Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Executive Tapped For Top DHS Cyber Post

Posted by samzenpus on from the reboot-to-be-safe dept.

krebsatwpost writes "The Department of Homeland Security has named Microsoft's 'chief trustworthy infrastructure strategist' Phil Reitinger to be its top cyber security official. Many in the security industry praised him as a smart pick, but said he will need to confront a culture of political infighting and leadership failures at DHS. From the story: 'Reitinger comes to the position with cyber experience in both the public and private sectors. Prior to joining Microsoft in 2003, he was executive director of the Defense Department's Computer Forensics Lab. Before that, he was deputy chief of the Justice Department's Computer Crimes and Intellectual Property section, where he worked under Scott Charney, who is currently corporate vice president for trustworthy computing at Microsoft.'"

138 comments

  1. There May Be An Upside by Velska1 · · Score: 0

    This guy probably knows the devious plans Steve Ballmer has...

    Anyhow, with DoD and DoJ experience in those capacities, it seems likely he knows a lot about privacy issues.

    OTOH, Microsoft using phrases like "trustworthy infrastructure" and "trustful computing" in chilling. Just whom am I supposed to trust? M$?

    Don't get me wrong. I use XP Pro on some stuff that's just easier to do with it (I know, laziness on my part, maybe) and it's doing it's thing. And after all, it's quite often cheaper to buy a desktop with Win than without (and I'm poor). But as an antimonopolist, I avoid it on principle.

    --
    Every problem has a solution that is simple, easy and wrong. Selling our Liberty for a little Security is a much too de
    1. Re:There May Be An Upside by maxume · · Score: 2, Insightful

      Things that you occasionally compromise are generally called preferences.

      --
      Nerd rage is the funniest rage.
    2. Re:There May Be An Upside by Anonymous Coward · · Score: 0

      I thought they were called 'principals'?

  2. Microsoft and Security in the same sentence? by BadAnalogyGuy · · Score: 1, Funny

    Boy oh boy. Obama seems to be turning into a big disappointment with some of these appointments.

    What'll he do next? Appoint Mike Tyson as head of Department of Heath and Human Services?

    1. Re:Microsoft and Security in the same sentence? by Praedon · · Score: 4, Funny

      Nope. New department, which is Department for Cannibal Relations.

      --
      Just me
    2. Re:Microsoft and Security in the same sentence? by timmarhy · · Score: 1, Flamebait

      what do you expect, you people carried on like it was the second comming when you elected him. no one can live up to that kind of hype.

      --
      If you mod me down, I will become more powerful than you can imagine....
    3. Re:Microsoft and Security in the same sentence? by BadAnalogyGuy · · Score: 1, Insightful

      What do you mean, "you people"?

    4. Re:Microsoft and Security in the same sentence? by Lumpy · · Score: 4, Insightful

      Why do you people think that the next new guy will be any different than the last one? I don't care WHO is elected. If they are Democrat or Republican, they will cater to their interests first and do the right thing last.

      MSFT funded a lot of his campaign. This is paying them back by appointing one of their executives, or they use their buddies.
      This happens every change of power.

      I just get a royal kick out of all the "WOO CHANGE!" people all sitting in their chairs sober now with their mouth open at the TV sets staring in disbelief.

      The only advantage is that this time our president is actually educated and articulate.

      --
      Do not look at laser with remaining good eye.
    5. Re:Microsoft and Security in the same sentence? by Anonymous Coward · · Score: 4, Insightful

      The only advantage is that this time our president gives great speeches from a teleprompter.

      There... fixed that for you.

    6. Re:Microsoft and Security in the same sentence? by Ihmhi · · Score: 1

      The rest of us refer to that as the Internal Revenue Service.

      --
      Random Thoughts From A Diseased Mind (Not For Dummies)
    7. Re:Microsoft and Security in the same sentence? by El+Torico · · Score: 1

      People who can use punctuation, capitalization, and spell properly. Actually, I think he was referring to those who voted the President into office.

      --
      In the land of the blind, the one-eyed man is usually crucified.
    8. Re:Microsoft and Security in the same sentence? by Sj0 · · Score: 1

      (Score: -1, Keep facts out of this)

      --
      It's been a long time.
    9. Re:Microsoft and Security in the same sentence? by mi · · Score: 1, Informative

      People who can use punctuation, capitalization, and spell properly. Actually, I think he was referring to those who voted the President into office.

      Actually, no, most of the people voting for Obama didn't know some very basic things about him or the opposition. And what they did know, was often wrong.

      In the particularly striking example, the vast majority attributed the infamous I can see Russia from my house! to Sarah Palin, when, in fact, the phrase was coined by Saturday Night Live, who were mocking her lack of foreign policy experience, while willfully ignoring Joe Biden's — whom Obama picked for the supposed foreign policy expertise — lunacies.

      What's much worse, though, is that these supposedly educated and well-versed people are now trying their damnest to keep the truth from becoming known — people trying to add mentions of Obama's association with (unrepentant) terrorist Ayers to Obama's Wikipedia entry have their changes reverted within minutes and their accounts banned for days...

      --
      In Soviet Washington the swamp drains you.
    10. Re:Microsoft and Security in the same sentence? by Anonymous Coward · · Score: 0

      What do YOU mean, "you people"?

      (tropical heat)

    11. Re:Microsoft and Security in the same sentence? by migla · · Score: 1

      I wonder how long the people will put up with this?

      I'd like to think that humanity is progressing (sure, there are setbacks and backlashes, but generally). I'd like to think that teh pendulum swings a little further towards enlightenment.

      The internet revolution, not twenty years old yet, should facilitate this. I think a different, better world is possible.

      If I'm wrong, at least I'm having a beautiful dream. What do you think?

      --
      Some of my favourite people are from th US; Vonnegut, Chomsky, Bill Hicks.
    12. Re:Microsoft and Security in the same sentence? by Anonymous Coward · · Score: 0

      Hello, Mr. Perot.

  3. ... trustworthy computing? by Anonymous Coward · · Score: 4, Funny

    Before that, he was deputy chief of the Justice Department's Computer Crimes and Intellectual Property section, where he worked under Scott Charney, who is currently corporate vice president for trustworthy computing at Microsoft

    Trust... worthy... computing at Microsoft... Isn't there a law that prohibits the words trustworthy and Microsoft in the same sentence?

    1. Re:... trustworthy computing? by erroneus · · Score: 1

      To be fair, "trustworthy computing" was just a buzzword that meant "DOS with no network card on the PC." It was still a work in progress and clearly has not been released yet.

    2. Re:... trustworthy computing? by gadget+junkie · · Score: 2, Interesting

      Before that, he was deputy chief of the Justice Department's Computer Crimes and Intellectual Property section, where he worked under Scott Charney, who is currently corporate vice president for trustworthy computing at Microsoft Trust... worthy... computing at Microsoft... Isn't there a law that prohibits the words trustworthy and Microsoft in the same sentence?

      I do not think it's forbidden, but it comes very close to the definition of Oxymoron, i.e. mutually contradictory terms.

      --
      "If a boss demands loyalty, give him integrity. But if he demands integrity, give him loyalty." (John Boyd, 1927-1997)
    3. Re:... trustworthy computing? by jaredmauch · · Score: 1

      If there was a law, it would be the justice department that prosecuted it.

    4. Re:... trustworthy computing? by cepayne · · Score: 1

      At least the guy will be well aware of the exploits in the
      worlds most popular operating system, which is most often
      attacked in security breaches.

      Having a microsofty on the payroll ensures that your security
      breaches will be well accepted.

      Keep your friends close, but keep your enemies even closer!

  4. Microsoft and Security in a same sentence? by Anonymous Coward · · Score: 4, Funny

    I foresee a lot of Microsoft Security jokes in the following threads.

    Here is one

    Do you allow Phil Reitinger to be the top cyber security official?

    Allow | Deny

    1. Re:Microsoft and Security in a same sentence? by Narnie · · Score: 4, Funny

      Do you allow Phil Reitinger to be the top cyber security official?

      (Okay)

      Fixed that for you.

      --
      greed@All_Evils:~#
    2. Re:Microsoft and Security in a same sentence? by Anonymous Coward · · Score: 0

      Microsoft has many security problems.

      Its ok to have Microsoft and security in the same sentence.

    3. Re:Microsoft and Security in a same sentence? by lxs · · Score: 1

      More like:

      Retry, Abort, Fail.

    4. Re:Microsoft and Security in a same sentence? by WhiteHorse-The+Origi · · Score: 1

      Do you allowing Phil Reitinger to top security official?

      There, fixed that for ya.

  5. Ah dammit... by Narnie · · Score: 4, Funny

    There goes any chance of the DHS switching over to an linux/unix environment in the next decade.

    --
    greed@All_Evils:~#
    1. Re:Ah dammit... by je+ne+sais+quoi · · Score: 1

      Well, wouldn't a former Microsoft executive be in the best position to know how fucked up Microsoft security really is? You'd think this would be a case of the burned hand learning best, in this case, the burned hand is also the one who turned on the fire.

      Well, alright, I'm blowing smoke and I know it. :) Odds are this guy has so much stock in Microsoft and their affiliates that it doesn't matter what he personally believes, his wallet will be speaking for him. Obama is turning out to be fairly disappointing in some respects. In other's he's doing alright, at least he had the decency to turn back a lot of the more idiotic Bush rules, like those signing statements. I suppose it's too much to ask for a president to both have common sense AND principles.

      --
      Gentlemen! You can't fight in here, this is the war room!
    2. Re:Ah dammit... by InsertWittyNameHere · · Score: 1

      Well they were going to hire a FOSS candidate but M$ came in and offered Phil Reitinger at 75% off.

      I hear they also threw in some CAL's and Vista upgrade licenses as well... at least that's how it worked out at my office

  6. que 500 stupid M$ sux0rs posts by timmarhy · · Score: 5, Insightful

    this guy doesn't seem a half way bad pick. of course if it was my call i'd eliminate the whole DHS nonense and just fund the FBI,NSA,CIA and police properly. if those 4 agencies can't get it done wtf is the DHS going to add?

    --
    If you mod me down, I will become more powerful than you can imagine....
    1. Re:que 500 stupid M$ sux0rs posts by BadAnalogyGuy · · Score: 0, Flamebait

      eliminate the whole DHS nonense and just fund the FBI,NSA,CIA and police properly. if those 4 agencies can't get it done wtf is the DHS going to add?

      Inter-agency communication.

      The lack of it, coupled with an administration that was ignoring the messages from all sides led directly to 9/11. Since we can't always trust that our President will be aware of all the right information, we can at least implement the bureaucracy in such a way that as long as someone is paying attention we can act.

    2. Re:que 500 stupid M$ sux0rs posts by Renraku · · Score: 4, Insightful

      If we could achieve with nuclear fusion what we have achieved with DHS, we'd all be living off of cheap and reliable energy.

      Suffice to say, the DHS is rather self-sustaining. If it isn't keeping liquids off aircraft or your electronics in the baggage handlers' pockets, its harassing and keeping us American citizens in fear.

      --
      Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
    3. Re:que 500 stupid M$ sux0rs posts by timmarhy · · Score: 4, Funny

      so let me get this right, government departments were shown to be poor are communicating, so your solution is to create yet another goervnment department for them all to mis communicate with?

      --
      If you mod me down, I will become more powerful than you can imagine....
    4. Re:que 500 stupid M$ sux0rs posts by BadAnalogyGuy · · Score: 2, Informative

      The DHS is the over-arching agency containing the previously separate agencies you listed above.

      Prior to the creation of the DHS, communication between agencies like the CIA and FBI was legally difficult because of the lack of transparency. But now that they are under the same umbrella agency, they can share information much more easily.

    5. Re:que 500 stupid M$ sux0rs posts by retech · · Score: 2, Informative

      Did you mean: Cue or Queue?

    6. Re:que 500 stupid M$ sux0rs posts by Chas · · Score: 2, Funny

      If we could achieve with nuclear fusion what we have achieved with DHS

      What? A parasitic reaction that just consumes and consumes and consumes, is more of a hindrance than a help, and wastes tons of money in the process?

      --


      Chas - The one, the only.
      THANK GOD!!!
    7. Re:que 500 stupid M$ sux0rs posts by Arancaytar · · Score: 1

      If it isn't keeping liquids off aircraft or your electronics in the baggage handlers' pockets, its harassing and keeping us American citizens in fear.

      So "re-settling to Mars now that we've blown the Earth up with fusion bombs" would be a more appropriate analogy than "living off of cheap and reliable energy". ;)

    8. Re:que 500 stupid M$ sux0rs posts by xouumalperxe · · Score: 2, Funny

      It's a portmanteau! He's cuing the "500 stupid M$ sux0rs [posters]" to queue up, since there's so many of 'em!

    9. Re:que 500 stupid M$ sux0rs posts by gtall · · Score: 1

      How about the Department of Miscommunication. The basic problem, it seems to me, is that miscommunication is spread out over the entire government structure. Now if we were to centralize it into a D. of MC., then all the other departments could rely on that sole department to implement their miscommunication and they would be left to do their jobs in peace.

      It wouldn't do to have the other departments communicate with the new D. of MC. (the obvious paradox, eh). Instead, there would be D. of MC. staffers in all the departments. Any communication out of the depts. would run through these individuals and be subsequently lost, stolen, misinterpreted, injected with blatant falsehoods, eaten by mutant weasels, etc. There is no need to handle communication into the depts. since no one dept. could effectively communicate it to begin with.

      And we could have this Phil Reitinger guy run the whole shebang. He'd feel right at home since when has MS ever effectively communicated with anyone without lying, misquoting, and being generally misleading.

    10. Re:que 500 stupid M$ sux0rs posts by Jane+Q.+Public · · Score: 2, Insightful

      And you honestly think that is a good thing? How old are you, anyway?

    11. Re:que 500 stupid M$ sux0rs posts by Anonymous Coward · · Score: 0

      Has MS security improved since 2003..?

    12. Re:que 500 stupid M$ sux0rs posts by Narnie · · Score: 1

      this guy doesn't seem a half way bad pick. of course if it was my call i'd eliminate the whole DHS nonense and just fund the FBI,NSA,CIA and police properly. if those 4 agencies can't get it done wtf is the DHS going to add?

      DHS adds funding for the Coast Guard. Before the DHS nonsense, the CG was within the Department of Transportation. Not really enough money in the pot for the CG to keep a modern fleet and perform all of it's various rolls.

      Actually, that's about the only good I've seen come out of DHS.

      --
      greed@All_Evils:~#
    13. Re:que 500 stupid M$ sux0rs posts by CaptainJeff · · Score: 3, Informative

      Ummm....the CIA and the FBI are not under the same agency now. The FBI is an agency of the Department of Justice and the CIA is an independent agency that quasi-reports to the Director of National Intelligence. The other agencies mentioned, the NSA and the police, are also not part of DHS. NSA is an agency of the Department of Defense and policing is a local function, run by any number of local agencies. But by all means, keep talking about things you obviously don't know anything about and cannot be bothered spending ten seconds on Google to confirm. :)

    14. Re:que 500 stupid M$ sux0rs posts by retech · · Score: 1

      Perhaps you give more credit than is due.

    15. Re:que 500 stupid M$ sux0rs posts by sunwukong · · Score: 1

      Not really enough money in the pot for the CG to keep a modern fleet and perform all of it's various rolls.

      If they'd stop scuttling their vessels they wouldn't have to keep replacing them!

    16. Re:que 500 stupid M$ sux0rs posts by Foofoobar · · Score: 1

      Suffice to say, the DHS is rather self-sustaining. If it isn't keeping liquids off aircraft or your electronics in the baggage handlers' pockets, its harassing and keeping us American citizens in fear.

      Fear them? Why? Because they stand at every gateway in their suits shouting 'YOUR PAPERS!!' with a nazi accent before frisking you and sending you away to some internment camp in a foreign nation where they cant be prosecuted for waterboarding you?

      Whats to fear?

      --
      This is my sig. There are many like it but this one is mine.
    17. Re:que 500 stupid M$ sux0rs posts by Late+Adopter · · Score: 1

      If we could achieve with nuclear fusion what we have achieved with DHS

      What? A parasitic reaction that just consumes and consumes and consumes, is more of a hindrance than a help, and wastes tons of money in the process?

      Only to be given up on when another disaster claims the lives of thousands?

    18. Re:que 500 stupid M$ sux0rs posts by xouumalperxe · · Score: 1

      Due? Isn't it dueue? I'm confused now.

  7. Good Grid! by Jane+Q.+Public · · Score: 5, Insightful

    Isn't that like asking the head of AIG to be the officer of "financial responsibility"???

    1. Re:Good Grid! by Vectronic · · Score: 1

      No.

    2. Re:Good Grid! by antibryce · · Score: 2, Funny

      it'd be like appointing a tax cheat to head the IRS.

    3. Re:Good Grid! by Anonymous Coward · · Score: 0

      You laugh, but it's how Joe Kennedy (who was a notorious stock fraud guy, dealing in both insider trading and stock manipulation) got appointed as head of the SEC.

      The reasoning? Can't stop a trick if you don't know how it's done. He just shut all the loopholes he himself used. Ended up being pretty good.

    4. Re:Good Grid! by mattwarden · · Score: 1

      LOL!!!!!!11 Or how about a tax cheat as head of the Treasury Department

    5. Re:Good Grid! by Anonymous Coward · · Score: 0

      Oh, yes, "LOL!!!!!!11," indeed! Good one.

      See, the IRS is part of the Treasury Department, so the head of Treasury is head of the IRS.

      Gee... Doesn't see so funny when you have to explain it.

    6. Re:Good Grid! by mattwarden · · Score: 1

      Yikes, you had beaten me to it by many hours. Please forgive the redundancy, but glad someone else was thinking like I was!

  8. Try not to be too delusional. by Anonymous Coward · · Score: 0

    Maybe this guy was a bad pick, maybe he wasn't. I'm not sure which it is, but just because he worked for Microsoft does not imply that he knows nothing about security.

    Microsoft might not be great at security overall, but that doesn't mean they don't have any security experts working for them.

    1. Re:Try not to be too delusional. by Anonymous Coward · · Score: 0

      I wouldn't pick a General from the Iraqi army to run another nation's military for reasons other than whether they have the necessary skills.

      Just because they were part of the Iraqi military doesn't mean they are unskilled. Similarly, just because this guy worked for Microsoft doesn't mean he lacks intelligence.

    2. Re:Try not to be too delusional. by daemonburrito · · Score: 3, Interesting

      [...] just because this guy worked for Microsoft doesn't mean he lacks intelligence.

      No, but it does mean that he was part of the team fighting US-CERT for months over autorun, at least. He likely helped resist an effort by a division of the department he is to head to fix a security problem that was so bad, they felt it endangered national security.

    3. Re:Try not to be too delusional. by jaredmauch · · Score: 2, Interesting

      A sad note on the autorun activity. The challenges US-CERT has are complex as they have little ability to enforce sane standards and are just as the name says a response team. Once you formulate a response, someone has to execute it, and the federal government is one of the largest enterprises out there, certainly if you include all the contractors as well. It will be interesting to see if there is a shift away from bah to career feds.

      At the same time, everyone makes mistakes and Phil has always shown himself to be a person who generally "gets it" compared to others I've bumped into at GLB. The same is true for any org, fed or not.

    4. Re:Try not to be too delusional. by daemonburrito · · Score: 4, Interesting

      I don't know. Even if he just did nothing to stop Microsoft's resistance it would be bad.

      If guys from CERT called me and said, "Hey, could you make The Autorun and NoDriveTypeAutorun registry values actually do something? We worried about this 10 million strong botnet," I'd probably comply. The reality was even worse; Microsoft wrote instructions for users to mitigate the problem which they knew were not effective.

      The last thing I would do would be to start a PR war, which they did only to save face about something that has been criticized for over a decade. It's amazing... some slight marketing concern overrode what they were told was a matter of national security.

      Funny... the wikipedia page on autorun was just stealth edited to remove all mention of the problem.

    5. Re:Try not to be too delusional. by mi · · Score: 0

      some slight marketing concern overrode what they were told was a matter of national security.

      Marketing over national security (as well as other real issues) is how Obama got elected in the first place. Even if we continue to give him the benefit of the doubt regarding past nasty associations (racist pastor Wright, terrorists Bill and Bernardine Ayers, governor Blagojevich), and not (yet?) question his personal integrity, the man's lack of experience (or, more harshly, lack of substance) is showing already: many of his appointees and would-be appointees are either a disgrace already or on their way to infamy. Today FBI raided the office of Vivek Kundra...

      --
      In Soviet Washington the swamp drains you.
  9. US-CERT mentioned in article by daemonburrito · · Score: 5, Informative

    I wonder if we will be seeing US-CERT standing up to Microsoft the way they did with this (a vector for conficker) with him in charge.

    I have a sick feeling about this. This guy was surely part of the Microsoft effort to call this a feature. And what was this "political infighting" that the article alludes to? I hope it wasn't over whether to go after Microsoft for aiding in the creation of the largest botnet to date.

    1. Re:US-CERT mentioned in article by Anonymous Coward · · Score: 0

      And what was this "political infighting" that the article alludes to?

      I suspect you're serious in asking that question. And if that is indeed the case, I'd suggest you pull your head out of your technological ass bubble and take a moment to look at what else might be happening in the world around you. And in case you truly do need it spelled out for you, the DHS has been a contentious entity ever since it was formed. For starters, there has been political infighting there over what exactly it's role should be in relation to the other intelligence agencies. Sometimes I seriously wonder just how big the blinders that you guys purposefully put on really are.

    2. Re:US-CERT mentioned in article by daemonburrito · · Score: 1

      RTFA. I'm talking about about CERT and conficker.

      FWIW, I don't like the very idea of DHS. Also, fuck you.

    3. Re:US-CERT mentioned in article by _Sprocket_ · · Score: 1

      And what was this "political infighting" that the article alludes to? I hope it wasn't over whether to go after Microsoft for aiding in the creation of the largest botnet to date.

      It's not all about Microsoft. DHS is a new bureaucratic entity that's trying to establish itself by carving in to the fiefdoms of others. That alone leads to political infighting.

      The Fine Article alludes to examples of this. A governmental body with a quick leader churn isn't a good sign - that's folks realizing they're in a bad situation and bailing. Effective organizations keep their leadership. Ineffective organizations that are comfy maintain ineffective leadership - yet the leadership remains. Within Government, an entity's funding is kind of a score keeper for their political capital, influence, and overall power. An organization that is budget-starved is an organization that is either ignored or under attack. If you go beyond TFA, you can find a whole history of wreckage.

  10. In all seriousness by Jane+Q.+Public · · Score: 4, Interesting

    While anecdotes from Windows users regarding how they tried to make an inherently insecure system secure could be extremely valuable, I doubt that anecdotes about how Microsoft executives tried to make their systems secure will be equally valuable. This was a ridiculous choice, and further undermines my initial hope that Obama might indeed turn out to be a good President.

    1. Re:In all seriousness by Jane+Q.+Public · · Score: 3, Insightful

      The choice of an executive officer of a major supplier of operating systems -- Windows of all things -- to this position sends a clear message to those who have been involved in "security" issues for many years. And that message is: "We don't care about 'security' except to the extent that it affects our corporate friends."

      I am very saddened by this news.

    2. Re:In all seriousness by Jane+Q.+Public · · Score: 2, Insightful

      Why? If you do not already know, then you aren't qualified to be in this discussion.

    3. Re:In all seriousness by Jane+Q.+Public · · Score: 1

      Pardon me, I should qualify that statement. If you are referring to Vista, which arguably has respectable security, my reply is: maybe the security is okay but nobody wants to use it. If, on the other hand, you are referring to Windows 7, then my reply is: we'll believe it when we see it.

    4. Re:In all seriousness by drsmithy · · Score: 1

      Pardon me, I should qualify that statement. If you are referring to Vista, which arguably has respectable security, my reply is: maybe the security is okay but nobody wants to use it. If, on the other hand, you are referring to Windows 7, then my reply is: we'll believe it when we see it.

      Since the fundamental design of Windows security hasn't really changed since Windows NT 3.1, I still want to hear about why it's any more or less "inherently insecure" than other platforms.

    5. Re:In all seriousness by Jane+Q.+Public · · Score: 1

      And I want to repeat: if you really don't know, then you are not qualified for this discussion.

    6. Re:In all seriousness by Jane+Q.+Public · · Score: 1

      For some reason that escapes me at the moment, I have changed my mind and decided to be charitable, and explain some things that should be obvious to the merest idiot:

      If Microsoft's basic security model has really not changed since NT 3.1, then there was really no reason to implement Vista's UAC... other than to unsuccessfully emulate the default security mode in most Linux distros. And, as so many people have reported in painful and repeated detail, the Vista UAC was indeed something that should have been aborted before it was born. Not only was it unsuccessful in emulating Linux default mode, it solved nothing and accomplished little but pissing everybody off.

      Linux's basic security model has not NEEDED to change since NT 3.1. But if you really think Microsoft's basic security model has not needed to change, then you have no reason to complain about any virus or IE-exploit malware that you get between now and Windows 7. Or maybe 8.

      Have fun with your "state of the art" OS... and don't come complaining to me when it fails to work with what everybody else is doing.

    7. Re:In all seriousness by Anonymous Coward · · Score: 0

      He was right to question you then. If you think that implementing UAC changed more than a tiny part of the security model, you're not qualified for this discussion.

    8. Re:In all seriousness by Anonymous Coward · · Score: 0

      "Have fun with your 'state of the art' OS... and don't come complaining to me when it fails to work with what everybody else is doing."

      Careful there.

    9. Re:In all seriousness by drsmithy · · Score: 1

      And I want to repeat: if you really don't know, then you are not qualified for this discussion.

      I *do* know, which is why I want to hear what bullshit you're going to make up to pretend *you* know.

    10. Re:In all seriousness by drsmithy · · Score: 1

      If Microsoft's basic security model has really not changed since NT 3.1, then there was really no reason to implement Vista's UAC...

      Right. Just like if Linux's "security model" hasn't changed since 1991 there wouldn't be any need for those nice graphical sudo prompts and the like that everyone gets now.

      UAC is little more than UI gravy. It's mostly about putting a prettier and more automated face onto "Run As", much like the graphical sudo prompts in OS X and recent Linux distros do. The underlying ACL-based multiuser security model that actually make it possible, has not changed since day 1.

      But if you really think Microsoft's basic security model has not needed to change, then you have no reason to complain about any virus or IE-exploit malware that you get between now and Windows 7. Or maybe 8.

      I've been running NT as a regular user since early 1996. As such, I've been no more worried about IE exploits than I have about any other userspace code exploits (on any of my machines, be they Windows, Linux, FreeBSD, Solaris, OS X, or whatever).

      Oh, and I'm still waiting to hear about these "inherent problems", rather than rhetorical, anecdotal, FUD about problems in the UI and userspace programs.

    11. Re:In all seriousness by Macthorpe · · Score: 1

      Only on Slashdot could asking a reasonable and polite question be considered 'flamebait' just because someone's simplistic view of the world is being threatened.

      --
      "It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
  11. Enemy combatants. by Snufu · · Score: 3, Funny

    Anticipate all persons attempting to enter the U.S. to be screened for explosives, hazardous chemical agents, firearms, radioactive materials, and open source software.

  12. I'd like to be objective about this. Let's try. by Anonymous Coward · · Score: 5, Insightful

    I like how this guy, whom I don't know much about, is painted a smart pick, coming as he does from the largest single computer security threat on the planet. Anybody recall that up to not very long ago at all security was not on their agenda? Simply because it made them more money not to care.

    Oh, and that is remebering their own words and without mentioning the usual, such as that they are convicted monopolists too, their business practices suck, their code sucks, their customer service and sales techniques reminisces that of office depot, and so on and so forth.

    The bottom line is that in politics you usually don't let the guy who fucked it up try and fix it. Unless perhaps the guy has friends in high places.

    1. Re:I'd like to be objective about this. Let's try. by gtall · · Score: 2, Funny

      How do you explain the Congress then? They cannot all have friends in high places. Watch CSpan when they broadcast hearings sometime. It's amazing how clueless these morons can be, especially the House members. For some odd reason, Senators have two brain cells to rub together instead of a single loner.

      Typical Committee Hearing:

      Title: Investigation into Why Tarp Funds are being Misused.

      Purpose: Figure out if Tarp Funds are being misused.

      Dennis Kucinich: Blah, blah, blah, Ohio, blah, blah, I am NOT an idiot, blah.....

      Each Member: Given 5 minutes to whine about how they don't understand anything.

      Suspect Witness: Given 10 minutes to state why he isn't lying after being told he is going to lie.

      Questioning: Isn't it true you beat your dog this morning after beating your wife and her mother?

      Suspect Witness: We didn't use Tarp Funds in beating those individuals.

      Dennis: Thank you for appearing here and assuming the position, we welcome you back to beat you up again at our convenience, 'cause, y'know, we have nothing better to do.

    2. Re:I'd like to be objective about this. Let's try. by Anonymous Coward · · Score: 0

      Now that you bring that up, can we ditch the whole thing and start over? I'd rather not wait before the rest of the world decides it's not going to happen and Takes Action[tm] themselves. Or in teams, maybe.

    3. Re:I'd like to be objective about this. Let's try. by roguetrick · · Score: 1

      I swear they do that jerry springer shit just to get people to watch them for once.

      --
      -The world would be a better place if everyone had a hoverboard
    4. Re:I'd like to be objective about this. Let's try. by Dragonslicer · · Score: 1

      I like how this guy, whom I don't know much about, is painted a smart pick, coming as he does from the largest single computer security threat on the planet.

      Yeah, how dare they pick a human that uses a computer.

    5. Re:I'd like to be objective about this. Let's try. by HiThere · · Score: 1

      On behalf of Office Depot, I would like to ask you to retract that statement.

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
  13. Did anyone else misread... by wayward_bruce · · Score: 3, Funny

    Many in the security industry praised him as a smart pick, [...]

    Did anyone else misread this as "smart prick"?

    1. Re:Did anyone else misread... by u38cg · · Score: 1

      Several times, yes. I didn't actually question it, then I saw it again, and thought, that's a bit harsh...oh, I see.

      --
      [FUCK BETA]
    2. Re:Did anyone else misread... by Anonymous Coward · · Score: 0

      Yes

    3. Re:Did anyone else misread... by mdm42 · · Score: 1

      Yes, I did.

      Not only that, but

      he will need to confront a culture of political infighting and leadership failures

      made me think, "He should be totally at home with that, then."

      --
      New mod option wanted: -1 DrunkenRambling
    4. Re:Did anyone else misread... by Anonymous Coward · · Score: 0

      Many in the security industry praised him as a smart pick, [...]

      Did anyone else misread this as "smart prick"?

      Yes. I re-read that statement 3 times until I convinced myself it said "smart pick."

    5. Re:Did anyone else misread... by Anonymous Coward · · Score: 0

      at least 3 times so far!

  14. MS hate posts? by Anonymous Coward · · Score: 0
    I hardly see any on slashdot lately. I mean, there are a few but they don't usually seem to get voted highly. If anything I see more of "omg MS just made me cum" kind of posts and people posting about how there are going to be so many anti-ms posts. Oh, and the occasional chair comment of course.

    Just scrolling the comments now and there seems to already be quite a few people who are almost in hysterics because they are expecting a million anti-ms posts.

    Seriously wtf is going on?

    Its kind of like slashdot has become infested with emo-ms fans who get emotional and have a hissy fit any time someone says something negative about ms.

    1. Re:MS hate posts? by retech · · Score: 1

      Phil Reitinger is a supermod on /. and hand filters each one of thos posts in the firehose section.

    2. Re:MS hate posts? by HiThere · · Score: 1

      I thought it was like preaching to the converted. Why bother? They're not the ones who need to be convinced.

      Yes, MS is evil. Yes, I won't work on MS systems (well, not past MSWind98) due to issues with the EULA. This isn't news, and most of Slashdot agrees, so why post about it? (Well, actually, most people on Slashdot have different major issues, but most of use have severe ones.)

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
    3. Re:MS hate posts? by Anonymous Coward · · Score: 0

      Yes, MS is evil.

      I love how this line is almost always presented as fact, when really it can only be opinion.

  15. Martyr complex by Anonymous Coward · · Score: 0

    Have you ever noticed that your "que [sic] the freetards", "que the ecocommunists", etc. predictions never seem to be accurate?

    I've got one that I bet will be accurate, though... "que the freerepublic mod squad modding you up".

  16. Its perfect .... for the NSA and CIA by AHuxley · · Score: 0, Offtopic

    The world sees the US security establishment using and trusting MS products.
    MS must be good right?
    Export orders and interoperability requests roll in from friends, allies, neutrals and some of the dumber freedom fighters.
    MS profits, the US gov can share with its rendition partners in real time.
    Think Condortel (1970's US/Latin American encrypted military network) with clippy.
    http://www.crimesofwar.org/special/condor.html

    Police, federal agencies and utilities around the world rush to upgrade.
    The CIA and NSA have just software "back doored" the world- again.
    Using MS for security is like handing out free Enigma units after WW2 or Iran using CryptoAG or the Soviets buying computer parts from the west.
    The difference is MS software and stays in your country for generations (over decades of hardware and software upgrades).
    But then does the US security establishment really eat its own dog food? ;)

    --
    Domestic spying is now "Benign Information Gathering"
  17. Expect many new ISO standards .. by Anonymous Coward · · Score: 3, Insightful

    I think choosing someone from a company that is STILL under DoJ supervision for questionable behaviour has a couple of unwanted implications, especially since this guy was at board level.

    It's only good news for foreign industrial espionage and botnet herders..

  18. In other news by Chas · · Score: 1

    The president's DHS pick has brought on board a liason from Symantec. Now everything will STILL be insecure, but run twice as slow, cost even MORE "way too much", and bitch, moan and cry about being renewed every year.

    --


    Chas - The one, the only.
    THANK GOD!!!
  19. If Obama were serious about his duty by Jane+Q.+Public · · Score: 4, Insightful

    then he would be hiring Bruce Schneier for this job. I know he is disliked by a lot of industry but he is the man with the facts and the plan.

    1. Re:If Obama were serious about his duty by drinkypoo · · Score: 1

      If Obama were serious about duty, he would never have become president of the USA. Presidents who want to make a difference are not permitted to do so. A bit more cynically, I would say that presidential candidates who want to make a difference are demonized, like when they said Nader was responsible for the loss of Gore. Did anyone else catch that whole kerfluffle with the ballots in that election? You can't blame the stopping of a completely legal and by-the-book recount on the guy, can you?

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:If Obama were serious about his duty by Jane+Q.+Public · · Score: 1

      Even that was not as blatant as the simple and direct refusal of the media to allow Ron Paul to participate in the more major debates this last election.

    3. Re:If Obama were serious about his duty by Anonymous Coward · · Score: 0

      Obama had nothing to do with this guys hiring. It's not a cabinet level position.

    4. Re:If Obama were serious about his duty by drinkypoo · · Score: 1

      Even that was not as blatant as the simple and direct refusal of the media to allow Ron Paul to participate in the more major debates this last election.

      People could reasonably (incorrectly, but whatever) interpret that as media bias. Wielding the new and improved Supreme Court to stop a completely legal ballot recount which almost certainly would have reversed the election, on the other hand, could not be construed by an intelligent individual as anything other than direct manipulation of the election system for the purpose of altering the result. When the well-substantiated reports of ballot fraud started coming in and they universally targeted primarily-democratic demographics, the point was really hammered home.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    5. Re:If Obama were serious about his duty by Jane+Q.+Public · · Score: 1

      But there was already precedent for that, from the previous election. I was referring to something pretty new.

    6. Re:If Obama were serious about his duty by noidentity · · Score: 1

      If Obama were serious about his duty then he would be hiring Bruce Schneier for this job.

      Actually, Bruce Schneier would probably hire himself by forging a message from Obama that he should be hired, one so good that Obama even believes he wrote it.

    7. Re:If Obama were serious about his duty by mattwarden · · Score: 1

      He is a paid adviser for the TSA

    8. Re:If Obama were serious about his duty by Ozlanthos · · Score: 1

      I believe Jane was referring to the no-holds-barred media blackout of Ron Paul coverage in the MSM. I completely empathize as I feel that if he were allowed to participate in a few of the bigger debates he would have DESTROYED Obama, McCain, and Clinton.
      -Oz

  20. He could assist in international relations by Centurix · · Score: 1

    You know, with countries like Iceland. They sure need an insight from a Microsoft exec right now...

    --
    Task Mangler
  21. 'smart pick' has one letter missing. by Anonymous Coward · · Score: 1, Funny

    ...already said it.

  22. To Anonymous Coward: by Jane+Q.+Public · · Score: 1

    You completely missed the point. If the UAC did not actually change the security model, then there was no real reason for its existence other than theater. You are merely confirming what others already know: it was a joke masquerading as "security". And if the security model did not really change, then the interface for it really did not need to change.

    The fact is that some basic security assumptions needed to change but they did not. The UAC has little to do with that directly but it illustrates the extend that Microsoft will go to misdirect its users.

    1. Re:To Anonymous Coward: by Anonymous Coward · · Score: 0

      You're dancing around the question, because you can't answer it. Can you actually commit to a response? Stop pussyfooting around, saying Vista may be okay and UAC might be security theatre. So what if UAC is misdirection? So what if it's designed to emulate sudo or whatever it is you're trying to say? The basic security model in Windows hasn't changed, and you haven't actually said anything yet that disproves that.

      So - answer the question, admit you're talking bollocks or shut up.

  23. Fan the flames... by bob5972 · · Score: 1

    Isn't sending Microsoft to fight insecurity like fighting fire with fire?

    1. Re:Fan the flames... by Muad'Dave · · Score: 1

      No, it's more like fighting fire with gasoline.

      --
      Tiller's Rule: Never use a word in written form that you've only heard and never read. You will end up looking foolish.
  24. Experience by Anonymous Coward · · Score: 0

    Reitinger comes to the position with cyber experience in both the public and private sectors.

    Cyber experience. Experience in... cybering.

  25. Bruce is smarter than that by Anonymous Coward · · Score: 0

    Bruce is smarter than that. He's never accept that no-win position.

    I've seen really smart people get crushed by political garbage. I'd **never** accept a job like that. That level of scrutiny and public life is simply too much to put my family through.

  26. Linux As Virus? by Anonymous Coward · · Score: 0

    Oh man this can spell disaster for Linux
    Can you imagine the head of security writes a report titled

    "Finnish Security Threat"

  27. To THE OTHER Anonymous Coward: by Jane+Q.+Public · · Score: 1

    I haven't danced around anything. I did not say that the UAC "might" be security theater, or any of these things you accuse me of. Here is simple logic, okay? I guess at this level I have to ask: You accept that simple logic is valid? From what you have stated I am not sure.

    *IF* the Windows security model hasn't changed, *THEN* the UAC is a joke. Okay? There is no reason for its existence OTHER THAN show.

    Get it?

    And the presence of such a major "feature" for nothing but show is ... well, "stupid" comes to mind but I am tempted to use another word.

    If the basic security model of Windows hasn't changed, then there was no reason for the security interface to change... yet it did. So, which is the truth? Better security, or an illusion? You argue for the illusion. Okay. But if so, let's not pretend it's anything else.

    I did not say that the basic security model of windows has changed. Others have. What I am saying is: if the basic security model of windows hasn't changed, then YOU shut up! You have nothing to complain about when you get a common virus via your Exhange server, or a piece of malware because you visited an unfriendly site via Internet Explorer.

    I'm not talking bollocks... I'm not talking anything. I'm simply pointing out where YOUR talk is somewhat misplaced.

    1. Re:To THE OTHER Anonymous Coward: by Anonymous Coward · · Score: 0

      Here's the thing though - you've written all that, and you still haven't answered the fucking question.

      HOW. IS. WINDOWS. INHERENTLY. LESS. SECURE.

      Give us a straight answer.

  28. ]pop[ Clippy: by Anonymous Coward · · Score: 0

    I see you're trying to become a cyber security official.

    Would you like me to help you with the kickbacks?

    Yes | No

  29. please explain why "illusion" isn't it by Anonymous Coward · · Score: 0

    UAC *is* a joke. Like the uninstaller that says "this DLL doesn't look like it's being used. Do you want it deleted? It may break something ig yo do", it's only there to make the USER responsible for a system problem, even though the user isn't given enough information (nor even the power) to find out what they should do.

    Windows security HAS NOT CHANGED.

  30. Let the jokes begin by Master+of+Transhuman · · Score: 1

    DHS calls on Microsoft for computer security.

    BWAHAHAHAHAHAHAHAHAHAHAHAH!!!!

    --
    Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
  31. Served their purpose by Anonymous Coward · · Score: 0

    No, I think you mis-understand.

    DHS served it's purpose very well: keeping Americans in fear, and providing security theater.

    What? you thought they made it to help the American people?

  32. Alas no by Mateo_LeFou · · Score: 3, Insightful

    The term might not be used as often, but the concept is alive and well

    "the new chips will 'block unauthorized access to the frame buffer.' ...

    There is a short list of parties who will be unauthorized to access your frame buffer: You. There is a long list of parties who are authorized to access your frame buffer, and that list includes Microsoft, Apple, AMD, Intel, ATI, NVidia, Sony Pictures, Paramount, HBO, CBS, Macrovision, and all other content owners and enablers that want your machine to themselves whenever youâ(TM)re watching, listening to, reading, or shooting monsters with their products. "

    http://www.infoworld.com/article/07/03/28/14OPcurve_1.html

    --
    My turnips listen for the soft cry of your love
    1. Re:Alas no by im_thatoneguy · · Score: 1

      You're missing one person on the long list. You. There is no prohibition on you choosing what data you want encrypted. It's not limited to movie companies.

      It is possible to create content of your own you know. It's not you vs the world. You're a part of the world.

      Here is just one example. (Beside the obvious case where you encrypt a movie file.)

      This technology can be used for privacy adovcates as well. Want to make sure that no unauthorized applications are secretly recording your activities? This denies access to the frame buffer from remote viewing.

    2. Re:Alas no by spitzak · · Score: 1

      Want to make sure that no unauthorized applications are secretly recording your activities? This denies access to the frame buffer from remote viewing.

      Wrong. This is only possible if you control the keys to the TPM. If you cannot set the keys you cannot implement any method of making sure unauthorized applications (who do have the keys) are not running.

      The reason you cannot set the keys is because it would also allow you to set the keys the same as another machine, and thus play media that is authorized only for that other machine. Otherwise it would be brain-dead obvious that the owner would be able to set their own keys. The fact that this is not allowed makes the lies behind this whole scheme obvious.

  33. Re:There May Be An Upside - but by INT_QRK · · Score: 1

    Bet he still owns MS stock...

  34. please stop!! by Unlikely_Hero · · Score: 1

    prepending "CYBER" to everything!! its so so wrong! *cries*

    --
    Happiness does not come from having much, but from being attached to little.
  35. ANECDOTAL EVIDENCE upon request... apk by Anonymous Coward · · Score: 0

    "anecdotes from Windows users regarding how they tried to make an inherently insecure system secure could be extremely valuable" - by Jane Q. Public (1010737) on Thursday March 12, @04:11AM (#27163463)

    Here is an anecdote, complete w/ quantified evidence of their security rating from a respected & widely recognized industry standards based benchmark gauge of security in the CIS Tool, with a user testimonial below, on how a Windows 2000/XP/Server 2003 user CAN make modern Windows OS variants secure (not just try, they have, 1++ yr. free of virus/spyware/trojan/rootkit/worms/malware-in-general below & how they did it):

    ----

    HOW TO SECURE Windows 2000/XP/Server 2003 & even VISTA, + make it "fun-to-do", via CIS Tool Guidance (& beyond):

    http://www.tcmagazine.com/forums/index.php?s=9237bccd0bf4b73b2fc429d84ccf01d2&showtopic=2662 [tcmagazine.com]

    ----

    (It makes securing a Windows NT-based OS of modern varieties such as Windows 2000/XP/Server 2003 actually fun! Much like running a PC performance benchmark almost and it is fun to do if you like benchmarking of any kind).

    There in the url above you also can see how Windows 2000, XP, &/or Server 2003 do on said test (and the guide goes far beyond CIS Tool guidance only), and for a hour or so's worth of work on the testers' part and they can have a system that scores 99/100 potentially on said test as well as years to decades of secure uptime after using its points.

    Word-of-Mouth/anecdotal results gained by a user who shows NO virus/spyware/trojan/rootkit/malware in general infestations on his own machine &/or those of his paying clients also after using this test & the points in the guide above:

    ----

    http://www.xtremepccentral.com/forums/showthread.php?s=b956ddd43cfcfc73f0f3378405860794&t=28430&page=3 [xtremepccentral.com]

    "Its 2009 - still trouble free!

    I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008.

    Great stuff!

    My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads.

    APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getting my host file updated, setting services to system service, rather than system local. (except AVG updater, needed system local)"

    THRONKA @ www.xtremepccentral.com

    ----

    Thus, as you can see? It is easily "doable" to have a secure Windows OS on a PC...

    (The entire "Linux is so secure" mantra you see online and rampantly here, in the past @ least but not so much anymore imo, is also upset by what is shown in the very 1st post in that guide because Linux itself can be more secure than it is out of the box oem stock as well, with data from a slashdot poster there in Bert64's 90/100 score using SuSe Linux as an example thereof - that said & aside, you Linux/BSD/Solaris fans here may wish to take a peek @ the CIS Tool as well for the purposes of making sure you "lock down" your *NIX machines also (this tool is extremely helpful on all of these platforms for these purposes)).

    APK

  36. To the down modder here... apk by Anonymous Coward · · Score: 0

    Whoever modded this down must be a botmaster or malware creator, or just have nothing better to do. Well, that or some disgruntled "Pro-*NIX" person here, who skimmed & overlooked the fact that the CIS Tool used also helps you people too!

    APK

    P.S.=> The bogus downmodding for spreading around something that really works to secure Windows' systems is pretty lame guys: Think about it - Everyone ought to be helping folks being attacked by the fools that create malware & what-not, no matter the OS platform they run...

    (& that especially means technically oriented people in this 'art & science', no matter what OS platform they use)

    That's a lot cooler & more productive than busting one another's chops w/ this "Windows vs. *NIX" lunacy!

    (Honestly, think about that, ok? Especially if the person modding my post down is a "Pro-*NIX" person doing the down modding...)

    E.G.-> Consider that 1 day (in some "alternate reality" maybe, lol) that *NIX variants will take over the desktop etc. et al that you here hear every so often & then you'd see *NIX variants being assaulted that way Windows is now (mostly thru apps from now on I wager, the OS is only NOW starting to become truly "core solid" imo), because those *NIX variant OS would be the most used, & thus, the logical target of those out to get your personal information of extreme value that you might leave on a PC (not advised, but, traces are possible)

    SO, that "said & aside" - How would you like some troll coming in & down modding what you KNEW worked vs. such bogus machinations, especially when you could show proof thereof from others no less?

    Again, food for thought... apk

  37. Where do they get these names? by Ozlanthos · · Score: 1

    With this guys resume, it should be 'chief "Thurstworthy infrastructure strategist'

    -Oz