What a Hacked PC Can Be Used For

An anonymous reader points out that the Security Fix blog is running a feature looking at the different ways hacked/cracked computers can be abused by cyber scammers. "Computer users often dismiss Internet security best practices because they find them inconvenient, or because they think the rules don't apply to them. Many cling to the misguided belief that because they don't bank or shop online, that bad guys won't target them. The next time you hear this claim, please refer the misguided person to this blog post, which attempts to examine some of the more common — yet often overlooked — ways that cyber crooks can put your PC to criminal use."

Comments

They don't care

[stoolpigeon]

Over the years I've offered help staying secure to friends, co-workers, etc. and I've learned that they just don't care. Most people only want help in one situation- when they have a virus that interferes with their computer working properly. Then they want it removed so they can go back to doing all the stuff that got it on their machine.

If you don't believe me - tell someone who isn't a tech person to go read this blog post. A week or two later ask them if they read it. I'm gonna go out on a limb and say over 90% wont.

Or talk to someone like that about security. Watch as their eyes glaze over and they look for a way to escape.

Re:They don't care

[Anonymous Coward]

this is soooo true.

I have coworkers who do downloads 24/7 from their home computers (no MAC spoofing, no TOR, no proxies, no nothing).
When asked about the dangers of being caught (even as a remote possibility), the answer was the same: "I don't care!"

Re:They don't care

[AtomicJake]

Same experience here.

However, I told people all those issues that are mentioned in TFA. The response of my friends? "So what?" -- They do not feel responsible for malware running on their computer. Somehow, I can even understand them; they just bought a computer and pay an ADSL line -- why should they care if their computer is broken by design (e.g. needs an update before the first connection as it was the case with Windows XP before the computers have been delivered with SP2 installed)? It's hardly their fault.

Re:They don't care

[ae1294]

I agree, I worked at a computer store doing service for many many years and I would see the same old people over and over and over again. I would tell them to just stop installing kazzzza! or stop browsing seedy porn sites but they never did and it was always their teenage son's fault.

(If it was me i'd ask how to lock him out after the 5th $100 reload) - didn't always need a reload just saying...
I even offered to explain to them how to setup a bios password and sold special case locks for three bucks... no takers.

They would however, always be very mad at me for not preventing their computers from getting reinfected. I guess they expected I would create some sort of magic barrier for them.... I donno... It's funny hearing "I'll never come back here AGAIN!" from the same person and then see them back in two months or so....

People don't mind going out to the bar and spending $200 on shots but don't try and charge for fixing their porn box or you'll get beat...

Re:They don't care

[anjilslaire]

Agreed. People simply use their PCs (and Macs) as appliances, with no thought whatsoever of using it *properly*, or learning how to use it safely. It's like leaving your door unlocked when you go out for the day.

Re:They don't care

[sohmc]

I think it's a mixture of "they don't care" and "I didn't know". I don't use any sort of firewall/anti-virus on my home computer because I know what I'm doing. I don't download anything malicious since I always know who sent me anything. I don't go to sketchy websites and my router locks everything from the outside out. I don't recommend this unless you're an expert and you don't want to waste resources on virus scanning every file. Most people, if they keep up with updates and run virus scan regularly, most of these things aren't problems. I think this is kind of like swine flu: trying to create a massive panic when really the odds of it happening is small.

Re:They don't care

[Auction_God]

Most people only want help in one situation- when they have a virus checker that interferes with their computer working properly.

There, fixed it for you. Most virus checkers are worse than the viruses they protect you from.

Re:They don't care

[castironpigeon]

It's just human nature, nothing to get upset about. The idea is basically this: is it more trouble to learn how to use a computer properly or to get it fixed when, on occasion, it stops doing what you need it to do?

I'd say it's much worse that people treat their vehicles the same way, but the same line of reasoning applies. It's more trouble to be a safe driver and maintain your vehicle in proper working order than it is to deal with the occasional hassle of a fender bender or possibly death. And if the possibility of dying isn't enough to get people to change their actions then I really don't think lecturing them about malware is going to do the trick.

Re:They don't care

[Anonymous Coward]

This is unfortunately very true. Several of my co-workers bring me their machines from home every few months to fix and 90% of the time none of the Windows updates are installed and the anti-virus software is either outdated or completely disabled. I finally sent an email to all employees that I will no longer fix any non work machines. My main reason is that they seem to think that my expertise is worth nothing to them..none of them have ever offered to buy me a pack of beer, much less pay me for the hours I spend on their personal computers, but also because it's extremely frustrating that they don't really care about preventing the problems in the first place.

Re:They don't care

[causality]

If you don't believe me - tell someone who isn't a tech person to go read this blog post. A week or two later ask them if they read it. I'm gonna go out on a limb and say over 90% wont.

I'm going to assume here that you're implying they say "ok" when you tell them to read it. I think this is a more general phenomenon and isn't specific to computing at all. Lots of people casually say they're going to do something with no intention of actually following through, which makes me wish they'd just decline the request up-front. It's like their word doesn't mean anything to them, so they give it carelessly. Of course, they wouldn't dare do that to their boss at work, because he has ways to make them regret it, meaning this is merely a selfish trait and doesn't require any explanation more complex than a weak character. It's one of those things that has become common but that does not make it normal.

Or talk to someone like that about security. Watch as their eyes glaze over and they look for a way to escape.

That's what I like about security. It's one of the few things where that sort of childishness and inability to deal with the real-world situation just won't fly, at least not for very long. An ability to put on an act and go through the motions won't protect you from the cleverness of the black hats; you need to actually have some understanding of what you're doing and why you're doing it. I think that's why people don't like this topic and consequently don't want to take even the more basic precautions. Whether they admit it or not, they resent finally encountering something that requires them to think, that cannot be reduced to a short list of simple steps that they can execute mechanically.

The technical information needed to maintain good computer security is abundant. It is easily found via Google. I think the real problem here, the reason why nothing seems to seriously improve, can be found in the mentality with which security is approached. That mentality, in turn, can be shown to have its roots in the way people have become during the last few generations, particularly their short attention spans and their addiction to convenience and instant results. Security is just good at exposing these things because its rules and concepts are like the laws of physics: the principles are sound and all the wishing in the world won't change that.

Re:They don't care

[Junior J. Junior III]

The answer to this is to put the "personal" computer into context. PCs really stopped being personal computers the moment the availability of internet access became the norm. They should be called "social" computers now, but most people don't think of them that way.

How you put the "social" computer into context varies from person to person. I have a family member who I support who knows little about how computers work, and barely knows how to use one. He happens to be very politically minded, in a right-wing hardcore military patriot kind of way. I forward him some info about the Chinese hacking into US military and government networks and "cyber warfare" and that woke him up. Now he thinks it's his patriotic duty to keep his antivirus updated, and not open email attachments. I have very few problems from him these days, and the last few have been due to his security software being *too* tight. He thinks any problem he has with the computer could be a virus, as opposed to a bug or human error, or whatever, but he has gained enough sense of paranoia that he's made his usage habits a lot safer than they were when he was first going online.

You just have to find the right button to press (in the person, not on the computer) and then the rest will follow naturally because they finally care. If the user's a businessman, play up financial scammers and anarchist punk hackers. If the user's religious, invent satanic hackers. If the user's a leftist, talk about The Man and government spooks. If they're a concerned parent type, talk about child predators.

Re:They don't care

[mh1997]

Agreed. People simply use their PCs (and Macs) as appliances, with no thought whatsoever of using it *properly*, or learning how to use it safely. It's like leaving your door unlocked when you go out for the day.

I wonder why people would use a computer as an appliance. Could it be that the OEMs, software companies, and retailers are selling the computer as an appliance for online shopping, banking, and entertainment?

I wonder why they don't care when they are repeatedly told by the software companies that their brand of OS is very secure and it even has a "red, yellow, green" warning system to show how secure it is.

I wonder why users (who are told their computer is so simple to use properly, that there is no training required) don't train themselves?

From the time people are old enough to use a lock, they are told by parents, teachers, police, media, etc. to lock their doors.

There is no comparison for the average person regarding computer security. If the software companies cannot provide the level of security, without training, that they promise, then there should be a warning constantly flashing on the screen telling the person that anything and everything on that computer is likely to be stolen or used to commit a crime.

Re:They don't care

[areusche]

As much as I know everyone hates these, computers are a lot like cars. They need regular upkeep and maintenance to perform at their best. Anything less and problems start to crop up.

Re:They don't care

[0100010001010011]

There is a point at which people want an 'appliance'. Be it your car, computer, yard, HVAC, water conditioner or toaster.

There are people who never clean their toaster. And when it dies they toss it and get a new one. This is no different than someone who buys a new computer everytime they get a big malware hit.

Everyone is guilty of neglecting SOMETHING. It's not just that it's human nature but the time you spend keeping your computer up to date your grandparents may have spent keeping their guns polished. And I'm sure your grandpa knows someone who treated their guns like appliances. Tossed them in the dirt, never cleaned them, let them rust, etc.

Re:They don't care

[AnalPerfume]

"People simply use their PCs (and Macs) as appliances"

That's like saying "people simply use their cars (and automobiles) as vehicles". A Mac IS a PC too, its just one where the same vendor controls the hardware, software and outlets.

Re:They don't care

[gnick]

The solution is obvious (albeit ugly). Punish the user. We are a long way from having a "secure" OS - I use Windows at work and both Windows & Linux at home and have used them for years. They both used to be swiss-cheese concerning security and both have improved dramatically, but neither are secure nor will they be any time soon.

1) Any ISP relaying openly malicious traffic needs to face consequences for it - Force them to self-monitor.
2) ISPs will start threatening users responsible for malicious traffic with disconnection.
3) Users with compromised connections will either have to start caring about security or give up Internet service.

I can feel the flames rising around me - They're welcome. As long as when you shout me down for this ugly step "forward", please present an alternative solution more insightful than "OS designers need to fix their security", 'cuz nobody's hit end-game yet. (Or "4 - ???" "5 - Profit", please... It's tired... But it did appear very recently in the WSJ as an analogy for Obama's stimulus plan - How cool is that!)

Re:They don't care

[Anonymous Coward]

If your car's brakes go out and you hit a tree, do you sue the tree? No. Do you sue yourself? No. You sue Ford. They sold you a broken product. Same with M$. They told you it worked when you bought it, but it's broken. Make M$ responsible for fixing the damed problem.

Re:They don't care

[thedudethedude]

They should have an update service, like a windows update...

Re:They don't care

[oldspewey]

They do not feel responsible for malware running on their computer.

There is one exception ... one thing that scares the bejeezus out of most people ... and that's when you tell them their computer is being used as part of a kiddie porn ring. Somehow, when people learn that their machine is being used to host images of 8-year-olds being sexually abused, they suddenly take the concept of computer security a lot more seriously.

Not that I'm advocating anybody should tell a devious lie to a friend in order to make him/her smarten the hell up ... I'm just saying is all.

Re:They don't care

[QuantumRiff]

Two words: Kiddie Porn.. First virus or worm that creates a P2P botnet for distributing Kiddie Porn, and not only will Nancy Grace and all the news channels talk about it all day, every day, but people will start getting arrested, since HAVING it on your computer is a federal crime. Then, and only then, will things change with respect to security...

Re:They don't care

[tepples]

Most virus checkers are worse than the viruses they protect you from.

Would you recommend something like ClamWin doing a weekly scan?

Re:They don't care

[element-o.p.]

It's just human nature, nothing to get upset about. The idea is basically this: is it more trouble to learn how to use a computer properly or to get it fixed when, on occasion, it stops doing what you need it to do?

Maybe. But it starts to get really tiresome when it's your spouse you are talking about (so the work is pro bono, and you *can't* just say no when they ask for help), they insist on using an OS that you don't like to administer (Windows), they insist on using software that requires admin privileges to run (Quicken, for example), they ignore your advice about having the kids use their own non-admin privileged accounts to play on-line games, etc., but they still blame you when *once AGAIN* the computer doesn't "just work" (because there are so many viruses on the machine that it takes 45 minutes just to start Task Manager).

Re:They don't care

[Cajun Hell]

They sold you a broken product. Same with M$. They told you it worked when you bought it, but it's broken.

My problem with that reasoning is that you knew they were lying. When you buy Microsoft stuff, and they say, "this works," BOTH parties are grinning and winking at each other. If you pretend that you thought it was ok to hook that computer up to the internet, then you're just as dishonest as Microsoft. So take at least some of the responsibility, dammit.

Re:They don't care

[AtomicJake]

Absolutely, and your OS should be secure, if you leave it enabled (as it was by default). Now, those damned computers get infected nevertheless. Who is to blame?

Re:They don't care

[AtomicJake]

They would however, always be very mad at me for not preventing their computers from getting reinfected. I guess they expected I would create some sort of magic barrier for them....

I quite natural assumption, don't you think?

Re:They don't care

[Your.Master]

Well yes, and one whose vendor actively differentiates themselves from PCs in all of their advertising (which is everywhere), and whose competitors do little to disabuse that notion.

In other words, a Mac is a PC which nearly everybody involved in the industry acts like a Mac is something different from a PC. You can hardly blame people for picking up on that.

Re:They don't care

[element-o.p.]

Insightful. I'll have to think about this for a while, and find a way to start putting this into practice. If I could offer one suggestion though...:

If the user's religious, invent satanic hackers.

The concept of satanic hackers seems over the top -- the threat just doesn't sound real enough. However, the threat of spammers relaying porn spam through their PCs is plausible enough to motivate a lot of religious users. If porn spam isn't distasteful enough, then ask "what if it's rape porn? kiddie porn?" That should do the trick.

Re:They don't care

[NeverVotedBush]

Your solution isn't ugly at all. I think it is necessary. People's compromised computers cost other people money and do harm in helping to spread malware, are used as repositories for stolen information, etc.

Holding users responsible probably opens a legal can of worms, but I think that is coming too. Once users are held responsible, ISPs will be held responsible - not only for the damage their users do, but also by users for letting malicious traffic to the user's computer. Software manufacturers will probably also end up fighting class action suits over security weaknesses.

But when some crime group blackmails a web site with a DoS attack, it's all the compromised computers that do the heavy lifting. There should be some responsibility there. Acting as repositories for stolen files and such should also carry responsibility.

There is a responsibility in owning a computer and putting it on the net. Everyone has sidestepped that issue for far too long. If someone's computer does me harm, then why shouldn't they be held responsible?

I think with all of the attention that cyber crime is now getting, holding people responsible to at least some extent will be inevitable. And I know there are lots of ways to hide which computers are contributing to DDoS attacks, but if a computer is discovered with lots of stolen data on it, attributing responsibility gets a lot easier.

Re:They don't care

[Sir_Lewk]

MAC spoofing is not useful in concealing your identity online. It's generally just used to bypass filtering by MAC addresses on local networks (think wifi).

Re:They don't care

[Anonymous Coward]

Whether they admit it or not, they resent finally encountering something that requires them to think, that cannot be reduced to a short list of simple steps that they can execute mechanically.

People resent having to think about SOMETHING BORING. It's not that people won't think, they just think computers are boring. It's kind of like the tax code. I resent my thinking being wasted on something so inane, but I find lots of other kinds of thinking interesting. You and I happen to think that computers are not boring, but this does not put us above everyone else. E.g. the steoreotype is that the average Slashdotter resents having to really think about how to best interact with other people... so the average Slashdotter doesn't like thinking? It's just not so.

Re:They don't care

[digitalhermit]

I fixed a computer for a family member by having it auto-boot a VMWare image. Underneath the XP client, the machine runs CentOS 5.3 with the latest VMWare server. It's configured to automatically use a snapshot image so the original image is never touched. If there's a problem it's a simple matter of rebooting and selecting a revert option. Once it boots, it autologins as a non-priv user and starts the guest then opens the console (google the VMWare forums for instructions on doing that).

Re:They don't care

[Runaway1956]

Yes, exactly.

ME: Ya twit, you've been browsing half the porn sites on the web, and downloading EVERYTHING - here are the logs. Here are 50 sites that have made various black lists because of malware. And you have NO security policy or applications.

TWIT: Don't tell my Mama! Can you just fix it?

ME: Of course, I can "fix" it, but YOU have to "fix" the way you browse the internet. Let me install apps x, y, and z, along with an antivirus, and I'll fix the hosts file, and download some black lists.

TWIT: Will I still be able to download my porn? I really like these sites, L, M, N, O, P.

ME: No, those sites are all in the black lists - those are the sites that infected your computer!

TWIT: Oh, well, don't bother - just kill the viruses and give me back my computer.

Seriously, that isn't word for word, but it reflects real conversations that I've had in real life. Go figure.........

Re:They don't care

[jonbryce]

Only problem is they will now ask why their iPlayer and YouTube videos look like slide shows.

Re:They don't care

[The MAZZTer]

I was just fixing someone's computer from a hard drive failure (was able to rescue all the important stuff off of it) and he has norton with an expired subscription, and it displays a pop up asking you to resubscribe every day. That's not too far of from malware that pops up ads on your desktop.

Re:They don't care

[Runaway1956]

"The solution is obvious (albeit ugly). Punish the user."

Agreed, in principle. Failure to take appropriate steps to secure you machines should result in liability of some sort.

How to enact such a policy, though? Do we fine the owner of every machine that belongs to a botnet? How much, $100, $1,000? Plus a court order that their machines be disconnected from the internet when not in actual use, AND prove to the court that an effective countermeasure has been instituted to prevent future instances?

Sometimes, the idea of licensing doesn't seem so bad. PROVE that you are competent to run a machine, and meet minimum standards before you can connect your machine to the internet.

That one certainly won't fly though - people are to used to chaos and anarchy. Voters never vote for responsibility, they would rather find someone to blame.

Re:They don't care

[bill_kress]

What motivates me is the fact that they can install a keylogger and scan for passwords after you type something like "wamu.com". Since I don't trust ANYTHING to detect rootkits, I've just completely stopped using windows to access anything financial... No credit cards, nothing.

Not that Linux/Macs are invulnerable, but at least they don't default to a state equivalent to the swiss cheese of security.

Re:They don't care

[PReDiToR]

When the authorities come knocking on your door asking to see the computer equipment with the MAC that did something naughty you have plausible deniability if they can check all your machines for a MAC that you don't own.

Just try and find one that actually exists; 12:34:56: ... isn't going to cut it.
For bonus points grab the MAC of a neighbour's laptop and say they must have tapped your WiFi when you had it open after a firmware update.

Your WiFi, their equipment, no trace of the activity on anyone's PC. They go away unhappy after spending yet more of our tax $currency on something stupid instead of catching people who are committing real crimes involving violence and actual physical theft.

Re:They don't care

[Anonymous Coward]

It's just human nature, nothing to get upset about. The idea is basically this: is it more trouble to learn how to use a computer properly or to get it fixed when, on occasion, it stops doing what you need it to do?

Maybe. But it starts to get really tiresome when it's your spouse you are talking about (so the work is pro bono, and you *can't* just say no when they ask for help), they insist on using an OS that you don't like to administer (Windows), they insist on using software that requires admin privileges to run (Quicken, for example), they ignore your advice about having the kids use their own non-admin privileged accounts to play on-line games, etc., but they still blame you when *once AGAIN* the computer doesn't "just work" (because there are so many viruses on the machine that it takes 45 minutes just to start Task Manager).

Aren't you glad you married an understanding woman you can talk to? Oh, wait ...

Re:They don't care

[Anonymous Coward]

Try installing VMware tools =)

Re:They don't care

[mccrew]

People simply use their PCs (and Macs) as appliances, with no thought whatsoever of using it *properly*

I wonder why people would use a computer as an appliance.

I would turn the question around. Why shouldn't people expect their computer to be a reliable and secure appliance?

If we, the technorati, keep insisting that computers and networks are somehow special and require special handling, then all we are doing is turning a blind eye to avoid seeing our own failures. Notice the trend to more appliance-like devices in both the desktop and mobile realms that run their OS out of firmware.

Customers are trying to tell us something. Are we listening?

Re:They don't care

[JayJay.br]

Spot on.

Can I have the car analogy for this one please?

Maybe we should have a "computer driver's license" so people with computers learn at least the most basic things about 'driving' and maintenance.

Re:They don't care

[gnick]

Sometimes, the idea of licensing doesn't seem so bad. PROVE that you are competent to run a machine, and meet minimum standards before you can connect your machine to the internet.

That gave me chills. I'm kind of an anarchist at heart, but licensing for HAM radio operators seems to have gone mostly OK... And abuse is punishable... What's the big difference between the RF spectrum and the Internet? Rampage traffic affects legitimate users... I'm torn.

Re:They don't care

[orange47]

sure, but do you want to spend your whole life securing the computer, polishing the car and always driving under the limit? we are all going to die some day anyway.

Re:They don't care

[Junior J. Junior III]

If the user's religious, invent satanic hackers.

The concept of satanic hackers seems over the top -- the threat just doesn't sound real enough. However, the threat of spammers relaying porn spam through their PCs is plausible enough to motivate a lot of religious users. If porn spam isn't distasteful enough, then ask "what if it's rape porn? kiddie porn?" That should do the trick.

You're quite right, but that was supposed to be the +1Funny portion of the post. I guess I was too subtle:)

Re:They don't care

[Zumbs]

Some time back, a Danish bank blocked the access of 8.000 internet bank users, as the bank could link their computers to ip adresses that might be infected by a trojan. They suspected that the trojan could be used to get access to the bank accounts of the 8.000 users. Thus, they sent (snail)mail to the customers in question that told them that they had to reinstall Windows before they could do their banking online again.

Re:They don't care

[cbiltcliffe]

This will only work if you're on cable, and don't use a router. And even then, I'd question it's reliability. After all...law enforcement isn't really known for being technologically savvy. Some of them are, certainly, but I wouldn't want to bet on it.

On DSL, on the other hand, you've got to send a username/password to connect.
Doesn't matter a hoot if you change your MAC address or not...the password still says who you are.

And you obviously don't know much about low level networking. If you have a WiFi router, then the only MAC address the ISP sees is the one of your router. They don't see anything on your local network. So your neighbour can tap in all they want, and your router MAC address is still the one going to the ISP.
MAC addresses stay on the local network segment.

Re:They don't care

[Ezrymyrh]

I too had this problem for a long time with people asking me to *fix* their rigs, and in every case it was dumb security practices that got them compromised. Then i realized i was being an enabler and i cant help them all, started telling them i was retired and they would have to fix it themselves. About 1/3 did nothing, Or bought another computer. And the other 2/3 either found another sucker to fix it for them. Or *Gasp did it for themselves...

Re:They don't care

[somersault]

If it was an actual known problem for that model and Ford didn't do a recall, then of course. But it's more likely someone cut your brake lines, or you didn't get the pads replaced and wore through the brake discs, in which case it's the users fault for not checking their brakes before driving off, and keeping their car well maintained.

Re:They don't care

[Clover_Kicker]

Aren't you glad you married an understanding woman you can talk to?

Where the hell do you find one of those?

Re:They don't care

[cbiltcliffe]

If you get a notice of a safety recall for your Ford's brakes, and you choose to ignore it and not get it fixed, then months later your brakes go out and you hit a tree......guess who's responsible?

I'll give you a hint. It's not Ford.

Re:They don't care

[Runaway1956]

I said "Sometimes," you said "I'm torn."

It seems we both see the pros and cons. There is no easy solution - someone is going to get burnt, no matter what. Eventually, somehow, Joe Sixpack is going to have to assume responsibility for his machines - either voluntarily, or by legal mandate. Voluntarily would be best of course, but I have little faith in human nature.

Re:They don't care

[PitaBred]

I see a job as a BOFH for you in your future, if you aren't one already...

Re:They don't care

[ae1294]

I quite natural assumption, don't you think?

Not sure if you are joking or not. If not yes I installed whatever antivirus or spyware scanner that was free and/or tried to get them to pay for one before they where good free ones like AVG. (yes yes AVG isn't that good compared to kaspersky or f-prot.)

We are talking 1999 to 2006 so VM's where not an option plus people probably would get mad when they have to keep reinstalling that new codec to view their pogo.com site or that porn.avi.exe file.

The store I worked at really tried extremely hard to help people and we bent over backward to explain what happened and how to prevent it in the future. It was a small local store so that is a requirement to stay in business or it was in Virginia Beach...

Really doesn't mater though if people choice to ignore you and still like the "punch the monkey" game and bonzi buddy's.

Re:They don't care

[PitaBred]

But you don't actually DO anything when you fix a computer. I mean, at least a mechanic takes parts out and puts them back in. You just click on things. That isn't real work!

The people smart enough to know that knowledge is worth something aren't the kinds of people who end up having to pay to get their computers fixed.

Re:They don't care

[PitaBred]

I just watched a Youtube video in my VirtualBox XP machine, and it was fine. If you install the VMWare/VirtualBox tools, the performance goes way up. Hell, I host netmeetings with enterprise java apps shared in my virtual machine all the time. Works fine.

Re:They don't care

[DRAGONWEEZEL]

It's your responsibillity to pull the ebrake, reduce the gearing, come to a controlled stop at all speeds. Even if the manufactuer is responsible, it's kinda your fault for not being able to maintain control of YOUR vehicle. The owner of that pole is coming to you first, which if you are insured will be defered to your insurance carrier who will then determine if they eat it cause it's your fault, or go after the manufacturer. I'm a huge car guy, and maybe I expect too much from people. There is a reason when my car was stock that my brakes and suspension where the first parts to get upgraded though.

Also what happens if in your example it's because of poor maintenance? Which is more akin to the computer world. AV not running, no firewall, updates not installed due to fear of big brother, putting in dirty fuel (downloading everything P2P has to offer) Even the most greedy windows geek who was like that 10 years ago has changed, or atleast recomends Autoupdate for clients when the situation allows (not talking about servers here)

It's like the old "My throttle got stuck" excuse. really? turn the key off, or throw it in Neutral and blow the engine! don't risk the lives of others and try and brake against it or get it "unstuck." You work on it AFTER you and others are safe.

Same as a comp really. Lock your firewall down (no in/ out) and boot into safe mode (on win) or recompile, or whatever you gotta do for linux.

You bought the car AS IS w/ no warranty expressed or implied. Neither windows nor linux has a warranty or guarantee, (I know both are waranteed by other companies, when embedded) it's a matter of doing the best you can w/ what you got.

I don't pretentend to be the master of windows security, but if you don't want to lock your doors, install a security system or change your oil, and you don't want to pay me to do it, don't come to me when it breaks or is stolen w/ an empty wallet and a tear in your eye.

Re:They don't care

[PitaBred]

A computer is not an appliance because it doesn't do a single thing. With complexity comes fragility. That's inescapable. The more complex, new engines are harder and more complex to repair and maintain. But they're more efficient and such. Same thing with computers... a computer unconnected to the Internet that only runs one app is perfectly reasonable to treat like an appliance. Think a POS (Point-Of-Sale, not the other POS...) register... it works just like an appliance. Hell, even game systems... a PS3/XBox/Wii is an appliance. Very few options and configurations, the environment is very controlled. And you still get periodic game crashes.

The only way to make a computer an appliance is to remove flexibility. Just like security... it's a balance. Do you want ease of use, or strong security? Do you want an appliance computer, or do you want a flexible, multifunction machine? You can't have both at the same time.

Re:They don't care

[cayenne8]

"...Obama's plan for the future."

Plan?? Spending even MORE money that the US doesn't have? What's to analyze?

Re:They don't care

[mrrudge]

Let's have a car analogy !

Say someone goes around putting tiny holes in a large amount of gas tanks, ( syphoning a little each time, a very experienced driver may notice ) and then one day runs around using these pre-prepared holes to collecting a large amount of gas and burns a school to the ground, before disappearing almost completely.

You think the car owners should be held responsible ? This seems like attacking the victims( they've had bandwidth and cpu cycles stolen, have no knowledge, no intent ) of a crime because you can't locate the perpetrator ?

Re:They don't care

[Dragee]

And you obviously don't know much about home routers. Many of them come out of the box with the ability to spoof the MAC address that the ISP sees. I believe that was what was being referred to, not spoofing internal MACs.

Re:They don't care

[Culture20]

If we, the technorati, keep insisting that computers and networks are somehow special and require special handling, then all we are doing is turning a blind eye to avoid seeing our own failures. Notice the trend to more appliance-like devices in both the desktop and mobile realms that run their OS out of firmware.

Customers are trying to tell us something. Are we listening?

But... computers are special and require special handling. Is there any other device in modern or ancient life that's used for more things? I might say the wheel or the knife, but beyond that, I can't think of anything. The wheel's pretty innocuous unless you put them on a big metal thing that moves fast. Knives, however, require special training. You probably don't remember it, but your parents were constantly guiding you and watching you while you used knives for the first time. Even as adults, people make stupid mistakes with knives: grabbing at a falling knife out of reflex, cutting themselves while peeling fruit, threatening someone who has a concealed-carry license. And computers can do a lot more stuff (some that seems to have no relation to computing) than any wheel or knife.

Customers are trying to tell us that they like GPS computers: it only does GPS. They like set-back thermostats: it only regulates temperature. They like Tivo: it only records shows. They like their car's computer: it computes gas mileage for them. They like their Wii: it plays games. But you had better not mess with their Office 2007 machine, because it has all their unencrypted income tax data on it, and little Billy likes to use it to play the latest FPS which requires quite a few open ports, and to be run as Administrator.

Re:They don't care

[austin987]

For what it's worth, at my university, if you connect a computer that's spewing out spam or some other detectable network sin, it cuts off your service and redirects all HTTP requests to a help page explaining the problem, with a download of McAffee available to clean it.

Once you've ran it and cleaned up, you can put in a request to re-enable network traffic.

It's a quick bastard too. I hooked up my cousin's computer to do some diagnostics (behind my router, so I could send some files over the network), and my Linux box had it's access cut off within minutes.

Re:They don't care

[cbiltcliffe]

Happened years ago. Didn't make a peep of difference.

Re:They don't care

[cbiltcliffe]

it's your spouse you are talking about (so the work is pro bono, and you *can't* just say no when they ask for help),

Why not? Might solve two problems in one. :)

Re:They don't care

[Anonymous Coward]

So... you blame windows for your lack of balls and inability to stand up to your wife?

RE: Your quicken problem: Are you too stupid to do a google search? It is simple to fix this by giving specific permissions to a non-admin user for Intuit registry keys. Either way, not a windows problem, it is Intuit's crappy design.

RE: Your kids: Why do they even have admin access? Stop giving them the password. Stand up for yourself and lay down some rules.

Re:They don't care

[ae1294]

We are talking about a few years ago before VM really was something you could deploy but yes I enjoy using it to test crap before installing it, although I am about to begin switching over to a linux Desktop and just dumping most of my Windows XP apps. I don't play games anymore and from the sound of it open office is good enough now and whine should run my quickbooks 2003 or I can change to the open source clone if not as quickbooks is bloat code.

Really the only program I paid money for that is something I'd like to run is anyDVD HD and they deserved the money. I've never seen anyone release updates every 2 days. Well I guess I paid for adobe acrobat pro as well... I tried the other pdf programs and just didn't find anything good enough for me. Not that acrobat pro isn't damn annoying to use and the whole javascript feature is a joke. I guess I will have to look at everything when I finish my switch. O I paid for winRAR as well... good program.. I hear 7-zip is good enough though and honestly there might be a winRAR for Xfree... haven't looked.

Any advise for good apps for linux out there? I mostly use my computer for annoying slashdot, adding dvd's to my media computer, quickbooks, writing stuff, spread sheets, ftp, torrent, burning cd's / dvd's, some coding and mostly boredom.

Current list:

1. Open Office
2. Handbrake
3. GIMP
4. Audacity
5. VLC Media Player
6. Q7Z
7. DVD writing software for xfree?
8. I've used Debian for years, so what's up with ubuntu anyhow?

I've always stayed away from xfree as the console has always gave me a warm fuzzy feeling like when I was young and had a shell account and a 14.4 modem.... but I'd like to keep the graphical interface to avoid thinking as that is what the government commands.

Re:They don't care

[Phreakiture]

Actually, it's more like saying "video and DVD" or "Cars and Fords" or some such case where the "first" or "most popular" player gets called by the name of the superset. It's pedantics, really

That said, the Windows/Linux running, generic-hardware, Intel/AMD/Via-powered computer is a descendant of a clone of a descendent of a computer made once upon a time by IBM called the IBM PC. Hence, the PC is capitalized, not because it is an abbreviation, but because it is a proper noun. It is akin to "Libertarian" meaning the party, versus "libertarian" meaning the idealogy. Yes, a Macintosh is a "personal computer", but no, it is not a "Personal Computer".

Re:They don't care

[eldorel]

A Mac IS a PC too, its just one where the same vendor controls the hardware, software and outlets.

A NEW Mac is a PC. but PC != Mac, until very recently.

The term Personal Computer (PC) was/is? trademarked by Tandy Corp for their IBM clones.
PC has been used as shorthand for IBM compatible Personal Computer for the past 28 years.
Hence the terms IBM/PC, PC/DOS, etc.

Meanwhile Macintosh computers were not IBM compatible until a three years ago, when they switched to Intel processors. Meaning that you could not use PC accessories, software, or hardware on a mac.

As for the predictable "things change, keep up", old habits die hard, and some of us still support Powerpc networks.

Re:They don't care

[PitaBred]

They aren't common, but I've found that book stores and other intellectual draws are a good place to start.

Re:They don't care

[PitaBred]

I think traffic laws are boring. I still learned them so I could get along with the other drivers on the road. Just because people don't WANT to do something boring doesn't mean that they shouldn't be required to.

Re:They don't care

[Anonymous Coward]

They were a little presumptive in their choice of OSs to "reinstall." Weren't they?

Lather. Rinse. Repeat.

Re:They don't care

[causality]

Whether they admit it or not, they resent finally encountering something that requires them to think, that cannot be reduced to a short list of simple steps that they can execute mechanically.

People resent having to think about SOMETHING BORING. It's not that people won't think, they just think computers are boring. It's kind of like the tax code. I resent my thinking being wasted on something so inane, but I find lots of other kinds of thinking interesting. You and I happen to think that computers are not boring, but this does not put us above everyone else. E.g. the steoreotype is that the average Slashdotter resents having to really think about how to best interact with other people... so the average Slashdotter doesn't like thinking? It's just not so.

I'm sorry, because it gives me no pleasure to say this, but the mentality you just described belongs to a bunch of overgrown children who call themselves adults. That's the real reason why technical advances alone have not made this problem go away.

It's a package deal. That "something boring" is inseparable from the things they really want to do. It takes a lot of immaturity to fail to recognize this and to be unwilling to deal with it even if that unwillingness causes you or others to suffer, which insecurity certainly does. I'll put that another way. You may resent the tax code, and I'd agree you have lots of valid reasons for doing so. But you still handle it, you still pay your taxes, you still file you return. Why? Because you have a responsibility. Because you know bad things will happen (i.e. the IRS coming after you) if you don't. I know bad things will happen if I fail to secure the machines I put on the public Internet. That has been proven again and again with the examples provided by those people who didn't think security was important. I would have no excuse for failing to take reasonable measures to take care of it and my personal feelings about this reality are quite irrelevant.

"Boring" versus "exciting" is valid when you're talking about preferences. It might determine what movies you want to watch or which books you want to read, because with movies and books generally all of your choices are morally equivalent, so it really is just a matter of taste. The failure to recognize when you are dealing with something that is not simply a matter of taste, where one choice really is morally and pragmatically superior to all other choices, is a personal shortcoming. That's why I spoke about this in terms of a character weakness. You seem to think you are explaining something to me that I didn't already know. I am well familiar with what you are saying, I just think it's completely invalid and unworthy of the "excuse" status you seem to want to give to it.

The thing is, right now there is so much low-hanging fruit that you hardly need to be an expert to avoid the vast majority of attacks. The respectable decision-making would be that if you don't want to deal with learning a few new things and don't want to become familiar with the basic steps needed to make yourself a much harder target, then maybe connecting a machine to the Internet isn't for you. There are things I don't get involved in that would be nice, except that I know I don't want to take the time and effort to do them properly. There's nothing wrong with that. If you think being on the Internet IS for you, and you really want to be there, that's good too. Ideally, lots more people would use and enjoy it. Just do it right and don't make the network a worse place for everyone else because of your negligence.

I don't think this concept is hard to understand at all. I think you just don't like it and want an easy way out of it. The funny thing about that, is that if all of the effort spent coming up with excuses and defending personal negligence were put towards securing systems and networks, we'd have already made tremendous progress. I make only one assumption there: that the most average people can astound you with what they can accomplish if they really want to. They just need to get over the ways in which they are their own worst enemies, and that mentality you described is one of the biggest.

Re:They don't care

[PitaBred]

"Ok, because you refuse to follow my advice, I'm going to have to charge you double my normal rate for fixing this machine. And I'll require payment in cash."

If they're a pain in the ass to you, be a pain in the ass to them. Once they have enough problems (or not enough money), they'll start figuring things out out of necessity to get their porn.

Re:They don't care

[cbiltcliffe]

And how does spoofing your neighbour's MAC address, claiming that he "tapped your WiFi when you had it open after a firmware update" sound plausible, if you spoof that MAC address into your router?

It doesn't. Because the wireless MAC of your neighbour will never, ever, under any circumstances, ever be seen by an ISP.

I know you can change MAC addresses in home routers. I'm not an idiot.

I can also think enough to know that "it musta been sumbudy else" isn't going to cut it as an alibi.

Re:They don't care

[Capt.DrumkenBum]

"You just click on things. That isn't real work!"
I had someone say that to me. My response was to stand up, collect my things, and silently walk out.

Re:They don't care

[Anonymous Coward]

This anecdote is on a small scale but since I am my entourage' little computer helper, a couple of days ago I rebuilt a computer illiterate friend's laptop. Installed XP, configured it to the bone, removed IE and installed Firefox with a few useful plugins. I explained to him that it is wiser to use Firefox and took the opportunity to give a little security crash course... I just came back from his place (BBQ and Corona were tasty :) ) and what have I seen? The little IE fucker was back on. I asked him why? He just told me he is so used to it and that was that. He also bought a new wireless router. I asked him if he was able to set it up and secure it. He told "yeah, no problem I plugged it in and the laptop synched to it". It was my eyes that were glazing over and I was the one looking for an escape.
People just don't care, don't listen.

Re:They don't care

[maugle]

Somehow, when people learn that their machine is being used to host images of 8-year-olds being sexually abused, they suddenly take the concept of computer security a lot more seriously.

Not that I'm advocating anybody should tell a devious lie to a friend in order to make him/her smarten the hell up ... I'm just saying is all.

There's absolutely no reason to lie to your friend in the name of security.
Just compromise his machine and put some kiddie porn on it. For bonus points, notify the FBI and wait near his house with a folding chair, some soda, and a bag of popcorn.

...or was that what you do to enemies? Crap, I have some apologizing to do.

Re:They don't care

[BronsCon]

Well, if there was a widely advertised and discussed "gas tank shield" that their mechanic friends kept telling them they really HAVE TO HAVE INSTALLED to protect them from such an occurrence... and when such protection can be HAD AND MAINTAINED FOR FREE...

I say, at that point, yes.

Re:They don't care

[BrokenHalo]

Holding users responsible probably opens a legal can of worms

It sure does. But if we were to enforce a policy that owners of infected or owned systems were to be shot (at one end of the scale) or spend a few days in the pillory (as a more lenient option), I suspect that people would be inclined to take a bit more care.

Maybe we need to introduce something like the principle of a driver's licence, where it is assumed that it is a privilege to use the internet, not a right.

Re:They don't care

[Anonymous Coward]

Fucking brilliant. I'll remember your post until the day I die (or stop having to do tech support for friends & family) -- thanks a million.

Re:They don't care

[Anonymous Coward]

I guess it would be safe to say that you're a BOFH.

It's probably more accurate to drop the 'O' part...

Re:They don't care

[Anonymous Coward]

I do it all the time. I don't say *you are* hosting CP, but I will tell them, "For all we know, you've been hosting CP this whole time you've been infected."

They tend to stay on top of security after that.

Re:They don't care

[PrescriptionWarning]

The ISP at my university when I attended and was in the dorms would actually detect if your computer were compromised and was sending out spam or whatever, and they would turn off your ethernet connection at your room wall port until you proved that your computer had either been cleansed or until they sent one of their own IT guys to try to clean it for you. Taking this to a broader scale to consumer ISPs is really the only best way to treat this by centralizing the responsibility. Of course if not handled properly it will likely piss tons of people off, and may even get false positives so it must also obviously lean towards leniency.

Re:They don't care

[Jaysyn]

Can't you just allow her non-privledged account access to the appropriate keys in the Windows registry? I know that works fine for older version of AutoCAD.

Re:They don't care

[Rastl]

Ah, time for the old mechanic joke. To summarize.

Yuppie takes his car to the mechanic. Mechanic spends 30 minutes looking over the car and then smacks it with a hammer. Car is working perfectly.

Yuppie complains about the bill. "You just whacked it with a hammer. I could have done that for free!"

Mechanic smiles knowingly. "The bill is for knowing where to hit it."

Same thing with doing computer work. Sure we're just pointing and clicking but we know where to point and what to click.

Re:They don't care

[Kayden]

My first car analogy on Slashdot! I think it's more like driving around in your car with people in the back seat shooting guns out the window. Sure, you're not pulling the trigger, but they're still racking up collateral damage via your car.

Re:They don't care

[Hyppy]

How about a gun analogy instead?

Let's say that you leave a firearm within reach of your child. It does not have a trigger lock and is not in a safe. You, however, at least took the care to teach your child about the weapon and the safety and care that must be taken with such a device.

One day, your child's friend comes over to play, sees the firearm, and decides to play with it. 5 minutes later, 3 neighborhood children are dead.

You don't think you would be blamed? You have no knowledge or intent. Why must you be bothered with purchasing and employing additional security measures?

Re:They don't care

[sexconker]

1) Fix the systems with important information.
Banks and online stores need to be as secure as possible.
2) When shit happens to frivolous shit like Facebook, just shrug and say "No shit, your ass got infected from all teh pr0n and WaReZ."

Side note: Someone got my credit card info somehow and used to pay a $253 electricity bill in Illinois (I am NOT in Illinois) and tried to buy plane ticket(s) for $185 this morning.

I disputed the first claim the day it showed up, and got it removed.
I got a call today about the charge for airline tickets. The charge was auto-denied by the fraud detection algorithm, and they're sending me another card.

Who the hell pays an electricity bill (tied to a PHYSICAL address) with a stolen credit card? Who the hell has a $250 electricity bill?
I wonder if the moron will try to use it again and get arrested.

Re:They don't care

[EdtheFox]

...Make M$ responsible for fixing the damed problem.

Good luck with that! NO. It's YOUR fault for accepting the EULA. It's the Lawyers man. They mess up [almost] everything

Re:They don't care

[CorporateSuit]

I can't explain to you the amount of horrible that idea is. You seem to think that ISPs and telecoms are some of the most honest, upstanding companies on the planet who are not in the business simply to make money for the least amount of service they can legally provide, but to provide a dedicated service to their community -- like garbage men or the post office.

You'd be asking the foxes to guard the henhouse. They don't want to cut off peoples' internets because that's how they make money. Instead, they'll simply throttle your service. They'll inject ads into your websites, they'll charge more and give you less. These are the same corporations that managed to prove, within the last year, that the grand majority of congress cares more about them than the constitution.

This would be tantamount to giving every highway construction company (the ones who take 6 years to rebuild 3 miles of freeway for $500 Million of your state's budget) police rights, and say "Make sure nobody speeds on this new freeway -- if you catch anyone speeding, you can take their car, and it's up to you to come up with ways to figure out if people are speeding." Bad Idea.

Re:They don't care

[Endo13]

No. You sue the crook who cut your brake line. If you can't find him, well, tough luck. That's still not Ford's fault. Unless you're trying to suggest that it's actually possible to create a brake system that could never be compromised by a malicious individual?

Re:They don't care

[Hyppy]

All I could think of while reading that was a giant, blinking "HERO" tag from Fark.

If more private companies took initiative like that bank, then we wouldn't even be discussing trying to pass laws like this

Heck, it would only take 1 company. Imagine someone being served with "Your computer is no longer welcome to access Google's servers. Goodbye."

Re:They don't care

[Hyppy]

With friends like that, who needs enemies?

Thanks, I'll be here all week.

Re:They don't care

[Erikderzweite]

Computer repairman doesn't get paid for clicking. He gets paid for knowing where to click, a knowledge his customers usually lack.

Re:They don't care

[mpe]

Can't you just allow her non-privledged account access to the appropriate keys in the Windows registry? I know that works fine for older version of AutoCAD.

How much help are you likely to get from the vendor to identify which registry keys/files are involved? (Assuming they don't just say "unsupported". Or don't even know how their own software works.)

Re:They don't care

[HeronBlademaster]

To enforce that you'd have to do something like this:

1) Government agency issues "Internet Use License"
2) ISPs require a login based on said IUL to connect

problems:

1) IULs would have to be OS-specific - a person who can safely use OSX online may not know how to safely use a WinXP machine online (similar to how you need a separate license for a motorcycle, passenger vehicle, or semi)
2) Requiring a login against a governmetn database allows the government to track internet use on a per-user basis - i'm not much of a "big brother" conspiracy theorist but I'm not comfortable with this idea.

Re:They don't care

[Hyppy]

Ubuntu is basically Debian, repackaged. Slightly less stable, but it usually has more of the latest packages.

Re:They don't care

[Hyppy]

I'm not sure if I'd be that nice about it. "Accidentally" clicking something devastating would probably come before step 1, at the very least.

Re:They don't care

[Anonymous Coward]

This would be tantamount to giving every highway construction company (the ones who take 6 years to rebuild 3 miles of freeway for $500 Million of your state's budget) police rights, and say "Make sure nobody speeds on this new freeway -- if you catch anyone speeding, you can take their car, and it's up to you to come up with ways to figure out if people are speeding."

I tried to come up with an analogy for just how bad this analogy is, but I failed. There is no expressing how far off base you are and you're so far from being understandable that I can't explain to you the number of ways that you're mistaken. (Stealing cars == Abandoning paying customers???)

Are you perhaps drinking?

Re:They don't care

[SkyDude]

Or talk to someone like that about security. Watch as their eyes glaze over and they look for a way to escape.

Just tell them that the next time they get acquire a PC virus, having one repaired at a shop is going to cost them more than $90. That may help sway their thinking.

Of course, mom might start charging you for dinner.....

Re:They don't care

[HeronBlademaster]

The biggest problem I see with licensing internet use is that it can quickly turn into licensing operating system use. As I mentioned in another reply, a person who knows how to safely use OSX online may not know how to safely use WinXP online.

There are also other variables to consider. Do we bother requiring licenses for users who are on dialup? Those users will be of little value to botnet operators, as they're not online often and their connections are slow.

What about people who just want to check e-mail, but logically shouldn't be required to have the knowledge necessary to maintain a Windows machine and keep it up to date? (I'm thinking about Grandma.) Granted, Grandma isn't downloading the latest movie or the newest leak of the latest commercial game via P2P - but she's still susceptible to OS vulnerabilities while she's online. Should we grant exceptions in such cases?

What about allowing someone a license given the promise that someone else will be maintaining their machine (be it the Geek Squad or the neighbor's 13-year-old daughter)? Does that then mean we need two levels of licenses, one for maintainers and one for their clients?

We could start talking about the "big brother" worries, too, where the government would be able to track people's internet use (because to log on you'd need to hit the government server to valid your credentials).

And what about foreign countries? Do we require them to get US-issued licenses, or do we require each country to issue their own? How do we handle foreign visitors?

Licenses in this context are far from a simple idea.

Re:They don't care

[element-o.p.]

Trying to keep her Windows computers functioning is a bit of a PITA, but overall, she's worth it. Not even a question, there :)

I guess that means I really don't have anything to complain about after all... However, in light of this thread, I couldn't help but notice your /. sig!

Re:They don't care

[Capt.DrumkenBum]

I doubled my hourly rate to come back and finish the job.

Re:They don't care

[HeronBlademaster]

I'm sure they assumed that someone infected with a trojan is probably not running Linux or OSX or *BSD or what have you.

Re:They don't care

[HeronBlademaster]

I remember getting a phone call from campus IT telling me they'd blocked one of my spare computers for the same reason. Somehow it got infected in the day or two between setting it up and bothering to install antivirus software...

Re:They don't care

[sopssa]

Having "gas tank shield", or antivirus and firewall isn't required by law. And most "normal" people dont really care either.

Also, intention usually counts a lot in crimes. Judges nor the layman (or what are those called in usa again) aren't usually really computer oriented, and they can see that user didn't have bad intention but the actual bad guys had.

Hell, even usa gov networks are hacked all the time now. Would you sue them for not securing them correctly? Would you sue car owner for not having 10m armored wall around the car when they park it?

Re:They don't care

[Kral_Blbec]

Offtopic warning

I know what you are implying, but IMO it is more the fault of the other parents than the gun owner. He took the steps to teach his kid gun safety and that was obeyed by his kid(s). The other parents (assumingly) just told their kid "guns are bad, dont touch" and left it a mystery.

Kids and guns have been together safely for centuries because they were taught how to use them as the tool they are. Your gramps probably got his first gun before he was a teenager. Its only a modern phenomenon that they have been demonized by left wingers.

Re:They don't care

[sopssa]

Yeah, because having random malware on your computer and 3 kids dead is the same thing.

Re:They don't care

[sopssa]

Sorry to say it, but you are the kind of lying person I wouldn't ever want to be a friend with.

The idea of pushing your agenda *by lying* about it is just wrong.

Re:They don't care

[Hyppy]

Oh, so it's not a PC because it doesn't run on x86 hardware?

Oh, wait...

Re:They don't care

[AnalPerfume]

I had no idea PC was trademarked by anyone, wow.

My use of the term "PC" is "personal computer", a computer which can be personalized to the users needs in terms of added software / hardware / layout / workflow etc, rather than a generic all-singing-all-dancing computer with every application known to man and beast pre-installed requiring a mortgage to pay for all the licenses, even if you only need it for a couple of functions or a specialized computer built with one function in mind like a word processor which does nothing else.

It's arguable how close either Windows or OSX meets that definition as they don't allow you to modify the default look and feel all that much as they have corporate branding to protect. They want their product to be recognizable at a glance. Both Apple and Microsoft believe in licensing software rather than selling it to the customer, where they retain rights or restrictions on it's use. If you don't own it, can it really be your personal computer? If there are corporate restrictions placed on it's use can it really be your personal computer? If there's a kill switch inside it that you can't remove, remotely controlled by the vendor can it really be your personal computer?

I'm guessing the term COC (Corporation Owned Computer) wouldn't be so easy or positive to market, aside from drawing the ire of the Ubuntu community for taking the CoC (Code Of Conduct) abbreviation.

All of that aside, Apple have gone to great lengths to be seen as a separate thing from a PC and it's worked. The mass mindset believes them to be two different things. They also won the iPod war too by getting in early with a slick device to the point that people talk about their mp3/4 players and call them iPods when they are not.

Re:They don't care

[mlts]

3: The people doing the computer compromising will just compromise the IUL, and use the license granted to Aunt Tillie so she can use Windows XP. The black hats then get free reign under a legal ID, and someone else takes the blame, perhaps a prison term.

I like the idea of having a civilian version of a CAC so one can use their client certificate (stored on a tamper resistant cryptographic token or a cellphone) instead of usernames/passwords that are intercepted by keylogging software. More points if there is a way to enter one's PIN on a device not connected to the computer, so a compromised computer can't obtain anything pertinent about someone's client key or unlocking PIN.

Best of all worlds would be a device similar to what IBM prototyped that would communicate with the bank via SSL so one can see what he or she is transferring and approve/disapprove so there is protection against active man in the middle attacks.

However, I don't like the idea of forcing people to have some type of number or identity to use the Internet. Its just too juicy a target for compromise, and would not do much in stopping the problem.

Re:They don't care

[bwchato]

Over the years I've offered help staying secure to friends, co-workers, etc. and I've learned that they just don't care. Most people only want help in one situation- when they have a virus that interferes with their computer working properly. Then they want it removed so they can go back to doing all the stuff that got it on their machine.

If you don't believe me - tell someone who isn't a tech person to go read this blog post. A week or two later ask them if they read it. I'm gonna go out on a limb and say over 90% wont.

Or talk to someone like that about security. Watch as their eyes glaze over and they look for a way to escape.

i know exactly what you mean.I keep a bunch of different peoples computers up and running and when i ask when was the last time you did this,they usually say weeks to never.even when i assure them it needs to be done a lot more often they say ok and don't do it again.One did'nt have the firewall i installed because they said it stopped them from doing something,i told them to ask and i would reconfigure it.they just don't care as long as it works

Re:They don't care

[Jaysyn]

You open the registry in regedt32, back it up, find all the Quicken sections & make them so a normal user can access / write to them. This may not fix your problem, but I have used it to fix other badly written programs & games. YMMV.

Re:They don't care

[mlts]

I know Cisco has the NAC Appliance (formerly CleanAccess) which does exactly this. This functionality can be coupled with Windows Server 2008 domains to point infected machines to a remediation server to get cleaned up and some decent A/V software installed.

In a business, the NAC (network admission control) functionality can also be used to enforce having various programs present on a machine, such as PGP Universal, Symantec Endpoint Protection, and others.

Re:They don't care

[Anonymous Coward]

"The solution is obvious (albeit ugly). Punish the user."

I don't think punishing the user is quite the answer, but informing the user would be good.

"3) Users with compromised connections will either have to start caring about security or give up Internet service."

My linux box got hacked into once while I was in college (I did something silly like thinking I had Redhat 5.2 instead of 5.1, and missed an important patch). I got an email from ITS within 12 hours informing me that my computer was generating malicious traffic and would be blocked until I could fix it. So, I found the damage, reinstalled, patched, and got it unblocked. The embarrassment is enough to make sure you update carefully from then on.

The problem, though, is ... is it generally possible for the ISP to distinguish malicious traffic from normal traffic? In my case, someone saw they were getting portscanned from my computer and emailed ITS...who then passed it on to me. But is it possible to automate that? Modern root kits can be very subtle. Or suppose I ask a friend to portscan my computer so I can test my firewall. Is that going to get him disconnected? Can it be done without creating significant privacy issues?

Re:They don't care

[ae1294]

o ok then, Debian it is!
I can use the 'make' command every once in a while if need be, I already build my own kernel without silly things like ISA support.

Thanks,
ae

Re:They don't care

[Anonymous Coward]

And I'm sure your grandpa knows someone who treated their guns like appliances. Tossed them in the dirt, never cleaned them, let them rust, etc.

etc = left them loaded and sitting out in the open?

Re:They don't care

[Dustie]

If the buyer is a /. reader perhaps they know. If they tell my mom that I'm sure she doesn't know what is so funny about it. If a seller says it's secure and it isn't then the seller is to blame not the buyer.

Re:They don't care

[MLS100]

And I should be safe to walk the streets wherever I please in my country but that's not true either.

I don't want to pay 100x the taxes so there's a cop on every corner; so I live with the fact that I can't take a late night stroll around Compton.

I don't want to wait 10 years in between OS releases or pay out the nose for them either, so you compromise. This is what is commonly referred to as reality.

Re:They don't care

[goarilla]

what you never had to replace a power supply, or you never had a computer
that had the bad caps plague (i had 3 this 2 weeks) and they were not second-handed (i dont work at a computer shop)
never had a bad-working power switch, broken graphics card or memory
that failed because it was overheating

Re:They don't care

[LanMan04]

I quite natural assumption, don't you think?

No, not really. If I take my 1991 minivan offroading, break a bunch of stuff, and take it to my mechanic to get it fixed, I would expect my car to break AGAIN if I took the same actions AGAIN.

The very definition of insanity is to keep doing the same thing over and over again, expecting different results.

Re:They don't care

[Anonymous Coward]

Especially right, considering changing one word out would fix that.

Instead of "You *ARE* hosting..." say "You *could be* hosting...", at which point the statement is 100% true.

Re:They don't care

[Dustie]

But where do the line go? Is it responsible enough to update with automatic updates? Is a updated anti-virus product mandatory (I know who would love that idea!)? Or should software have an "Internet approved" certificate?

Re:They don't care

[Hyppy]

That depends on what the malware is used for. Sending spam? Maybe not so bad. DDoSing a hospital? Hmm...

Re:They don't care

[Hyppy]

I could see a Mastercard-style commercial being made on this premise.

Getting infected... Free
Paying for someone to come fix it... $200
Paying the same guy to come back again... $400
Learning to not bite the hand that controls your porn access... PRICELESS

Re:They don't care

[sopssa]

Then that hospital is just stupid having their main infrastructure on public network to begin with. Ok, they can bring down their website. It ends there. Its not like people are going to die because of that.

Re:They don't care

[NotBornYesterday]

You and I know Microsoft is lying, but the non-geek rest of the world has little or no clue. These technologically disinclined unwashed masses are exactly the one-born-every-minute type that Microsoft relies on as its new customer base. In my experience, most of them truly have no idea how to begin to secure a system, or how inherently insecure Windows is. Microsoft is guilty of exploiting this.

I agree that users are also culpable, but not in a nudge-nudge wink-wink kind of way. Going back to the car analogy, your brakes need to be replaced every so often, "updated", if you will. If you are at 100k miles and still on the original pads and haven't done an oil change, don't go crying to the manufacturer when the whole thing fails. Most home users I know are guilty of not doing proper maintenance on their systems, and of often not even knowing what needs to be done.

Re:They don't care

[sopssa]

Was going to write this to earlier post aswell, but what would be the point of ddossing a hospital? Old days of malware are gone where most of people just wanted to do bad things and gain fame. Most hackers now are now in it for the money. It would be stupid from them to ddos a hospital for the publicity it would get and the fact they cant get any income from it.

Re:They don't care

[causality]

You just have to find the right button to press (in the person, not on the computer) and then the rest will follow naturally because they finally care.

That's probably effective, only I just don't think that's really viable long-term. There just isn't any substitute for people who love what is right and want to take responsibility for themselves and for how their actions can affect others, not out of fear, but because it's the right thing to do. I think using fear to motivate people has all sorts of nasty and non-obvious side effects that are seldom appreciated. It's another example of what you can call "external motivation".

Strong, wise, healthy people who make good decisions may be radically different from each other in many ways, but they all have one thing in common: they are all internally motivated. They have a strong sense of how things should be and they work towards that goal. Their personal growth is experienced in terms of a constant refinement of "how things should be," what that means, and why it has that meaning.

Their self-expression is not experienced in terms of reward and punishment, or doing the right thing only because of fear, or appearing good in the eyes of others. People often do things for hollow reasons like that, and then they wonder why they have inner conflict, why they don't feel that joy towards life that they know deep down is quite possible. That's my only real objection to what you advocate, and it's a hard one, because what I describe is not something you can just give to another person. Much patience and acceptance is required to deal with that.

Re:They don't care

[Anonymous Coward]

If someone steals your car, then robs a bank and kills some folks while they're at it, should you be charged with a crime if the locks on the car door and the ignition were defective?

C'mon people, computers should be secure out the box. Windows is simply a defective product.

Re:They don't care

[BronsCon]

Intention does count, you're right. Negligence is a crime. Knowing you can and should have protection, and choosing not to, is negligence. Knowing that not having such protection can lead to your property being used in the commission of a criminal offense, and choosing not to, is criminal negligence.

Intent is implied by "choosing".

What I would do is irrelevant; there has been at least one case in which the owner of a legally and properly parked vehicle was sued by someone who plowed into said legally and properly parked vehicle... and lost. They lived at the corner of an unlit street (with a no parking ordinance and signs every 100 feet); the city had agreed to move the no parking sign from the corner or their yard to the end of their property when they installed lighting that allowed other drivers to see their parked vehicle clearly. The bulb burned out and someone came down the street doing about 50MPH and totaled their parked car. Driver sued and won.

Would I? No. Would you? I'd like to think not. Is what you or I would do relevant? Again, no; the above account (property owner was a friend of mine, I was there at the time of the accident, so I know it happened, making it an account, rather than an anecdote) acts as proof of that.

Re:They don't care

[Anonymous Coward]

Two words: Kiddie Porn..
First virus or worm that creates a P2P botnet for distributing Kiddie Porn, and not only will Nancy Grace and all the news channels talk about it all day, every day, but people will start getting arrested, since HAVING it on your computer is a federal crime. Then, and only then, will things change with respect to security...

Clearly the only moral thing to do is to create a such a virus, and start distributing it like mad. It's for the good of the internet.

Re:They don't care

[Anonymous Coward]

1) Any ISP relaying openly malicious traffic needs to face consequences for it - Force them to self-monitor.

2) ISPs will start threatening users responsible for malicious traffic with disconnection.

3) Users with compromised connections will either have to start caring about security or give up Internet service.

1) What stops an ISP from saying "MMORPG players are hackers!" or "torrents transmit malware!"?

2) ISPs have, and for legal apps doing legal things!

3) Talk to Comcast users. See how they felt.

Seriously, think about it.

Re:They don't care

[CorporateSuit]

I tried to come up with an analogy for just how bad this analogy is, but I failed. There is no expressing how far off base you are and you're so far from being understandable that I can't explain to you the number of ways that you're mistaken. (Stealing cars == Abandoning paying customers???)

How about we start with the ways you're mistaken? "Tantamount" does not mean I'm starting an analogy. It means I'm making a comparison of value to show what other ideas could be so well-intentioned, yet naive, as to cause disaster. Now for an analogy: You tried swinging at a curveball (because EVERY slashdotter throws curveballs) and still don't recognize that I threw a fast pitch instead.

Besides, it wouldn't be STEALING cars... it would be government-sanctioned temporary removal of their driving rights through removing their car as regulated by someone who cannot be trusted, as said regulator possibly stands to benefit from every removal, financially. The ISPs wouldn't be STEALING the internets. They would just be stealing the monthly payment then cut off service before they have to provide.

And because you seem to have trouble identifying literary devices, my sig is a meta-metaphor.

Re:They don't care

[Hyppy]

I think that if it were possible to interrupt hospital services via DDoS, and that was just an example, then profit could be made from it. What about, say, someone in critical condition after an attempted murder? Finishing the job off would certainly be valuable to someone.

Re:They don't care

[Lost Race]

Not that I'm advocating anybody should tell a devious lie to a friend in order to make him/her smarten the hell up ...

It's not necessarily a lie.

Re:They don't care

[Hyppy]

Are you suggesting that people should ask for the IT manager's credentials and a full network diagram before deciding where to go when they're in need of emergency care?

Re:They don't care

[sopssa]

Why would they? Everyone is gonna call emergency number, which is 911 in usa and 112 in nordic area. Other areas I dont know about, but they should know it really well.

Re:They don't care

[Hatta]

First virus or worm that creates a P2P botnet for distributing Kiddie Porn, and not only will Nancy Grace and all the news channels talk about it all day, every day

Nancy Grace would just assume the owner of the computer is a dirty perv, and call for his prosecution. She's not in the business of making alibis for people.

Re:They don't care

[sopssa]

That is really a long way from the traditional malware. Most of malware/adware makers are just trying to make money off from as many people as they can. They're not targeting hospitals or anyone specifically.

I agree, there are targeted attacks aswell. But once it gets targeted attacks, no normal firewall, linux or whatever are gonna save you. They're gonna find a way around, be that via exploits or actually sending people to have fake jobs at that hospital and finish that target -- which 99.9% malware isn't targeted to do.

Re:They don't care

[Hatta]

The concept of satanic hackers seems over the top -- the threat just doesn't sound real enough.

When you're talking to folks who believe in a cosmic jewish zombie and his invisible sky daddie, "sounding real" never really enters the picture.

Re:They don't care

[antdude]

They will care if you charge them a lot to fix it. They can pay me a lot to keep cleaning their computers. :D

Re:They don't care

[pbhj]

If your car's brakes go out and you hit a tree, do you sue the tree? No. Do you sue yourself? No. You sue Ford. They sold you a broken product. Same with M$. They told you it worked when you bought it, but it's broken. Make M$ responsible for fixing the damed problem.

And Ford ask you in court how often you had your brakes serviced.

I don't think MS (nor Ford) tell you that "it won't be hacked" (won't need brakes servicing) when you buy it. They more than likely disclaim all liabilities except those forceably applied by law.

Re:They don't care

[Anonymous Coward]

Why is an ISP responsible for anything other than providing a pipe?
Uh, just like a telco.

OTOH, if an ISP wanted to be helpful to the rest of the internet, they could remove access for the offending IP and force all requests to redirect to anti-virus/spyware/firmware/etc sites when they see behavior that is proven to be from a hacked computer. This would force people to fix their PCs or never use them again. 80% would never be used again.

Re:They don't care

[cbiltcliffe]

Trying to keep her Windows computers functioning is a bit of a PITA, but overall, she's worth it. Not even a question, there :)

Well, of course. According to standard /. logic, you and I must be the only two /. posters with wives. It's worth just about anything to stay in that exclusive club. :)

I guess that means I really don't have anything to complain about after all... However, in light of this thread, I couldn't help but notice your /. sig!

Well, about time somebody noticed it. I've had that there for a year or more, and nobody's mentioned it before that I've noticed, and I've never got a call from it, either.
Considering how everybody bitches on about having to fix their mother's computer who lives halfway across the country, and their entire Christmas vacation is taken up by virus cleanups, software updates, and other assorted crap, I'm surprised I didn't get a flood.....

Re:They don't care

[gmuslera]

Now that a manga collector got jailed up to 15 years having a some, hosting a website to the internet with plain and real child pornography should get at least death penalty (they will try to push it to something worse). You could not care if your pc is sending spam, or cracking captchas, or serving malware, not affecting specially you... but hosting a child porn site in your own pc is a bit risky taking that into account.

Re:They don't care

[xelah]

nearly everybody involved in the industry acts like a Mac is something different from a PC. You can hardly blame people for picking up on that.

Well...they're right. A Mac is a computer with the smiley face, an apple menu thing at the top and the pretty icons. A PC is the one with the start button that's made by Bill Gates. Linux, naturally, doesn't exist - or is something funny complicated thing technical people use. They're brands (or at least brand-like in the case of PC) referring to 'kinds of computer', complete with all the associations that go with brands like 'nasty monopolist' or 'stylish arty thing'.

Every name is simplified to the smallest most specific sub-part that's still able to distinguish it. That's why no-one thinks about 'IBM compatible PCs' any more and why Macs are 'Macs' and not 'Apple Macintosh computers' or 'computers running MacOS'.

Not too many people care about the insides of computers, or have concepts of processors, instruction sets and hardware platforms, or a clear differentiation between hardware and OS. For as long as the words 'PC' and 'Mac' are enough to function in this area they aren't going to learn, either (and even if they cease to be they'll complain about it being so complicated). A (hypothetical) computer running Windows on ARM or Itanium or whatnot would be 'a PC', and Mac OS on x86 is 'a Mac', because they have all the attributes associated in an ordinary person's mind with PC-ness or Mac-ness. An Itanium computer running Windows which can't run, say, Photoshop would merely be a broken computer, or a computer which is not very good....not some special other class unless it became so common people were forced to waste their time on understanding it.

Re:They don't care

[mrmeval]

Hack their PC, pwn it and suck the fuckers dry. Keep doing it till they pay attention or get the fuck off the net.

Nice thing about my parents? They've never had credit cards and just got debit cards this year 2009 and my step dad actually used one to get money. Listening to them discuss him using his debit card the first time was a very strange experience. They are in their 60s now. I don't consider them idiots or stupid just culturally not connected to higher technology. This is IMHO a good thing as they will not use a computer to do any financial transaction.

Re:They don't care

[Paul server guy]

Agreed. They will come in with a warrant to take all computing equipment and data storage devices, and empty your house of everything (Including store bought DVDs), and trash half of it on the way. (House included.) This happened to someone I know - And it really was someone on the open WiFi. They never found who, they finally gave him his (mostly ruined) gear back after six months.

When they come knocking They won't be looking at MAC addresses...

Re:They don't care

[BlackSabbath]

> Microsoft is guilty of exploiting this.

You got me thinking about class-actions Does anyone know if any enterprising lawyers have tried suing MS around this? Can't see why you couldn't at least try.

Re:They don't care

[Zancarius]

I agree with much of what you're saying--I merely need to make a point which you likely already know but some readers might not.

On DSL, on the other hand, you've got to send a username/password to connect.

Not all DSL providers require username/password combinations. There are a few that offer bridged connections and you're authenticated by MAC address. However... if the telco were subpoenaed, it would be trivial for them to provide details on when you were using your circuit, MAC address be damned. If it's coming from your port, it's you. So, your point is still entirely valid!

Re:They don't care

[WeeBit]

You don't sue Microsoft either... If you had a passenger in your car... They sue you for failure to maintain vehicle. The police also writes you a ticket for that same reason.

Laws are now in place stating they have to use every means to protect your personal data. So you could sue... but how do you sue a business because they did not protect your data? I mean really we have a lot of inept computer users out there hooked up to the internet. The only thing they know how to do is turn it on, read email, visit a few websites, look at the happy videos, and log off. There bosses are no different.

Re:They don't care

[kamikazearun]

If the 10m armored wall were free, yes.

Re:They don't care

[Anonymous Coward]

Both of you are idiots. You can't possibly force the world's ISPs to all disconnect malicious users. It would make it too costly for the majority to get on the Internet. At least with a MS Windows computer anyway. Plus it would cost us our freedom, our anonymity, and it still wouldn't work.

Those who are effected are a effected as the result of their own or their companies/organizations/ISPs actions- that is using MS Windows and MS software generally. Spam is not the result of MS Windows users though- not really. It is the fault of a system that isn't designed to authenticate users. That is both a feature and a cost. Then DDoS attacks are inevitable anyway. Even with ISPs disconnecting some users in places where enough users can afford it their still remain those places where users can't afford it so the ISPs have no choice but to ignore it.

Ok- so why shouldn't they be responsible? You chose to get on the Internet. A place where you knew or should have known was dangerous and ungovernable. Anything that someone else is able to do to you is therefore a cost of being on the Internet.

So you hold 1% responsible. Do you really think that holding 1% of the population responsible has any effect on spam, DDoS, and other stuff? They can't even track down those responsible for the actual malicious act.

I have a better solution that is just as unrealistic. People like you shouldn't be allowed on the Internet.

Re:They don't care

[BrokenHalo]

...but I'm not comfortable with this idea.

I'm not too comfortable with either of your suggestions. Which I guess leaves us back with the pillory or being shot. ;-)

Re:They don't care

[ae1294]

No, not really. If I take my 1991 minivan offroading, break a bunch of stuff, and take it to my mechanic to get it fixed, I would expect my car to break AGAIN if I took the same actions AGAIN. The very definition of insanity is to keep doing the same thing over and over again, expecting different results.

I agree, I've just learned that most normal people somehow don't see it that way or instantly think "he just removed a virus and gave it back and said good day" when in fact it's the other way around.

Re:They don't care

[ae1294]

But you don't actually DO anything when you fix a computer. I mean, at least a mechanic takes parts out and puts them back in. You just click on things. That isn't real work! The people smart enough to know that knowledge is worth something aren't the kinds of people who end up having to pay to get their computers fixed.

LoL.. ok sure spending hours at a keyboard clicking isn't real work and mechanic's always replace a part and never just turn off the odbc2 code that is making the check engine light come on.

Re:They don't care

[supernova_hq]

If the car's ABS warning light has been on for 2 years and you haven't bothered to fix it, the owner of the tree can sue YOU!

However, a much clover analogy would be this. If you have a broken window in your car and leave the keys in the ignition, who is responsible when your vehicle is used for a drive-by?

Re:They don't care

[ae1294]

what you never had to replace a power supply, or you never had a computer
that had the bad caps plague (i had 3 this 2 weeks) and they were not second-handed (i dont work at a computer shop)
never had a bad-working power switch, broken graphics card or memory
that failed because it was overheating

We always did a lot of laptop power connector fixes since people like to stab them into the laptop as hard as humanly possible.

Re:They don't care

[supernova_hq]

How about child porn servers? Many of these hacked computers are being used to store just that kind of material. Sure the server may not be causing the damage to the children, but it's the same as working at a photo-booth that processes the negatives.

Re:They don't care

[rdnetto]

1) Any ISP relaying openly malicious traffic needs to face consequences for it - Force them to self-monitor.

The problem is that it's not too far from monitoring for 'malicious traffic' to monitoring for 'illegal traffic' (P2P, etc.) to monitoring for 'objectionable traffic' (porn, unpopular political view, anything unsuitable for children, etc.)
It's hard enough to keep ISPs out of content filtering without people actively encouraging them to do so for security reasons.

Re:They don't care

[rdnetto]

Perhaps there's a way to leverage this - write a virus that tells the user they are infected and downloading child porn, and the FBI are being contacted. If the virus actually searches for and downloads the content, then this should get considerable media attention, possibly changing the public perception.
It's a pretty grey idea morally, but would certainly be effective.

---
I hereby release all ideas, concepts and designs in this post into the public domain. Where this is not possible, all users are granted implicit permission to use it in any way they desire.

Re:They don't care

[Tuoqui]

And 'You musta did it because it's your computer/router/connection' isn't gonna cut it for a conviction because of this thing called reasonable doubt.

Re:They don't care

[Tuoqui]

While I can sort of agree on the general principle of making end users somewhat responsible for their connection and/or computer security. The problem lies within the system that would happily abuse it.

First of all I can imagine the MAFIAA slipping some malware into their things on the sly to do stuff to trigger these responses from people who are 'downloading illegal music'.

On a side note I've had a malfunctioning router that repeatedly sent DHCP requests to my ISP to the point where they cut my connection. I took the offending router out and never had a problem since. I wonder just how much trouble it had to have caused in order for them to actually do something though if crazy infected botnet crap slips by without notice.

Re:They don't care

[stonertom]

Security needs to be applied away from the end user. A lot of malware and other crap would be stopped with ISPs offering "safer" internet by default, block all incoming only allow standard outgoing ports etc. Then make users go through an extra hoop to enable "pro" mode or similar. Personally I'd hate using the net with those kind of filters, but most people I know whouldn't even notice that they could only get to port 80....

Re:They don't care

[mh1997]

A computer is not an appliance because it doesn't do a single thing

Except compute.

Re:They don't care

[dotancohen]

Once users are held responsible, ISPs will be held responsible - not only for the damage their users do, but also by users for letting malicious traffic to the user's computer.

Hey, that's a great idea! We should have the ISP filter our web traffic, to keep us safe. Government mandated!

Re:They don't care

[NotBornYesterday]

I don't know what legal grounds one might have (consumer protection laws, maybe? RICO?) for such a lawsuit, but historically, MS is notoriously difficult to win against (although that may be changing, and not necessarily in a good way), even if you have a good case. I am sure there are enough hungry lawyers out there who would love a piece of such action. If it is possible to make a case, I am sure there are a platoon or two of lawyers who would be eager to try.

Re:They don't care

[Bryan_W]

runas /savecred
look into it.

Re:They don't care

[toddestan]

It's more like the Windows car has adequate door and ignition locks, it's just that most users don't lock their doors and leave their key in the car because they can't be bothered to secure it properly. The Mac and Linux cars are much the same, it's just that they have manual transmissions so the thieves generally don't mess with them.

Re:They don't care

[Anonymous Coward]

I have long since stopped offering my tech-savvy services to friends and family. It is not worth my time. I wouldn't even do it if it was my job. That's why I don't work for the Geek Squad.

Re:They don't care

[skarphace]

And I should be safe to walk the streets wherever I please in my country but that's not true either.

I don't want to pay 100x the taxes so there's a cop on every corner; so I live with the fact that I can't take a late night stroll around Compton.

Bad analogy. In your analogy, you'd be locked up or fined if you were mugged or attacked in some way like the users of the computers in the above posts. It may not be smart, but should the victim but punished?

Re:They don't care

[element-o.p.]

I was once told it's never a good idea to argue with a moron because someone listening in might not be able to tell the difference. However, here goes anyway.

So... you blame windows for your lack of balls and inability to stand up to your wife?

Ahhh, the irony of an Anoymous Coward starting his post with an attack on my backbone...that's pretty funny, actually. In response: http://en.wikipedia.org/wiki/Kobayashi_Maru

RE: Your quicken problem: Are you too stupid to do a google search? It is simple to fix this by giving specific permissions to a non-admin user for Intuit registry keys...

And do this for every one of how many programs that operate this way? That's just idiotic. How about using software that wasn't designed with boneheaded permissions requirements in the first place?

Either way, not a windows problem, it is Intuit's crappy design.

That's probably true, but this type of design seems to be endemic with Windows software. OTOH, I don't recall ever running into similar problems with Mac, FreeBSD or Linux software I've used -- unless it was something that truly needed superuser access. Even in those cases, for example NMap, the software will still run with limited functionality for users without sudo/root access.

RE: Your kids: Why do they even have admin access? Stop giving them the password. Stand up for yourself and lay down some rules.

You want me to take marriage advice from an A/C on /.? Yagoddabekiddinme. Yeah, I could "lay down some rules" but IME, being a jerk about things rarely makes anything better. So I give her advice. If she ignores my advice, I work on her computer when I get a chance; it's not a priority. Like everthing else in a marriage, this solution is a compromise.

Based on movies....

[Kenja]

Based on what I see in movies, they can be used to blow things up, crash alien space ships and steal Sandra Bullocks identity.

Re:Based on movies....

[TomRK1089]

Way to rip off Cracked.com :P
http://www.cracked.com/article_15229_5-things-hollywood-thinks-computers-can-do.html
Not that I think you actually did. Funny nonetheless though.

Re:Based on movies....

[Larryish]

and steal Sandra Bullocks identity.

Can they steal her panties?

Re:Based on movies....

[Culture20]

I'll believe examples one and three. If it turns out that my weird friend is right and transistors really are alien technology, then I might believe example two.

Re:Based on movies....

[Paracelcus]

I was working for IBM when "Independence day" came out, and when Jeff Goldblum hacked into the alien spacecraft all my co-workers an I said the same thing, we can't get Windows programs to work in OS/2 but Goldblum can program in ET code.

Re:Based on movies....

[Anonymous Coward]

and steal Sandra Bullocks identity.

Can they steal her panties?

Only if you do it in a three-step profit plan.

Re:Based on movies....

[Anonymous Coward]

I think it can only take down motherships. Jeff Goldblum and an apple laptop have to be involved somehow too.

Dissapointing

[splug]

I was hoping for a bit more from this article. As i read through it I was hoping to see reasons or impacts to the user. There was only a couple of very light examples. There is a very big need for people to understand how a Hacked computers, they own, can impact them. If it doesn't hurt them they aren't going to care. This is just FUD until it becomes personal.

Re:Dissapointing

[ShadowRangerRIT]

Until it's personal, I'm fairly sure it's not FUD. If people don't care, they won't experience F, U, or D.

Don't be a patsy!

[Drakkenmensch]

Lately there's been a LOT of attacks on military servers and data thefts of sensitive info. You do NOT want military techies to trace this back to YOUR machine that's been used as a proxy for some 15 year old script kiddie!

Re:Don't be a patsy!

[Krneki]

What can they do about it?

If anyone should get a fine is Microsoft or whoever is responsible of the software. If your car suffers a breakdown and you hit somebody, who is to blame? The answer to me is not simple and obvious.

Re:Don't be a patsy!

[Knara]

What? Sorry, American Idol was on and I got distracted.

Re:Don't be a patsy!

[Drakkenmensch]

When the cops come to arrest you for the bot net's hacking crimes, do you really think they'll care about your innocence pleas when they're holding you face down with a knee on your neck?

Re:Don't be a patsy!

[plague3106]

Your fault; you didn't maintain your car properly.

Re:Don't be a patsy!

[Chlorine Trifluoride]

If I break into your car and use it to rob a bank, would you come after me or your car company?

Re:Don't be a patsy!

[Krneki]

You watch too much TV. No one will point a gun to you merely because they suspect something is going on with your PC.

Besides there aren't enough cops to stop a botnet.

Re:Don't be a patsy!

[Krneki]

Possible yes, but how can you exclude a car manufacturer error or a mistake in the car service?

Re:Don't be a patsy!

[node159]

Ignorance is bliss.

Do you really think they will bother with someone who obviously has just nearly grasped the ability to turn the 'hard drive' on?

Honestly, what fantasy world do you live in?

Re:Don't be a patsy!

[Krneki]

Am I responsible for my car? To some extend I am, but if I have done all that is required by the law to make it secure, then there is nothing against me.

Again, if I'm required to maintain my PC secure by law, so are the OS providers.

Re:Don't be a patsy!

[Chlorine Trifluoride]

The point is that I am the person whom you should be going after, not the car maker.

Re:Don't be a patsy!

[Krneki]

You take you car to the official service, they make a mistake. Your tire comes off and you hit somebody.

It is your fault?

The point is: you can't blame someone just because you think they are wrong. You need proof, but once you get your proof they might point to something else. In this case a poorly designed OS by M$.

Re:Don't be a patsy!

[ubersoldat2k7]

Does anyone remember the Firestone and Ford Explorers doing face plants on highways? I believe Ford didn't pay anyone.

Re:Don't be a patsy!

[causality]

You take you car to the official service, they make a mistake. Your tire comes off and you hit somebody.

It is your fault?

Though I have worked profesionally in this area, this is just my unofficial personal opinion. I know that in my particular state, your insurance company would consider such an accident to be your fault and would charge you accordingly (higher rates, surcharges, etc). My state does not have no-fault accidents so your mileage may vary. It makes sense from the perspective of the other guy. If the other guy obeyed all traffic laws and took reasonable measures to avoid the accident, and then you lose a wheel and slam into him, why should he have to pay for that? At least with cars there is some sense that it's your equipment that you're using on a shared system and you are responsible for how it affects others.

Now what I don't have a clue about, and what you'd have to ask a lawyer, is what happens next. Does the fact that the mechanic screwed up absolve you of any guilt or any liability? Or is that liability your damages that you can then use to separately go after the mechanic? Either way I'd guess that you would have to go to court.

Re:Don't be a patsy!

[Anonymous Coward]

You take you car to the official service, they make a mistake. Your tire comes off and you hit somebody.

It is your fault?

Yes.

When you get behind the wheel in a vehicle it is your responsibility that the vehicle is in proper condition.
You are supposed to check this before you start driving.

Re:Don't be a patsy!

[Anonymous Coward]

Ignorance is bliss.

Do you really think they will bother with someone who obviously has just nearly grasped the ability to turn the 'hard drive' on?

Yes, because it helps their crime-solving statistics which drives their funding.

Honestly, what fantasy world do you live in?

A slightly cynical one.

Re:Don't be a patsy!

[Artifakt]

I'm a former signal corps officer who once held the electronic security officer position in a S-2 shop (that's military intelligence), and I personally know of three cases where a military computer intrusion resulted in serving a warrant at some person's home. One of them was on post and was served by MPs - the other two at civilian addresses. In ALL cases, persons bearing M-16s were present (MPs, FBI or SWAT). In ALL cases, all computer and related equipment in the home was impounded and held at least until trial.
        In one of the three cases, a firearm was actually pointed by police in my presence, and the civilian policeman informed the suspect (a 16 year old kid), "Step away from the computer NOW! Or I will splatter your dumbass fucking head all over the fucking wall". fortunately he complied at that point, although later, one of the police told me it was probably because a non-cop was present that his buddy didn't bang the kid against said wall 'just a little' before handcuffing him. Even though I was only along as a witness to identify presence of the suspected software on his machine, since this was a civilian related case, I ended up having to testify at the trial that the kid appeared to be trying to destroy evidence, because he argued at first that the language and being cuffed constituted excessive force.
        So yes, if that something is intrusion in a military system, someone may very well point a gun at you. I think the police were reasonably professional in the cases I was connected to, and I recommend that people don't rely on that. I got to where I really feared having a case come up in some areas where I would expect the police to get overexcited about it. We always had to assume a cases such as this might be espionage by foreign agent, but the police typically reacted like they never heard the word 'might' in that - to them it simply was spying and sabotage, and I also heard the word 'treason' thrown around a lot when we briefed the local DAs that the suspects were believed to be U.S. citizens. Many cops damned well may go a lot farther than pointing, and you are giving out very, very bad advice.
     

Re:Don't be a patsy!

[chris mazuc]

Exactly that happened to my wife a few years ago while she was driving through Virginia on I-95. We had some work done on the car which involved the removal of a wheel. About a week later while on her trip, the wheel came off and rolled across the median into oncoming traffic, colliding with a brand new Cadallac (only cosmetic damage). She got a ticket for "failure to maintain the vehicle", though the insurance company considered it a no-fault accident.

Re:Don't be a patsy!

[Drakkenmensch]

Thank you for your first-hand experience input. This goes to show that it's a very, very bad idea to mess around with an arresting officer, no matter how small you may perceive your offense to be. Cops are trained to be aware that there's always a possibility that the guy they pull over for a broken tail light may have a corpse in his trunk, a suitcase of coke on his backseat and a semi-auto under his seat. They simply can't take this kind of chance.

Re:Don't be a patsy!

[JayJay.br]

Are we still talking about computers here?

Re:Don't be a patsy!

[Anonymous Coward]

Want to be the first to test that out?

Why do I keep wondering what Kevin Mitnick is doing these days?

http://en.wikipedia.org/wiki/Kevin_Mitnick

Mitnick served five years in prison, of which four and a half years were pre-trial and eight months were in solitary confinement because the Judge was convinced he could start a nuclear war by whistling into a pay phone if he were near one.

Notice 4 years in JAIL before he got a trail.

Re:Don't be a patsy!

[Krneki]

Can you tell us a little bit more about the involvement of the boy with the military server?

One thing is hacking and another being part of a botnet of 300.000 units.

Re:Don't be a patsy!

[Krneki]

Police, they go always for the easiest solution.

In that case you had to appeal to the fine for "failure to maintain the vehicle", since it was properly done by a professional company. Use the receive to validate your claim.

Re:Don't be a patsy!

[Anonymous Coward]

While I appreciate the advice given in this post, I can't help but be confused by the following:

Even though I was only along as a witness to identify presence of the suspected software on his machine, since this was a civilian related case, I ended up having to testify at the trial that the kid appeared to be trying to destroy evidence, because he argued at first that the language and being cuffed constituted excessive force.

In what way does "he argued at first that the language and being cuffed constituted excessive force" constitute the kid appearing "to be trying to destroy evidence." The way it's written conveys that you testified to this solely because he argued excessive force, not because he actually appeared to be destroying any evidence.

Re:Don't be a patsy!

[PitaBred]

Because if a part failed and you didn't perform recommended maintenance on it, that absolves the manufacturer. That's why they can get out of warranty work on, say, the radiator if you haven't had it maintained at the intervals they recommend.

Re:Don't be a patsy!

[PitaBred]

I certainly hope you got that company to repair your vehicle, and pay all of your insurance deductibles, or the insurance company went after them. There is no excuse for that. I had my engine replaced by a company that put the wrong oil filter on my car, so when I hit the gas it popped the filter off and I couldn't turn the engine off fast enough before the oil drained completely out of the engine. It didn't cause a wreck fortunately.

Re:Don't be a patsy!

[nasor]

I'd assume that the worst thing that would happen if and when the military traces an attack back to your hacked computer would be them confiscating your computer as evidence. Certainly annoying, but half these people buy a new computer every few years anyway because the old one "slowed down" or something, so it would hardly be an extraordinary inconvenience. It's not like they're going to prosecute some grocery store manager whose unpatched computer is riddled with viruses and rootkits. If nothing else, the mere presence of all the malware would probably creat instant reasonable doubt.

Re:Don't be a patsy!

[plague3106]

If you have properly been doing all the services, you'll have records. If the part is faulty from the manufacturer, there's likely many others with the same problem, and also likely a recall for said problem.

Re:Don't be a patsy!

[hxftw]

+1 GP makes no sense.

Re:Don't be a patsy!

[Anonymous Coward]

I ended up having to testify at the trial that the kid appeared to be trying to destroy evidence, because he argued at first that the language and being cuffed constituted excessive force.

Do you wanna clarify that one a little please? Are you really saying that you testified against the kid, by saying he was destroying evidence, because he questioned the method of arrest - which btw you pointed out was less than civil and would have been downright violent had you not been there.

Don't get me wrong, i'm not surprised by the way the cops act - but unless you had more reason than you're letting on, I'm appalled that you agreed to testify to that.

Child porno?

[Anonymous Coward]

Come on now, that has got to be a troll.

What are the odds that a hack0r is also a pedo that would do this?

Even if a pedo paid a hack0r what are the odds he would report him?

I am I being naive here or is this guy really trolling?

Re:Child porno?

[ShadowRangerRIT]

You're being naive. Since hosting illegal material yourself is dangerous, a fairly standard trick would be hosting it in a deniable location. Multiply the percentage of pedophiles (I'd guess upwards of 0.1%) by the percentage of hackers (including script kiddies, I'd say upwards of 0.01%), and at least 1 in 10,000,000 people would be both, or at least 600 worldwide. Not that many, no, but enough to have it be a potential use of cracked machines.

Re:Child porno?

[_Sprocket_]

What are the odds that a hack0r is also a pedo that would do this?

Even if a pedo paid a hack0r what are the odds he would report him?

A friend of mine is a network admin at a local university. As such, part of his duties include network security. He knows of several anonymous FTP servers on "his" network that are routinely tagged and used as drop-points for illicit data. Attempts to fix the situation have been stone-walled or outright ignored. So he just watches what goes on with these servers. It's amazing what shows up on them. There's a pretty good trade of warez that goes on - he doesn't have to hunt down torrents. There's often interesting malware examples to poke around with. And there's often more porn covering a wide array of kinks than you can get googling for "fetish". Child porn included. On a side note - that's based on what data he can see. There's also a large number of encrypted archive files that show up. It's a mystery what's in those. But often they're found in directory structures created by the illicit data peddlers so one can make a guess that if a given directory structure includes unencrypted kiddie porn, the encrypted archives found in that directory structure are probably more of the same. Of course, this is all very old-school. Hijacking servers? How very 1990's. Today we hijack small workstations often with just as many resources as a dedicated server - without the hassle of the occasional alert sysadmin.

Re:Child porno?

[0100010001010011]

I'd just fill the servers with data. Someone will notice then. Since he's on a local network he can probably do it faster than most people too.

A while loop, /dev/null and an ftp client should be all he needs.

Re:Child porno?

[_Sprocket_]

I'd just fill the servers with data. Someone will notice then.

It's not so much that they don't notice - they don't care. Whenever the system gets full, they just go do some house cleaning. Sometimes the taggers do stupid directory naming tricks to make that more difficult and he's asked to help. I have to admit - my friend's sense of cynicism is pretty pegged. He tends to enjoy deleting only the encrypted stuff to "punish" the illicit data traders for not sharing. Of course - this comes from a few years ago. Maybe by now the university has been hit with enough crap on their network that they've started to care. I wouldn't put money on it though.

Re:Child porno?

[0100010001010011]

I more meant the user.

Can you do chmod 000 through FTP?

Re:Child porno?

[areusche]

I'm going to burn some karma, because this type of worker completely irritates me.

Your "friend" better get his act together. Nothing can ruin a person's career more than a child pornography accusation. As a network admin he should be raising hell up and down the bureaucratic ladder and using his resources as network admin to remotely block access to those machines. . When one of those "files" gets discovered, I hope he gets hauled in for aiding in the trafficking of child pornography when Professor Sixpack gets caught.

Network security can work. It bugs me to whits end that someone knowingly lets that type of junk in.

Re:Child porno?

[_Sprocket_]

Your "friend" better get his act together.

When you quote "friend", are you implying that the individual is me? Or are you questioning that he is my friend? You're wrong in either case.

Nothing can ruin a person's career more than a child pornography accusation. As a network admin he should be raising hell up and down the bureaucratic ladder and using his resources as network admin to remotely block access to those machines. . When one of those "files" gets discovered, I hope he gets hauled in for aiding in the trafficking of child pornography when Professor Sixpack gets caught.

My take on it is that it's best to say "hey - I told you guys", document it in some memo or email, and then walk away. Playing around with the data is asking for trouble. But then - it's not me we're talking about. I also doubt it was some professor involved in this. I apparently failed to explain what is going on with these things and you're apparently unfamiliar with "tagging". There are groups of individuals who scan for anonymous FTP servers. They then "tag" the server with their group's name via a file or, more commonly, a directory structure that identifies the group. Said group then uses that structure to store illicit data. The nature of this data varies. There is nothing to indicate that any individual from within the university is involved in this process. I'd also note that my friend did a fair amount of bitching. Blocking access to those machines would probably get him fired. Like a lot of folks that have to deal with these kinds of bureaucracies, he lacks any authority required to force the issue.

Network security can work. It bugs me to whits end that someone knowingly lets that type of junk in.

I agree. But at the same time, one has to work within the environment one is in. I've been lucky in the past to work for some really good environments that took this kind of thing seriously. I've also had to deal with occasional brain-dead bureaucrats that let these sorts of situations develop. The blame doesn't always begin and end with the network admin.

Re:Child porno?

[Culture20]

The best thing to do in this situation is to call the FBI. NOW. Your friend needs to grow a pair and tell the professors (after the FBI takes the machines and/or runs their sting operation): sorry about your FTP servers, but I told you... now there's kiddie porn on the machines, you stupid gits. Your friend is risking his job, reputation, and the futures of the pedo's victims. He makes me ashamed to be in the same line of work.

Re:Child porno?

[jeff4747]

I am I being naive here or is this guy really trolling?

Pedophiles have this thing called "money". The hacker need not be a pedophile himself.

Re:Child porno?

[Anonymous Coward]

If his anonymous FTP servers get hit, I'd consider more than one mechanism. At the least if input/output functionality is needed, have one machine or VM that just services incoming files with permissions set not just by the OS, but by the FTP daemon to allow write access only, another VM to take care of the reading side. Then have a script or PFY move stuff from one side to the other.

If all he needs is read-only access for anonymous FTP, what's wrong with mounting the files read-only from a SMB/CIFS server, and having the FTP server either be a diskless box with a small USB flash drive for /etc, or a hardened VM?

This way, users can copy files to an internal machine, but the FTP server, even if completely rooted cannot write to the files.

Re:Child porno?

[Anonymous Coward]

You're being naive. Since hosting illegal material yourself is dangerous, a fairly standard trick would be hosting it in a deniable location. Multiply the percentage of pedophiles (I'd guess upwards of 0.1%) by the percentage of hackers (including script kiddies, I'd say upwards of 0.01%), and at least 1 in 10,000,000 people would be both, or at least 600 worldwide. Not that many, no, but enough to have it be a potential use of cracked machines.

You are grossly underestimating. Haven't you ever frequented a .onion forum or used Freenet?

The intersection of pedophiles with the technically literate is astronomical. I would also say that 0.1% is extremely low - by an order of magnitude. Consider the number of Americans in prison and you can start getting an idea of the "deviancy" in people.

CAPTCHA: penitent

Re:Child porno?

[hasdikarlsam]

Child porn is, obviously a criminal offense.

Guess what?

Not reporting a crime when you know about it is [i]also[/i] a criminal offense. That means your friend is now a criminal, as are you. You're legally required to report it [i]yourself[/i]; you should try convincing your friend to do the same, but don't wait a minute to report it.

This isn't some small crime. This is a crime where lives have already been destroyed, and if the government find out you knew about it and did nothing, they're both legally and [b]ethically[/b] justified in prosecuting you.

Re:Child porno?

[ShadowRangerRIT]

I was trying to lowball my estimates on purpose. If I overestimate, pedants discount the whole argument on that basis. Since even an underestimate made for a working argument, I simply used the underestimate.

Windows trojans devastate complacent idiots

[David Gerard]

A computer worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is posing a growing threat to users blitheringly stupid enough to still think Windows is not ridiculously and unfixably insecure by design.

Despite many years' warnings that Microsoft regards security as a marketing problem and has only ever done the absolute minimum it can get away with, millions of users who click on any rubbish they see in the hope of pictures of female tennis stars having wardrobe malfunctions still fail to believe that taking Windows out on the Internet is like standing bent over in the street in downtown Gomorrah, naked, arse greased up and carrying a flashing neon sign saying "COME AND GET IT."

Microsoft cannot believe people have not applied the patch for the problem, just because they keep trying to use Windows Genuine Advantage to break legally-bought systems. "Don't they trust us?" asked marketing marketer Steve Ballmer.

Millions of smug Mac users and the four hundred smug Linux users pointed and laughed, having long given up trying to convince their Windows-using friends to see sense. "There's a reason the Unix system on Mac OS X is called Darwin," said appallingly smug Mac user Arty Phagge.

"It can't be stupid if everyone else runs it," said Windows user Joe Beleaguered, who had lost all his email, business files, MP3s and porn again. "Macs cost more than Windows PCs."

"Yes," said Phagge. "Yes, they do."

Ubuntu Linux developer Hiram Nerdboy frantically tried to get our attention about something or other, but we can't say we care.

Re:Windows trojans devastate complacent idiots

[Whalou]

millions of users who click on any rubbish they see in the hope of pictures of female tennis stars having wardrobe malfunctions

Link please!

Re:Windows trojans devastate complacent idiots

[ubersoldat2k7]

"like standing bent over in the street in downtown Gomorrah, naked, arse greased up and carrying a flashing neon sign saying "COME AND GET IT." "

You mister, have a very sick mind. Now I should thank you for making me spit my coffee.

Re:Windows trojans devastate complacent idiots

[David Gerard]

All Hot! All Ready! All Infected!

Re:Windows trojans devastate complacent idiots

[element-o.p.]

A computer worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is posing a growing threat to users blitheringly stupid enough [today.com] to still think Windows is not ridiculously and unfixably insecure by design.

But, but but...that's just because there are more Windows computers in use than Mac and Linux combined!

Re:Windows trojans devastate complacent idiots

[Anonymous Coward]

Link please!

ok, here you go

Or just to see what would happen.

[LWATCDR]

Take on PC and put it on an unsecured internet connection and see what happens.
Or set up and FTP server with no security and wait.

For example...

[lupine_stalker]

A hijacked computer submitted this story!

Users won't care

[node159]

Having read over the list I can tell you with absolute certainty that the common user will not care for one specific reason:

None of the items listed affects them directly.

Computer security for the common goo does not interest the average user one bit, ultimately the responsibility falls of the developers of the compromised software for not designing the software in a safe and secure way. In my home I run ALL PC's on limited user accounts, this should have been made standard 8 years ago when the push for security came about. The unwillingness to enforce this of most fundamental security provision highlights that:

As well as the average user, developers don't care about security either.

Re:Users won't care

[pilgrim23]

If anyone believes that the average user cares about how their actions can effect other people on the "Net" ... Try driving on an average interstate....

Re:Users won't care

[NeoSkandranon]

There should be a +6 just for you sir.

Re:Users won't care

[Lost Race]

A guy I know well enough to know for certain he's innocent got charged with possession of child pornography because of some crap that got dumped into his pwned PC. He lost his job (university professor) as a result and the case is still slowly grinding through the legal system, though it's looking less and less likely as time goes on that he will ever be convicted. Unfortunately when the stigma of kiddie porn is invoked the damage is done long before the case goes to trial.

I tell his story to anyone who casually dismisses PC security issues, because my friend's life is completely and irrevocably fucked as a result of his naive and by no means extraordinary security lapse.

Sadly, no, they don't

[RulerOf]

Of all the people I've done computer work for, one of the worst offenders is a man who owns a small business I do side work for. He would somehow manage to acquire viruses at alarming rates.

It stopped when I forced him to use Firefox instead of Internet Explorer, and set him up with a limited user account and told him he'd need to log out or switch users to an administrator if he wanted to install something.

Hasn't had a problem since.

Everyone else I've tried that (or something similar) with is too obstinate or stubborn to recognize or believe when I tell them that they're actually clicking "Yes please, install this virus on my computer" over and over again, every time they want a new free, useless desktop widget or application or game produced by a company no one's heard of... that just has to have Admin privileges to run...

Re:Sadly, no, they don't

[daveime]

told him he'd need to log out or switch users to an administrator if he wanted to install something.

Which of course doesn't help, as most people WANT to install free screensavers or 100 new smileys for their email. The whole "switch to an admin account" merely serves as an annoyance at first, and then becomes rote after a few installs.

It's only useful for tech-types, who of course are more likely to take care what (and from where) they are downloading, run a virus scan on it, and hence be the group most unlikely to need the "protection of an admin account" in the first place.

I wish I had a positive solution to this, but pretending that admin accounts are the holy grail of security is just shortsighted.

Re:Sadly, no, they don't

[tepples]

I tell them that they're actually clicking "Yes please, install this virus on my computer" over and over again, every time they want a new free, useless desktop widget or application or game produced by a company no one's heard of

What company that you've heard of publishes applications like Pidgin or games like Lockjaw? But because these are free software, it's more likely that someone has looked over the source code for you.

Re:Sadly, no, they don't

[AtomicJake]

I agree, this helps to an extend. But then: Is it my business to make the damned PC secure, disable IE, and create a new user account? Or should this be the case, when I get the PC in the first place? And, btw, I twice got a PC that was infected before I actually did the first update -- it was infected within 2 minutes after having an Internet connection. If this is not a case for warranty, I do not know what is.

And when we are on it: The worst thing is the 30 day trial period of an antivirus. Ensures that your PC will be unsecure afterwards (and that the average user did not install a proper, and maybe free, AV).

Re:Sadly, no, they don't

[DeafZombie]

I think the point made on the previous post is that you need to know what you are installing... I have plenty of applications from companies that are unknown by me, I do however do a bit of research before installing anything -- and yes, even from well known vendors -- there is usually pretty good information available online that can hint you as to what something available online for download is legit. And if you don't find anything... just be safe and leave it alone.

Re:Sadly, no, they don't

[RulerOf]

The worst thing is the 30 day trial period of an antivirus. Ensures that your PC will be unsecure afterwards (and that the average user did not install a proper, and maybe free, AV).

I'll one-up that with the people who have expired AV products that they don't care about, then feed their credit cards to Antivirus 2009 because of how annoying it is with its doom-and-gloom.

Funny that Symantec and co. could take a lesson from the criminals, eh?

Re:Sadly, no, they don't

[brentonboy]

But because these are free software, it's more likely that someone has looked over the source code for you.

There is a big difference between "free" and "open source." All virus are free, but there are only a few that are open source, and those are jokes, plus, you know what it does before you install it.

Re:Sadly, no, they don't

[CodeBuster]

they want a new free, useless desktop widget or application or game produced by a company no one's heard of

You mean like the guy who registered a company name of "ClickYesToContinue" and then got VeriSign to issue him a certificate for active-x control signing?

Re:Sadly, no, they don't

[cbiltcliffe]

I'll one-up that with the people who have expired AV products that they don't care about, then feed their credit cards to Antivirus 2009 because of how annoying it is with its doom-and-gloom.

Funny that Symantec and co. could take a lesson from the criminals, eh?

Symantec has done this.

Don't know about the other "legit" vendors....

Re:Sadly, no, they don't

[PitaBred]

If Symantec did that, we'd string them up for FUD and anti-consumer advertising. Antivirus 2009 gets away with it BECAUSE they're a shady company. The proper response is to have more than a 30 day install on a machine by default, or better yet, a better browser and limited user setup that prevents a lot of that in the first place.

Re:Sadly, no, they don't

[PitaBred]

It may become rote, but it can become a big enough pain in the ass that it's not worth it. Think about it... cooking food at home really isn't THAT hard, and it's much better than what you get from McDonald's, but damn if it's not easier to just get McDonald's. Making installing a virus-laden POS more like cooking at home than it is like McDonald's is not a bad idea.

Re:Sadly, no, they don't

[Theoboley]

You've obviously never had my cooking.

Re:Sadly, no, they don't

[Hyppy]

If you're not running as admin, drive-by installs don't stand much of a chance. Just sayin'

Re:Sadly, no, they don't

[RulerOf]

a company name of "ClickYesToContinue"

That's... evil.

I read up on it and seem to recall that back in the day. It drove me so nuts having to constantly close ActiveX dialogs that SP2 was like a panacea against the awfulness. Still, post-SP2, I *will* admit that I fell for a site that told me I needed to click the yellow bar and all that...

And that was the first time I manually hunted down and removed a virus. Been pretty damn good at it ever since (special thanks to Mark Russinovich :D).

Re:Sadly, no, they don't

[RulerOf]

Damn. I had meant in the sense of the OEM crap-installed version doing that, only for it to be as annoying as AV2009 and its variants.

A quick google search says that checkup app is bundled with flash and other things, but being a sideline install is close enough.

I don't give too much care to false positive cookies, as I've learned them to be overhyped, but false positive virus or malware infection is some seriously slimy tactics. IIRC, the AV 2009 folks got their assets frozen and sued to oblivion, but /. hasn't updated us on that in a while.

Re:Sadly, no, they don't

[Anonymous Coward]

How about setting them up with Sandboxie?

Re:Sadly, no, they don't

[cbiltcliffe]

Well, if it was false positives saying a cookie was malicious when it's not, it's one thing. It could be an accident, or an incorrectly referenced domain or something.

But saying that a bunch of cookies are malicious when they're not even on your machine is something else entirely. That means it wasn't an accident. It was an intentional and malicious false positive.

As you probably guessed, I did those videos. I didn't bother verifying anything else that was detected, because after verifying the cookies weren't there, I have completely written off Symantec, and consider them to be rogue.

Re:Sadly, no, they don't

[Anonymous Coward]

Free and Open Source, libre software

Re:Sadly, no, they don't

[goarilla]

it was infected within 2 minutes after having an Internet connection.

is this still true in a world where NAT routers are the norm ?

Hello, I'm "misguided"

[rodrigoandrade]

I've been online since mid-1995, and never suffered an attack, aside from a couple minor virus infections from pirated games.

Until recently, I played the tin-folied-hat, security/privacy paranoid nutjob, being very careful when visiting unkown or shady sites (always using FF or Netscape back then), stacked under layers upon layers of AV, firewall, NAT router, anti-spyware/malware, anti-trojan, and whatever other crap Symantec and McAffee could sell me. I couldn't buy/download/update enough secuity software.

And yes, I've been doing trouble-free banking and shopping online since 1995. And who says money can't buy security??

One day I decided I had enough!! Partly due to a period of unemployment (03-04), partly due to a slow PC (Pentium with 64 MB of RAM), I decided to shun most of that security stuff little by little. The free AV (resource-hog Avast) was the last to go.

Fast-forward to 2008, 3 PCs later. The only security feature I have is my NAT router, and best of all I'M STILL DOING TROUBLE-FREE ONLINE BANKING AND SHOPPING!! No virii, no malware, no nothing!!!! I scan my PC once a year, just to be safe, and still nothing!!

As it turns out, unlike Symantec, McAffeee et al would have you beliveve, COMMON SENSE goes a very long towards keeping your PC safe. Best of all it's free!!!!

And yes, I've been using Windows all this time, and my PC stays online almost 24/7.

Re:Hello, I'm "misguided"

[Bobfrankly1]

I scan my PC once a year, just to be safe, and still nothing!!

Oh, you use Antivirus2009 as well. Sad.

Re:Hello, I'm "misguided"

[Anonymous Coward]

Do you scan it offline or online? As in, do you boot from external media (which you created using an uninfected PC) to run the scan, or do you do it on the machine?

My parents machine was dumping out spam (verified with wireshark) even though AVG said it was clean and updated. I installed other AV softs, same thing. I copied softs like stinger to external media, booted a PE disk, still clean.

I finally downloaded an .iso with AV built in on my linux box, burned it, and rebooted the infected PC with it. Almost every single EXE was infected. But as far as all the security softs on that machine could tell, it was clean as a whistle.

Re:Hello, I'm "misguided"

[JasterBobaMereel]

I was reinstalling a PC at work, started it downloading/installing the 50+ updates it needed, after SP1 was installed ....got called away ....

Next day remembered I had not finished it ... had an error on the screen, and the System32 folder had only *6* files in it!

The error was two viruses fighting each other for control and one losing .... ...all this while logged in as a default user, and behind a NAT and firewall .....

Needless to say the machine was wiped to the bare metal and reinstalled .....

Re:Hello, I'm "misguided"

[_Sprocket_]

As it turns out, unlike Symantec, McAffeee et al would have you beliveve, COMMON SENSE goes a very long towards keeping your PC safe. Best of all it's free!!!!

It's not as common as you would think.

Re:Hello, I'm "misguided"

[Kozz]

Congratulations, you've won the fool's lottery!

The simple fact is that it's pretty hard (not impossible) to defend against 0-day exploits, no matter how much common sense (or paranoia) you might have. I suppose you run with NoScript, FlashBlock, AdBlock, etc?

I'm knowledgeable and informed (hey, I'm on Slashdot, right? [tongue-in-cheek]). I had a work laptop that was p0wned because a rogue advertiser sent a specially-crafted PDF which exploited a hole (amongst many, surely) in Adobe Reader (aka Acrobat). Since then I've replaced Acrobat with a safer more lightweight alternative and use AdBlock.

I agree that common sense goes a long way, but if it's the only protection in your toolkit, it's most certainly just a matter of time...

Re:Hello, I'm "misguided"

[Krneki]

Cool, now improve the security by using Firefox + AdBlock plus. Since most of the viruses come through advertisement, removing them makes your surfing more secure.

Re:Hello, I'm "misguided"

[Anonymous Coward]

I'm with you. I stopped using big brand AV software about 10 years ago because it kept crashing my full screen online games to tell me that it quarantined a cookie or that nothing was wrong (Much like WKUK What is it Baby?).

I have nothing protecting me except firefox and a home router with next to no security on it. Every couple years I reformat my computers to speed things up a bit, not because I have any viruses. Sure, my pc may get hacked one day whether I'm careful or not, but Norton sure isn't going to stop that from happening if I open that email from ebay saying that there are some unknown charges on my account and I need to click the link and login to access them.

Re:Hello, I'm "misguided"

[Anonymous Coward]

Is your work network infected? A single computer behind a NAT firewall is an unlikely target while it is being patched. The private network is designed to give you a fighting chance. I'd be cautious plugging machines into your so-called, safe work network. They don't call it the soft, chewy underbelly for nothing.

Re:Hello, I'm "misguided"

[Bengie]

chrome just sand box's your tabs with lower privs so an Ad can't do anything anyway

Re:Hello, I'm "misguided"

[Knara]

Sad to say, the logical conclusion is that your internal network was compromised in some fashion (an infected host on the LAN that got your install), not the external connection to the internet.

If you're at home and only have 1-2 hosts behind a NAT, this isn't as much of a risk.

Also, ever heard of OS images? :P

Re:Hello, I'm "misguided"

[G00F]

It doesn't have to be another PC on his NAT'ed network. Could be the windows iso he downloaded had a calling home backdoor feature. But I agree, getting attacked from outside a NAT'ed environment is unlikely. Using an unpatched IE on some warez site could lead him in that direction as well. But I would have a look around at the other PC's on the network.

And I rarely do an image of a system, between yearly system reinstalls of my windows box, there is new releases of everything (graphics/sound/nic/chipset drivers, OpenOffice, Firefox, opera, etc) where it is nice to have a clean system up rather than have to stack on more updates that leave traces.

Re:Hello, I'm "misguided"

[Anonymous Coward]

There must be a problem with your firewall, or NAT configuration.

Re:Hello, I'm "misguided"

[Anonymous Coward]

sounds like somebody might have installed a virus on your network sometime after you got called away. i've left several fresh installed XP boxes that had an internet connection and not one of them was messed up the slightest.

Re:Hello, I'm "misguided"

[goarilla]

The free AV (resource-hog Avast) was the last to go.

that's funny because today the free avast is probably the most lightweight and effective (free) av software i've found

jerk technique! say it louder!!1

[FooAtWFU]

"Bill! Fix your computer and stop sending me spam!"
"Dude, whatev-"
"Stop sending me spam!"
"Geez, man!
"Spam spam spam spam spam spam spam!"

The apocalypticism is getting old

[petrus4]

I'm tired of the press and so-called "experts," taking the Chicken Little approach to security, personally. There are a few basic ground rules; if you follow them, 90%+ of the time, you're going to be fine.

1. Ideally, don't use a Windows machine on the Internet. (Yeah, right) If you must, however, don't browse sites devoted to smilies, ringtones, custom mouse pointers, or that sort of crap...you're asking for it that way.

2. If you use Linux or FreeBSD, use sudo. Do NOT be an idiot and just use root all the time, and don't use sudo without a password on it, either.

3. Use multiple disk partitions. On Windows, that means you can reinstall faster if you do get hit by something, and on Linux or FreeBSD, it hopefully limits the number of places an attacker can go.

4. Realise that while virii/trojans might be common on Windows, actual live attacks on individual machines (i.e., with an actual human 14 year old on the other end) are rare almost to the point of rendering the scenario academic. That's not to say that they don't occur at all, mind you, but there was this absolute paranoid idiot who I saw being interviewed a few months back, who was declared an, "expert," who spoke of using virtualisation and various other gratuitously overblown means of keeping people out of his systems, and also advanced the theory that the entire Internet could effortlessly be destroyed in around five minutes flat.

5. Virus scanners on Windows are hugely overrated. Use one if you must, but I've never seen an infested Windows box that didn't have multiple virus scanners running, thus proving that in the grand scheme of things, they really don't do all that much. A better idea is to learn to identify the types of sites that virii can typically be picked up from, and avoiding said sites.

Basic, minimal security, up to a certain point, is of crucial necessity, IMHO. Beyond that point, however, most paranoiacs are actually hobbyists who don't realise it. Their obsessive measures aren't truly as necessary as they think they are; for the most part they do what they do more simply because they like it, than because they actually need to.

Re:The apocalypticism is getting old

[Anonymous Coward]

Why not just run a Linux host, and run Windows in a VM for tasks that require Windows? You can have a semi-up to date backup of the VM file, so if it ever does decide to die, it'd be an easy recovery.

Re:The apocalypticism is getting old

[petrus4]

Why not just run a Linux host, and run Windows in a VM for tasks that require Windows? You can have a semi-up to date backup of the VM file, so if it ever does decide to die, it'd be an easy recovery.

a) There's only a single application that I can think of which I might conceivably want or need to run Windows for, now.

b) I don't want that kind of overhead, and with my hardware, I probably can't really afford it either.

c) I don't need said overhead. If I run FreeBSD and do external backups of whatever I want to keep, assuming a 14 year old does somehow manage to hack my machine, all I need to do is reformat, change my passwords, restore from backups, and carry on with my life as usual.

If it turns Theo on to be paranoid, then I genuinely hope he enjoys himself, but the hysteria of "experts," aside, most of the rest of us truly don't need to be.

Re:The apocalypticism is getting old

[Culture20]

3. Use multiple disk partitions. On Windows, that means you can reinstall faster if you do get hit by something,

I used to suggest this for Windows. I no longer do. Why? I keep seeing reinfections from D:\autorun.inf (yes, HDDs run autorun too)
Even for people capable enough to reinstall their own OS to a specific partition, and knowledgeable enough to turn off autorun, it's common to want to check D:\ right after installation to make sure the files are still there. Oops, didn't wipe out d:\autorun.inf with a boot CD, and didn't turn off autorun yet? Reinfected.
Side benefit: copying files on reinstall helps people clean out the cruft on their desktops.

Re:The apocalypticism is getting old

[maxume]

If I thought I could destroy the internet in 5 minutes, I would do it just so I could watch it go down.

The infamy would be worth *any* legal consequences.

Re:The apocalypticism is getting old

[Anonymous Coward]

Do they let you have matches in the hospital?

Re:The apocalypticism is getting old

[ion.simon.c]

How would spreading your *nix fs across multiple partitions limit the number of places an attacker could go? Are you supposing that these partitions are unmounted at the time of the attack?

*confused*

Re:The apocalypticism is getting old

[petrus4]

Mount some of them read-only. Mounting /usr read-only AFAIK is advised practice with Linux, even if virtually nobody ever follows it because it's a pain in the ass.

Re:The apocalypticism is getting old

[ion.simon.c]

*grins* I could do ya one better. /usr /var /opt

Could all be mounted r/o on my system. :D
But yeah, I guess that that sounds like a mitigating strat... otoh, only root should be able to write to files in those dirs. If an attacker *can* write to those files, don't you have more to worry about?

Re:The apocalypticism is getting old

[rusl]

well said

My hacked PC

[Dystopian Rebel]

If I can no longer read files because of changes to proprietary formats,
if I cannot play media because of DRM,
if I cannot use my hardware because proprietary drivers don't exist and the manufacturer won't release the information needed to create an open-source driver,
if I cannot obtain security updates because my OS is wrongly deemed to be an unauthorized copy,
if I am not allowed to install the software that I buy on any PC I choose without having to call for permission,
if the software on my computer calls home without my explicit permission,
if the software on my computer transmits information about my computer without my explicit permission,

I have lost control of my computer and it has been hacked.

Re:My hacked PC

[FLEABttn]

Lost control of your computer != Hacked

Re:My hacked PC

[cj1127]

Sometimes I wish I could just killall rmsSoapbox

Re:My hacked PC

[SlothDead]

if I cannot obtain security updates because my OS is wrongly deemed to be an unauthorized copy,

Which pirated OS is excluded from security patches? As far as I know Microsoft distributes security patches to pirates to protect the customers from attacks.

Re:My hacked PC

[Anonymous Coward]

You're posting on a BBS that you have no control over. You're screwed, man.

Obligatory bad car analogy

[PPH]

Many people respond to the security issue with the idea that a PC should be plugged in and "just work" with no further effort on their part.

Think of the responsibility one has when purchasing a motor vehicle. There are numerous safety issues that the operator must address. Plus, you don't just park it and leave the keys in the ignition (illegal in many places) so anyone else can jump in and drive it around.

Obligatory Airplane! Reference

[HangingChad]

"What do you make of this hacked PC?"

"Oh, you could make a boat anchor, a fish tank, or a flower pot!"

Re:Obligatory Airplane! Reference

[ledow]

Surely you can't be serious?

Re:Obligatory Airplane! Reference

[Anonymous Coward]

Yes I am serious, and don't call me Shirley.

Re:Obligatory Airplane! Reference

[Anonymous Coward]

Of course I serious.

And stop calling me Shirley.

(Hmm, that sounds better than it looks when typed).

Re:Obligatory Airplane! Reference

[Anonymous Coward]

Yes I am, and don't call me Shirley!

common sense helps a lot

[davidwr]

If you do these easy things you will greatly lower your risk profile:

1) Install a NAT or other hardware firewall that blocks unsolicited incoming traffic
2) Never visit the Internet except known-safe sites
2b) Pray the known-safe sites never get hijacked or have off-site ads or other content
3) Never insert a thumb drive or other media except from a trusted source. Copying your factory music CDs to an MP3 player that's never touched another machine is okay, but that's about it.
4) Make sure everyone using your computer follows these practices.

You are still vulnerable to trusted web sites that get hijacked, visitors to your house that put their infected thumb drives into your computer without asking, and other issues, but the risk is greatly reduced.

The downside is you've just sacrificed the ability to use search engines in any meaningful way, as well as the ability to click on off-site links from trustworthy sites.

Now define "openly malicious"

[tepples]

Any ISP relaying openly malicious traffic needs to face consequences for it

Now define "openly malicious". Here are some minimal pairs to consider when legislating what traffic will invoke consequences:

• Are port scans malicious? Are port scans initiated by the target computer's administrator malicious?
• Is an attack intended to crack your phone malicious? Is an attack intended to crack your phone malicious if you initiated the crack in order to install an app that the phone's maker doesn't like?
• Is copying Photoshop Elements malicious against Adobe? Is copying GIMP malicious against Adobe?

Re:Now define "openly malicious"

[gnick]

"Openly malicious" is really tricky - I'll grant you that. But before going for the borderline cases, I'd start at the ones that are more "open".

E.g.
* E-mail with 1000s of recipients that are readily identifiable by postini-style filters as spam.
* Packets containing known exploit strings that are currently "popular" for compromising PCs

Now, ideally I'd like a system that didn't require these kind of measures. Short of that, I'd like a system where I could at least have a warning from my ISP so that I could respond and say, "That traffic was only directed at systems that I own or at systems from which I had consent from the owner" so that they had deniability and I could pen-test my computers or hack my phones without risking consequences. But I acknowledge that it's messy... I'd love a cleaner solution.

Re:Now define "openly malicious"

[evanbd]

It's openly malicious when the owner of the computer on the other end complains. Sure, not many will notice and complain -- but if complaining did something, a few would. Dealing with the user who got infected can be reactive rather than proactive, provided it happens in a timely manner. Most compromised machines spew so much garbage that they're bound to hit someone who will notice and care.

Re:Now define "openly malicious"

[zapakh]

"Openly malicious" is really tricky - I'll grant you that.

Nah just check the evil bit. That's what RFC3514 is for!

Re:Now define "openly malicious"

[supernova_hq]

I definitely agree with the complaint idea. This is how most other systems of law work, and it works quite well. If you have a dog that barks constantly for 3 hours every night and your neighbour complains, you get a warning. Enough warnings and the dog can be taken from you.

The same should be possible with spamming. ISP's who supply email service (pretty much all of them) should have an address where you can forward spam you have received. The spam they get there should have headers examined to determine origin, then a warning sent to that person's ISP.

Spam may not cover all the malicious, but it is where the money comes from. Ask any police officer and they will tell you that the best way to hurt a crime organisation is to hit them in the wallet. Take a pot dealer's pot, and he grows more. Take his money, and he has a shit-load of work to do to recover it.

HELP

[buttfscking]

Why is my mouse moving all by itself!?

Re:HELP

[Da Cheez]

Try gluing it down...

That's because they WANT an appliance

[zogger]

Consumers want a secure easy to use web surfing appliance, but it is unobtanium to them. I mean wtf, why isn't this obvvious yet? Not everyone is a computer nerd and specialist, most people aren't, and they have no huge desire to become one, they just want to surf the net. The computer industry just freeking *insists* on selling them devices that actually take a fairly high level of sophistication to keep running smooth and clean, because it makes them shedloads more money. Megaboatloads. The only web surfing appliances that have been on the market have mostly all sucked and been grossly over priced, and we all (here) know that.

And the computer repair and fixit industry doesn't want more rugged and fool proof net surfing appliances either, cleaning up borked windows machines is a multi BILLION a year industry. I bet for most whitebox shops it might be the bulk of their income. The computer hardware makers like borked computers because they get people on a hardware upgrade path once the consumer has been pwned a few times and people just decide a brand new machine will be the magic fix.. The operating system industry wants borked because they get people on an upgrade path, again, get them thinking/hoping new version "Grand Horizon 7.0 XPU" will be the magic fix.

This won't change until we have software lemon laws and consumer warranties.

  If a product is not "suitable for purpose", in this instance being on the net 24/7, without having to be a computer expert and installing a crapflood of other additional software, etc, this will just continue. Once it starts costing computer sellers and operating system sellers serious coin because of defective by design products, then things will change for the better, just like what happened in all other industries. It's the last industry with legalized "caveat emptor" out there, the magic get out of all legal responsibility EULA.

Obligatory car analogy: What would you think of paying big bucks for a new car, then finding out after you left the lot that you needed an additional entire trunk full of tools you needed to purchase and carry around with you all the time and at least a medium professional/serious gearhead hobbiest level knowledge of car mechanics in order to drive all the time?

That's the situation with computers and software today. Don't blame the end user all that much for getting broken computers when that is all they are provided with in the first place, no matter how much they spend on them.

Re:That's because they WANT an appliance

[Radical Moderate]

I agree with you, but good luck marketing your appliance. The tech press will trash it for its limitations, and the techie friends they talk to before buying a computer will tell them it's junk. So they'll buy a nice hackable quad-core machine to browse the interwebs.

Re:That's because they WANT an appliance

[PitaBred]

We've tried web surfing appliances. They're not flexible enough for the common user. They're ok for grandma that just sends emails, but most people use just enough of their computer to make it slightly more than a web-surfing kiosk. So we need a multi-purpose machine for 90% of the Internet-using population. With that multi-purposing comes more complexity, and more modes of failure. You can't make it more resistant to failure without removing capabilities. A computer that's more resistant to failure would look like an XBox360/PS3/Wii.

It is certainly appropriate to blame the users for failure. To use your analogy, you spend "big bucks for a new car", and you damn well better be taking it in for oil changes and fluid top-offs and maintenance, otherwise it will fail fairly quickly. Why should a computer work without maintenance? It's MUCH more complex overall than a vehicle. But there's a bonus! They give you the maintenance tools inexpensively or free... yet you still don't use them. Why are people surprised at this? Why is it a failure of the computer industry when people don't even take the time to change their fucking oil and get a car wash to keep the dirt and salt from ruining the finish and rusting away the body?

Re:That's because they WANT an appliance

[somersault]

Another car analogy is: people need to get a license before they can drive. They might be able to get a car and drive around and avoid killing themselves or someone else due to a lack of knowledge of rules of the road, but they are significantly more likely to have an accident if they haven't been trained and don't know any rules. If you crash your car due to a lack of knowledge and/or experience, you can't blame the manufacturer. Neither do you expect to be able to be able to crash into walls and come away mysteriously unscathed.

Even if the computer hardware is in good condition and the software is 100% secure from exploits, people can and WILL still enter in their password just so that they can see some titties, or fall for the idea that "your computer has a virus!" and install a fake spyware cleaner app etc. Unless the device itself is heavily restricted in its intended uses and will simply not let you install any more software, including plugins (which isn't a bad idea at all for a browsing and messaging device), it can be compromised.

If computer viruses could easily and directly kill people in the same way that a car can, then nobody would be allowed to use a computer without a license.

Re:That's because they WANT an appliance

[Anonymous Coward]

Obligatory car analogy: What would you think of paying big bucks for a new car, then finding out after you left the lot that you needed an additional entire trunk full of tools you needed to purchase and carry around with you all the time and at least a medium professional/serious gearhead hobbiest level knowledge of car mechanics in order to drive all the ti

That's why I pay the big bucks to my authorized dealer for scheduled maintenance. I probably could save money if I had more skills or knowledge, but I have no desire to do so. I don't see how it should be any different for personal computers.

Typing this from my dealer waiting for my service to be completed. They just recommended yet another thing for $100 and I said yes since I don't have a clue.

Re:That's because they WANT an appliance

[Anonymous Coward]

>A computer that's more resistant to failure would

not look like an XBox360 :)

I do agree with the other two though.

Re:That's because they WANT an appliance

[couchslug]

They don't JUST want an internet appliance, they want an appliance that will do various subsets of the functions available on various office, printing, photo editing, media dowload, etc programs and they will be pissed when an internet appliance fails to do them and to accomodate their gradually evolving desires.

They want sophisticated capabilities with appliance-like reliability on an OS whose user interface never changes.

Re:That's because they WANT an appliance

[Anonymous Coward]

Obligatory car analogy: What would you think of paying big bucks for a new car, then finding out after you left the lot that you needed an additional entire trunk full of tools you needed to purchase and carry around with you all the time and at least a medium professional/serious gearhead hobbiest level knowledge of car mechanics in order to drive all the time?

This is really just a sign of product maturity - roll back 100 years to the birth of the car and yes, you did have to be "a medium professional/serious gearhead hobbiest" mechanic to drive a car if you didn't want to be shafted when your car breaks down in the middle of nowhere.

If you can't get people to wear seat-belts

[petes_PoV]

which save their lives, what chance is there to voluntarily inconvenience themselves, to stop bad things happening to others. Most of the hazards in this article don't materially affect the hacked individual. Yes, if your machine sends spam out, that's bad, but only for the people who receive it. So their selfish natures come to the fore: on the one hand I can do nothing, on the other I can make my life harder so that a bunch of people I've never met get a small amount of less SPAM / porn / whatever.

Couple with this, the article is full of fuzzy words like: potential, could, may, can, possibly. There's nothing in it that says, authoritatively that anything bad will CERTAINLY happen if you don't secure your machine. Hell, people exceed the speed limit 'cause they don't think they'll get caught. Imagine what they'd do if there's not even a chance of any financial penalty for wrong-doing or laziness.

In the end, appealing to the average Joe's sense of community responibility is a non-starter. There's got to be mandated security that cannot be disabled. It's got to work all the time and it's got to be ubiquitous. Until then, the situation won't get any better.

Re:If you can't get people to wear seat-belts

[Culture20]

which save their lives, what chance is there to voluntarily inconvenience themselves, to stop bad things happening to others.

Regarding seatbelts: I've had better luck explaining to people that in a crash, seatbelts aren't there just to save their lives, but also that of their passengers. In a side-collision, if the driver is not wearing a seat belt, but the passenger is (or vice-versa), the one without a seatbelt becomes a bouncing projectile, injuring or killing the "safe" person in the seatbelt.
This argument appeals to the same people that never tried to quit smoking until they had kids ("I'm only hurting myself. A baby? Time to quit.")

Re:If you can't get people to wear seat-belts

[belg4mit]

Tragedy of the commons

Re:If you can't get people to wear seat-belts

[dstones]

ain't that the truth.

H*Commerce in the comments

[CleverDan]

I read through the comments and found a reference to the stop H*Commerce site put up by McAfee. Documentary style videos that the average non-./ reader can understand.

I think that 'H*Commerce' sounds a bit hokey/awkward, but I give McAfee props for trying to boost awareness.

No real-world analogue

[Captain Spam]

The problem, in my opinion, is that people who don't seem to care about computer security are the sort of people who abstract a computer into real-world analogues and stick to that, hard. That is, they're the sort who've been taught how a computer works solely by comparing it to things they know outside the computer world (i.e. "your hard drive is like a big filing cabinet and you don't need to care past that", "email is just like getting letters, just over the internet!", "the media player is like a big jukebox with all your favorite songs!"). Anything that doesn't fit in their real-world analogue system is for those stupid smelly nerds who exist solely to fix your problems when they inevitably happen.

And that last part is where it starts to go wrong. Try explaining computer security to a non-techie. If you go from the technical end of what's happening, they'll get confused and ignore you. If you go from a real-world analogue method, you'll be inventing all sorts of fantastical explanations that, to a real-world person, sound patently absurd, the stuff of fantasies and science fiction for those stupid smelly nerds who exist solely to fix their problems when they inevitably happen.

For example, they'll think you're out of your mind when you tell them there's botnets trying to break into your computer(s) endlessly without rest, and they don't care who you are or how rich you are. Try explaining that in a real-world or sorta-real-world context: There's an army of zombies on your lawn, they feel no pain, they want to get into your house, they will never stop, your brains are as good as anyone else's, and unless you stay on the ball, they WILL get in and make you one of them (not to mention the fact that, of course, we don't want zombies on the lawn). Does that sound like something anyone outside the computer world would take seriously?

They can't see it, they can't abstract it out to anything that makes sense in their minds, they don't know how it would happen, it sounds really stupid, so you're the crazy person, and they can go back to cheerfully installing smiley packs. End of story. Unless there's some way to explain it that doesn't bore them, test their attention spans, or make them think we're the crazy people, they're going to ignore security concerns and just assume it's someone else's problem. Like those stupid smelly nerds. They don't have anything better to do, just staring at all that white on black text all day long.

Computer security is like a convertable car

[AnAdventurer]

You buy a nice convertible car and you are out driving it around. The sky is cloudy and it looks looks like rain. What do you do and who responsibility is it to put the top up?

1) Do you wait for the car manufacturer to install a rain sensor (now that you are on the road and you see that it sometimes rains, that would have been a good option to get) that will automatically put the roof up when it senses the first rain drop?

2) Do you pull over before it rains and put the top up to be safe?

3) Do you drive around with the top down blaming the car maker for designing a car that can get wet and/or doesn't keep the rain out automatically all the time forever?

How is computer security different (metaphorically speaking)? I am sorry, but we all know it's up to the user.

Re:Computer security is like a convertable car

[droopycom]

Driving a convertible is a lifestyle choice.

If you cant take the Elements (wind, hot sun, and possibly rain), then you just dont drive the convertible.
Its kind of like going camping...

I'm definitely not stopping *before* it rains. If I get wet, too bad, but I'm not made of sugar, and my convertible has leather seats, specifically so that they can withstand the rain...

blame China!

[Anonymous Coward]

Some one can use it to blame China attacking US army's computer systems! Brilliant!

Cloud Computing at its Finest!

[scorp1us]

Looking at all the apps, it seems the hackers have created proof-of-concept cloud computing model. I wouldn't be so upset about haing my machine cracked if I got paid for my computing power. Then, we can all win!

That's pretty devious...

[Radical Moderate]

and I like it!

The better way

[DRAGONWEEZEL]

for me was to RAISE PRICES.

Client/friend/family: "Yeah I got some virus on my machine, it's running slow"
Me: "I'm booked through the end of the month" Lying through my teeth.
Client: "We really need this, how soon can you get here"
Me: "It'll be $100 for 1st hr, 75 for each after, I can be there tomorrow, but I have to bump Joshua smith..."
Client: "Oh thank you so much, you're the best"
Me: "Anything for you..."

Granted for family the numbers drop or change to work exchanges. But I was put in the same spot.

In fact I had one client whom I actually told I wouldn't fix there computers security issues, or work on an old machine, and they said they would pay me "what ever it took" That was the slowest $250 afternoon I ever worked. 8')

Did I take advantage of them? NO, I warned them, then when it happend they wanted my time, and I didn't want to give it away for anything less than a certain price. If you really are good at what you do, don't sell yourself short!

Re:The better way

[glyneth]

I have told my family that if they want me to fix their computers, they have to consult with me and take my advice on purchasing a computer first.

Except my mom. She'll still get free help. /sigh

Re:The better way

[Anonymous Coward]

I tell people that they can either pay the fee for decent A/V software and for my time in fixing something, or they can take the machine to a PC repair store, who will keep the machine for a couple days, and of course, it is the duty for computer repair depots to report anything unlicensed (such as software or MP3 files) immediately to the proper authorities, as well as any photos or other documents on the machine that might be suspicious.

With that logic, people almost always give me the go ahead to do the task at hand.

Screw em

[Anonymous Coward]

Why help ignorant people who don't want to be helped? I think it's funny when my friends tell stories about how they clicked on a link for fr33 prOn or 5u93r awesm GaMeZ and *horror of horrors* got a VIRUS instead.

I've heard that one too.

[DRAGONWEEZEL]

But you don't actually DO anything when you fix a computer. I mean, at least a mechanic takes parts out and puts them back in. You just click on things. That isn't real work!

I just say Sure, take it wherever you want, when it's not done right, come back to me but the price may go up.

Portables, portables...

[BrokenHalo]

Part of the problem here is the issue of readily stealable laptops, netbooks etc. The more "friendly" the system is (read MacBooks for instance) the greater the temptation to just close it up rather than logging out properly. This wipes out any benefit of encrypted filesystems and so forth, and I have to confess I am pretty much as guilty as anyone else on this count, despite the fact that in other respects I am inordinately paranoid.

In my case, this might be related to overconfidence in my (hitherto effective) competence in beating the crap out of any mugger, but nevertheless, I obviously have to admit it's not an ideal security policy.

For some reason, I'm much more careful about my desktop boxes, which are much more effectively locked down when I'm not around.

Re:Portables, portables...

[the_womble]

Assuming that it needs a password on wake up, I do not see what easy attacks there are that exploit it being suspended rather than off.

Yes, lots of stuff is unencrypted in RAM, but it would not be easy to read it off a running system.

If there is a weakness, please let me know, because I have been doing just this thinking it was reasonably secure.....

Re:Portables, portables...

[BrokenHalo]

My point was that most people don't bother with password on wake-up either.

What?

[DRAGONWEEZEL]

That's like saying an engine is reliable, so the user shouldn't change their oil?

No way. I get what your saying, but marketing for anyproduct is like that. A "mach 5 fusion power gamer"
http://www.penny-arcade.com/comic/2009/3/2/ (It's real) razor won't cut you right? wrong. A diamond is worth the jewlery stores sticker price right? wrong.

Most anyone knows that product advertising is sketchy at best, lies most of the time, and outright deception otherwise.

  That's why only hot guys with women crawling all over them drink beer right? Now that there is 25 blades on the razor, one stroke is enough? A cold soldering iron works as advertised? Spektrum TX/RX never lose signal right? Sync understands every word you speek? GPS never leads you down a dead end street? Geico is the cheapest insurance along w/ progressive, allstate, farmers, and everyone else who claims to be the best? You'll retire comfortably in any market with charles schwab?

Sorry but I don't buy it. Yeah some of those products may be best in their class, but they all lead you to believe that the product is something more than what it really is.

I had a client actually pay for that

[DRAGONWEEZEL]

then, it asked them to pay more.

I said do you know what country your money just went to?

They were like "uh... USA, China, Japan"

The answer? RUSSIA.

They went "oh shit"

I had to have them change their account, and buy credit protection. God only knows what they have tried to do w/ their card #. AV2k9 is a horrible (but easy to remove) piece of junk!

!sudo != idiot

[nuckfuts]

I take umbrage when called an IDIOT for not using sudo. I've been an administrator for many years on numerous flavours of *nix and I've NEVER had a problem caused by misapplication of root priviledge.

I've also habitually run Windows with administrative priviledges, because I personally find that the benefits of a limited account are insufficient to outweigh the repeated inconveniences it imposes on me.

I've also eschewed running antivirus software on my current (Vista x64) desktop.

Do any of these choices make me an IDIOT? I don't think so. In fact, if IQ tests mean anything, I can point out that I'm a member of Mensa, and in the high range even within that group.

Do these choices make me careless? Quite the opposite. I am knowledgeable and very CAREFUL.

Typing "sudo" in front of a command does not make you intellectually superior. What's to stop you from typing "sudo something_stupid"?

Re:!sudo != idiot

[petrus4]

I take umbrage when called an IDIOT for not using sudo. I've been an administrator for many years on numerous flavours of *nix and I've NEVER had a problem caused by misapplication of root priviledge.

Not long after the pain of installing Linux From Scratch, I accidentally typed in "rm -rf /usr" one evening when tired, distracted, and thinking I was doing something else. I've felt extremely uncomfortable using root ever since. ;)

Typing "sudo" in front of a command does not make you intellectually superior. What's to stop you from typing "sudo something_stupid"?

I use its' asking me for a password as the equivalent of a fairly strong confirmation prompt, and I nearly always have to consciously think in order to enter a password, so that also gives me the opportunity to reflect on what I'm doing. If it turns out that I've done something stupid, I can simply deliberately type in garbage instead of the password, in order to slam on the brakes.

Re:!sudo != idiot

[petrus4]

Something else I forgot to mention, about why I feel more secure using sudo.

Unless you've written a bad shell script, one sudo invocation = one root command.

Granted, you can keep issuing dumb sudo commands one after the other, but it takes more effort to do, involving possibly having to re-enter your password multiple times, in other words also increasing the likelihood of you stopping to wonder wtf you're doing.

This also means I minimise the amount of time the root account is active, which makes me very happy as well. In my own mind anyway, less active root = more secure root. It means less chance that I've made a mistake, such as a blank or partly blank +x root shell script, which an attacker can then use as the equivalent of a blank cheque on the system.

It's also been pointed out before that many consider root too powerful, with a single overall super user representing a single point of weakness in the system. I'm currently researching the means to create a scenario with sudo where ports/upgrades are handled by a single user, and a few other things are all each handled by respective users as well, and said users will only have access to very specific directories, and very specific commands. Use of text editors in particular (vi(m), ed, ee, cat, sed, echo) will be tightly restricted.

It might end up meaning that I need to type in a few different passwords, but the upside is that if I ever was going to get a potential hacker, they wouldn't necessarily just be able to bank on getting a single root password for overall access to the entire system; if couldn't get the root password, they'd need to know around six others, and if they didn't know all of them, whichever users they had broken, would only have access to very specific subsections of the system.

Re:!sudo != idiot

[Anonymous Coward]

For someone claiming to be so smart you completely misunderstood what the GP was saying. Nice work, Mensa boy.

Re:!sudo != idiot

[nuckfuts]

I could offer differing thoughts on a number of the points you make, but why bother? You make choices that you're comfortable with. So do I. I don't assume anyone is an "idiot" because they make different choices than me. That was my point.

Meh

[Anonymous Coward]

I severely restrict the value my box would add to a botnet by having Virgin Media as my ISP. You won't host too many pr0nz and warez servers on the crappy 8k/sec upstream I have.

A bit of rhetoric

[oryator]

And so, my fellow HaX0rz, ask not what a hacked PC can do for you; ask what you can do for a hacked PC.

Running Windows is already a crime (n/t)

[toby]

(should be, anyway:)

Not that I care really

[DRAGONWEEZEL]

but I recently worked on a comcast connected XP system w/o a firewall. It took 1 malware to disable win updates, which consequently caused more and more crap to come in.

However, on a vista 64 machine, I saw no problems whatsoever. It patched itself in a timely manner, and was good.

I don't know whether it was luck, or what, but that was just an observation of a recent situation.

Mechanic

[msimm]

Talk to a gearhead and have him refer you to a equally banal article and see if you read it. Security is presumably YOUR field of interest but never expect that means it should take equal footing for every other person, and thank god it doesn't because we need specialists in so many other fields. I find it arrogant to the point of stupidity when technical people are surprised or outraged by this.

When was the last time you read an article on the proper maintenance and use of airbags? Most of us just want the airbag to work. Some don't know and don't care. It's the same with anything. And when we do our jobs properly users don't have to become specialists in our chosen field(s).

"Internet security best practices"

[droopycom]

My ass!

I dont follow any either because nobody can even agree on what they are.... Like password rotation.... The most stupid "best practice" I've ever seen.

So my wireless is wide-open, I never change my passwords... and because of that I have a good life.

That may change, but nothing I can do will significantly change the odd of it happening without making my life miserable with stupids annoyance to start with...

Slow

[msimm]

an infected computer "goes slow". That's about the most you should expect out of a reasonably alert user. The more noticeable the slowing the more likely they'll bring it somewhere to get looked at. Once they do bring it somewhere the results will be fairly uneven with a lot of shops attempting upsells, recommending unnecessary upgrades or replacements (better swap out that hard drive..) with no particularly good way for the user to gauge the quality of the technician (which will frequently be alarmingly low).

What a rooted system is good for

[x102output]

glftpd / pzs-ng then xnc ;)

Anonymous Coward

[Anonymous Coward]

There is no security. Let me tell you about a recent experience with Vista. I was hacked I don't know how many different ways. I noticed strange activity on a new machine and I installed a popular anti-virus product (some say it is the best). A lot of the preinstalled stuff was infected as well as Windows Live. After repeated attempts to get rid of the infections I realized the only solution was to reformat. I used a Vista install disk and asked to repartition and reformat, but still it didn't feel right. I downloaded a Linux partition tool and found the hidden partition and got rid of it. I'd tell you the name but the last thing I want is for this tool to be targeted. On another machine I had to reset the BIOS to the defaults to get rid of the hidden partition. Even with the Linux tool.

Feeling somewhat safer I figured I would try and format a USB flash drive on a machine running the anti-virus with the latest updates. I plugged it in and it immediately started installing 'audio drivers'. Before I could unplug the Ethernet cable (less than 10 seconds) it had spread the virus to 2 other computers and I was back where I started (remove the battery, wait, BIOS defaults). The Anti-Virus was clueless. ANY USB device with storage should be suspect. This includes iPhones. I plugged an iPod Touch into an infected computer and it was quite happy to spread it to another computer. iTunes (on a Mac) was smart enough to recognize something was wrong with the infected back up and wouldn't restore it but it meant starting from scratch with contacts, settings, ...

Next comes the router. Even after the machines were cleaned some of the settings on the router my ISP provided couldn't be changed. Like disabling remote access. After repeated attempts to disable it my router went into lock down and I had to call my ISP to unlock it. I bought another router so my network is now behind another firewall but I don't think it matters. Just for fun I power cycle the routers several times per day.

I am still invited to install Adobe Flash from sites that I know don't have any Flash. I'm hoping this will stop soon.

Re:Anonymous Coward

[Anonymous Coward]

Install Vista.

Copy this to a file and name it something.reg:

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

Then run that file to have this placed in the Registry. You will need Administrator rights to do this.

End result: No more autorun.inf to worry about.

I like that idea

[DRAGONWEEZEL]

Because one client consistently uses P2P against my recommendations. I keep getting paid though, so I can't complain. They refer me to everyone so it's not too bad a deal. If a different client had issues though, & is running P2P to steal shit I think I'll bring that up!

TY!

From the comments

[Locke2005]

Now you have to work around them and they're eating your food, peeking into your private matters, running up your phone bill, misusing your name, and pushing you out of your house. Isn't that usually known as "getting married"?

wildly OT

[Clover_Kicker]

Intellectual chicks are no more likely to be understanding.

Try making it happen

[azrider]

In my home I run ALL PC's on limited user accounts, this should have been made standard 8 years ago when the push for security came about.

Windows Media Center. Two accounts - Administrator (hidden by default, accessible by three finger salute) and personal account. Try to set personal account to limited user (logged in as Administrator). Response: You must have an administrator account. In other words, You must have TWO administrator accounts (one as a personal account). WTF is this?

install Linux of course

[Anonymous Coward]

what else?

Fuk security

[Anonymous Coward]

You can take your damn blog post and shove it up your ass. If i have to freakn worry about freakn security every second of the day I'd have no time left to live my life. I didn't fuking buy a damn computer just so I can spend all my day enhancing the security of my computer to a fortress, I buy the damn box to get work done and use it.

appliance

[zogger]

Those folks could still get a regular computer then. A surfing appliance is just that, and could fill the needs of a lot of people as long as it didn't suck, ie, "web TV". Probably the OS in a rom chip, fast boot etc. Could be modular as well for adding additional chips for additional functionality if so desired. Advertise it as a web surfing, easy to use appliance.

I was actually thinking of building my own, a variant, for my next upgrade. My idea was to source a used cheap server mobo with a ton of RAM slots. Make it be filled up, gobs. Add optical drive,(and vid card and sound obviously) then use a live cd or dvd OS and set of apps, the latest Knoppix or whatever, run the whole shebang from RAM. When done,turn it off, respawn it again on demand. Much less worries, runs pretty fast. Doing that with some of the mini distros I have found is like having a top end expensive machine in terms of responsiveness. It just flies running entirely from RAM. If it was a full DVD OS and you had like 16 gigs of RAM, that would be more than enough apps and space for a fast no hassle surfer that would still do chat and email and do media playback and so on, and would be self cleaning at each restart, if it had picked up any netcooties. I think for a lot of people that would work quite well, something designed like that, a home kiosk type thing. Not for everyone, but I bet a lot of people would appreciate the no hassle self repairing surfing machine.

Re: appliance

[visible.frylock]

Add optical drive,(and vid card and sound obviously) then use a live cd or dvd OS and set of apps, the latest Knoppix or whatever, run the whole shebang from RAM

I don't know what your opinion on slackware is, but if you really want to make a custom live cd, you may want to check out slax.

Knoppix is nice because it has many more people behind it and thus has much broader driver support. But, to fit it on the media (and optimize as well), they use tricks on the iso. This isn't necessarily bad, it's just done for a targeted purpose.

On the other hand slax has a rootcopy directory that makes it easy. This was information I picked up about a year ago when I was looking into it, so things may have changed since then.

Public Activity

[rusl]

Why should someone hide what they are not ashamed of? You are confusing the issues of security and privacy. The privacy to hide what you do online is an unusual and difficult to acquire privledge since most of us get online via some big corporate entity we only quasi-trust and we want to connect with the wider world which isn't in a VPN.

Anyway, filesharing isn't something that should be hidden. As with any civil disobedience it is best done very publically. And hiding doesn't protect you anyway. It's nice that there are networks of the paranoid where you can have some level of anonymity. And we should support these/not take them for granted. But resisting the repressive tide of copyright enclosure and privacy diminishment takes a lot more than hiding in the margins. Hiding in the middle of an open field along with millions of others is Best Practice.

Let's all be sheep

[rusl]

Great advice: Follow orders. After all, if we all obey what could possibly go wrong.

onions, belts, economy

[zogger]

Heh, I still do this lugging the tools around with my daily driver 450 buck truck. The engine shutoff is a cable and piece of heavy cord I have to pull that shuts the fuel delivery off (diesel). Heheheheh

hacked pc

[whereisjustice]

No one can imagine how serious this problem is until you've been embroiled in a child porn case. My son's ex-wife had a child pornographer friend of hers hack into his computer and plant child porn in order to gain custody of their children. No matter how innocent you are, once a jury sees a couple hours of the most disgusting filth you can imagine, they'd convict Jesus Christ. It didn't matter one single bit to the jury that none of the material had been opened, viewed, most had been downloaded at times he was working, his ex-wife bragged about doing it, etc., etc., etc., my son was still convicted and is serving 30 years in prison.