics
And when a reader tried to sing them
All he got was frustrated
https://www.eff.org/https-everywhere
I thought this meant "it's bad for your health to use AV software".
The Common Criteria configuration of Windows XP disables 56 unneeded services. However, the process list only shows 37 after the default install. So Windows is running a huge heap of shit that most people don't even know is running and which are impossible to stop by normal means.
So, how did your friend disable all those things???
Excuse me, but please get off my Pennisetum Clandestinum, eh!
The Windows NT (which all Windows versions since XP are derived from) security model is comprehensive, powerful and granular..
8 14232
If it's so great then why can't I just put an unpatched windows box on the internet with a public IP?
It has always been possible to log on as a safe unprivileged user for normal work.
Now that's just nowhere near the truth. I've got a stack of games that don't work in user mode. Intuit applications don't run in user mode. Furthermore, blaming resellers for Microsoft's design failures has no basis in reality.
Microsoft's alleged priority of patching of WMP DRM failures
See here for an example: http://yro.slashdot.org/article.pl?sid=06/09/07/1
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
If it's so great then why can't I just put an unpatched windows box on the internet with a public IP?
For the same reason you can't put an unpatched UNIX machine from ~7 years ago on the internet.
Now that's just nowhere near the truth. I've got a stack of games that don't work in user mode. Intuit applications don't run in user mode. Furthermore, blaming resellers for Microsoft's design failures has no basis in reality.
No software developer has had a remotely justifiable excuse for releasing software that needlessly requires an Administrator level account for nearly a decade now. It is *most certainly* something that can be blamed 100% on "resellers".
It's pretty obvious from this and other postings you have made that you have absolutely no idea whatsoever about the architecture of Windows and, most likely, any other OS. You're just a standard anti-Microsoft FUD mouthpiece.
You should not transfer in one step.
I have only moved my father to Linux, but it was worth a while.
I started with dual booting his Win95 system to get rid of Internet Explorer and mail issues. I created three partitions, so that he could exchange data between the two systems. He used Linux for connectivity and Win95 for the rest.
Some time later, I prepared a complete Linux system for him (Debian+ KDE 3.5). We kept his old system with a network connection, so that he could access it using VNC.
The only things for which he calls is to know about the functionality of programs. He uses OO.o, GIMP, QCad, Sylpheed, and is able to use his printer, scanner and camera. If he calls because he has problems, he either finds it himseld, or I am able to trace it together with him, and its always because he has forgotten something (which would be the same under Windows).
This particular migration took 6 years. This was because a whole lot of desktop functionality was missing and was only added incrementally. The last one to enter (about a year, a year and a half ago) was support for USB drives in KDE (it was available longer before in GNOME).
I think, currently, the only difficult thing in migrating someone from Windows to Linux, is to have a usage, software and hardware inventory upfront, and based upon that finding out what the possible options are for hardware support, software equivalents and data migration.
And I guess this T-shirt wraps it all up.
Anti-virus software plays too nice with viruses. It needs to be more aggressive. If viruses don't play by the rules by infiltrating all kinds of places on your system, why can't anti-virus software follow the same route in sever cases. I mean a system plagued by malware can't be damaged any further if your AV goes a bit hard on your system to get rid of the malware. One thing for instance. There is nothing more annoying than installing an AV package on an infected machine only to find that the malware is disabling the setup program. Then you start into Safe Mode and now the installer doesn't work because it depends on the Windows Installer. Why the hell did you purchase the software in the first place, it is much cheaper to format the hard drive in that case. I know that making AV software more aggressive can lead to system instability, but I'm not suggesting AV going haywire in your Windows Registry or getting rid of stubborn files by causing bad sectors on your hard drive. I'm simply suggesting that you make AV software so that it can go to the same underground levels on your system than viruses and not bow to the supremacy of some nasty viruses, rootkits and trojans.
www.cybertopcops.com
What's this? A story that methodically reviews OS's for network security and finds Linux good and Windows uhh, lacking.
1 7234
http://it.slashdot.org/article.pl?sid=07/03/29/17
It's reasonable to state windows XP/Vista the most vulnerable OS when comparing windows and Linux. No FUD necessary.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
But, I thought windows was secure?
http://it.slashdot.org/it/07/03/30/1311247.shtml
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html