Slashdot Mirror
Flawed Survey Suggests XP More Secure Than Vista
SkeeLo writes "One of Vista's big selling points is security, but a report from CRN concludes that Vista offers little in the way of security advancements over Windows XP. Ars Technica analyzed the report and found some methodological problems. 'The report faults Vista for "providing no improvement in virus protection vs. XP," but of course Windows Vista does not ship with antivirus software — something the reviewer fails to mention. Faulting an AV-less Vista for not stopping viruses is a bit like faulting a door without a lock for opening when the handle is twisted.' That's not all: 'It was also disappointing to see CRN completely ignore the issue of buffer overflows, which has been addressed well in Vista by most accounts. This was a major weak spot with XP, and so far, Vista looks strong in this area, strong enough that Vista may never get its own "SQL Slammer." Why CRN didn't address this is a mystery, as it is no minor matter.'"
Since most consumers aren't buying WinVista if they can avoid it.
... oh, wait, they are.
But, if that were true, chip sales by Intel and AMD would be down
-- Tigger warning: This post may contain tiggers! --
Study finding Vista more secure then XP = X hits.
Study finding XP more secure than Vista = Y hits.
if (x > y)
post Vista more secure than XP
else
post Vista less secure than XP
That's life for being MS.
If MS put in a AV software, other AV companies will file for anti-competition lawsuits; If MS didn't, consumers will moan about it too.
Virtual Betting on Facebook for non-geeks.
By the time your AV software comes into play your already infected. So AV software is not the lock on your door. Its the rifle in your house.
Still important, But vary different.
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
XXX#######
Or rather.. it's a bit like faulting the construction company when the wall in your house fell over because somebody knocked on the door.
Anywho, anti-virus and personal firewalls are ridicilous concepts. You shouldn't have userland applications necessary for keeping other userland applications out of the actual operating system.
"" How about taking the safety labels off everything, and let the stupidity-problem solve itself? """
Seriously. A pro-MS article? whats next, mr spock with a goatee? Doc
If at first you don't succeed, redefine 'success'
I'm sorry, but if I bought a security door that claimed it would keep out 99% of criminals, I would be a bit pissed off if I got it home and realised that an actual lock for that door was considered an 'optional extra'. The idea of browsing the internet with IE, no anti-virus and the windows firewall for any length of time, even no longer than it takes to download zonealarm and avg, gives me the heebie-jeebies.
"If you want a vision of the future, Winston, imagine a boot stamping on a human face forever." - George Orwell, 1984
Comparing XP to Vista security is kind of like having a SUV milage competition, except SUV's are sometimes useful and that utility is destroyed by poor fuel economy.
Friends don't help friends install M$ junk.
Right now linux is more like an empty house. No one bothers to break into the house because they know there's not enough in it for them to do so.
Windows is more like the house with a simple lock on the door. Plenty of other ways to get in, but it's up to the homeowner to implement the security.
I don't understand. What's wrong with the CRN article. So they didn't mention, Vista doesn't come with AV software. Big deal. Wasn't security one of Vistas selling points? Regardless, Vista without AV software and XP without AV software,... I'm failing to see why the CRN article is wrong.
- Nucklebone
But of course XP is also an MS product.
Maybe I missed it when I RTFA, but it didnt mention which version of XP was used... a look at HPs site shows that the HP Compaq nc6400 did ship with XP Pro (whether that matters much compared to home edition or not)
Also... were these systems ran all the way default, as in, boots up as Administrator with no password? (again, not sure how much that matters in a test like this)
I do agree with the title, flawed survey indeed.
I dont blame Vista or XP so much as I blame IE version X.XX
Id like to see the exact same suite of tests ran against the latest version of Opera, Netscape and Firefox.
Of course from practical point of view XP right now is more secure. And I don't mean default install. For example take my company and few facts:
- we managed to make the machines behave as we will
- we have invested money into third party security software
- we have invested time (which equals money) into free (as in speech) third party security software
- we have some knowledge and experience into XP security -- after these - what like 7? - years who doesn't?!
Right now we have quite healthly and working infrastructure based on XP and surrounding (like VPNs, IDSs, AVs, proxies, backup, imagining etc.) services. We know how to do it, we have experience.
Now Vista from my standpoint is just big black hole - another system from MS that does not offer me anything significant but opens a can of unknown worms... I don't see any serious businesses building their security infrastructure around brand new shining Vista systems.
Of course in *theory* Vista can be more secure, but from practical standpoint it is new and untested product that has ben rushed to the market.
It really depends on your security definition. Security is not a product - security is a proces in which you have knowledge about what you are doing. In which you have educated users. In which you have policies and audits and so on. Vista isn't anywhere near to be even a stable product from security standpoint.
What about home routers? If you can hack into few million broadband routers, you've got yourself a major botnet with little to no antivirus. Not to mention you're past the primary protection of the average home network. From there, you could spam networked printers with ad printouts and read the contents of any netork shares. Not to mention sniffing and redirecting network traffic...
tasks(723) drafts(105) languages(484) examples(29106)
Don't look that flawed to me.
XP: No AV included
Vista: No AV included
Report says: "Vista no improvement over XP"
Report is pretty much correct.
Assorted stuff I do sometimes: Lemuria.org
that was not the point. Corporate, government and financial databases are probably going to be better secured than the multitude of everyday users' computers that have XP/Vista on them.
I'm getting tired of the XP vs. Vista vs. XP vs. Vista vs. ... articles posted here all the time. Microsoft will eventually drop support for XP and will continue to support Vista. Microsoft will continue to focus on Vista. If Vista is now less secure than XP Microsoft will eventually it stronger ... that is until the next Windows OS is released.
Dammit we had to listen to XP versus everything-else-before-it. Tiresome, damn tiresome. No worthwhile discussion came from it last decade but you never know ....
What? I know we get a lot of "RTFA" around here, but read the fucking summary! Shall I condense it down for you further, since I see your time is precious?
/. reports on study #2.
Study #1 finds that Microsoft has made no improvements (XP -> Vista)
Study #2 finds Study #1 to be incorrect and badly done.
In essence, the story accepts that XP isn't as secure as it could be, but Vista improves on this significantly. Its one of the most pro-MS stories I've seen on slashdot for a little while now. Of course, I'd never touch Vista personally, but that doesn't mean it isn't an improvement over XP in security.
How does an OS know what apps are good and what apps are bad? That's what a virus scanner is: It's a list of known bad apps. If one wanted a real world analogy it wouldn't be like a locked door or anything, but rather a bouncer with a list of people who need to stay out.
Vista already has privilege escalation if that's what everyone is bitching about. So evil apps that want system access will have to ask for it, just like everything else. However if the user says "Sure, you can have that," what can the OS do about it? Apps don't have an "evil bit" they are just code to be executed.
Same deal with the real world. If you choose to unlock your door and let someone in, it's not the fault of the people who made the lock or the door that you did.
I think the grandparent is just another of many Windows haters that seems to think there's some magic that could be done to keep viruses out that MS just won't do. Well, actually there IS such a technology and that would be the scary version of trusted computing. If hardware enforced protections past what the OS could override, and checked signatures on apps, then only valid, signed apps could run. Provided the signing authority did their job, there'd be no viruses. Of course that would mean giving total control of your computer to a third party, something I think none of us want.
What it comes down to is there is no way for an OS to both give someone control of their system and protect them from themselves. The ability to grant the authority to run code at a privileged level implies the ability to do it for both good and bad code. Thus the necessity of virus scanners. They maintain a known list of bad code, and can warn you if you try to run that. I suppose you could build it in to the OS, but it changes nothing, it is just a virus scanner that's part of the OS now. There's no magic juju, other than taking away the user's administrative rights, that will work.
Just to be clear: By taking away administrative rights I don't mean running as a deprivileged user, Vista does that, I mean NO admin access AT ALL. No escalation, period. That'll do it. Indeed we do that at work as much as we can and on those computers, we have no problems as users simply can't install software. However to do it at home, well you can see how that'd be a problem.
And since it's not plugged into an electrical outlet, it doesn't draw any power either!
paintball
Let's face it. Anti Virus software is the day after pill. I daresay if someone relies on defending against viruses by antivirus software, the security model is already utterly, completely broken. So no, not including an anti virus software doesn't mean an operating system shouldn't employ design and tactics against viruses. Ars Technica is simply wrong.
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
Faulting an AV-less Vista for not stopping viruses is a bit like faulting a door without a lock for opening when the handle is twisted.
I think the point is that M$ should have learned their lesson last time, and the time before that, and made vista such that having anti-virus software would be unnecessary. Or in the terms of the analogy, Having forgotten to put a lock on the door of their previous house and repeatedly come home to find their underwear scattered all over the yard, you would have thought they would have made a secure door this time.
The difference between Canada and the USA is that in Canada healthcare is a right and gun ownership is a privilege.
You must have missed the fact that even though niether system had AV on it, niether did Vista. And it's not fair that you should expect a new system to be more secure just because they say they are.
Obviously, if you want a non-biased test the Vista computer should be in a secured bunker with no internet access within 50 miles and the XP computer should be an unpatched beta version set to search for "WAREZ PLEEZ".
IOU one (1) signature
Just wondering, how many linux distro's come with A/V? is it standard now?
And how fast would MS find themselves in court again for monopolising everything if they HAD included A/V.
A lot of work was done to support running as normal user. This does not get much attention, but it means that I can (and I do) run as a normal user without administrative credentials (it is much harder to do this in XP). If I have to manage the system, I have to use full administrative credentials (read, su root). It also means that malware that might hit me does not have the permissions needed to modify the system. This is even stronger than the UAC protections on administrative users. My wife and kids run as normal users and do not have administrative acess.
A lot of internal work was done to reduce service permissions and internally harden the OS, including the introduction of the integrity level mechanism that is used to support protected mode IE. These changes reduce the scope and impact of local compromises.
Enormous amounts of fuzzing of acessible interfaces and parsers was conducted and many issues were found and fixed.
The security bulletin data since Vista has shipped suggests that there is reduction on the order of 2X or greater in bulletin class vulnerabilities. Indeed, the numbers suggest that Vista is running fewer issues than either OSX or the major Linux distributions.
The user has a great deal of control about their vulnerabilities based upon how they configure and use their system. Microsoft exposes a very rich and neat set of functionality in Vista. If you are trying to reduce your security vulnerabilities, there are a number of things that you can do (at the expense of neatness and functionality):
Run as a normal user, not admin (which is standard UNIX practice)
turn off sidebar (less stuff running means less stuff to compromise)
turn off scripting, activeX, multimedia, etc, in your IE Internet zone
Add sites to your trusted zone (where scripting is allowed) only if you trust the site with your credit card info
If you run a desktop suite, run Office 2007 rather then Office 2003. Note that Office 2007 almost certainly has fewer security vulnerabilities than Open Office.
Be very cautious about what software you install.
That's not strictly true any more tbh, with net traffic monitoring systems like imon in nod32. the code, or at least part of it (I'd expect a lot of threats would be detected before the code was completely downloaded) , may have been downloaded but couldn't have been activated at all.
Shipping Vista with an AV package would have practically been admitting that they can't make secure products and the only thing left to do is have a separate layer in the OS to try to intercept stuff before it caused problems (or clean up after it), rather than blocking the holes in the first place - which is, I believe, part of the point of Vista's entire security model (DON'T RUN THINGS AS ADMINISTRATOR, JERKS).
I wouldn't call having a file on your desktop (from email, for example) that could potentially infect your system and infection in and of itself. A good AV package will detect and clean the virus BEFORE it infects your system. That is, before you open/exec the file. Though there are other viruses that infect through the network without any user action required. So in that case your are correct.
:-)
I'd say AV software is more like having a bouncer at the door... preferably with a rifle.
-matthew
"THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
I wouldn't even call it pro-MS, I'd call it anti-anti-MS and pro-"not being a douche bag and making incredibly controversial claims based on obviously and likely intentionally flawed studies".
I'm all about bashing MS, but using spurious logic to do so is just detrimental to the entire anti-MS movement.
Try not to take me more seriously than I take myself.
"Faulting an AV-less Vista for not stopping viruses is a bit like faulting a door without a lock for opening when the handle is twisted." This simply means that Vista is a basically a faulting program!!! Any Linux distro or OSX do not ship with antivirus either. That doesn't make them faulty or unsafe to use it. Vista should be safer "regardless" of the presence of the antivirus, otherwise it simply faulty by design.
'The report faults Vista for "providing no improvement in virus protection vs. XP," but of course Windows Vista does not ship with antivirus software -- something the reviewer fails to mention. Faulting an AV-less Vista for not stopping viruses is a bit like faulting a door without a lock for opening when the handle is twisted.'
Vista is supposed to have these features built-in, as well as a host of other improvements. Such as service hardening, anti-malware (which does claim to kill viruses), network access and more.
Why, you can read the whole list right here.
So I wouldn't say it's like a door without a lock on it. If Vista is flawed, it would be like saying it's a door with a crappy lock on it. Big difference.
Weaselmancer
rediculous.
Noooo.
Since few people update their AV software each day they use their computer and indeed since the best that AV software can do is reactive in nature... AV software is more like the month after pill or even the 9 months after pill.
At best AV software is doomed to failure. This incident illustrates how serious the lack of security in common practice is. Clearly the perpetrators were a novices. Perhaps they were just a couple script kiddies playing around wondering if the lack of security was real.
If an amateur can do this, then consider that organized crime must know tonnes of passwords. A lot of people do online banking and online stock trading. The exposure our financial systems are exposed to is incredible.
You mis-spelled predictable. The issue isn't that more people use Windows; the issue is that the same exploit reliably works on vast numbers of Windows machines. It's not the popularity, it's the monoculture, combined with a broken design that is trivially easy to exploit. Another example of monoculture and utter lack of security combining to create havoc is the Morris Worm of 1988. Happily, *nix systems have moved on since then.
Sorry to rain on your parade, but that's utter bollocks. I have empirical proof of this, from having installed and run numerous Linux-only computer resource centres for first-time computer users. The users are mostly under- or uneducated youth from a developing country, who love nothing more than to click anything that flashes or shines. The number of people who have used these centres is in the thousands, so it's statistically significant. We've just opened another centre that uses only Mac Minis.
So why, pray tell, is the total number of malware-infected machines a big fat zero? It's not the administration. The staff are taken from among the youth themselves. In most cases, they have no prior experience with IT. They're simply more interested in it. It's not user habits; the youth do wander regularly onto malware-infested sites.
The bottom line is that Windows gets regularly and predictably infested with malware because it's so easy to do, and the 'rewards' are so great.
Crumb's Corollary: Never bring a knife to a bun fight.
More fanboys.
For whoever doesn't see this screaming at him, here's a breakdown:
In home-user-land, credendials were an option nobody used until Vista. NO amount of buffer-overflow susceptibility can EVEN COME CLOSE to outweighing the security implications of having UAC - a restricted-user+sudo working model rather than XP's work-as-root one. Vista and XP for the home user are incomparable and are in totally different leagues, vista winning by very, very, very long shot.
In corp-land, everybody (who gives a damn about his security) has been using non-administrator-accounts on his workstations (at varying and ever-improving degrees of annoyance) since NT4. For all intents and purposes, XP with domain policies had all the functional benefits of UAC, as did 2000 and NT4. So the battle over which is more secure needs to be resolved on much finer points, such as susceptibility to buffer overflows, code maturity etc. This is what the report in TFA addressed and they may be quite correct on this.
Pushing titles saying "XP less secure than Vista!" without VERY THOROUGHLY POINTING OUT WHEN AND WHERE THIS APPLIES (*WHERE THERE BE NT DOMAINS AND RESTRICTED USER POLICIES*) is a cheap, inflammatory and sensationalist way of getting attention. Most people who have no clue reading this headline will get the VERY WRONG message, become misinformed, spread on more hyperbole about Vista "being less secure than XP" to people who know even less, and the overall effect will be doing WAY more bad than good in the name of either stupidity or anti-MS fanboyism.
-
"a bit like faulting a door without a lock for opening when the handle is twisted". They are asking, nay forcing me to buy yet another new stable which has the same open door. I would be wrong to fault them for this?
Home fucking is killing prostitution.
Go ahead and post your facts supporting MS then.
To be fair, with windows you don't have to twist the lock... a strong fart on the way past would do it.
Slashdot: where don knuth is an idiot because he cant grasp the awesome power of php
My company gets delivered (hey, it's free, so they don't argue). As such, I've run across their "reviews" before this. And I believe I can summarize.
They look at things from a distinctly user-centric POV. They're focused on what the apps/solutions/OS they review do for the end user.
As such, they're not a "technical review" in any real way, shape, or form.
The term "fluff piece" comes to mind.
They add just enough to give the business users who read CRN a bare taste of what they're talking about. Any more, and the reader would go glassy-eyed.
So, lots of hype, lots of buzz, a couple explanations of things the user MAY encounter directly in a business environment, and that's about it for CRN.
For you techies out there, think about the general technical "IQ" of the sales guys in your organization (if they have one at all). THIS is who CRN is writing for.
As such, it's easy to see how the non-techie reviewers at CRN could look at a naked Vista install.
Understanding NOTHING of the security process, comparing it to the loaded out XP install on the locked-down machine his IT department provided him would be easy.
Because he hasn't seen the process, going on behind the scenes, that are necessary to secure an XP machine.
Chas - The one, the only.
THANK GOD!!!
Any AV worth its bits will scan downloaded files before they're opened, and any executables before they're run. It's both the lock and the rifle, and the stain remover that gets the blood out of your carpet, though sometimes you'll have to buy a new carpet.
Stretchy analogy is streeeetchy.
So you're saying Linux and Mac OSs are doing the impossible?
Someone call the tabloids and we'll be rich!
IOU one (1) signature
...That submarines with screen windows offer slightly better floatation than submarines with screen doors.
MacroSubs has affirmed that this is incorrect, however, and stated today that the question will be settled once and for all when their new submarine, entirely made out of screening material, captures the imagination of the nation with its launch in 2009.
So-called "alternative" submarine manufacturers continue to insist on using steel for their doors and heavy lexan for their windows. They claim this quaint, antiquated approach lets them offer better floatation, efficiency at depth, and crew survivability, but independent studies have shown that their apparent "floatation edge" is due to the fact that far fewer of these submarines are produced, not any superiority in design. A. Noying, of an independent think-tank funded in part by contributions from MacroSubs, had this to say:
"Look, we all know that as more of these all-steel and plastic subs get produced, you'll start seeing network effects and their buoyancy will be reduced down to normal levels. Currently, with only a few percent of the market, the oceans aren't interested in them as a point of ingress. This will change soon and you'll see some interesting numbers from my lab to back this up."
When asked about the widespread buoyancy failures of MacroSub submarines around the world, Mr. Noying said only "it's hardly MacroSub's fault if submarine captains tend to drive their submarines into reefs and long-forgotten sea monsters. Their duty is only to make subs buoyant, not idiotproof. However, they are working on an interesting feature called USC, or User Submergence Controls, which should make things a little easier. The submarine will basically ask the captain if he's really, really sure he wants to increase depth, once per fathom. If the captain insists on running into that reef after all the help he's been given, perhaps he shouldn't be driving a sub anyway..."
NO CARRIER
It's almost done logging me in, in fact.
The point that Microsoft will drop support is moot. There are a lot of companies that still run NT servers and workstations. I worked for one last summer that used embedded NT workstations as a frontend to access the GE LM6000 turbine PLCs. They also had NT servers and NT desktops for SCADA. My current desktop at a different company is windows 2000. Companies will balance cost, security, and familiarity. Microsofts support cycles often have nothing to do with that.
Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
No, I made no mention of Linux or MacOSX. But if you're curious, I am of the belief that neither Linux nor MacOSX without virus protection are immune to virus. The fact that there exists viruses for Linux and MacOSX seem to support my belief.
And they DO get hacked. According to most popular defacement sites, most sites hacked are running Linux, not Windows. And the difference is usually bigger than the ratio of installed bases. But as personal machines, they are a vast minority and not worth investing in hacking, XP being a much better target. I think that's what the comment referred to.
No operating system is 100 % safe even with anti-virus. My point was that your analogy is saying that even the thought that you could be remotely secure without anti-virus is like trying to print without a printer.
Bad analogies waste time and resources, just like the cold war. The creator of that analogy must be as bad as Stalin.
IOU one (1) signature
People. Get off the denial job already. Vista is not magically going to become the upgrade you were hoping for; No matter how many studies, weblogs, reviews, taste tests, or procto exams happen, Vista sucks, end of story. Microsoft will come out with service packs this fall, there will be all sorts of heavy breathing once again, but it's going to be the same historical disappointment. Microsoft needs to get their shit together and stop robbing people.
boycott slashdot February 10th - 17th check out: altSlashdot.org
No, all I said is that complaining that Vista-without-antivirus is no better at defending against virus attacks than XP-without-antivirus is about as dumb as complaining that Vista-without-printer is no better at printing out documents than XP-without-printer.
Note that I specifically chose the wording "defend against virus attacks" as opposed to "remotely secure".
Of course the great irony is W98 is more secure than either.
Need Mercedes parts ?
The "security enhancements" in Vista were to protect Microsoft from piracy, not to protect Vista users. Microsoft still doesn't care about them.
You must be still clicking endless Cancel or Allows...
Personally, I am waiting until at LEAST SP1 is released before I install it.
Cheers, Chris
Those dirty little penguins! Who knew?
Other flawed surveys show:
- Bush Is Actually Orangutan In Suit
- RIAA Hates DRM Music, Gives Thousands To College Kids
- Emacs Is Better Than Vim
- IE Is Most Secure Browser Of All Time
- Volcano Likely To Erupt In Redmond
You know what they say: "News for nerds. Stuff that matters."
"'The report faults Vista for "providing no improvement in virus protection vs. XP," but of course Windows Vista does not ship with antivirus software -- something the reviewer fails to mention. Faulting an AV-less Vista for not stopping viruses is a bit like faulting a door without a lock for opening when the handle is twisted.'"
No, it's like comparing an old door without a lock to a new door without a lock and saying that the new door is no more secure than the old door. (Which sounds reasonable to me)
dnuof eruc rof aixelsid
My comment was based on my experience earlier this week on Monday, only the second time I've been close enough to be able to identify a Vista install, and the very first time I'd used it. It had just been installed (as well as Office 2007) by one of my colleagues on a brand new HP laptop. No, didn't get asked to Allow or Cancel anything, but what I did experience didn't surprise me in the least.
From the instant I hit Ctrl-Alt-Delete (and this is after waiting for the machine to finish choking itself) it was the same familiar Windows experience - watching the HDD LED as if it's going to give some sort of indication as to when it might be safe to go on to the next step as the machine crawls through the login procedure - totally unresponsive for the majority of the time.
People bag Windows about insecurity, DRM and UAC all the time - they're not the things I have problems with. I play the game, keep machines patched, AV installed if the shareholders demand it, and so on. My only real gripe with Windows it simply that I habitually find small sub-tasks to do like clip my fingernails or organise desk-drawers while waiting for countless delays my Windows box gives me. Screwed if I'm going to spend a month of my life waiting for start menus to render.
Where with a different OS, I'd start the kettle boiling and check my email while that's going on, in Windows I launch outlook and then go and see to the kettle, because I know which will make me wait longer.
really? and the 'popular defacement sites' are :.......? I'd like to see the stats on that please. I still can't find where you may have read that info to come to those conclusions.
Semi-automatic amateur armchair Australian philosopher; conjecture ready at any moment...
Microsoft is their own worst enemy; they make wild claims about the functionality of their latest version but that functionality never meets their or their customers expectations. Then some exploit points out that they were being economical with the truth. Much like a recently patched (again) exploit that affected 98, NT, 2000, XP and Vista. Seems somewhat odd that an operating system that has been completely rewritten at great expense and effort should be affected by the SAME bug that has been in their products for years.
I mean, how can a company whose email clients automatically launch attachments say that they take security seriously? Let's not get started on the brain-dead file association open / execution misfeatures in every version up to and including Vista. Here's an interesting exercise to see how bad things can get: rename a safe executable to a filename with a WAV extension. Now double-click it; the executable runs. Combine that with browsers and email clients that automatically play WAV files and you've got a very exploitable platform.
What continues to amaze me is that the file type security is applied based on the file extension - but when you execute a file, the system looks at the file header to determine how to open / execute it. This bit of design stupidity has been the cause of millions of systems being exploited. Just a simple check to see if the file header matches the selected file type would go a long way - but no, this is too difficult. Here, have a UAC nuisance instead...
Of course the great irony is W98 is more secure than either.
No it's not. I remember in Systems Programming for Windows 95, there was a great quote. They talked about protected mode, descriptor tables and so on. At the end of it, the author said something like
"I bet now you're trying to work out if it's possible to subvert this stuff. Well, it's so easy that there's no point. Windows doesn't protect the descriptor tables from Ring 3 [the least privileged] code so it's easy to create a trap gate or call gate for yourself to get into Ring 0 [the most privileged] where you'll probably crash and burn because you can't handle interrupts correctly. It's a "personal computer" - and you're free to do whatever you want to it, just like you're free to run your car without oil until the engine seizes up"
Which sums up Microsoft's attitude to security right up to the security push for XP that resulted in SP2 being deployed and all those patches getting downloaded unless the user stopped them. On the other hand people used to collect email over a dialup connection then if they used the internet at all and so the "personal computer" rule was kind of true. Before people started sending executables by email, probably the only ones people installed were ones that they got from the admin at work, or very occasionally bought in a shop.
So Win 9x and Dos seemed to be more secure because they weren't under constant attack in the way that a machine connected to DSL most of the time and bombarded with malicious software by email and websites is now. Actually another difference is that Dos and Win95 were mostly configured as client OSs - they aren't listening for (overly) complex protocols over a wider range of ports the way an NT machine does.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
Much like a recently patched (again) exploit that affected 98, NT, 2000, XP and Vista. Seems somewhat odd that an operating system that has been completely rewritten at great expense and effort should be affected by the SAME bug that has been in their products for years.
1. The OS was NEVER completely rewritten. Stop spreading FUD. A complete rewrite would mean zero or monimal backwards compatibility -- see OS 9 vs OS X.
2. The exploit was far less severe in Vista with IE protected mode than in Vista with Firefox OR XP and below with both IE and Firefox. Says something, doesn't it?
Only problem: AV is based on the assumption that we know what a virus looks like. There are enough false positives that the heuristics can't be working well, and the very existence of a signature means someone must've been infected already.
AV is a bit like the rifle, because it's the last line of defense, and a pretty damned weak one. I'd say anytime your AV hits, if you didn't see it coming with that particular file, you're doing something wrong.
Don't thank God, thank a doctor!
But then again you have other problems.
My 2cents: M$ could have made Vista more secure out-of-the-box without AV-Software.
There's never enough time to do all the nothing you want. --Calvin
The first would be how do you design this system that is supposedly so secure that nothing ever needs to run in kernel mode, and yet runs with reasonable performance. Can you show me ANY system like that? At a bare minimum, you have hardware drivers that get installed and there's generally plenty more. Also, even if you lcok down the kernel mode there's still the user mode to think about. There are plenty of cases where you want to put something on the system that everyone can have access to. When we install apps on the Solaris computers at work, they usually need root to do it.
The second is what the hell is with this idea of the user's data being less valuable than the system? Maybe that's true on a multi-user system, but not on a desktop. When someone brings us a crashed laptop, what do you imagine they want recovered? Do you think it is the OS? Hell no, it is the extremely important data (that for some reason they neglected to back up). They can get a system with the software reinstalled, they can't get the data again.
So sorry, you fail to convince. Show me the OS out there that does what you claim, and I'll have a look. However right now I can tell you it isn't Linux, it isn't OS-X, it isn't Solaris, it isn't VMS, it isn't BeOS, it isn't any OS I've ever encountered. Show me the OS that can protect itself against a user with administrative privileges installing bad software. Unless you can do that, it really is disingenuous to demand that Windows should be able to do it.
It isn't that hard to design an OS that keeps unprivileged users form screwing up anything but themselves, but I've never seen or heard of the OS that can keep the administrator/root/the system user/whatever you want to call it from screwing the whole system. The power to access that level is the power to fuck it up. On a Linux distro if you have the power to recompile your kernel, that means you have the power to recompile the kernel from a bad source that builds in a back door. On an OS-X system if you have the power to escalate to run a program that does system maintenance you have the power to escalate to run a program that wipes the whole drive. You cannot have one without the other, at least with current OSes. Code is code to them and when the admin says "run this" they don't have a choice.
I thought mail scan and on access file scan are 'before the event' and also part of AV. How could anyone rate the parent as insightful? Oh, sorry, i just noticed i'm on slashdot.
Patents Drive Free Software as Hurricanes Drive Construction Industry
Of course the great irony is W98 is more secure than either.
No, it's not.
These days it might be exploited less, but that is a completely different thing to being more secure.
Sorry to rain on your parade, but that's utter bollocks. I have empirical proof of this, from having installed and run numerous Linux-only computer resource centres for first-time computer users. The users are mostly under- or uneducated youth from a developing country, who love nothing more than to click anything that flashes or shines. The number of people who have used these centres is in the thousands, so it's statistically significant. We've just opened another centre that uses only Mac Minis.
If you think in any way this refutes the argument presented, you are stupid.
So why, pray tell, is the total number of malware-infected machines a big fat zero?
Because it's a managed environment. Managed environments are (relatively speaking) _trivial_ to keep secure.
It's not the administration. The staff are taken from among the youth themselves.
What ? You just said:
Which is it ? In which paragraph above were you lying ?
The big difference between earlier versions of NT and XP, which led to Microsoft's security push, was that NT was mostly deployed in the LAN environments for which it was designed, where all the systems were more or less trusted. Windows 2000, and especially XP, gained widespread use in Internet environments, where the other systems on the network are not trusted, which completely changed the security dynamics.
...vampireware? Wow, that's one I haven't heard before. :)
That being said, moderators, please mod parent up - it's one of the most insightful comments I've seen in this debate so far.
butter the donkey
Actually there are lots of distributions that are AV-less and are quite secure from viruses and malware. Microsoft itself said that Vista wouldn't be subject to viruses. A distro should be reasonably secure out of the box. If it's necessary to add security software (and usually expensive security software) just to make a distribution secure then it is not fit for the purpose for which it's sold.
Yes, you're missing something. The most important function of AV software is not to fix security holes, it is to protect the user's data from user mistakes, such as running malicious software. Users who only run software from trusted sources, and use a firewall, don't really need AV software.
this news is pure FUD
Maybe there should be a time window on how many days we can get
to post about a new OS, c'ause I'm sick of reading about how Vista is great
and an improvement. It ain't, it bytes, it's not what we were promised at purchase time.
Let's all move along now, and let the MS/Industry paid bloggers alone with their macs ok ?
End of Line.
You didn't RTFA. Ars never claimed your strawman argument that the OS shouldn't defend against viruses.
Examples cited by Ars about how Vista "employs design and tactics against viruses" better than XP:
Ars Technica is right.
Bandannarama
Microsoft has a huge user base, millions of lines of code in their OS and applications, and a lot of 3rd pary legacy applications with which they don't want to break compatibility. On top of this, the majority of Windows users are not computer savvy. These restraints, combined with the huge financial incentive for hacking MS products, prevent them from writing software that's completely secure. That's not because they're Microsoft and thus evil (as half the posters here seem to think) or because they just don't care (as the other half assert). It's because they've reached a size and complexity (both in their applications and as a company) where it's no longer possible.
In other words, I don't think any company could do what Microsoft is trying to do, so I'm not surprised (nor angry) when they fail.
Interested in a Flash-based MAME front end? Visit mame.danzbb.com
I wouldn't call it pro-ms, I'd call it damage control posted by a MS PR Bot.
Microsoft and a couple other companies have begun to recognize the power of the tech crowd and Slashdot is a major hub of that crowd. Of course I can't prove whether or not this submission was posted (and likely bolstered in the firehose by MS shills. I can establish the power of the tech community. It was the general tech perception that AMD's chips were faster that allowed AMD to penetrate MS marketshare. Then the core 2 duos came out and the general perception was that Intel had finally after half a decade come out on top. Almost immediately thereafter AMD was reporting record losses.
Expect more pro-microsoft and microsoft PR posts.
And their conclusion at the end: THE BOTTOM LINE
Based on the Test Center's findings, businesses that migrate their Windows PCs from XP to Vista will get a slightly more secure OS. But as the Finjan reports showed, Vista's security remains wafer thin.
There is no -1 Disagree mod. Slashdot.org/faq defines mod options. USE IT.
Desktop Gnu/Linux and OS X fanatics would disagree with you.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
"deployed in the LAN environments for which it was designed, where all the systems were more or less trusted"
Which was, of course, one of the more stupid design decisions - because there are NO trusted systems other than ones not connected to a network which are locked in a (relatively) physically secure room.
By the way, are you saying that NT did not have Internet access? WTF?
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
"Expect more pro-microsoft and microsoft PR posts"
Is that even possible? As far as I can tell, the MS shills here outnumber the Ubuntu fanboys two to one.
Or maybe just because they're being paid to run their mouths, they just post more?
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
This is totally true.
How many times have I tried to kill a process only to have Windows either utterly refuse to do it - because the process is buried in some buggy driver - have to wait a minute and a half only to have Windows ask "Do you really want to kill this process?" Yes, fucking asshole Bill Gates, that's what I just TOLD YOU TO DO! In Linux, you do a "kill -9 - it's fucking OVER for that process.
And the really fun stuff about supporting Windows PCs is how you go in intending to do one thing - and spend the next THREE HOURS doing all the "back story" stuff just to get to the point where you can do what you intended to do - because the machine has been steadily hosing itself since the last time you did a support call.
Had a client yesterday with Windows 2000 losing its printer drivers because the spool service crashed. (And God knows why your printer drivers have to disappear just because the spool service isn't running - who thought that stupidity up at Microsoft?) So I get there, and of course it's a Lexmark POS with their driver hooked to the spool service - or maybe a security update hosed it, since my Google search shows that happens.
So I try cleaning out the drivers from the Registry and the spool directories. So then the spool service and the spooler program somehow got mismatched, so an error message pops up every few seconds.
So while I'm trying to fix this, I see some Windows updates need to be applied. So I start that going, and that fails. I look at the update history, they're all failing with some stupid error code. So I try to rename the catalog directory as per the usual fix - can't do it even as administrator because somehow the system thinks it's still in use.
So I try to go into Safe Mode - machine won't come up at all in Safe Mode. WTF?
So it's "repair install" time. Then, because it's an old Windows 2000 and the repair install dumped the updates (and why is this - a repair install keeps the buggy end user programs, but dumps all its own updates?), I have to download 53 updates (which is still better than Windows XP current 72 updates).
Finally the machine is functional enough that I can do what I intended - install a newer printer driver.
Windows is utter shit.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
'allowed AMD to penetrate MS marketshare'
Should obviously be 'allowed AMD to penetrate Intel marketshare'
If you think everyone designing network operating systems before the Internet era of ubiquitous connections to an untrusted network was 'stupid', I think that says a good deal more about you than it does about them.
It's a bit like office doors in a building owned by an organisation. They might have locks, but the primary security barrier is the entrance to the building itself. Most people in the building more or less expect that others inside it are trusted enough that they don't have to close and lock their doors all the time. If the building were to suddenly become open to the public, the situation would change drastically.
No, I'm saying NT was primarily used in corporate/institutional LANs, where every machine was owned and managed by the same organisation, and Internet access was rare or nonexistent. That's how the overwhelming majority of networks were in the late 80s and early 90s, when NT was designed and first deployed. Even when the Internet did catch on, most organisations restricted direct Internet access to a few hardened machines, and required all the others to proxy through them.At any rate, security vulnerabilities are hardly unique to Microsoft's email clients, so it doesn't really make any sense to point to Microsoft in particular, and ignore all the vulnerabilities that have been found in, for example, Thunderbird. More importantly, the post I was replying to made an argument based on two assumptions, (1) that Microsoft email readers automatically launch attachments, and (2) that file extensions are ignored when opening files on Windows. Both of these assumptions are wrong, so the argument was rubbish, based on either ignorance or a deliberate intention to deceive.
I'd say a car that doesn't ship with lcoks *IS* less secure than one that does. The survey seems reasonably valid in suggesting that security is the last reason on Earth a fool might waste money on Vista.
"You're young, you're drunk, you're in bed, you have knives; shit happens." -- Angelina Jolie