Slashdot Mirror
Microsoft Releases Super-Secure XP to US Air Force
Wired is reporting that Microsoft is releasing the most secure version of Windows XP ever created, but only if you are the US Air Force. "The Air Force persuaded Microsoft CEO Steve Ballmer to provide it with a secure Windows configuration that saved the service about $100 million in contract costs and countless hours of maintenance. At a congressional hearing this week on cybersecurity, Alan Paller, research director of the Sans Institute, shared the story as an template for how the government could use its massive purchasing power to get companies to produce more secure products. And those could eventually be available to the rest of us. Security experts have been arguing for this "trickle-down" model for years. But rather than wield its buying power for the greater good, the government has long wimped out and taken whatever vendors served them. If the Air Force case is a good judge, however, things might be changing."
In all seriousness, I'd imagine usability is likely the reason this won't see a public release -- "really secure" and "really easy to use" aren't necessarily mutually exclusive, but you can bet they sacrificed the latter for the former in this case. I'd fully expect application compatibility to take a serious hit, and for many Windows features to be cut entirely.
This product is probably unusable for the average consumer. I'm sure there are some enterprise contexts in which it'd make perfect sense, though.
And of course, Microsoft doesn't want to dilute Windows Vista/7 sales with a new edition of XP (which they'd have to support for years) either.
"Having the most secure Windows ever" does not equate to having secure Windows.
Rich And Stupid is not so bad as Working For Rich And Stupid.
You're kidding aren't you? "85 percent of attacks were blocked after the configuration was installed". ...and the remaining 15% were not! The concept of a secure computer running Windows XP is a contradiction in terms. The military needs to do better than this, or China is gonna whup their ass.
Because it's probably not the most compatible Windows and might lack some features.
Slashdot anagrams to "Sad Sloth"
Now lets rephrase that; 15% of the attacks were still successful after a complete lock-down configuration was applied and lots of manpower went into burning custom installation disks and procedures. Is it just me or does anyone else see a problem with this?
Next up: Why we don't lock our doors, because thieves might happen to carry lockpicks!
After all, locks are not 100% secure, therefore, that security is totally useless, right?
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
if you look closely at the article, this is something that the air force did between 2005-2007. so this is actually old news. 'The Air Force began the project in 2005 and finished installing the new configuration on systems in 2007. In contracts with hardware providers it demanded that vendors pre-load the special Windows XP configuration onto systems before delivering them to the Air Force.'
Wrong analogy. Try: "This bucket has 85% fewer holes than Bucket XP."
Literalism isn't a form of humor, it's you being irritating.
Exactly, locks (unless you pay a shitload for them) are not designed to keep people out. Any locksmith will tell you that the only thing a lock will do is make your neighbours house an easier target.
Computer security is the same way. You *can* cracl WPA(1/2) encryption, but if you neighbour has his connection open (or is using WEP), you are not likely to become a target.
The exception, which appears in this situation, is when you are chosen as a target due to a high payoff (military). In this case, simply being harder than your neighbour is NOT going to help you.
Personally... If I'm being forced to patch a rusty old bucket, I'd rather start with the one that 85% less holes...
Exactly, locks (unless you pay a shitload for them) are not designed to keep people out. Any locksmith will tell you that the only thing a lock will do is make your neighbours house an easier target.
Arguably, an alarm system is more important in keeping people out than the lock on the door. If they kick down the door and a message goes off that lets them know that you know they are there and that the police are coming shortly, they usually won't stick around that long.
Same thing applies to computer systems. It is more important to know that you have an intrusion as soon as possible than the actual prevention of the intrusion.
Not that you want to leave the door unlocked, but rather you need the ability to lockdown and detect when someone is there when they shouldn't be.
"I am the king of the Romans, and am superior to rules of grammar!"
-Sigismund, Holy Roman Emperor (1368-1437)
Holding out for absolute perfection, I see. Let me know when you find it. I'm stuck here on planet Earth where nothing is 100% anything.
I disagree. Security is a layered thing, both in implementation and subversion. If I'm running Windows NT with no service packs and no firewall, I'm easily hacked by 90% of people.
If I'm running Windows XP patched and firewalled, I'm easily hacked by 1% of the people. If I'm running OpenBSD fully patched with no open ports aside from SSH, I can be easily hacked by .01% of the people (likely a BSD or SSH developer who slipped in a back door).
Nothing is 100% secure -- HOW secure you are is the important thing. If this super XP lets in 15% of attacks, you need to ask who knows and who would bother to run those attacks, as well as what other layers of security beyond the desktop are available.
If you're running a desktop operating system "in the wild" with no patched firewall software of any kind to block basic traffic, then you should add that layer.