Slashdot Mirror
Microsoft To Disable Autorun
jchrisos writes "Microsoft is planning to disable autorun in the next Release Candidate of Windows 7 and future updates to Windows XP and Vista. In order to maintain a 'balance between security and usability,' non-writable media will maintain its current behavior however. In any case, if it means no more autorun on flash drives, removable hard drives and network shares, that is definitely a step in the right direction. Will be interesting to see what malware creators do to get around this ..."
@ Will be interesting to see what malware creators do to get around this ..."
Attrib -w? Flip the Writeprotect dword in StorageDevicePolicies?
BBH
Has to do with crap like this - the theory goes that you may WANT to have an autorun from them for legit reasons (movie on a "read only" flash disk, or a "plug this hard drive in and automatically launch Program X" setup).
Hell, without this, those "U3 Enabled" flash drives (yeah I know, gag puke awful crap software) are even harder to use too. They use a single partition with the U3 software, autoboot it, check for you entering your "password", and only they will it decrypt the OTHER partition on the drive for you.
See where this is going?
take any USB controller, have it emulate a Human Interface Device (aka keyboard), use it for the keystrokes of "windows, up, up, up, enter, virus-website, enter" and it's game over. you can do the same on Mac, just a tad more difficult.
CD-ROMs could have kept the common "Play button" interface from the beginning. Everyone knew this procedure. You insert a VHS into a VCR, you press play. You insert a cassette tape into a Walkman, you press play. CD into a CD player, press play. When the CD-ROM came out, wouldn't it logically follow to insert the CD-ROM, then press the "Play button" to execute any "autorun" functionality? That way it's a user-initiated event, but one that your entire target audience is already going to be familiar with. And the users who weren't intended on "playing" the CD-ROM don't press they play button and can go about, uninterrupted, copying it or navigating the file system as they intended. It's not a huge deal, but I just find it odd that Microsoft's implementation of "Autorun" was the solution to this "problem" back in the day.
Yes, mapping a windows network share would indeed cause autorun.inf to be read.
When life gives you crap, Make Crapade.
Sluggy Freelance.
As someone who likes autorun, my reaction to this is "yeah, because I like doing work myself that a computer is good at".
Computers are HORRIBLE at deciding what is safe to run at what isn't. That's the central security problem, and it probably won't be solved until we have strong AI.
As an interesting side point on that issue, M$ knew all about Sony's root kit prior to it being released in fact they were involved in evaluating it and it was a M$ advertising blogger who announced it to the world not long after it was released and of course just prior to the release of the playstation 3, ahh, the wonderful world of modern marketing techniques.
Chaos - everything, everywhere, everywhen
CLIs are great IF you know the command to launch it.
What if you type in Word. Do you get MS Word or WordPad or Word Search?
What if you don't know the program's name ("Writer" comes to mind) but you know it's a part of Open Office? What if you don't know anything about the program but would recognize it if you saw it?
The list of things on a computer which a person should know the correct command to launch are very few. Vista's: Windows Key -> "Search Phrase" -> Enter. System seems to be the best. You can search or if you can't find it then look through your program list. It's the best of both worlds.
Now the worst place for a CLI is anywhere the user doesn't know 'what they can do'. If you launch a CL program you're presented with no possibilities. You have no idea what the program can do. It's like driving up to a drive through without a menu. You can start quizing the person on the other end of the little box what they offer but a nice photo menu is the fastest way to absorb data.