Slashdot Mirror
New Malware Report Hits Vista's Security Image
An anonymous reader recommends a Computerworld article on a new report from Australian security vendor PC Tools. The company released figures on malware detection by its ThreatFire product, and in its user base 27% of Vista machines were compromised by at least one instance of malware. From the article: "In total, Vista suffered 121,380 instances of malware from its 190,000 user base, a rate of malware detection per system [that] is proportionally lower than that of XP, which saw 1,319,144 malware infections from a user base of 1,297,828 machines, but it indicates a problem that is worse than Microsoft has been admitting to." Microsoft hasn't responded yet to this report.
Malware is not defined anywhere in the article. I know from experience that some "malware" scanners tend to mark even cookies (such as Doubleclick's) as malware, which will appear on any computer.
I would also like to see how many of these "infected" computers had UAC and automated updates turned off.
Looks like just another Vista bashing article (so it will no doubt be really popular here).
After all, the survey missed classifying Vista as malware -- how accurate could it possibly be?
Help poke pirates in the eyepatch, arr.
Please read the article first so that the statistical numbers sink in.
Next, think about an Ubuntu install vs. a Vista install. Vista caught a lot of flak for the "cancel vs. install" thing but sudo('s GUI counterpart) is not much different, right down to the dark fade as it asks the user what to do. Since Linux clearly stole that idea from Windows, well, won't some leet folks please write a virus for Linux and level the playing field? Linux users are so tired of having nothing to painstakingly tweek.
No need to slam Vista (or Windows in general) -- the problem is combining a dumb user with /any/ OS he can get admin rights on.
No matter how good your antivirus/antispyware/OS, once an idiot user figures out that by closing a certain app or clicking "yes" somewhere he can run the funny application he got by e-mail, he will do so, and the system is potentially infected.
New Malware Report Hits Vista's Security Image
Come again? Does anyone but Microsoft actually believe Vista has an "image" of better security?
Vista has one and only one major security-impacting feature - The "Train users to always click yes" interface to privilege escalation. And I feel confident saying that very, very few of us consider that a "good" thing.
Vista Had a Positive Security Image?
27% of all the machines were owned by a marketing company. Its sunk in.
Sudo copied Windows - hmmmm ... "Sudo was originally written by Bob Coggeshall and Cliff Spencer "around 1980" at the Department of Computer Science at SUNY/Buffalo".
As for the virus remark - Its more difficult to write Linux viruses. User level permissions are more rigorous. The browsers don't have ActiveX. People who use Linux tend to know what a firewall is; and don't click yes in reply to "would you like to install" dialogues so much.
I don't think that works as an excuse for Microsoft.
The trouble with that Windows is supposed to be the operating system of the common man. At least, every time Linux gets a cool feature, the Redmond apologists start roll out their hypothetical Joe Sixpacks and Great Aunt Mildreds and tell us how these ordinary people can never cope with Linux, but windows, focus-grouped to death as it is, has been designed for these exemplars of non-geekiness, and is therefore superior.
But that makes it kind of hard to blame bad security on the users. Windows is supposed to be designed with the click-on-the-dancing-monkey demographic in mind. They can't really throw their hands in the air and say "it's not us, it's the stupid users" without admitting that, really, they haven't a clue how to make a secure operating system.
Don't let THEM immanentize the Eschaton!
Why might "Australian security vendor PC Tools" claim this? Could they have a vested interest in saying this?
So a company that sells security software puts out a press release to say that you still need to buy their software even if you run Vista. I can't think of a single ulterior motive that they might have to do this!
How many of the anti-virus companies don't issue doom-and-gloom style press releases? It is just their way of drumming up business. I would rely on these figures as much as I would rely of Microsoft's "research" that might suggest that Vista is completely immune to any security issue. The truth lies somewhere in between - which shouldn't surprise anybody.
And before anyone jumps down my throat, no Microsoft didn't says Vista was that perfect.
This was my first thought too. But then I realised that they've obviously omitted that fact on purpose, to solve an infinite recursion paradox:
Vista is malware
Vista can host malware
Therefore vista is self-hosting
Vista is unstable
Therefore, vista can't host a stable OS
Therefore Vista can't host itse..
Oh, never mind. It works out just fine.
Some other commenter pointed out that being trained to clicking "Yes" was comparable to running everything as super doer. Rightly so. Do you know how tremendously difficult it is to convince Peter average user to have strong passwords, to keep user accounts and administrative accounts separate, and so on? As soon as he finds out how to run programs with administrative privileges, he'll stick to this new "freedom".
So is any other OS with an UI, because they require a user. The user is the problem.
While I agree, I do this because I think an operating system should have user accounts with no rights to install anything, and an administrative account without any GUI. Please explain Peter average user he has to use CLI to install/uninstall software. (This works with my Peters, because I manage their Linux workstations for free. But it won't work with most users.)
But still, the user has to install software on the system. Unfortunately, he wants to do so without any hassle.
Comment removed based on user account deletion
Instead of "obnoxious security" as highlighted by the apple commercial, now we have "less effective than advertised obnoxious security that's still better than XP."
Can we possibly bring ourselves to acknowledge that M$ actually brought about an improvement in PC security? It shouldn't hurt too much since it appears to be verifiable.
Invenio via vel creo
"New Malware Report Hits Vista's Security Image" -- Vista had a security image?
No dude lol... just plain no.
A Network admins know that the common man or woman doesn't know their computers from their asses. It's like the saying goes, PEBKAC.
The fact of the matter is that Microsoft is king because Linux software isn't even there yet when it comes to quality. Whenever you have new hardware you probably can't even use linux because the drivers haven't come out yet or are beta and/or a bitch to install.
Linux continues to be dogged down by too many deal breakers for so many people. You can have Linux be good for 15 / 20 uses and even throws in 5 - 10 new ones but the few you got left might include deal breakers for so many people. This is the challenge the open source community will need to overcome before it ever wins this war. It will eventually win though. We're only 15 years into a networked world. 60 years from now software companies will only make money from custom code.
Or we combine the powers of water, air, earth, fire and love to form Captain Planet. Or - even better - we combine Cheetos, Coke, anonymity, too much spare time and Linux to form Captain Fanboy, with the power of writing scathing flames on Slashdot.
Of course, Microsoft could counter that by combining the powers of Soviet Russia, old Koreans, Nathalie Portman, hot grits and Cowboy Neal to form Captain Meme, who drowns out everything Captain Fanboy posts with a flood of +5, Funny posts.
USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
I expect Twitter to come rushing out with one of his many sockpuppet accounts and attack you at any moment! How dare you cloud a perfectly good Vista bashing with a few facts! Shame on you!
Vista isn't great and was overhyped, but it's not nearly as bad as most people here seem to think. I'd hazard that the loudest critics haven't even used it.
27% of Vista machines were compromised
This is indeed troubling (notice position of tongue and cheek). How can we fix this? I propose a five step program
5. Electro shock all users the click "install now" without thinking
4. Remove the fingers of users that follow the links on penis enlargement spam
3. Publicly flog all users that attempt to install that "special media player" to get to "free p0rn" from a any site in the former communist block.
2. Revoke all credit card, debit card, home depot card and sears charge cards for those that purchase a fake Rolex based on an email they got
1. Remove any and all computers from folks that say "My computers running slow, you know about computers, can you look at mine"
Respectfully,
Cluge
PS - A more meaningful less painful solution would be an OS lock down - IE think a live image distro where the Hard Drive is only used to store user data. Every reboot takes you back to square one - a heavily locked down environment with basic abilities allowed, but little else.
"Science is about ego as much as it is about discovery and truth " - I said it, so sue me.
I've purposedly ran some shady programs, with antivirus disabled on Vista. No WAU prompt, nothing. Yet, my PC was infected and had processes running. It was even harder to clean out then simular virii in XP.
Al these prompts and other crap, it's useless. It's just to "make you feel secure" and "annoy the hell out of you". Effectiveness is ZERO.
"Vista suffered 121,380 instances of malware"
I thought Vista with UAC didn't get malware. Didn't Allchin say Vista didn't need any anti-virus software.
davecb5620@gmail.com
... a mile away.
I'm a windows savvy user, and I've never had problems with viruses or malware, mostly because I know when to make sure what I'm about to run isn't malware.
That means I know generally what's already in my computer, and when I'm about to install or run something new, I either know it's from a legitimate source, and thus don't worry about it, or I scan the file before using it.
that's why I applaud things like the firefox virusscanner, it's actually combating the risk of infection at the point-of-entry rather than scanning everything all the time, over and over and over again, and hogging your resources while it's at it. In this regard, current virus software only helps when you've already gotten a virus and you need to clean it, which in my opinion is too late. the solution should be at the point of entry.
It's also why I hate UAC, UAC doesn't help people to understand where the point of entry of malware is, and it only teaches people to click yes to everything, or to google how to disable it.
I've used Vista since it was in beta. The DRM hasn't stopped me from doing anything. The only software I use that does get in my way is Apple's iTunes. But we can't hate on Apple, /. loves Apple because it's not MS. That's why /. can never be taken seriously. It's a humor site.
I'm not not licking toads.
... is a +5, "Telling Slashdot what it likes to hear" moderation.
;)
-- Posted from my Vista machine
Help poke pirates in the eyepatch, arr.
Windows has never been nor never will be designed for the "common man". The entire Windows experience is designed entirely to be put on corporate networks. It's designed to be set up and maintained by a geek. The corporate market is the base of income for Microsoft. The users are non-technical, so there are attempts at "ease of use", but when it comes down to it, features make it into Windows because the corporate market is moving in that direction. Every now and then home users get features too, but they account for such a small amount of computer purchases that Microsoft can ignore them and rely on the network effect to force them to use Windows at home.
Linux suffers the same kind of mentality, but in a difference direction. Desktop Linux is designed for it's user base, which is programmers, network admins, and more technically inclined users. They find, on the whole, "Linux" (insert favorite distribution here) to be on par with Windows. From their point of view, they are right. My mother would highly disagree. When it comes to generic operating system environments, Linux has a STRONG advantage. The level of customization possible due to the availability of the source has allowed manufactures to created smaller integrated products that are easy to use, but generally trade a degree of functionality for that (Nokia and Asus come immediately to mind)
OS X is designed for environments where administration cost is a very big concern and for people doing design work. On the whole, Apple ignores a large part of the development community and relies on making tools that encourage specific practices. This is done under the philosophy that any developer that wants more Windows like dev environment will just end up messing up OS X, via the user and this will reflect poorly on Apple. Hence their reportedly large market share on the home user market, "it just works" when compared to its competitors is a valid comparison. Because of how they treat developers, their market will never grow outside of it's established core base.
Burn Hollywood Burn
No, he really wasn't.
gksu, which acts more or less like a GUI front-end to su, dims the background when you use it. I don't know if it's a configurable option, or how long it's been doing that, but I first noticed it a little while after Vista started dimming the screen on UAC prompts. That's what the GGP was referring to.
gksudo:
Dims screen, asks for permission to perform administrative operation, asks for password.
UAC:
Dims screen, asks for permission to perform administrative operation, asks for password if you are not administrator.
The comparison is obvious, and while sudo itself was written before permissions were even a twinkle in Mr. Gates' eyes, gksudo's current behavior does emulate Vista's.
I don't know that it was a troll. There are a lot of people (myself, included) who think that a large part of Window's malware comes from trojans. Between the Windows firewall/NAT (helping to prevent worms from spreading) and Windows Update being on by default (somewhat mitigating exploits in Internet Explorer), non-trojan malware infections are really dropping. They're still there--from people who don't upgrade, who have older systems, etc. but they're decreasing. What's left is trojans and pre-installed malware.
But people continuously slam Windows for being insecure while touting OS X and Linux as secure alternatives. Secure? Sure, the code is good and secure, but there's no patch for gullibility.
I suggest the possibility that there are simply other factors that account for the almost total lack of malware on these systems.
First and foremost (and to get it out of the way, because it's so commonly presented) is the market share--virus writers want their viruses to run, so they target the largest markets.
Second is user education. Even with Ubuntu bringing Linux to the common man, the vast majority of Linux users are more knowledgeable about computers, and will not be as likely to fall for trojan traps. While the same cannot necessarily be said about OS X, both Linux and OS X have a history of better security architecture, which means that most operations do not require any sort of administrative access. While malware can run without administrative access, it's much harder to hide. Antivirus running as administrator will easily detect malware running as a user, and because of the history of these two operating systems (not needing administrative privileges that often) it's going to be harder to trick the user into giving up his password. That's not to say that it's impossible--and certainly there isn't a push to use antivirus on these systems anyway, but it would ultimately be a losing battle for malware authors even if the marketshare situation were different.
The upshot of all of this is that I think that if some magic happened and all Windows installations were turned into Linux installations overnight, malware authors would start targeting Linux, and the new (and largely uneducated) Linux users would fall prey just as easily, despite what OS X and Linux fans would have you believe (that somehow using the OS inherently makes you more secure.)
Of course, I'll probably be modded down into oblivion, as a troll, or flamebait, or just as overrated, but I've never seen someone post a valid counter-argument to this type of post.
The first OS to have a prototype implementation of an API is beside the point.
Uh, not when you're arguing it's a problem with the API, it's not.
I'm not sure why you think it was a "prototype", either. Win32 was NT's primary API.
Most applications for the home market were designed and tested not on Windows NT but on Windows 95 and Windows 98, as Microsoft didn't market NT for home use until 2002.
This does not excuse developers for blatantly bad practices. There is no excuse, for example, for applications spewing user-level data like configuration files through system areas.
What's the good way to solve PEBKAC without requiring the OS vendor to certify all applications with a digital signature, which certification processes have historically shut out free software?
There isn't one - at least, not within the realms of practicality.