Microsoft To Disable Autorun

jchrisos writes "Microsoft is planning to disable autorun in the next Release Candidate of Windows 7 and future updates to Windows XP and Vista. In order to maintain a 'balance between security and usability,' non-writable media will maintain its current behavior however. In any case, if it means no more autorun on flash drives, removable hard drives and network shares, that is definitely a step in the right direction. Will be interesting to see what malware creators do to get around this ..."

Comments

Erm.....What the hell?

[Sj0]

Why wasn't this the default to begin with? There's no good reason to automatically run anything on media like hard disks or flash drives. It's an obvious virus vector.

Re:Erm.....What the hell?

[Anonymous Coward]

Microsoft wanted a computer to be an appliance. The person operating it didn't have to know much. When it got older, you bought a new one Want your new camera to work? Plug it in and insert cd. Want an external hard drive you just plug in and it backs up your stuff? You got it. Want to watch tv on your computer? Plug it in the usb slot, plop the cd in the drive and you're good to go. Good idea. However, the real world doesn't play with good ideas very well.

Re:Erm.....What the hell?

[Sj0]

The risk is too obvious and too stupid to take.

A menu pops up with this stuff anyway: "Hey, want to open this folder?", so it's not like you're doing anything more than adding exactly one step.

Re:Erm.....What the hell?

[Midnight Thunder]

Why wasn't this the default to begin with? There's no good reason to automatically run anything on media like hard disks or flash drives. It's an obvious virus vector.

A compromise would have been to ask the user, but disabling is completely is probably better, since it will avoid stuff like the Sony Root kit, being installed by a clueless user. After all:

Computer: "Do you want to do xyz? It may break you computer."
User: clicky, clicky "Why yes of course"

Re:Erm.....What the hell?

[Twillerror]

Not entirely true. When I plug in my camera and a little popup comes up I really like that. Why...because it's not exactly what program I'd like to launch. Most of the time I just want to get at the file system and copy and paste over the files.

Then there is my wife who would be completely lost without the auto run that cameras present users with.

When USB drives plugin sometimes they auto run management software which could include faster drivers or encryption utilities. I'd don't want the option for this lost.

The problem to me is not that it auto runs, but that it doesn't require any sort of user involvement. I like auto run cds...except when I don't want it. I know I can hold down shift to get around it, but if I forget or my arms are to short to do both at the same time I'm boned.

If there is a use case (even if you don't see the need) for this then we need to try to continue to support it. My guess is someone though of a GOOD user for it. I don't want my entire computer expierence to be dictated by virus writers and boring programers. It's like saying we can't fly on jets because someone could fly them into buildings...figure out how to stop people from flying into buildings...not stop flying.

Re:Erm.....What the hell?

[Feanturi]

That's only if there isn't an autorun.inf pointing to an executable. If there is, it runs that instead of showing the "What do you want to do?" dialog. Only having autorun disabled will protect you from that. What would be good is if it was disabled by default, but could be turned on for select "trusted" flash drives. Or, just a thought, maybe people could learn a bit about how to use a computer and not have to have it do all the driving. Nothing wrong with learning to open an Explorer window, then navigating to a drive to access something on it. What a concept, actually knowing what's on your media. All this "ease of use" and accessibility crap is just making users dumber and dumber.

Re:Erm.....What the hell?

[EvanED]

Or, just a thought, maybe people could learn a bit about how to use a computer and not have to have it do all the driving. Nothing wrong with learning to open an Explorer window, then navigating to a drive to access something on it. What a concept, actually knowing what's on your media. All this "ease of use" and accessibility crap is just making users dumber and dumber.

As someone who likes autorun, my reaction to this is "yeah, because I like doing work myself that a computer is good at".

I think Vista's "always autoplay, never autorun" (if I got those names right) scheme works really well.

Re:Erm.....What the hell?

[thePowerOfGrayskull]

hat a concept, actually knowing what's on your media. All this "ease of use" and accessibility crap is just making users dumber and dumber.

Why should those people who are using computers as tools (in the same way they would use a car, lawnmower, or vibrator) have to know anything at all about how it works, where content is stored, etc?

The best system is one that just does what you want it to do, without distracting you from your task by making you think about it. That holds equally true for computers, windshield wipers, and toilet paper.

Re:Erm.....What the hell?

[Darkness404]

And remember the Sony rootkit fiasco? That's no better or worse than something you might catch from popping a pirated CD or DVD (the ones you buy for $1 off the streets).

Except for the fact the Antivirus you paid $80 for will catch the malware that came off the CDs and DVDs but believes that the Sony Rootkit is "legitimate" and leaves it alone.

Re:Erm.....What the hell?

[Happler]

I have met people who do not think about toilet paper and they stink. I am a firm believer that people should have at least a basic understanding of what tools they are using. Knowing the basics of windshield wipers means that you can purchase and change them yourself (and pay less in the long run). Knowing the basics of computers means that you will, at least, help minimize the amount of damage you do to your computer via virus, malware, stupid user tricks, etc. I have worked too much tech support to encourage systems that do everything for the user. It just creates more problems then it is worth.

Re:Erm.....What the hell?

[Cajun Hell]

The best system is one that just does what you want it to do

Autorun isn't intended to do what users want it to do. Close, but not quite. Autorun is intended to do what ..
.. .. somebody .. ..
.. wants it to do. That person is never the user, unless the user wrote the autorun script. That person may have the user's interests at heart.

Re:Erm.....What the hell?

[Tanktalus]

No other device stores nearly so much of a user's information as a computer. Except maybe a filing cabinet, and you damned well better know where to find your information there, because there's no "grep" tool for that!

All I'm saying is that analogising a computer against a lawn mower may break down for some things. And this might just be one of them.

I don't expect a user to be able to write a program, or even a script, or even a batch file. But I do expect them to know where they store their stuff insofar as its similarities to a set of filing cabinets goes.

Re:Erm.....What the hell?

[rnelsonee]

If we're talking about CD's, then the user is already assuming the script writer has their best interests at heart - why else would they be sticking the CD in the drive? All disabling autorun does is make it harder for users, because *no* user is ever going to stick a CD in the drive, and then say "Well, that was fun" and then take the CD back out and throw it away. They're putting it in to install software! And if they're putting a CD in that doesn't have a setup.exe, then there's not going to be an autorun.

I use autorun for my customers. I have multiple install scripts depending on the type of computer and dependencies. I'd rather change an autorun.inf than explain which setup to run to my customers. I'm getting paid to automate tasks (my software is basically an automated testing suite). If Windows forces my users to run setups themselves, its making everyone's life more difficult.

If you think autorun is a security threat, you can already disable it. At least make it a choice.

Re:Erm.....What the hell?

[Thinboy00]

I'm not very familiar with KDE history, but if I had to guess I'd say MS shamelessly ripped that off...

Re:Erm.....What the hell?

[Thinboy00]

No, Sony got in HUGE trouble for that (not sure if it was legal trouble, but after the public outcry, they recalled EVERYTHING and IIRC a court may have ordered them to do more or something...?).

Almost, but not quite

[sqlrob]

Since non-writable media such as CD-ROMs generally aren't avenues for malicious software propagation

Because no that's infected ever burns a CD, nope, never.

Getting around this will be difficult?

[gringofrijolero]

I don't think so. Just tell the user to double click the setup.exe icon if it doesn't run automatically. Gotta turn off autorun in the user's brain.

It's done right in Ubuntu

[Benanov]

Not sure exactly what's doing it, but in my Ubuntu and gNewSense installs:

If I insert a CD with autorun files on it or it has an autorun folder, I am prompted that this disc has software on it designed to run automatically, and I am asked what I would like to do about it.

Seemed to be pretty sensible really. I mean *I* inserted the CD, so I expect something to happen.

Re:It's done right in Ubuntu

[Anonymous Coward]

The fact that you're using a CD drive as a jewel case pretty much invalidates any opinion you may have on this matter.

Sony CD

[cant_get_a_good_nick]

Didn't Sony install rootkits as part of CD insertion/autoRun? CD-ROMs are a vector for malware.

Also, I remember some website getting sued because they mentioned how to disable autorun, effectively disabling their anti-copy rubbish. So will Microsoft be sued for removing this?

wrong tree?

[Tom]

Wake me when they disable "autorun" for E-Mails.

Seriously, when's the last time you heard about 100,000 PCs getting infected by malware on a USB stick?

It's certainly a good step, but the problem it solves pales compared to pretty much everything else that windos has burdened itself with over the past decade or so.