Microsoft Eyes PC Isolation Ward To Thwart Botnets

CWmike writes "In a paper published Wednesday (PDF), Scott Charney, who heads Microsoft's trustworthy computing group, spelled out a concept of 'collective defense' that he said was modeled after public health measures like vaccinations and quarantines. The aim: To block botnet-infected computers from connecting to the Internet. Under the proposal, PCs would be issued a 'health certificate' that showed whether the system was fully patched, that it was running security software and a firewall, and that it was malware-free. Machines with deficiencies would require patching or an antivirus update, while bot-infected PCs might be barred from the Internet."

Comments

A better PC health idea

[h4rr4r]

I have a simpler pc health idea, stop installing the disease that is windows.

Re:A better PC health idea

[Moryath]

While your response was flip, I can see a number of ISPs - who already have policies of "sorry all we support is Windows" if you call in because of trouble on the line, and who have script-following Indian monkeys who will demand to know your OS before talking about anything else to replace ACTUAL customer service - using this at Microsoft's behest.

"Ohh, sorry. You're running OSX or Linux? We can't scan those for their patches so we're just going to block you off. Come back when you have a nice Win7 box. Oh, you signed a contract for a year of service? If you read the 4-point fonted small type on page 37 you'll see it clearly states in paragraph 18 line 3 that only systems with fully updated Windows 7 and an active virus scan package from an approved vendor such as Symantec or McAfee will be allowed access to the internet in order to keep the service trouble-free..."

Maybe Apple would be able to cry foul and get their systems allowed too, but home Linux users would pretty much be out of luck. And so much for anyone who responsibly has a home system with a hardware NAT and their ports properly firewalled too...

Re:A better PC health idea

[Jeremiah Cornelius]

I tried to get the idea of "Network Access Protection" for the Internet on the agenda, at Microsoft, for 2 years. We already had the client mechanisms for evaluating health-status, and the signed messages for communicating that status.

  I was working with big eCommerce and online finance companies. In my proposal, enforcement would be at site logon. Infected machines could not access account services or cart/profiles, etc. They'd get a re-direct to a clearing-house that would disassociate the online brand from the notice of infection. That protection site would have remediation resources.

In the end, we had some great discussions - but MS can't execute - and no one trusts 'em.

Now, Charney waves this thing around. AND WANTS ISPs TO BLACKHOLE clients! Way to go. I see this as another stealth control measure to create a defacto model for denying service. Today, it is a ZeuS infection - tomorrow an HDCP patched player or WikiLeaks cookie.

You get the idea. Stuff this genie back into the bottle.

Re:A better PC health idea

[h4rr4r]

If by archaic you mean what windows finally got via powershell only about 30 years late, then yes. Exactly that, or one of many other GUI environments.

Re:A better PC health idea

[icebraining]

2003 called, they want their FUD back.

Re:A better PC health idea

[postbigbang]

They've been championing 'network admittance control' for a long time. It's pretty difficult to do, especially in a heterogeneous OS network. Add smartphones and other possible attack vectors, and it's nigh impossible.

Yet it's a nice idea to block machines that probe servers on ssh ports with logon names like 'oracleadmin' and so on. Isolating suspect systems has to be coupled with a method to vet systems, and therein lies the rub. Unless you use pattern matching to watch system traffic for phone-homes and wierd characterizations, it's simply too tough to get anything but a homogeneous (read Microsoft clients only) network intrusion detection system to work.

Re:A better PC health idea

[h4rr4r]

You can use scanning software like nessus + vlans to do basically this in a very heterogeneous environment add in a simple intrusion detection system and you pretty much have your bases covered.

Sure this is not 100%, but nothing is. Another thing most places get wrong is not everyone needs to be able to talk to everything, even internally. White list not black list.

Re:A better PC health idea

[jc42]

I have a simpler pc health idea, stop installing the disease that is windows.

Except that if you aren't running Windows, your machine will be declared totally infected and not allowed any access at all.

Remember that it'll be Microsoft software doing the checking.

Re:A better PC health idea

[postbigbang]

I double dog dare you to vet a wifi-connected smartphone. No bases covered *at all*. Your idea only works on flat networks, rather than multi-tiered, as well. It isn't as easy as it looks.

And when you get close, your help desk lines light up with people that can't get logged on because you set your criteria too tightly and they don't have remediation for their Ubuntu 10.10.... or even their freaking Macs. The whole rubric here is to sell more Microsoft stuff underneath the perceived goodwill proffered by trying to vet then shackle machines whose state is unknown.

Re:A better PC health idea

[Jeremiah Cornelius]

"Microsoft only clients" pretty much adequately describes the malware-bearing portion of the Internet!

You only need to block access to a protected resource - who's management ELECTS this level of defense.

The real play is NOT to protect the Online Bank or Payment Portal.

It is to create a "forcing function" by which the customer remedies his client - also to helpfully cooperate on making those remedies accessible.

Why? Because Internet business models rely heavily on trust and reputation. As occurrences like "account takeover" and fraudulent transactions become more common, consumer trust in online modes for business and commerce will erode.

Your AmEx's, Amazon's and Turbo Tax's (Names from a hat - not my customers) are vested in margins that are supportable through online delivery. Their CSOs are charged with not only safeguarding their own applications and infrastructure, but mitigating the negative effects of client vulnerability on the online business model. This is a big enough problem that it drives enterprises together, at the CSO and CTO levels. They want a solution that raises the general level of trust and confidence in Internet uses.

They all see this as a problem with Microsoft - if not at fault - at its hub.

Now, Corporate Microsoft wants to use this reasonable, cooperative approach to deny service in the broadest possible way. In light of this week's failure of the Internet blacklist bill (COICA) to be ratified, without vote, in committee? I smell an agenda.

Microsoft are just the stalking-horse for Congressional supporters of COICA to use: "See, if we don't act with responsible legislation, then Industry will take the matters into its own hands!"

Trust me. I have seen how these guys work.

Re:A better PC health idea

[adjuster]

NAP / NAC without trusted computing platforms on the client nodes is a stupid, pointless idea. Unless the client can be trusted not to lie about its "health status" there's no guarantee that the client isn't simply infected with something that's smart enough to hide from "health scans".

Re:A better PC health idea

[h4rr4r]

The wifi network should not be allowed to talk to anything internal at all that can be avoided. Like I said whitelist only, so only open port 80 to your web servers from them and so on.

Re:A better PC health idea

[postbigbang]

Ah, were it true. While I follow your logic on COICA, it's not just Microsoft whose software can be swiss-cheesed, given enough attempts.

Today, one of my servers was under attack. I sent complaints to vsnl.in and their abuse and postmaster accounts bounce. No one is at the switch... or perhaps they're sleeping. So I tried to characterize the attacker. It's a Linux box running an old version of CentOS. As I write this, it's dutifully trying to logon with single letter logon names.

Yet Microsoft Windows users represent not just the statistically largest attacking surface, but the one with the most plentiful cracks that have botted machines. Bots come in all sizes, shapes and characterizations. They're not exclusive to Microsoft, just the most statistically significant.

There are better ways to prevent attacks, and better kill switches to partition-out attackers. We just have to agree on how to deploy them, rather than give the enemies of genuine freedom the tools to kill the friendlies.

Re:A better PC health idea

[postbigbang]

And how long does it take to employ a method that says: I'm ok, my virus defs are cool, I'm patched to your favorite level, so gimme the IPSec connection and credentials for this user: trusteddomainadminJoey?

You're right that trusted systems would help. One day....

Re:A better PC health idea

[postbigbang]

You're presuming that there's such a thing as a trusted perimeter. There simply is not. Each device needs to have a protection state. But how do you do this with a half-dozen client OSes and a half-dozen major smartphone OSes, etc? Answer: you don't.

Re:A better PC health idea

[h4rr4r]

No, I am stating that every damn machine be kept apart from every other one that it does not need to talk to. That is all you can do.

Also avoid running the OS that has the most in the wild exploits, that helps a lot.

Re:A better PC health idea

[h4rr4r]

Why in the devil do you have ssh available to the world?

Re:A better PC health idea

[bloodhawk]

isolating different machines has never been a problem, the problem is that isolation is not what people are after, they want to read documents and access their apps on their portable devices, they want to use whatever they prefer external to the organisation and still have their connectivity. isolating and blocking is easy, safely permitting is the problem here.

Re:A better PC health idea

[postbigbang]

Sounds good on paper.

Now user Magee needs to access his email on his iPad. First, there's the pop3 account. Then there's gmail. He surfs. A complex page cites more than a dozen (often dozens and dozens) of other IP addresses.

You gonna shut him down? I don't think so.

Re:A better PC health idea

[technos]

They've seen the horrible uptake numbers from Vista continue with Windows 7.

Step 1. Convince everyone to get behind the idea of black-holing insecure or infected machines.
Step 2. End support for all versions of Windows other than the current.
Step 3. Wait for a new remote vulnerability in older versions.
Step 4. Refuse to patch the issue.
Step 5. Profit as everyone either has to buy a new PC or a newer operating system to access the internet.

Just think about it. Something like two thirds of machines running a Microsoft operating system are still running the end-of-life Windows XP.

Re:A better PC health idea

[mysidia]

Why in the devil do you have ssh available to the world?

Because SSH is a secure protocol for remote management of computer systems.

Re:A better PC health idea

[Barny]

Or an ISP like mine, that runs whatever OS is required and best for the job, but will support anything because they have real techs answering phones.

I was floored when I setup my internet and had to do a support call, they asked what router I had, I said a x86 machine running m0n0wall, they then preceded to find out I had misconfigured my ipv6 settings...

Re:A better PC health idea

[mysidia]

NAP / NAC without trusted computing platforms on the client nodes is a stupid, pointless idea. Unless the client can be trusted not to lie about its "health status" there's no guarantee that the client isn't simply infected with something that's smart enough to hide from "health scans".

The health scans aren't meant to detect an infection; they're meant to detect the absence of an antivirus, or absence of security patches, before an exploit occurs.

It is theoretically possible some unhealthy systems might be infected while they are unhealthy and the 'health agent' fooled in a manner that will cause it to report healthy; however, if internet access is limited while unhealthy, the chances of infection are reduced.

The greater risk is a "healthy" system becoming infected and caused to become unhealthy, but the health management agent fooled to still think the system is healthy; it will be an unhealthy, infected, "apparently healthy" system.

However, that is still an improvement over the current situation, where unhealthy, uninfected, "apparently healthy" systems can establish connections with other unhealthy systems all over the place that may actually be unhealthy, infected; or healthy, infected.

The presupposition is that being healthy reduces the probability of infection by other systems.

Re:A better PC health idea

[DAldredge]

Windows 7 isn't have "horrible uptake numbers" It is actually doing very well.

Re:A better PC health idea

[Jeremiah Cornelius]

I have been in the botnet warrooms of som BIG .coms.

When dealing with non-targeted attacks on massive scale (Think ZeuS) then the non-Windows computers are rounding errors.

IE is, itself, north of 85% of the online business - no matter what is reported about overall market share.

Re:A better PC health idea

[Anonymous Coward]

Maybe you guys should stop signing up for contracts you don't agree with?

Re:A better PC health idea

[postbigbang]

There are brute force, random attacks, dumb bots, smartbots, and the real motivation: $$ and control.

Along the way, somebody gets root on money machine and has a good time. Windows machines are likely prospects, but there are a lot of unpatched machines out there. Tons. Zillions.

Changing protocols a little here and there might help. Ultimately, it's behavioral analysis that figures it out. One day we might get lucky and throw a few in jail.

Re:A better PC health idea

[znerk]

I want your ISP. Who are they?

Re:A better PC health idea

[Moryath]

When you're in the US, it's either the one monopolistic dickwad company on your area (cocks, comcrap, time waster, etc), or some combination of one of them with some equally crappy DSL company (verysucky, American Titty&Twister, etc) that equals a duopoly, or some really crappy dialup or satellite service with absolutely suck-tastic lag and lousy bandwidth.

We don't have competition, so therefore, we don't have any choice. And the Republicrats and Demicans, may they both rot in fucking hell, don't do what's necessary to fix it because they're both in the pockets of the aforementioned monopolies.

Re:A better PC health idea

[technos]

Hmm. Maybe you're right. I looked around for some numbers, and it looks like it took Microsoft nearly three years to take 20% with Vista. Win7 is currently at 19% after only one year.

Re:A better PC health idea

[Moryath]

Obviously not an American ISP.

Re:A better PC health idea

[znerk]

IE is, itself, north of 85% of the online business - no matter what is reported about overall market share.

This is because the majority of business sites (banking, etc) *require* IE to access. I have seen offices where the "big blue e" on the desktop is referred to as "the software", because any surfing takes place in a separate browser, and IE is only used to access their web-based software to do their jobs.

Regardless of market-share, MSFT has been successful at changing the "de facto" web standards; now that all the big boys have learned to make their web pages so they only break in "non-standard" (ie, not IE) browsers, why should they change their coding practices again, just because the standard actually says they're doing it wrong? They may be wrong; at least they're all doing it in the same (wrong) way.

Re:A better PC health idea

[interval1066]

"I have a simpler pc health idea, stop installing the disease that is windows."

Seconded.

Re:A better PC health idea

[Snowbat]

Today, one of my servers was under attack. I sent complaints to vsnl.in and their abuse and postmaster accounts bounce. No one is at the switch... or perhaps they're sleeping.

VSNL changed their name to Tata Communications Ltd. in 2007. The abuse account at tatacommunications.com should be operational (it's registered with whois.abuse.net).

Re:A better PC health idea

[GreenTom]

And once we have a monoculture of any other operating system, do you really think it will be any better?

Re:A better PC health idea

[ghjm]

Name another product which went from zero to 20% of all worldwide PCs in one year. Or three years.

Re:A better PC health idea

[DAldredge]

Who says you can't buy a new computer without 7 on it? It really isn't that hard to do.

Re:A better PC health idea

[Your.Master]

After three years? Are you posting from a time warp? Windows 7 general availability was October 22, 2009. It hasn't even been 1 year. And yet its install base is about a third of a product that has been on sale for almost *9* years, of which for less than 3 of those years there was another OS product (which did not do so well in the marketplace).

Even if you decided to change the subject by combining Vista and Windows 7, they combine to well over 1/3 of XP's marketshare in well under 3 years.

So let's replace that by something that makes more sense:

"Failing to replace more than a third of a previous OS product before 1 year".

I'd say that this does not contradict doing well *at all*.

Re:A better PC health idea

[bmajik]

Well, I'm a MS employee, and on my machines joined to the relevant company domains, they _do_ have NAP and it does wreck your day if your machine isn't compliant. Maybe there's a way around it. Maybe there isn't. I've never bothered to look because I just want to get my job done.

As part of the "security push that never ended", that led to XPSP2 and all of the "we thought a little about security for a change" work that MS has done since, there was finally a shift in opinion internally.

The people at MS who _had_ been thinking about security usually stuck to the immutable laws, and were continuing to think about things in absolute terms, i.e. "well, they can get root, so all bets are off"

But what changed was that someone got practical instead of ideological and said, "look, the 80 hojillion windows PCs out there don't need absolute protection against a supreme attacker with infinite time. If they could get _basic_ protection against what's getting them 80% of the time, that's progress"

And so I think you need to think about NAP and most future MS security efforts in the same way. There may not be a way to keep the most brilliant / lucky / dedicated attacker from succeeding once. But there is almost always a way to keep inelegant attacks from being successful widely and repeatably. And the #1 problem on the public internet right now is NOT all of the high profile deep penetrations against single well researched targets, it's the legions of automated remote-compromises that turn Grandma's PC into a botslave.

A network protection scheme doesn't have to verify that Macs, ubuntus etc etc are "compliant", because those are noise in the signal as a percentage of customer endpoint equipment. A network protection scheme has to keep people who want to continue running MS stuff up to date and patched. It doesnt' ahve to keep windows power users from getting on the internet if they can read about registry hacks or whatever, it has to point windows neophytes at a black-holed page that has all the patches and scanners and removal tools they need to get healthy before they go out to play for the day.

In summary: the point isn't to create Sauron's eye. The point is to tell people to put on their seat belt.

Re:A better PC health idea

[Nyder]

I have a simpler pc health idea, stop installing the disease that is windows.

I'm a gamer, so what should I do then?

Re:A better PC health idea

[Nyder]

I tried to get the idea of "Network Access Protection" for the Internet on the agenda, at Microsoft, for 2 years. We already had the client mechanisms for evaluating health-status, and the signed messages for communicating that status.

  I was working with big eCommerce and online finance companies. In my proposal, enforcement would be at site logon. Infected machines could not access account services or cart/profiles, etc. They'd get a re-direct to a clearing-house that would disassociate the online brand from the notice of infection. That protection site would have remediation resources.

In the end, we had some great discussions - but MS can't execute - and no one trusts 'em.

Now, Charney waves this thing around. AND WANTS ISPs TO BLACKHOLE clients! Way to go. I see this as another stealth control measure to create a defacto model for denying service. Today, it is a ZeuS infection - tomorrow an HDCP patched player or WikiLeaks cookie.

You get the idea. Stuff this genie back into the bottle.

You wanna know the sad part? I have Qwest and according to them, MS is my ISP, qwest just leases the line to them/me. It's almost enough to make me change ISP, but I am NOT going back to comcast, so i'm sort of SoL.

Re:A better PC health idea

[Maxo-Texas]

Notice the "fully patched" proviso too.

Re:A better PC health idea

[Grishnakh]

Can't be done, it makes too much sense.

It's like looking at all the problems surrounding marijuana, including billions spent on enforcement, the cartel problems it's causing in Mexico (which are spreading into the southern US states), billions spent on housing offenders in prison, etc., and saying, "just legalize it and tax it like alcohol and tobacco" (and drawing a parallel with alcohol Prohibition in the 30s). Can't be done, it makes too much sense (plus there's many monied interests who don't want this done, and our government is far more corrupt than it was in the 30s, or else Prohibition would never have been repealed).

Re:A better PC health idea

[sincewhen]

Do you really think so?

I wouldn't judge it to be a failure by any means, but clearly the market hasn't wholeheartedly embraced it either.

I'd say that without the forced factory installs, the current 17-18% would be much lower, and that must be a disappointing "voluntary" take-up rate for Microsoft.

Re:A better PC health idea

[smash]

SSH open to the world is pretty stupid yes, however you can restrict it to known-good hosts (as you should with any internet facing service where this is possible).

If you implement SSH properly (i.e., use public keys, and firewall incoming port 22 to only known good hosts) having your machine compromised via this vector is FAR less likely than the other exposed remote services such as DNS, SMTP, etc.

Re:A better PC health idea

[lazybeam]

One of my ISPs explicitly supports Linux: http://www.internode.on.net/support/faq/broadband_adsl/getting_connected/#So_you_undoubtedly_support_Windo :) Too bad most of you guys can't use them!

Re:A better PC health idea

[arivanov]

I had that idea around 3 years back when one of the major UK service providers asked me if I want to be the security director for their Internet ops (in an hindsight I should have taken the job).

There is a big problem with the idea in this "proactive" manner. You cannot certify PCs to connect because they do not connect to the Internet. They connect to a network behind a CPE or a router which in the administrative domain of whoever connects them. That person is not implementing it any time soon. It is _HIS_ network.

Re:A better PC health idea

[SuricouRaven]

I run it on a port other than 22. It's not going to confuse a real hacker for long, but all the opportunistic script-kiddies just scanning IP ranges won't even realise it's there.

Re:A better PC health idea

[mysidia]

however you can restrict it to known-good hosts

That's no good, when you need to connect to your machines from your laptop in the hotel room or coffee shop wireless.

Remote management technologies are for remote management.

Of course public key / certificate based authentication is the proper mechanism to use for remote access using SSH, and you need the server's public keys pre-installed on your client as well.

But it really does no good to limit SSH to known hosts, when you actually can't know what IP address you will be accessing from a-priori.

Re:A better PC health idea

[Jeremiah Cornelius]

Do you kiss your children "good night" with that filthy mouth? :-)

Re:A better PC health idea

[Jeremiah Cornelius]

Like the patch that breaks your HDCP workaround...

It's not YOUR computer, if someone else sets policy for it.

Re:A better PC health idea

[Anne Thwacks]

buy a Wii, like the rest of us!

Re:A better PC health idea

[RocketRabbit]

Windows 7 adoption rates are almost identical to PC replacement rates.

Re:A better PC health idea

[gmack]

Look at who authored that paper and who proofread it and Guess again.

Why do the IPTV and Media center people have such a large say in this? It's real goal is to force TPM down our throats. This is about protecting media companies from pirates rather than protecting the internet at large. The fact that this plan edges out alternative Operating Systems is just a side benefit. No certificate, no access and where would I get a certificate for my Debian Workstation?

If this were about Network Protection Microsoft could simply enforce this locally on the PC and not worry about the network. No patches? No access to anything but Windows Update. Simple and doesn't involve any changes to network infrastructure.

Re:A better PC health idea

[mindwhip]

infected computers may still be permitted to engage in certain activities."

Such as buying an OS / Windows Live OneCare / Other MS Service online to unblock your tubes?

Re:A better PC health idea

[wildstoo]

He said gamer, not grandmother.

Re:A better PC health idea

[HungryHobo]

Bets that in order to be issued a 'health certificate' your operating system would also have to have been certified somehow.
In order to get certified there would of course be a small fee payable by the OS vendor, hardly anything really, just for admin costs you understand.
No problem at all for any highly profitable OS vendor.

Re:A better PC health idea

[node_chomsky]

I love how Microsoft's answer to their own security holes is to force you to stop using your own computer. Proving once again, that Microsoft has no interest in engineering.

Re:A better PC health idea

[Jaysyn]

My ISP doesn't even ask about my PC when I'm having issues. They are only concerned about their modem & the router it's attached to.

Re:A better PC health idea

[queBurro]

to quote someone else in relation to your supreme attacker... "guard against Murphy, not Machiavelli"

Re:A better PC health idea

[jedidiah]

> Lol, what's the alternative an archaic CLI with shell?

Any Unix with a GUI bolted on top will do.

It's a far better alternative to giving some entity the power to keep an idiot like you off the internet.

As much as I might personally like that idea in some respects, it's an intolerable precedent that will likely have grave unintended consequences.

Re:A better PC health idea

[Alsee]

Your post left me a bit confused.

I see this as another stealth control measure to create a defacto model for denying service.

You hit the nail on the head there, and about the obscenity that this would deny people internet access if they aren't running an approved operating system, and to "Stuff this genie back into the bottle".

However I find it appalling that you were pushing for this exact system in the first place. "Infected machines could not access account services or cart/profiles, etc.". If I understand you correctly, you're still proposing making it mandatory for people to have TrustChips in their computers. You're still using those TrustChips to scan exactly what operating system and software people have. You're still banning people if they aren't running specific whitelisted operating systems. You're still banning people if they aren't running specific mandatory whitelisted software. Furthermore you are still using the false term "infected machines" when you ban UNINFECTED machines. Banning people for the grievous crime of choosing some other operating system. Yes, some sites might bother to whitelist specific Apple operating systems, and in theory specific sites could whitelist particular unmodified (and unmodifiable) compiles of Linux. However whitelisting for Apple system would be very hit-or-miss at best. Anyone with a Mac would be banned from a substantial percentage of sites, and any other operating system would in reality be subject to an absolute lock out.

In my proposal, enforcement would be at site logon

Oh joy, your proposal was that people would be free to connect to the internet but instead be banned from using the internet in any meaningful sense?

It is also misleading or naive if anyone suggests the system is just for banking and shopping. (As if "merely" banning non-Microsoft systems would be much better.) Once you actually deploy this sort of system then any and all websites can use it for any and all purposes. Do you seriously have any doubt that the system would quickly and widely be used by general websites, even "open" websites withou logons? That ordinary sites would want to check that you're not running any sort of ad-blocker? That many ordinary sites would want to check for DRM-style conformance that your OS/broswer won't save a copy of images or other content from the site?

If you actually build and deploy the system you said you advocated a large portion of sites on the internet would use it for one reason or another, and anyone NOT running the Standard Approved Microsoft OS would be largely banned from the internet. And then it just keeps getting worse. That functionality can and will be baked into protocols. Anyone not running the Standard Approved Microsoft OS would be banned from using those protocols at all on the internet.

Al also find it strange that you didn't foresee this ISP-level enforcement in the first place. Preforming the "Health Check" at the initial ISP access is the obvious and unavoidable result of any system of this sort.

As I said, your post left me confused. I have trouble reconciling how you reject this system, yet you were intimately involved in producing it. I have trouble understanding your support for the underlying system is being used in a somewhat more limited form, yet a form which was still "stealth control measure to create a defacto model for denying service". I don't understand how widespread "denial of service" on the internet is somehow Good while denial of internet service somehow crosses into Evil. Did I misinterpret part of your post?

-

Re:A better PC health idea

[jedidiah]

Windows 7 isn't some "new" product.

It's just the latest in a very long line of monopoly-ware.

It just replaces whatever the last OEM monopoly-ware was.

Of course, the last attempt was so bad that they had to offer a downgrade to the previous version.
That's part of why we're having this conversation. The previous version of Windows really is so bad
that they could not force feed it to people. Although the idea of having "downgrade rights" is still
embedded in the market.

So for a number of reasons, those individual version sales statistics of WinDOS don't really mean anything.

Re:A better PC health idea

[Bengie]

yes, lets instead use Linux, so all these shitty Windows programmers can flock to Linux and start requiring root permissions to install all of their shitty addons and then we can be right back where we started, except Linux will be the new target.

YAY. Sounds like a great plan.

You do realize that most malware is installed on a Windows box because someone get an email that says "INSTALL THIS" and when Windows says "Are you sure? You need to use Admin privs for this", the user clicks "OK". Moving to Linux would be "same crap different pile". Almost no malware these days is from Windows exploits.

Re:A better PC health idea

[m50d]

Who says we're replacing with a monoculture? Let the market be split between five or six different systems, then everyone'd be a lot better off.

Re:A better PC health idea

[TimSSG]

Wow, I was just thinking it was an Microsoft way to get all the XP machines off the internet.

Tim S.

Re:A better PC health idea

[jedidiah]

I've never once had to be bothered about what OS I was using for an ISP.

I told a tech once that I wasn't putting a Windows box on the net without a firewall in front of it and they were very accomodating.

Re:A better PC health idea

[jedidiah]

> He said gamer, not grandmother.

Then buy a PS3.

If Lemmings didn't put up with being fed shit on a shingle for more than 20 years we would not have this mess.

Re:A better PC health idea

[jedidiah]

> Windows = things work, without knowing exactly what "packages" or bits to download and compile.

+...for limited values of "things".

Windows actually tends to be a complicated difficult pain in the ass if you want to do anything
remotely interesting. It tends to break in subtle inexplicable ways. This is especially true if
you are dealing with Microsoft apps and not just the OS itself.

WinDOS has the benefit of being considered the "default option" and support from 3rd parties.

It was never good or robust by any other metric.

Re:A better PC health idea

[postbigbang]

XPSP2 was a godsend for those of us that had to scrape malware sludge from other people's machines. It gave us a needed short break. It demoted various processes and made MS think about user space isolation. Now it's session isolation with out a valid manifest.

MS can only cover their own products in terms of vetting integrity or trust. I agree with others that aren't interested in TPM, either-- it's too easy to crack and spoof. Every device on a network has to be individually and separately maintained for security purposes.

So I guess I don't agree with you much at all.

Re:A better PC health idea

[postbigbang]

>>>It would be easy to detect and block spam/DDOS zombies and a fair number of known worms just by network inspection. Not 100%, but a lot of them are high traffic and patently obvious.

That's if the machines, having been botted, are ordered into action. It's my guess that well over 2/3rds of botnets aren't in use at any one time. Why use all your soldiers at once?

Re:A better PC health idea

[Alsee]

The way the system works is that a special chip in the computer will scan what Operating System and softer you are running. This Trust Chip is designed to be secure against the owner, and secure against software. Any malware or virus is unable override this chip, but the owner himself is also denied the ability to control or override his own computer.

The simplified description is that the chip spies on your operating system ans your software as they load, and then this chip can send a cryptographically-secure spy report to other computers over the network. You're right the scans do not detect "infection". What it does is code your exact system as a number, and then check that Microsoft (or some other entity) has approved that exact system with a crypto-signature.

If you are running Windows and you get infected by something, that change in the system will change the number the chip generates for your system. That different number is not approved. Your computer gets "quarantined". You are denied internet access.

If you are running Windows and you want to an unapproved driver or make any other change to your operating system, then that will also change the number the chip generates for your system. Again, that different number is not approved. Again, your computer gets "quarantined" and you are denied internet access. You no long "own" or control your computer. Your computer is locked against you, and any attempt to change it results in a loss of internet access. In fact any attempt to change your system will also result in the chip locking you out of your own files. That's the other main function of the chip. The network function of the chip is called Remote Attestation, and the file function is called Seal Storage.

If you aren't running Windows, well the chip still generated a special number for whatever OS you are running. Obviously Microsoft or whoever else has not specifically issued an approval for that number, they have not specifically given you a cryptographic signature of approval for that number. When you attempt to connect to the internet your ISP doesn't have that number on their list of "Healthy" numbers. Your computer therefore fails the Health Check. Your computer gets quarantined. You are denied internet access.

If you want to mane an UnApproved modification to Windows, or if you're not running Windows, then your computer is treated the same way the system treats an infected machine. You are denied internet access, and they justify that action by using the phrase "infected machine" when in fact there is no infection.

Oh, and I almost forgot. If your computer doesn't have a Trust Chip in it then you can't preform the cryptographic Health Check at all. Without the chip you could falsely send the number representing a clean approved system. Without the chip a virus could falsely send the number for a clean approved system. If you don't have the Trust Chip you fail the Health Check and they have to assume you are infected. They intend to ban you from the internet if you don't have the Trust Chip to lock down your computer.

However, that is still an improvement over the current situation

Some people do think it would be an improvement to ban non-Windows systems from the internet, some people do think it would be an improvement to prohibit anyone from modifying their operating system, some people do think it would be an improvement to deny people ownership and control of their own computers, some people do think it would be an improvement to impose globally-enforced DRM system. However I suspect you might now have a somewhat less favorable view of this particular system :)

-

Re:A better PC health idea

[Hatta]

It's pretty difficult to do, especially in a heterogeneous OS network.

That's the point. Microsoft doesn't want a heterogeneous network.

Re:A better PC health idea

[JasperHW]

FPS on a PS3? No thanks. RTS on a PS3? No thanks. MMORPG on a PS3? No thanks. People with different opinions than yours != lemmings

Re:A better PC health idea

[postbigbang]

Bingo. You read between the lines well.

Re:A better PC health idea

[mcgrew]

Why and how would that ever happen? Ubuntu isn't Red Hat or Mandriva. Hell, in any Linux distro you have choices between Gnome and KDE (and there's at least one more desktop iinm). There isn't "Linux", there are a lot of Linuxes. Plus, there's Apple, and other OSes like BSD.

Why would you assume a monoculture is the natural order of things?

Re:A better PC health idea

[srh2o]

Known good hosts is a good security practice and it does plenty of good. In your case you are choosing convenience over a sound security practice. It's a completely acceptable choice, but you accept all of the consequences of making that choice on the front end. Others might decide that it's simply not worth the risk to allow ssh access from a coffee shop. Personally I'd consider a system accessing ssh from a hotel room or coffee shop as an unknown host. But there are plenty of ways to verify the host is a known-good host. Implementing them does require more work, thought and layers than simply opening ssh to the world, but security isn't convenient. "Remote management technologies are for remote management." Great, telnet is a remote management technology as well, but it certainly doesn't mean that I'm opening it to the world or even local for that matter. Security practice aren't really one size fits all. What you deem an acceptable risk, isn't for me. All I can say is that because of the practices I've chosen, I don't have the same issues on my Centos boxes that the grandparent has on his.

Re:A better PC health idea

[mcgrew]

Bitch at the game companies for not supporting your choice of OS, and install an alternate OS dual-boot. Only use the Windows side for games (or other software like TurboTax) and you'll be a lot safer.

Re:A better PC health idea

[Jeremiah Cornelius]

No. No advocacy for tracking machines - no advocacy for hardware-based "Palladium" keying.

Just a way for your machine to communicate it's AV and patch-level health state, to those you do business with.

Then, they can look at the assertion of health and say:

"OK - now log in"

OR

"If you don't update, you are likely to get rooted, and your accounts stolen. Try again, in a few minutes after getting this AV update. BTW: here's a list of free updates that our consumer interest group is making available."

That's A LOT different than: "You are denied access to the Internet. I hope you didn't need to pay a bill or renew your vehicle registration, today."

It's the difference between someone not answering your phone call - or turning off your line.

BTW. NGSCB or Palladium, or whatyouwannacallit is coming. We can't do much about it, except be glad it will have as many laws as any complex system. This is a future where every aspect of your hardware and software are signed with digital keys - of which you are not the owner.

This has worked "well" for XBox 360 and iTunes. It creates a protected marketplace, with certain reliability in use cases and safety - at the expense of economic and civil liberty. Think of these as digital "Singapore".

Intel wants to be at the root of this - instead of Microsoft, who'd proposed this PC architecture in 2002. They have a better chance of acceptance than do MS. They will provide kits - at a price - for enterprises and individuals to build their own signed spaces.

"Here's my "Cloud" - with these signing rules to participate in one of a number of roles." Not quite as inherently evil a vision as Microsoft NGSCB - but fraught with potential in terms of unintended consequences, and peppered with multiple disastrous points-of-failure.

You don't believe it is happening? I am SURE that's why Intel bought McAfee for the incredible price they paid.

Re:A better PC health idea

[Alsee]

A network protection scheme doesn't have to verify that Macs, ubuntus etc etc are "compliant"
In summary: the point isn't to create Sauron's eye.

If the system worked the way you suggest then viruses and malware could simply claim to be a Mac or Linux. Viruses and malware would be able to completely bypass the system.

If you check the PDF in the article, page 14 explicitly states that the system is supposed to run with a Trusted Platform Module. The very point of the system is to prevent a computer from faking its way past this "Health Check".

As you appear to acknowledge, this system is unable to tell the difference between a clean or infected version of a random operating system like Ubuntu system. This system also cannot tell the difference between Linux and a Virus. If you make any modification to your Windows operating system, this system is unable to tell the difference between your change and a virus infection.

If you read and understand how this system works, any modification you want to make to a Windows operating system will cause it to fail the Health Check. If you try to connect with any alternate operating system it will fail the Health Check. And yeah, a virus infected machine will also fail the Health Check.

However the point is that the system is a whitelist. It checks the precise binary version of the operating system. All it can check weather it has been specifically pre-approved. When this system sees a computer infected with an unknown virus, when this system sees a computer with an unknown operating system, all it knows is that there is unknown unidentified software on the computer. Some random operating system looks the same as some random a virus. Any system that has not been pre-approved is TREATED as a virus.

Anyone who attempts to connect to the network with Linux, or any other operating system, it will fail the "Health Check". Any computer that fails the Health Check is assumed to be infected. The computer is "Quarantined". Quarantine means that you are denied internet access.

One can certainly argue that the intent of this system is to block viruses and malware. However the fact is that the PDF is advocating that this system be imposed by ISPs. The fact is that this system treats any unrecognized operating system like a virus. The fact is that any unapproved system is denied an internet connection. In theory your ISP could put specific binary version of Linux on their whitelist so it will be recognized. However but the instant you recompile Linux it will no longer be recognized. It doesn't matter if you're improving Linux or even patching Linux to prevent it from getting infected. The fact is that the operating system binary is different, it is again unrecognized. You fail the Health Check. You are denied an internet connection. The fact that other operating systems could in theory be whitelisted is completely empty in reality. Macs would survive by for a while in a big show charade of interoperability, but it's a fantasy to imagine even they could last for long.

One could argue that there are good people with good intent working on this, but the fact is that "creating Sauron's eye" is a disturbingly accurate description.

-

Re:A better PC health idea

[BuckaBooBob]

Its failed before its even begun... How many people are Still running XP... And how many of those are in Corps that Have no intention of moving off IE6?

And really MS and Trusted Computing really?!?! Don't they just redefine what security means so they can be considered secure? Thats more like SCO Publishing a White paper on Successful Business Practices.

Re:A better PC health idea

[Jeremiah Cornelius]

They belong to the same cartel.

Re:A better PC health idea

[Alsee]

Replying to myself, I forgot to point out that the PDF explicitly advocates using legislation and international bodies to impose this "Health Check" on internet access.

-

Re:A better PC health idea

[cshark]

It's unrealistic to assume this kind of change would be anywhere but the internals of the windows operating system.
You've got all kinds of devices, other than pc's, other than windows machines, devices that are not even computers at all that would be affected if it's done by the isp.

And even if it does solve the problem of windows... it's not solving the core issue, which is that even despite years of promising security for windows machines... Microsoft has been unable to deliver.
Now they're talking about how to protect the rest of the world from their inability to secure their own product.

If this were any other product in any other sector, this would be totally and completely unacceptable.

I think it's clear that Microsoft needs to get out of the operating system business, and stick to server products where they actually do a competent job of things.

Re:A better PC health idea

[Jeremiah Cornelius]

Again - see my earlier references on this thread to Microsoft as a "Stalking Horse" for COICA type legislation and the "Obama Internet Kill Switch".

Tuesday, I get to be in an audience of security pros, being addressed by Bill Clinton. I have already heard Richard Clarke, on a number of occasions. I suspect that his messaging will be an intelligent and warm, friendly advocacy for increased controls on Internet access - in the name of financial and national security.

This is an inevitable push. Our digital technologies will be turned against our civil liberties - under the guise of defending our financial stability. The best we can hope for is a "Digital Singapore" - versus a "Digital East Germany".

The difference between Government control of Internet access in China and the US/EU? In China the state is a mechanism to enforce the mandate of a Party elite. In the US/EU Government is a mechanism to enforce the will of elite Oligarchal capitalists. This business elite deflect the unpopularity of social control from themselves towards the straw-man of "big government", which they pretend to oppose, but secretly employ towards their objectives.

It is no mistake that "the Big Dog" is being brought out to address this issue, at a time when "government control" of Internet access is being pushed as an urgent contingency.

Keep watching what develops.

Re:A better PC health idea

[Jeremiah Cornelius]

Microsoft is allowed to do this because Government doesn't want a heterogeneous Internet, allowing arbitrary use cases and communications.

Government doesn't want this because the people who bought it, lock stock and barrel, are threatened by this.

Who bought Government? That's another thread.

Suffice it to say - those who see this issue in TECHNOLOGY terms miss the point. It is not a technology issue, but rather one of POLICY.

Re:A better PC health idea

[postbigbang]

There is much paranoia in what you say. Microsoft doesn't give enough $$ to politicians to have owned them. Yet.

Policy or technology, the threats are real. Since this I responded in this threat, I've had another 1000 or so attacks on my servers. It's a normal day. I don't run Microsoft servers, but not far away from me at my ISP, another non-Microsoft user's public face business server was cracked on Tuesday. It shut itself down, but there's several thousand dollars in rework to get it back moving again.

While Microsoft has a huge statistical attack surface, they're not the only ones vulnerable. This isn't about Microsoft, this is about Microsoft and all of us that put an IP out on the Internet.

Re:A better PC health idea

[Jeremiah Cornelius]

Backwards. Microsoft is "owned" by the same interests that own Governments.

Microsoft introduces this as a part of an escalation for a controlled Internet. If there are side-benefits to MS? OK. If the benefit accrues to Intel? OK. The control mechanism is ultimately servicing Government. But gov power is not the top of the pyramid. Gov is a tool of an elite class, that prefer to have the masses fault government itself.

Re:A better PC health idea

[sexconker]

I tried to get the idea of "Network Access Protection" for the Internet on the agenda, at Microsoft, for 2 years. We already had the client mechanisms for evaluating health-status, and the signed messages for communicating that status.

Ah, so you're a moron.

A rooted client can lie about it's health state, issuing valid copies of whatever certificate bullshit you can dream up, and you'd have no way of finding out if it's true or not.

Client-side anything is pointless when the entire premise is "we can't trust the client".

Re:A better PC health idea

[sexconker]

Horse shit.
Wireless clients are no different from wired clients, except that their network performance sucks.

"Someone across the street could be tapping into my Wifis!" And someone from within the building could be plugging into a network port. Unless your wired network has armored cables, locked ports, and complete and total physical monitoring, there is ZERO practical security advantage compared to wireless.

Someone would have to break your WPA2, spoof an allowed MAC, and hop on the network when the real client with that MAC was inactive. (Otherwise Alice would call the help desk saying "My internet's being weird." and you'd be alerted.)

This isn't any more likely than Bob plugging in an unapproved device to the network, or infecting his workstation, etc.

Re:A better PC health idea

[Voyager529]

It's not that they don't exist, but if you're going to shop for a computer from an OEM, a purchase of a computer without a copy of Windows will essentially be purchased on that basis. The number of computers that ship with Linux/BSD pale in comparison to Windows units, and even fewer will have vendor support from third parties if another OS is loaded. For most, it's better to choose a computer (especially a laptop) based on its hardware, and if you want that selection, you're basically stuck with having a Windows product key sticker on the bottom. It may not be difficult per se, but it does require one to go out of their way to find it.

Re:A better PC health idea

[Jeremiah Cornelius]

Yeah. You're right. What was I thinking. Thanks for setting me straight. Glad you understand the problem so well.

Now, go back to writing your next version of ZeuS.

Re:A better PC health idea

[h4rr4r]

So at least only leave it open to one machine, so you have to get into that one first.

Re:A better PC health idea

[Kazoo the Clown]

Worse than that, how about a Wifi connected security camera. All this effort to "connect your toaster to the internet," and now that we have some of that stuff they want to bar anything that isn't running an ineffective self-serving technology like anti-virus (clue: only detects the latest threats *after* the infection-- hello?). And not all of these devices are upgradable. Get bent, Microsoft-- take your world domination schemes and shove them up your ___...

Re:A better PC health idea

[postbigbang]

AMEN.

Is that IP address the camera we think it is? Is it an iPod Touch? Is it a Blackberry? Is it hijacked, compromised, or generally a nuisance?

The world domination thing is probable. The problem of vetting the state of everything remains a problem. Admittance control is unlikely to be the answer, sadly.

Re:A better PC health idea

[Bengie]

more reason for IPv6. give a user a /64 and only block the IPs that are bad vs blocking someone's who network because of a single bad device.. bwaaa-hahaa!

Re:A better PC health idea

[Bengie]

Maybe you guys should stop signing up for contracts you don't agree with?

if given the choice between not eating or eating stale food that tastes like crap, which would you choose? Based on your post, your DNA wouldn't last very long.

If we didn't sign a contract we didn't like with our ISPs, then we wouldn't be able to post on /. how much we hate our ISPs.

Re:A better PC health idea

[mysidia]

So at least only leave it open to one machine, so you have to get into that one first.

Leaving 'just one' with a working remote SSH daemon is not a very good option. That one machine could go down, then you cannot get into the other.

Also, this implies you are ssh'ing into that machine, and leap-frogging to the other.

This is a security risk larger than simply leaving both machines open, as it means your credentials are passing through another machine.

Either there is an additional copy of your workstation's private SSH key on the machine you have open, you are typing a password, OR you are using ssh agent forwarding.

All 3 provide a mechanism a hacker could use to leverage your credentials from a trusted host, if they had quietly compromised the first machine, they could patch the SSH client to quietly log your passphrase or secret password.

If you SSH in with agent forwarding, a hacker could wait and detect that you have SSH'd in with an active agent socket, and then connect to your SSH agent socket and leverage your credentials with any machine you have access to, for the duration of your SSH session.

By SSH'ing directly to each machine, disallowing agent forwarding, and never allowing any of your servers to have SSH credentials for any other server pass through them, security is improved.

Re:A better PC health idea

[Barny]

Guess who I am with ;)

Their tech was actually pretty excited to get to configure the user end IPv6 stuff, there is very little in the way of consumer routing gear that supports it atm, whereas m0n0wall does right out of the box, err, flash device image file.

Re:A better PC health idea

[porl]

even though they are not the cheapest, i recommend them to everyone that asks me about adsl.

also, where i am at the moment i can't get adsl, so i have one of their 3g sims to use. the service has been great (although i much prefer dsl)

Re:A better PC health idea

[znerk]

You failed to read the linked article, where it explains all of the things you just wasted time and bandwidth bitching about. Congratulations.

To recap: Vista and 7 *combined* have less than a third of the market share of machines professing to be "Windows". An actual figure bandied about was 66%. Another was barely over 60%. If you spent less time jumping to conclusions with your MSFT fanboyism, you would realize that in the past 3 years, despite 2 new OS releases from MSFT, their previous Os is still dominating their market.

As far as whether you can combine Vista and 7 into one lump of crud... can you name one feature in 7 that isn't in Vista's pre-release "announced features"? Without googling? Yeah, didn't think so. Most (non-techie) people can't tell the difference between the two without pressing window-break (a keyboard shortcut to "Control Panel, System" or "Right-click My Computer, choose Properties".

By many accounts, 7 is just what Vista should have been when it was released, and they still haven't hit the whole set of announced features for Vista, even with 7 Ultimate. Kinda dropped the ball, there, fellas.

Adding in the ridiculous learning curve, and the lack of backwards compatibility (not counting the virtual appliance that is "XP Mode" and can be accomodated via virtualbox just as well), and I decided to stop paying the MSFT tax and learn Ubuntu, instead... and I'm an MCP.

--
Microsoft has jumped the shark.

Re:A better PC health idea

[ResidentSourcerer]

Great idea.

Now if Adobe would release CS for Linux;

If only I could get Mapmaker Pro for Linux;

If only I could get an app that lets me throw together an off the cuff database with forms and reports like MS access for linux;

If only I could get a word processor/ spread sheet for linux that had decent documentation, and didn't crash every two hours;

If only a half dozen web sites that I have to access to run my business didn't require using IE to access their web site;

. . .

Re:A better PC health idea

[RocketRabbit]

People don't buy a new computer to run Windows 7. They buy a new computer because a game doesn't work on their older computer, and getting a new machine with Windows 7 is barely any more expensive than Windows 7 itself. It's a race to the bottom, for generic PC (aka "windows box) manufacturers.

Compare the profits Dell pulls per PC, to that which Apple pulls, and you'll see that Dell needs to sell roughly 30 computers to equal the profit that Apple gets from a single sale. Why do you think Apple has become nearly the most profitable company in the entire WORLD? After all, they are mainly just slapping a heavily modified FreeBSD / Nextstep on top of commodity hardware these days.

Re:A better PC health idea

[smash]

Lose the laptop, you revoke the key... i password protect my keys as well, for an additional (short term) line of defence until i know that the laptop has been stolen / compromised and i can revoke them.

Re:A better PC health idea

[smash]

VPN in first, and allow SSH in only from your VPN IPs. Yes, VPN is then open to being compromised, but things like routers and switches have no business being administered by an unverified source.

Security is like onions... layers...

If your VPN server is fucked, then chances are you really should be in the office looking at it in any case.

Re:A better PC health idea

[mysidia]

A VPN is no more secure than SSH, and if the VPN is compromised, chances are you are in worse shape than if one server were compromised, plus VPNs are susceptible to the same type of attack as SSH. While an "illusion of safety" tends to propagate among VPN users, this arrangement is no more secure.

VPNs have their place, which is not to secure remote management sessions to server infrastructure. VPNs are for joining pieces of a corporate LAN together over an untrusted network, where the LAN runs insecure protocols, and workers who need access to remote things on a corporate LAN, using insecure protocols such as Windows file sharing.

And you stated a big issue so I barely need to -- the VPN server can die, and probably when you're across the country.

but things like routers and switches have no business being administered by an unverified source.

Who said anything about routers and switches? We're talking about servers. Most routers and switches deployed on the internet don't even support SSH for management, they either use either serial only, or plaintext Telnet + Serial.

Routers and switches shouldn't be exposing control plane management ports outside the local subnet, because (in general), they don't have the hardware to resist a flood, and software is infrequently updated on routers, they would be ideal DoS and hacker targets.

Routers and switches can be administered over the serial port, with the serial console switch you dial into via modem or SSH into, again, with public key authentication.

Re:A better PC health idea

[smash]

A VPN is no more secure than SSH, and if the VPN is compromised, chances are you are in worse shape than if one server were compromised, plus VPNs are susceptible to the same type of attack as SSH. While an "illusion of safety" tends to propagate among VPN users, this arrangement is no more secure.

Well actually, its an additional layer to having SSH access in from anywhere.

First, a user must get onto your network via the VPN. Then know your topology behind the VPN to log into the router/internal server/etc.

Trusting the VPN to the limited extent of then requiring public key access to get onto the device is lessening your exposure to brute force on your servers.

Sure, if they're on the VPN for a long period of time, they can run scanning tools, etc but if you've got appropriate

Your VPN server can die, if it is that important that getting back into the office to fix it is an issue, they can be installed with redundancy.

At some point, it comes down to trusting the remote SSH connection attempt enough to let it attempt to authenticate. I trust my VPN session users more than I trust the internet at large (ipsec tunnels), thus i require VPN first.

Re:A better PC health idea

[smash]

Sure, if they're on the VPN for a long period of time, they can run scanning tools, etc but if you've got appropriate

... appropriate logging in place, and perhaps a static IP on the VPN for your users who actually do need to make a connection attempt to the server, you are minimizing your exposure.

ahem

[shentino]

I presume that fully patched disqualifies anything that doesn't use Windows Update, yes?

Re:ahem

[marcello_dl]

I don't think they are after linux but after XP equipped old pcs, whose users are more likely to buy a new pc if they have issues with "health certificates".

Re:ahem

[Literaryhero]

Actually, I see it as a way to stop people from using pirated Windows. Oh, you can't pass the Windows Genuine Advantage (or whatever it is called these days), so you can't properly update your machine. Since your machine isn't updated, that means no internet for you. That would be a big disincentive to pirates everywhere.

Re:ahem

[similar_name]

At least in the U.S. it's hard to see how MS can justify anything because of pirates. Unless you build your own PC you are paying for Windows anyway. Even if you specifically look for a prebuilt PC without Windows it's hard (it is a small fraction of the market) to find one where you don't pay for Windows whether or not it's already installed. It is a travesty how hard they make it for legitimate users to reinstall Windows.

In countries where MS doesn't already have a contract to license Windows for every PC sold by a company it's hard to argue that people would pay for Windows separately if they couldn't pirate it.

My roommates laptop came with Vista Home. It has a COA key sticker on the bottom. Unfortunately he didn't make a restore disk before his computer crashed. He got a Vista Home CD from a friend. It installed fine(fine meaning I had to find wireless drivers that would work. Ubuntu sees it out of the box :) ) and then one day came up with the WGA crap. He typed in his valid COA key on the bottom and Vista rejected.

Now I have a few options to help him.

Call MS for support I should never need to activate a valid license.

Install a cracked version of Windows

Give him another reason to use Linux.

Why would MS even create a situation where 2 and 3 look like the least hassle? In the many closed vs open debates that go on here I often see people ask why anyone would complain about a system that is closed and marketed as such. I don't care how it's marketed closed proprietary systems are bad for technology and society. No matter how you market cigarettes they are bad for you. No matter how you market closed proprietary systems they are bad for society. Won't anyone think of the children? Our culture is being DRM'd, manipulated, and controlled by the golden calf instead of by people.

Re:ahem

[Archangel Michael]

Responding to undo accidental "redundant" mod ... I meant "insightful" Sorry

Re:ahem

[phantomfive]

In the old days, before Microsoft had all that DRM garbage, people would build a few machines and install the same copy on all of them. In the 90s (and moreso the 80s) it was standard operating procedure. People figured it was ok, you paid for the software after all. So Microsoft started doing the DRM stuff, learned how to write better EULAs, and a few vendors got together and gave employees an incentive to rat out their ex-bosses to the BSA, and suddenly it wasn't ok to install one copy on multiple computers. Strange how norms change.

Re:ahem

[Neil Boekend]

That seems like a great plan:

1. 1. No non-M$ systems on the internet.
2. 2. All the main routers booted of (No windows there).
3. 3. No internet left
4. 4. Let's start an internet with only non windows-systems
5. 5. Hey, WTF: the infrastructure is already there!
6. 6. A lot les spam and malware for a couple of months (at the most)
7. 7. ...
8. 8. Profit!

Re:ahem

[powerlord]

Amen.

My wife had a friend whose laptop slipped off the table where it was being used. It survived the fall, but the hard drive was toast. She hadn't received any restore CDs from the company, she was expected to make them himself from hard drive images. It was also just out of warranty, so the company told her she was out of luck (or quoted her some absurd price to get it working again).

I picked up a new hard drive on NewEgg for $60 (same size as the old one). I offered to put Windows on, but told her she'd need to buy a copy. I also gave her the option of installing Ubuntu so she'd have SOMETHING to use until she could give it to a friend at corporate to reload Windows (didn't want to give her a machine without an OS, that's just cruel to a non-techie).

She ended up liking Ubuntu and the saved money (Loaded Firefox, OpenOffice, Flash). It did what she needed, and she never bothered putting Windows back onto it. Whenever I run into her I always check how its doing and so far she's been happy and hasn't mentioned ANY problem.

Yeah, 99% of what she uses it for is probably Web related, but it speaks wonders that a lay person can be given a copy of Linux and just use it (I was expecting more support calls, or for her to get frustrated and get a friend to put windows on it for her).

Maybe the year of Linux on the Desktop isn't so far away after all.

Re:ahem

[Hatta]

Dude, shrug your shoulders and say "that's why I use Linux". Don't be an enabler.

Re:ahem

[dupeisdead]

While I agree that that wga is stupid and annoying, it takes less than 5 mins to solve over the phone.
- call them
- type in the authorization id on keypad
- answer their question that it's installed on only 1 pc
- type in key they give you

yeah its a pain once, but pretty sure that 5 mins is less than the time it takes to even find a wga crack and ensure it stays working.

the real problem is that the mfg of notebook customized the windows install and locked it to the bios. the key on the bottom of the notebook is actaully a dummy key,its called SLP keys.

intent?

[lx93]

another good approach to censorship.

WTF

[Anonymous Coward]

M$ should be bared from the Internet.

Re:WTF

[The Archon V2.0]

M$ should be bared from the Internet.

Why do you make me think of naked Ballmer? What did I ever do to you?

Pay for it?

[headkase]

And who exactly is going to pay for this? If your system is not infected can you be exempted from a "monthly fee" or is it punishing everyone when Windows is the majority of infections? Maybe Microsoft should pay for it all?

Re:Pay for it?

[X0563511]

Perhaps it's MS that should be cordoned off from the net at large...

Oohh, doesn't sound like such a good idea now, does it MS?

Re:Pay for it?

[sqldr]

I'm more worried about the implications. On one hand it's great to not have loads of unpatched computers bent over with their arseholes facing the internet sending me spam, DOSing stuff and distributing child porn. Then again, "you cannot go online unless you download this patch from microsoft".. what if the patch contains something I don't like?

Re:Pay for it?

[Peter Simpson]

And who exactly is going to pay for this?
Oh, you are, of course. I mean, was there ever any doubt? This is Microsoft. They'll be the ones signing the certificates (for a fee), selling the anti-virus and deciding whether your PC is safe enough. Running Linux? Sorry, no certificate and no access...we don't support Linux.
Bad Idea.

Re:Pay for it?

[X0563511]

I'm guessing you didn't catch my (intended) tone. I share your opinion in truth.

Re:Pay for it?

[Alsee]

I'm more worried about the implications.
"you cannot go online unless you download this patch from microsoft".. what if the patch contains something I don't like?

Oh, you missed a whopper of an implication. You can't even install that patch until you install Windows.

If you have a computer infected with a random virus, all this system knows is that it doesn't recognize the stuff on your computer. If you have a computer with some other OS, all this system knows is that it doesn't recognize the stuff on your computer. In fact as far as this system knows you could have a Windows system infected by a virus, and the virus is trying to sneak past the Health Check and avoid the new Windows patch by pretending you're running Linux.

All this system understands is that you failed the Health Check.

Your computer has to have the Trust Enforcement Chip to even preform the Health Check.
Then you need to be running Windows.
Then you can install the patch from Microsoft.
Then you pass the Health Check.
THEN they want your ISP to allow you internet access.

-

Re:Pay for it?

[Bengie]

The issue is not the OS, but the end user.

Most 3rd party crapware, that every farmville freak(stereotype) will install, will say.. "Hey I need Admin privs to install!" Then the program goes along, changing system settings.. lalalalalala. Next thing you know, the computer is infected.

Now, lets pretend we're using Linux.

I'm some stupid end user.. lalalalalala... Ohh look!! some useless program! Lets install!.. I need to enter my root password to install?.. OK!!.. yay!! now I have one more annoying thing.

How long do you think Linux will survive and onslaught of morons?

Show me an exploit in Win7 and I'll show you one in Linux. From a security standpoint, both are secure, the problem is the users.
I'm not saying Win7 is any better than Linux. I would love to use Linux if it transparently supported my games, but Win7 is actually quite a good OS and MS has made huge improvements.

Re:Pay for it?

[sqldr]

As much as I appreciate Microsoft bashing, I don't think they would go that far :-) You mean Apple, who already have.

Re:Pay for it?

[Alsee]

As much as I appreciate Microsoft bashing, I don't think they would go that far :-)

You are still missing how the system works. There is no Microsoft bashing involved.
I will stipulate that Microsoft is run by Mother Theresa and Gandhi.
I will stipulate that Microsoft is staffed with angels and saints.

The way this system works is that the Trust chip scans the exact operating system binary running on your computer and generates a 160 bit number (a 54 digit number). This number is what the Health Check uses to pass you or fail you. An important point here is that, for all practical purposes, the number of different values can be considered infinite. If someone gives you a random number, you have no way to know what that number means. If a computer is infected by a virus you will get some particular, but arbitrary, number. In fact a virus can evade identification by deliberately randomizing the Health Check number - it can simply generate some random (but unused) code in itself when it infects the system.

Under this system a specific known clean OS binary shows up as a specific known number. Under this system an infected computer shows up as a random number you've never heard of. If this system is going to do anything at all, the only thing it can do is treat a random unrecognized number as a virus.

The only way you can pass the health check is if the system does recognize your specific number as acceptable. The system can do this in one of two ways. The first way to do it is for the ISP to preform a direct check against a whitelist of known approved numbers. The ISP would need to add a particular number to their accept list. They would need to add a specific number for each exact-binary operating system. Most of the ISP's customers use Windows, so obviously your ISP will keep their list up to date with the identification numbers for Windows. In order to force you to patch your system they take your operating system's number off of the approved list and they add the new patched number to their accept list.

The second way they can check these Health numbers, they way that will actually be used, is with an indirect check. They can look for a cryptographic signature from somebody certifying that a particular number (your particular number) represents a clean operating system. Obviously Microsoft is an authority who can legitimately certify that a certain number represents a clean version of their operating system. Apple is also an authority who can legitimately state that particular numbers represent clean versions of their operating systems. Obviously ISPs will put Microsoft on their whitelist to certify clean systems. ISPs will probably put Apple on their whitelists as well, however I certainly wouldn't want to be a Mac user worrying whether an ISP had bothered placing Apple on their whitelist.

In theory your ISP could put a specific binary version of Linux on their whitelist, but ISPs are hardly going to get into the business of certifying specific compiles of Linux or anything else are clean. Much more reasonably, in theory an ISP could put someone like RedHat on their witelist, and RedHat could provide signatures certifying that a particular number is a clean version of their operating system. However good freaking luck if you think your ISP is actually going to bother adding RedHat or anyone else on their whitelist. And even if your ISP whitelisted RedHat, you still fail the Health Check and denied internet access with any other Linux distro. And obviously you have no chance whatsoever if you're using BSD or any other operating system.

ISP's won't be "banning" Linux, they will simply say they don't support it. That already happens today, most ISPs really don't want to hear from you if you're running anything other than Windows. They'd rather just drop you as a customer than deal with support for "strange" operating systems.

But lets pretend we live in Candyland. Lets say your ISP does put RedHat or whoever on their whi

Re:Pay for it?

[sqldr]

The way this system works is that the Trust chip

Apple have made such a device. Microsoft haven't. Innocent until proven guilty?

Re:Pay for it?

[sqldr]

PS. be concise :-)

Re:Pay for it?

[Alsee]

You seem to obsessing over Microsoft.

There are more than 100 companies involved in developing and pushing Trusted Computing, and a good argument could be made that Intel as the primary company responsible for initiating it, developing it, and pushing it.

Apple have made such a device. Microsoft haven't.

Microsoft doesn't manufacture PCs, so obviously the number is zero and will remain zero.

However Microsoft does dictate hardware specifications that manufacturers have to follow for their hardware to be compatible with Windows. At one point Microsoft did in fact declare Trust Chips would be REQUIRED on all motherboards in order to be compatible with the next release of Windows. Hardware manufacturers screamed that they wouldn't be ready in time, and Microsoft's internal development project ran off the rails, and they cut the TPM from the hardware specification.

It's funny that you refer to the kerfuffle when a some Apple computers were found to contain this chip. You appear to be unaware of the fact that the !!!majority!!! of Windows computers being sold today include this chip. More than 80% of laptops contain this chip, and a lower but rising percentage of desktops are now shipping with the chip.

Innocent until proven guilty?

Who? And guilty of what?

You seem to be obsessed with the Microsoft angle, and to that extent they are certainly guilty of abusing their monopoly position to dictate to manufacturers that they MUST put Trust Chips on all motherboards, or be driven out of business. It's pretty obvious that no PC motherboard manufacturer could possibly remain in business selling motherboards that were incompatible with Windows. Manufactures must comply with Windows compatibility specifications or they are dead, period. The fact that Microsoft backtracked on that move doesn't change their guilt in intention and guilt in action when they declared the Trust chips would be a mandatory specification.

But if we set aside your obsession with Microsoft, I'd say the first "who" to consider is the Trust Chip itself. I am a programmer and I have read 332 page technical specification for the chip. The chip is specifically designed to be secure against the owner. The chip specification explicitly refers to a "rogue owner" as an attacker, and explains that parts of the specification are MANDATORY in order to secure against the owner. So yes, I'd say it is "proven guilty" that the chip is specifically designed with hostile intent against the owner of the computer. And if we consider the "who" to be the Trusted Computing Group that designed the chip and published that specification, they too are are "proven guilty" of hostile intent against computer owners. There are over a hundred companies that have joined the Trusted Computing Group, but it was founded and is primarily controlled by five companies: AMD, Hewlett-Packard, IBM, Intel, and Microsoft. As such, they share the "proven guilt" of designing the chip with hostile intent against computer owners. Or more directly relevant to this story, we can consider the "who" to be this internet access control system. I have read the technical specifications. Those specifications "prove it guilty" of operating as I describe. The future effects the system will have if it does get deployed are not "proven", however it is quite obvious what effect it will have. As far as I am aware you have not disputed that this system will indeed have the future effects that I described.

You seem to think this is just some anti-Microsoft bashing, just because I point out that one of the results of this system will be to give Microsoft effectively monopoly ownership of the internet. If I had a choice between (a) killing Microsoft while letting Trusted Computing proceed, or (b) GIVING Microsoft monopoly ownership of the internet while stopping Trusted Computing, I'd let Microsoft own the internet. Trusted Computing is vastly more destructive than just this particular side effect that happens to benefit Microsoft.

-

Re:Pay for it?

[Alsee]

To quote Pascal, Twain, Jefferson, Hemingway, and Goethe:

I apologize for the length of my post. I had not the time to make it shorter :)

-

Re:Pay for it?

[sqldr]

and I apologise for finding something else to read 1/3 of the way through.

IPV6's Killer App!

[TheNarrator]

Every connected device will be mandated to have the bottom 64 bits of its ipv6 address store a pc health certification identifier which will link to their owner's unique citizen identifier. I told you this was coming...

Re:IPV6's Killer App!

[X0563511]

Trusted Computing for the lose.

if this DOES happen, lets have a betting pool for how long it takes to fuck it HDCP-style

Re:IPV6's Killer App!

[plover]

I have a cheaper implementation. Just set the evil bit upon boot up, then clear it once the PC passes a health check. And it's even IPv4 compatible!

Re:IPV6's Killer App!

[Jurily]

Every connected device will be mandated to have the bottom 64 bits of its ipv6 address store a pc health certification identifier which will link to their owner's unique citizen identifier. I told you this was coming...

Specifically, your plan fails to account for

(X) Lack of centrally controlling authority
(X) Open relays in foreign countries
(X) Asshats
(X) Jurisdictional problems
(X) Armies of worm riddled broadband-connected Windows boxes
(X) Joe jobs and/or identity theft

Re:IPV6's Killer App!

[Nyder]

Every connected device will be mandated to have the bottom 64 bits of its ipv6 address store a pc health certification identifier which will link to their owner's unique citizen identifier. I told you this was coming...

Yes, remind us again, because everyone loves a "I told you so" person.

Re:IPV6's Killer App!

[AltairDusk]

I'd prefer that we prevent it from happening in the first place.

Modelling real disease?

[gringer]

If you want to model how our body recognises and deals with disease, you need to concentrate on whitelists, rather than blacklists. Vaccinations are similar to a community blacklist, but for most pathogens our own immune system can work out what things are appropriate to reject.

Re:Modelling real disease?

[girlintraining]

Sigh. They don't want vaccinations. They want their client base spending money on half-baked security solutions. So in addition to the license, you have to pay for a certificate, pay for software certification (goodbye open source), pay for the software, pay for the bandwidth to keep your system online all the time, pay pay pay pay pay....

And nothing will change except you'll be paying more.

Re:Modelling real disease?

[X0563511]

Oh no, something will change.

We'll get our own private internet to use our OSS in. I'm sure I'm not the only one who would do what they could to put an "alternate" backbone in alongside the Microshit one (at it's expense, of course)

Re:Modelling real disease?

[izomiac]

That's not quite how our immune system works, but I agree with the idea. IMHO a good measure would be to enforce a whitelist for system changes and permitted executables. Wanna change the wallpaper, that's whitelisted for "*" so go ahead. Wanna add an autorun, oops, it's not on the list, the registry key (or shortcut, or service, or system task, or line in a config file, etc.) cannot be created. Large businesses can run their own whitelist, home users can pick one (or none) that they like, e.g. the "keep crapware from slowing stuff down" list, or the "don't let me change/delete anything important since I'm a noob" list.

Re:Modelling real disease?

[DrSkwid]

We did it ourselves before everything got ruined by the internet

http://en.wikipedia.org/wiki/Blue_Wave ftw

Re:Modelling real disease?

[gringer]

That's not quite how our immune system works, but I agree with the idea.

I consider the whitelist to be equivalent to the process of selection against autoimmune antibodies, mentioned at the end of this section. B cells won't ordinarily progress through to maturation if they generate antibodies with affinity for self signatures.

Re:Modelling real disease?

[mister_dave]

No. The Computerworld article offers an example:

Carney's ideas are neither new nor untested, as he pointed out in his paper. For example, Comcast, the largest residential Internet service provider in the U.S. with an estimated 16.4 million subscribers, recently announced it would notify customers when it detected a bot on their machines. Comcast will direct infected users to a site that walks them through a malware clean-up chore.

In the UK, Virgin Media (ISP) are also doing something similar:

Virgin Media subscribers whose computers are part of a botnet can expect a letter warning them to tighten up their security, under a new initiative based on data collected by independent malware trackers.

The UK's third-largest ISP will match lists of compromised IP addresses collected by the Shadowserver Foundation, among others, to its customer records.

Those with infected machines will be encouraged to download free security software to remove the malware and protect their connection in future.

Re:Modelling real disease?

[Pharmboy]

Yes, as a former member BBS of Fidonet, (and bluewave user), yes, we were able to have our own virtual "internet" at a cost. Sort of.

To those that are not familiar, it meant my BBS (the system users would call into) would call up a regional guy at midnight, and he would call a national guy at 3am, etc. to transmit all those messages. They were not real time, they bounced around systems via phone line. The average "email" from the US to Europe used to take 2 days. This is only slightly faster than RFC1149 - Standard for the transmission of IP datagrams on avian and was slightly more expensive.

In the same vein, I DO miss the internet back in the days when it was "hard to use". That is the problem when you make something so simple an idiot can use it: Idiots use it.

Great idea!

[Legion303]

This is a not-at-all-terrible idea that will ensure people are up to date with such security patches as WGA. Bravo, Microsoft, bravo.

What he really means is

[santax]

If those darn pirates of our lovely and very safe OS that can't update due to our policy of finding income more important than safety on the web could be disconnected, we could make even more profit!

Already a mechanism for that

[courteaudotbiz]

It's called BSOD :-)

Re:"Running Security software"

[AnonymousClown]

RUN NORTON OR NO INTERNET

If those are my only two choices, I'll take NO INTERNET please.

Gov vs Corp

[Dutchmaan]

Can you imagine the hysterics if the government had proposed this! But it's a company, so I'm sure it's all OK.

Re:Gov vs Corp

[red_blue_yellow]

The difference is the perception of competition among corporations. With the federal government, you know you don't even begin to have an option. With corporations, at least you can pretend for a while...

Re:Gov vs Corp

[Alsee]

Can you imagine the hysterics if the government had proposed this!

I regret to inform you that the government has been proposing this every year for at least the last ten years.

It seems to have disappeared from the internet, but I saved a copy of a PDF from the December 4&5 2001 Global Tech Summit in Washington D.C. It contains the keynote speech from Richard Clarke, Special Advisor to the President for Cyberspace Security. He literally cited Osama bin Laden in his call to secure the internet. Here are some snippets from that keynote speech:

I think we need to decide that from now on IT security functionality will be built in to what we do, to the products that we bring to market.

TCPA, the Trusted Computing Platform Alliance, is an example of bringing hardware and software manufacturers together. But TCPA is not enough. It's a good beginning, but it's not enough.

It is not beyond the wit of this industry to figure out a way of forcing down patches.

ISPs and carriers can insist that when cable modems and DSL hookups are made, firewalls are installed. It is not enough for an ISP or carrier to say, oh, and by the way, you might want to think about a firewall.

If you check the PDF on this story, the plan is explicitly based on TPM Trust Enforcement Chips being built into computers as part of forcing down these patches and controlling internet access. "TPM" is the modern name for TCPA.

The US Government has been pushing this crap harder and harder each year in the "National Plan to Secure Cyberspace" and the plans to "Secure the National Information Infrastructure" and in every other Capitalized Plan And Policy And Strategy Regarding The Internet. The government has been funneling tens of millions of dollars of grants every year into developing this crap. Starting in 2006 the US Army mandated Trust Enforcement Chips be included in all new computer purchaces, I think(?) this policy been science extended to all military computer purchases, and the government has been seriously discussing making it mandatory for all government computer purchases. The really fun is that the explicitly stated purpose for this government policy. The purpose is to use government buying power to fund and manipulate the manufacturing industry. The declared purpose is fabricate a commercial demand to ramp up production of these chips, and for these chips to be included by default in ALL new consumer PCs. The government has been increasingly pushing this agenda in international relations and in bodies under the UN. Unfortunately the European Union has, if anything, become even more eager than the US in their grand plans to in promoting the new Information Economy and the new Information Society. Yay for more Capitalized Plans from our European brothers. There has been increasing activity from all parties on plans for instituting Internet Governance. It's interesting to note that the world's most repressive regiems are most enthusiastic. They are just drooling over the surveillance, control, tracking, law enforcement, repression, and censorship that comes along with locking down computers and locking down the internet internet access and internet communications.

Just to link a single example of recent government work product, Slashdot reported on White House Unveils Plans For "Trusted Identities In Cyberspace" from the President's Cyberspace Policy Review. And lets have a Capitalized Yay for the Capitalized Identity Ecosystem it wants impose on us. If you actually get down into the proposal it is the same crap to lock down our computers with these Trust Enforcement Chips. Not only can these chips preform Health Checks to grant or deny you access to the internet, these chips will lock down our digital identities and manage our privacy. If you read the fine PDF in that link, page 4 has an "Envision it!" box explaining how this Identity

Further proof

[Darkenole]

There is no cure for stupid.

Re:Further proof

[X0563511]

40 grains cures it just fine...

Re:Further proof

[onionman]

40 grains cures it just fine...

Wrong website. Although, I am curious about how many computer geeks get this reference. Most of the ones I encounter (I'm in academia) would assume that you've misspelled "grams" and were talking about a mood stabilizing drug.

Re:Further proof

[h4rr4r]

I think he just is not using enough. 165-190 grains at about 3000ft/sec might be more likely to solve the problem.

Re:Further proof

[onionman]

Okay, that's two!

(Yeah, 40gr seems a bit lite to me, but it is sufficient... and substantially cheaper for practice purposes than your suggestions.)

Re:Further proof

[Nimey]

174 grains at 2600 feet per second would let you deal with it at range before it can /touch/ you.

Re:Further proof

[X0563511]

You assume I'm talking about the bullet. I was referring to the powder :)

Re:Further proof

[Moridin42]

40 grains of powder... 7.62? out of an evil black rifle?

Re:Further proof

[AJWM]

I just assumed he was talking powder weight, not slug weight. For slug weight that's in the .22 ballpark -- and if you're close enough for that to be truly effective you might as well just whack them over the head with the butt and save the ammo.

Re:Further proof

[Deathlizard]

Customer Service Bat.

Very effective and it has the added benefit of dropping IT dept stress dramatically, Although the Housekeeping dept. seems to beg to differ for some reason.

Re:Further proof

[!eopard]

Not neccessarily. I'm from Australia (which has fairly strict firearms laws) yet I'm still thinking this is 40 grains of gunpowder as imagine a single bullet to use (or perhaps pellets in a shotgun cartridge). As to whether that projectile targets the PEBKAC or the PC, well that's someone else's decision.

hope I have the right terminology, I didn't Google any of it.

back OT, while the expressed sentiment may seem fine, I doubt that every Linux distro could be checking their installs and issuing certificates. Yet another way to dump on open sauce :/

Re:Further proof

[Nyder]

There is no cure for stupid.

death.

Re:Further proof

[sempir]

There is no cure for stupid. Bullshit. Put them all on "Finest Kind Zulu Gold Grass"and they will be cured of stupid for ever!

Re:Further proof

[mapkinase]

You mean "ignorant" or "negligent". I have seen very bright minds (not in the field of computer security or system administration) whose computers were compromised in this or that way. The fact that you are skymodded reminds me again about the slashdot snobbery.

Re:Further proof

[Jaysyn]

Rat poison? Gunpowder? Wheat Fire?

Re:Further proof

[X0563511]

All of the above? (at the same time?)

Re:Further proof

[AltairDusk]

To oblige your curiosity I'm happy to report I got it immediately.

Microsoft's real motive

[Dunbal]

while bot-infected PCs might be barred from the Internet.

      Or rather, machines that don't have the right "health certificate". You know, like ones running discontinued operating systems, or "unsupported" operating systems.

Re:Microsoft's real motive

[cgenman]

I'm sure Linux and other systems will just spoof the certificate.

Which brings up the bigger question of "how do you supply a health certificate?" You can't expect the computer to respond properly, because any virus would just spoof the right answer. You *might* be able to have the local machine certified by a remote machine, but IP addresses change constantly, and then it's just a question of spoofing to the certifying machine.

On a practical scale, how can this even work?

Re:Microsoft's real motive

[Dr_Barnowl]

This comes from the MS Treacherous Computing group, so spoofing the certificate may not be easy.

A certificate would be composed of a hash of all your critical OS components, constructed and signed by the TPM chip on your motherboard.

This would be a form of Remote Attestation. MS, and their real customers in the media cartels, would love to get the thin end of this wedge into Windows, because it would mean that you could e.g. provide streaming media servers while being sure that the client is an official approved client, running an approved software stack that hasn't been tampered with to do naughty things like dump the stream to disk.

Using it to keep virus-infected machines off the internet is just a piece of spin - the real reason for wanting this is the usual - a general purpose computer is a powerful tool, and many powerful interests feel nervous about them being under the full control of their owners.

Re:Microsoft's real motive

[Hatta]

Linux might be able to do that, once you desolder your trusted computing chip and dump it. That is, if it doesn't self destruct on dumping.

Re:Microsoft's real motive

[Hatta]

In short, it won't. Think of the timescale involved in a new virus/worm/trojan/vulnerability being discovered, the time it takes to figure out how it works, and the time to patch/fix it.

You don't have to know anything about the virus. Microsoft knows the checksums to all the files in Windows. All they have to do is include hardware that checks theses files for any changes. We're talking about a white list of verified systems, not a blacklist of bad stuff.

Oh yeah, and if you disable, or attempt to emulate the trusted computing chip, you're breaking the law under the DMCA/ACTA/etc.

We're talking a multitude of OS's, various windows boxes (XP, vista, 7, home/pro/corp), unix boxes, bsd boxes, linux boxes, OSX.

No we're not. Depending on how cynical you are, banning non-supported operating systems from the internet is either a nice side effect for Microsoft, or the entire reason for this initiative.

Re:Microsoft's real motive

[dupeisdead]

Wow. Everything is about media companies? do they meet in underground parking lots at 3am in the shadows?

Stating the Obvious

[SilverHatHacker]

This would be really ugly for Linux, BSD, and possible OS X boxen, but I would expect Apple to play along while proclaiming that their certificates are better because they come stamped with a big shiny sticker.

Re:Stating the Obvious

[thestudio_bob]

This would be really ugly for Linux, BSD, and possible OS X boxen, but I would expect Apple to play along while proclaiming that their certificates are better because they come stamped with a big shiny sticker.

I know your joking, but Apple is pretty adamant about not placing stickers on any of their products. Case-in-point "Intel Inside" stickers.

Re:Stating the Obvious

[DAldredge]

Instead the place a huge glowing apple on the back which can't be removed.

Re:Stating the Obvious

[Reaperducer]

And somehow it's yet another Apple thing that the Wintel crowd now copies.

I've never understood why Windows machines are shipped looking like they belong in a NASCAR race.

Re:Stating the Obvious

[MysteriousPreacher]

Stickers make computers go faster. it's like painting stripes on the sides of cars. When peeled off the computer will slow down, but the nice sticky residue left behind on the palm rest will help prevent the user from falling off while browsing the web at high speeds.

Re:Stating the Obvious

[arivanov]

It is not an apple thing which is copied. It has been invented long before Apple. Google for Trusted Solaris (or DGUX even before that).

Apple is simply the first company to successfully integrate the idea with a commercial model into a working consumer PC.

Re:Stating the Obvious

[spitzak]

I am even more amazed by the number of people who do not remove all the huge colorful stickers on the edge of there very expensive HDTV (the ones saying 1080P! and listing all the types of inputs it takes). This includes very intelligent people btw.

File under "Dumb Ideas"

[vtcodger]

If Microsoft or anyone else were capable of certifying a computer to be malware free, and being right about it, malware wouldn't be much of a problem, now would it?

File under "Dumb Ideas"

Re:File under "Dumb Ideas"

[MightyMartian]

Not if the core idea is to cripple any competing operating system by depriving them of Internet access, under the guise of "security".

Re:File under "Dumb Ideas"

[h4rr4r]

DING DING DING, we have a winner. Everyone else can now go home.

Re:File under "Dumb Ideas"

[straponego]

No kidding. That program would be worth more than Microsoft.

Re:File under "Dumb Ideas"

[by (1706743)]

My alma mater did this, and it seemed to work out quite well -- any MAC address which had been shown (by their free Mac+Windows utility) to have run the anti-virus scanner (included in the aforementioned utility) was then whitelisted, and given access to the 'net.

Non-OS X *N?X users were automatically whitelisted (which also meant that any tech-savvy user could simply spoof running Linux to avoid running the utility).

Re:File under "Dumb Ideas"

[adjuster]

It's worse than that. The idea is to introduce pervasive and potentially legally-mandated "trusted computing".

Re:File under "Dumb Ideas"

[h4rr4r]

Mac address is a very bad metric, very easy to spoof. Switchport is the correct level to do this at.

Re:File under "Dumb Ideas"

[Sir_Lewk]

The whole point of the system is basically to require people that don't know better to run virus protection software, while staying out of the way of people that do know better. If you know enough to get around they system, then they are not particularly worried about you anyway.

My school did this as well (requires virus software for windows users, whitelists everyone else automatically) and it worked out rather well.

Re:File under "Dumb Ideas"

[pspahn]

Thank you for being the one to say it.

I almost never use AV software. In the past, when I suspected an infection, I would run something that told me I was infected, and I would just backup-reformat-reinstall.

I know that malware of today tends to be much more inconspicuous. It is not always obvious that malware is present. I run this risk will full knowledge of potential consequences. One of the consequences is that my machine isn't always bogged down by some crappy AV suite that will tell me I'm infected, and then attempt to remove malware unsuccessfully, meaning I have to reimage/reinstall anyway.

The irony here is that I do run that Windows Defender thing occasionally. It comes back and says everything is fine. I don't really trust its accuracy, but then again, if someone wants to try and steal my banking info or something, they won't find much anyway.

Re:File under "Dumb Ideas"

[v1]

the local univ here basically has the same requirements. You don't get your MAC packets to route on any of the campus's switches or routers until you've brought your computer into them to "secure". (read "scan and then install bloatware")

Mac users kept bringing in their laptops because they've been "norton'd" and aren't working right anymore. Symantec's had a pretty good track record lately of making their software very hard to remove. Two years ago a removal tool didn't exist and they'd point you to a web page to type in, I am not kidding, almost 200 lines in terminal. And even doing that, it still would cough up errors all over the place because bits were still installed.

It took them over a year and somewhere around 10 version of a shell script wrapped in an applet to get their "removal tool" to do a close to proper removal. And about that time they got the kinks worked out of Symantec AV vers 10-12 and they didn't continuously hose the computer. I haven't been forced to remove Norton in half a year, it's fairly well behaved now it seems. But 2 yrs ago it was downright malware, and I felt sorry for all the students that had to pay us to remove the crap their school forced them to have installed.

Really, AV software on a Mac? how does that brilliant idea make it up the chain of command at a large university's IT staff? (care to bet they got a site license that just so happened to include macs as well as pc's, and thought "sure why not, what can it possibly hurt?") I haven't seen a virus on a mac in almost 10 years, since the days of OS 9, and the only malware I've seen is the dns-changing trojan ("click here to download and install the codec required to play the porn you are trying to view") that installs a cronjob to keep your dns servers pointed to their banner servers. (which incidentally has dreadfully bad response time, forcing them to bring in their computer because "the web is slow", where the malware is instantly identified and removed) Not really smart of them to do something that triggers an immediate trip to the shop for removal? But I digress.

Yes this really does reek of a "everything will be much better if you buy exclusively from us, we can take care of you as long as you don't buy from anyone else." Riiiiight. Cuz you've shown you're just so good at that.

Re:File under "Dumb Ideas"

[sshir]

you do understand that as soon as it's widely used, virus writers will add that "functionality"?

Re:File under "Dumb Ideas"

[node_chomsky]

If Microsoft or anyone else were capable of certifying a computer to be malware free, and being right about it, malware wouldn't be much of a problem, now would it?

File under "Dumb Ideas"

I think you are giving Microsoft too much credit for even caring about the user experience, I think Microsoft could do something about malware and spyware, but that would involve actually spending their time and resources developing their own product instead of developing the world for their product. Microsoft loves to shift responsibility over on the user for their hole-ridden software.

Re:File under "Dumb Ideas"

[Hatta]

Trusted Computing. Where it's the government that can trust your computer, not you.

Re:File under "Dumb Ideas"

[AltairDusk]

My alma mater had a less intrusive method, if they detected your machine trying to infect other nodes on the network your switch port was blocked and redirected to a page notifying you that your machine was infected and you either needed to clean it yourself or bring it down to the campus help desk where they would be happy to assist you (for free of course). All it took to get your connection back was a quick phone call saying you had addressed the problem, if you hadn't you would be seeing that page again in very short order.

Re:File under "Dumb Ideas"

[Sir_Lewk]

Of course. I don't advocate this sort of thing for use on anything but university networks for a very large number of reasons (least of which is it won't work for very long at all). On relatively small private networks though? Works great.

I should add that I don't have the technical details of how their system worked, but I believe it used nmap's OS fingerprinting. The process of getting your computer off of the protected subnet onto the real network took a minute or two regardless of your OS, but only window's users had to install antivirus to get through it.

(and yes, this system doesn't do squat for booting off windows boxes that were previously approved, but later became infected. This goes back to the whole issue of "antivirus isn't actually worth shit" though...)

Re:File under "Dumb Ideas"

[El_Oscuro]

In a Unix based system like a Mac, wouldn't something along the lines of:

# rm -rf /opt/symantec

do the trick?

Re:File under "Dumb Ideas"

[diverman]

Yeah, one problem... Anti-virus is not terribly effective against a lot of the botnets out there! They update themselves more often than most A/V companies update their DATs. And many of them are managing to root-kit the system, so even if it's cleaned, hidden processes (even from the OS) just reinfect.

I work in security. I tracked down 2 systems just this week (a number of others I provided for the local sys admins to track down) that had spam malware (detected and tracked down through outbound traffic monitoring for a 15K+ employee network). One of the systems got a clean bill of health from McAfee... well, actually, it found malware, said it cleaned it, except for some running processes. So, reboot the system... all the malware came back. The system had a root kit that can really only be cleaned by a full re-install of the system (or an off-line boot CD that could possibly clean it if properly identified). And the user who didn't know better just assumed he was clean when the A/V software said he was, and that maybe he kept getting infected... but felt safe because the McAfee "status bar" was green.

So... while it sounds like a neat theory, I am highly skeptical of it being fully successful. It would reduce things greatly to ensure people are running A/V. Although, it also forces people to run A/V, and probably only "supported vendors".... i.e. pay someone to scan your system if you want to use the Internet, in addition to you Internet access fees. Not sure how I feel about the power posturing and shifts in this scenario.

Re:File under "Dumb Ideas"

[v1]

oh no. Pretty much every AV software digs itself deep into the system. Multiple running processes, launch daemons, startup items, hooks hooks hooks. Some of the really fun ones outright replace kexts with their own to hook things that normally aren't hookable. (and imagine the overhead this adds)

My favorite symantec trick... user brings in their computer, they've done what appears to the layman to be the right way to remove the app... deleted the "Symantec" folder in /Applications. Now they get popup errors several times during startup and all the time they try to use their computer, because components can't find each other anymore

Uninstall it? Symantec tells you how. Open the Symantec folder and run the uninstaller. What, you deleted the folder? Reinstall it.

OK, try to reinstall. "you must first remove the previous installation before reinstalling". No I'm not kidding. Can't uninstall it without installing it. Can't install it without uninstalling it. Brilliant! Fastest resolution at that point is to find another similarly norton'd computer with same version on it and do a drag and drop of the symantec folder over and then run the uninstaller. No, you can't just copy the uninstaller, it won't start the uninstallation unless it finds everything that's supposed to be there.

IMHO, symantec is worse malware than the malware it purports to save you from.

Re:File under "Dumb Ideas"

[Sir_Lewk]

Duly noted.

computers or windows installations?

[brenddie]

computers don't get infected. Windows installations are usually the problem. Besides, I dont need no internet driving license

Re:computers or windows installations?

[djdanlib]

Computers don't get infected? They sure do. Like those SCADA systems infected by Stuxnet, for example. Yes, Windows is an infection /vector/ for them, but they don't run Windows and if you manage them from another OS, you can still inject the same code. How about hypervisor viruses, and things that otherwise push malware into the BIOS or other flashable EEPROMs? Heard of the ones where they can compromise your car's electronic control systems? What about the ATM exploits that were demoed this year? Oh, how about the hacks that alter the firmware on a printer, PS3, Wii or iPhone?

Now, if you changed it to "OSes and applications and data and sometimes hardware all get infected" you'd be mostly correct but your original argument sort of dies at that point.

This is just a lockout for OSS

[Anonymous Coward]

They just want to lock out Open-Source OSes, which won't have such a procedure due to the fact that it doesn't use binary-only distros with checksums built into the low-level OS.

Re:This is just a lockout for OSS

[icebraining]

Well, Debian has debsums, but it's not useful for security purposes, only as a corruption check.

Re:This is just a lockout for OSS

[Rich0]

Yes, and I wouldn't use any of them if I couldn't choose to modify them at will - and get myself kicked off the internet in the process...

Nothing against distros - they're wonderful. But, the whole idea of FOSS is that the computer OWNER gets to choose what to run.

Wow.

[Anonymous Coward]

Where is the USDOJ when you need them to remind Microsoft about their recent trip down anti-trust lane? Not to mention a nasty little thing called "collusion" - whichever AV and PKI vendors are selected naturally benefit, and I imagine all the ISPs will have to agree to enforce this as well or suffer some consequence.

A framework like this makes two assumptions that spell doom for future innovation by free thinkers: Microsoft Windows on every consumer device that connects to the Internet and every device using "Microsoft approved/recognized security software." Not a bad approach at first blush since that describes a large part of the marketplace and at least 100% of the problem, but honestly - there are better ways to solve this than trying to fit the future Internet ecosystem into Ballmer's limited imagination.

Read the paper. Please. And look for it soon as a key exhibit at the next anti-trust action against Microsoft.

Re:Wow.

[choongiri]

that describes a large part of the marketplace and at least 100% of the problem

Yeah, I hear you. MS really does feel like 150% of the problem, doesn't it.

Re:Wow.

[phantomfive]

There won't be another anti-trust lawsuit. Microsoft learned from their mistakes last time, and now donates enough to ensure it will never happen again. As documented here. It is really a shame that companies have to give money politically to avoid lawsuits, or that money donated can have any effect on lawsuits, but that is the reality of the game right now, and Microsoft is playing by the rules, and playing well. That's why there won't be another anti-trust lawsuit.

Re:Wow.

[znerk]

whichever AV and PKI vendors are selected naturally benefit

Hmm... like, for example, Microsoft Live OneCare? Sounds like roll-your-own will be MSFT's way to go.

Yeah, I know, OneCare's discontinued... but if this flies, how long do you think it will be before some other AV solution is rolled out by MSFT, and touted as the "best" way to maintain your internet connection?

ok, then: a couple questions

[Dhrakar]

First; who will be administering this program? Under what authority could an organization possibly 'certify' systems that are located around the world?
Next; How often would these certificates need to be updated? Every time a vendor issues a new patch?
Third; What kind of crazy-ass DRM would be needed to keep folks from just spoofing the certificates?

    Unfortunately, this is the kind of simplistic easy-to-follow proposal that our congress-critter really go for... yeesh.

Re:ok, then: a couple questions

[MightyMartian]

In one respect it reminds me of all those really stupid anti-spam proposals like SPF that started rolling off the assembly line of dumb-ass ideas about six or seven years ago.

Moron: Yeah, you see, everyone with a legitimate mail server will have this TXT record that says "I'm legit, you can trust mail from me!"

Guy With Actual Experience: Uh huh. So what happens when the spammers start buying up domains, putting in the SPF TXT record? What happens when a server with an SPF record is hacked?

Moron: Um, well, you know, we need to add some sort of certificate... Yeah, that's it, a cert, and that will make it a-okay. You'll be able to automatically tell the good stuff from the spam.

Guy With Actual Experience: Uh huh. So what happens when the spammers start buying up domains, putting in the DKIM record? What happens when a server with an DKIM record is hacked?

Moron: Um, well, um... um.. UM... <BOOM... HEAD EXPLODES>

I think this idea sits in the same category of simplistic idea put forward by morons who really haven't got the foggiest idea what the fuck they're talking about.

Re:ok, then: a couple questions

[Nyder]

First; who will be administering this program? Under what authority could an organization possibly 'certify' systems that are located around the world?
Next; How often would these certificates need to be updated? Every time a vendor issues a new patch?
Third; What kind of crazy-ass DRM would be needed to keep folks from just spoofing the certificates?

    Unfortunately, this is the kind of simplistic easy-to-follow proposal that our congress-critter really go for... yeesh.

I know, let's use HDMI, it's safe, no one will crack it.

This would get abused

[erroneus]

Being anti-virus protected and updated sounds like a great idea until you ask questions like "which vendors of antivirus are excluded?" and "which updates will Microsoft push as critical that are just another piece of crapware or something that would break compatibility with something important to the user?"

Microsoft should be responsible. They should push out adblockers and javascript blockers. It makes browsing a lot safer. Oh no... commercial interests would be pissed and we know those interests are of more importance/significance than the end users are... remember Vista and all that DRM encumbered crap? We all know they had the consumer in mind when they did that.

Re:This would get abused

[erroneus]

Preaching to the choir. I run Linux everywhere. At work; at home; with green eggs and ham. I have converted lots of users to Linux and have been especially successful with people who just want to do their social networks, web and email. "It's about the things you want to do with the computer, not about the computer or the software itself. If this doesn't suit your needs, I'll put Windows back on for you." I have also used "It's like Mac OS X in many ways in that it's not Microsoft but will still do a great job at the things you need to do."

But I have seen people spend thousands of dollars in order to keep their Windows systems going and up-to-date where free/oss would have done the job just fine. Fear and change are motives that drive people to extremely unreasonable lengths to avoid. It doesn't matter how bad Windows is. What matters is that they know Windows. There is just no getting around stupid.

Re:This would get abused

[Rich0]

Oh, don't worry - this will be completely open to anybody - that pays for QA testing of anything they release. As long as ubuntu pays $10k per repository change they'll get to keep their certification and use the internet. As long as you don't use anything that isn't either in the repo or sold in a box, you can even get some use out of your $30/month ISP bill.

For MS that is no big deal - they'll pay $10k per patch Tuesday and start EOLing every OS they make after three years. Oh, and you'll be paying full retail every three years too, because no doubt pirated copies of windows will fail to validate and get issued a cert.

Even RHEL would have trouble keeping up with such a system...

Re:This would get abused

[DAldredge]

You do know that Linux has security issues too? Don't you?

Re:This would get abused

[djh101010]

The part that really bothers me is when otherwise intelligent friends are convinced by some retail-droid that the reason their 2 year old Windows box is slow, is because it's old. Um, no, it's because you've installed every malware toolbar, weatherbug, animated email notifying dancing teddy bear, and Crom knows whatever else. When I suggest to them that perhaps they buy me a bottle of Scotch, or case of (good) beer, and I'll sort it out for them if they leave me alone while I do it, suddenly _I'm_ the bad guy. So I shake my head sadly, watch them piss away another grand or so on hardware that will render their FarmVille farms 23.8% faster, and, well, yeah, I can't even find a way to take pleasure in it. A simple "let me install a REAL antivirus and adblocker...or let's do this for real and let me install this leenucks thing that you've never heard of, it'll be fine". The few people who have gone with that, haven't asked me to put VirusOS back on. The rest, keep buying new hardware when they get re-infected badly enough. Wow. I should figure out a way to get those people to pay too much for computerspeedup.com or something.

Re:This would get abused

[djh101010]

I'm sure he does. Right now, my Mac is asking to install "security update 2010.06". How many security updates has 'doze had so far this year? Unix/Linux, vs. Windows, have an entirely different security model. You know that, right?

Re:This would get abused

[djh101010]

Microsoft's error messages for "This vendor hasn't paid the extortion fee to get this app certified for a microsoft icon" pretty well predicts how they would implement this whole thing. An alarming error message saying "Whoa, dude, if you install this, it may just Shut. Down. EVERYTHING." or whatever. They're extorting payola from potential business partners, and intentionally spreading FUD against those who won't play that game with them. I don't expect this concept, pure as the driven snow as presented but we all know Ballmer and freinds, to be executed any more honorably.

Re:This would get abused

[znerk]

You do know that Linux has security issues too? Don't you?

I am aware that a few Linux security issues exist, but I haven't seen anything even remotely like the Windows exploits' proliferation. Can you point me at a website or other documentation that shows some in-the-wild exploits for Linux-based systems? I swear I'm not trolling, I just really don't see the parallel.

To be honest, I read something along the lines of "Tens of thousands of new Windows malwares (virus, trojan, adware/spyware, etc) in the wild every day, 25 proven exploits of Linux in the last 15 years (only 2 of which were ever in the wild)", but I can't recall where I read it. I would welcome some information that contradicts that. No, really.

Again: This is not a troll, this is a serious inquiry.

Re:This would get abused

[bloodhawk]

http://www.zdnet.com/blog/security/report-apple-had-the-most-vulnerabilities-throughout-2005-2010/6801

Apple also combine all their security patches and release a single patch/advisory every few months, so that 6 is in reality at least 10 times that amount of vulnerabilities or more, from memory one of them mid year had about 30 vulnerabilities patched in it.

Re:This would get abused

[DAldredge]

I am nearly positive that you are unable to tell me the difference between the two security models.

Re:This would get abused

[pyrr]

"Remote execution/privilege-escalation exploit" is the category of issue you're thinking of, not security exploits in general.

Linux has plenty of security advisories that may be exploited, but almost every last one requires physical access to the machine to do serious damage. However, Linux has almost no credible remote execution threats; there are a handful from useful apps that are installed on Linux, such as Apache. It's simply not the situation where anyone sitting halfway around the world can poke at your ports a little and root your Linux server through no fault of your own (and by "fault", I mean failing to choose a strong password and keep it secure).

Local exploits are simply not the same class of risk as remote exploits. It's so very much more difficult for purveyors of malware who want to convince your computer to join their botnet when they have to break into your house to root your system, or to trick you into signing-up your system to distribute their worm voluntarily through your own stupidity.

The problem with Windows and Microsoft's integrated applications such as IE is that remote execution/privilege-escalation exploits are everywhere. Try connecting a computer running Windows XP SP1a directly to the internet. It'll get pwned before you can even navigate to the M$ site in order to download the security updates it needs. Fortunately, Windows isn't quite that XPloitable anymore, but it's still pretty bad when you visit a website, and that website (which may have an otherwise reputable operator aside from having their database injected with malware) exploits your browser, which in turn hijacks Windows. This is the problem: there's not sufficient compartmentalization between the "untrusted" area of the computer that runs applications that venture into risky territory, local userspace (which is not infallible, but generally not malicious), and the system's inner sanctum. In effect, Windows security is generally so poor that it just allows internet traffic to wander right into that inner sanctum, largely unchecked. It's inconvenient for users to encounter locked-doors or security checkpoints, but if trusted users aren't subjected to such inconvenient and unsightly things, then unauthorized/untrusted users aren't subjected to them either.

You trust the window latches in your home or the deadbolt on your front door to keep random, unauthorized strangers who you don't trust from entering your home, stealing your stuff, or setting-up a webcam in your bedroom. You presumably already trust the people in your home or office who are going to be able to just sit-down at your computer, so local exploits are largely moot. If you can't trust your operating system to not let strangers from the internet have full access to system files and resources, it's not trustworthy computing.

Re:This would get abused

[znerk]

"Remote execution/privilege-escalation exploit" is the category of issue you're thinking of, not security exploits in general.

You are absolutely correct, thank you for the correction and information.

Several of the AC posts were ignored, due both to a general distaste for someone unwilling to provide me with even a pseudonym to respond to, and the idea that religious fervor has no place in a serious discussion of the merits of an OS; but you caught right on to what I meant, even if I didn't express myself properly - I bet your users are quite happy.

Re:This would get abused

[djh101010]

Hm. I'm responsible for operations for 2300+ Unix servers, it's possible that I do in fact know the difference. I'm not really interested in comparing resumes here, but, sometimes people make comments that they _are_ qualified to make, after all.

Has anybody else had this problem...

[skogs]

Old SMS client -- System Management Console --- Is supposed to be automatically updated via sms push to the new client -- Configuration Control/Console or whatever.

I've seen computers fall off the 'good' list and onto the 'naughty' list quite frequently. They don't generally patch themselves and make it up to the 'good' list on their own...though that is specifically the idea. M$ hasn't gotten it right for the last decade...so obviously they are going to patent the process and make more money off other people that DO make it work.

Re:Cisco already does this...

[h4rr4r]

Or you can just use anything like nessus, vlans and some simple scripting.

My way has the advantage of being way more cross platform.

How is this like vaccinations?

[drdrgivemethenews]

Vaccinations are voluntary, at least in the free world. They don't shut the door to the hospital if you haven't had one.

[Please don't start about health insurance now, that's not mentioned in the article.]

Re:How is this like vaccinations?

[EmagGeek]

You must not be talking about the US, where you cannot attend school, university, or get a job if you have not had your government mandated mind contr^H^H^H^H^H^H^H^H^H^H^H^H vaccines.

Re:How is this like vaccinations?

[plover]

Not quite. Vaccinations are mandatory in several situations. Some jurisdictions require them for public health workers, police and first responders, etc. And I think almost all schools require them.

Here's a good stupid story about required vaccinations. Last winter I had an academic hold placed on my record because I never bothered to provide evidence of a measles vaccination. Apparently being enrolled in an online-only program, and not being within a thousand miles of the campus in 40 years doesn't mean I'm not a terrible threat.

Re:How is this like vaccinations?

[Oligonicella]

I only showed my daughter's vaccination in grade school. She and I both went through middle, high and college without having to show. I have never in my life shown vaccination proof for a job. Other than grade school, you're blowing it out your ass.

Re:How is this like vaccinations?

[PPH]

You have to bend over and drop trou' to get one?

Re:How is this like vaccinations?

[bogjobber]

I moved a lot growing up and I had to show proof of vaccination for every grade school, high school, and university that I attended as far back as I can remember. But for each there was an exemption for people who were morally opposed to vaccinations. The parents (or the student if they were 18) just had to sign a waiver.

Re:Catch 22

[Anonymous Coward]

You get what you deserve. Next time, don't drink the Microsoft (spiked) kool-aid

A few problems...

[Todd Knarr]

1. Define "fully patched". On my systems the version numbers often have nothing whatsoever to do with what patches have been applied to them. Sometimes the patchlevel's updated, but many simply don't bother updating the version. And what would they update it to, anyway? There may be thousands of permutations of applied patches, there's no way to assign versions to them.
2. What security software? I don't know of any "security software" vendors who make anything for my systems. And frankly I'd consider a system that needed security software to be fatally buggy and I'd be replacing it ASAP with something more secure.
3. Firewall? That's something I run on the border routers to control access to my network. Internally firewalls are verbotten, they cause too many technical problems. Untrusted machines get access via wireless (everything connecting by wireless is by definition untrusted, it's not nailed down permanently to the wiring), with client isolation turned on and access to the internal network only via IPSec VPN. If your machine needs a local firewall to be safe, over on the wireless segment it goes without VPN access so it can't endanger my network.
4. Malware-free, that's the normal state of my machines. Malware is a hazard to be blocked at the edge of the network, and my systems do a pretty good job of it.

I've been running since the early 80s, and have yet to have anything of that sort found on any machine under my control. Which is more than I can say for the networks I've seen "protected" by the major security vendors, every single one of them has regular problems with malware infections. So, when Microsoft can show me a network that's been running under their system for say 5 years with no machine on it ever needing to be cleaned of malware, then I'll take their recommendations seriously. Until then, well, I'll stick with the procedures and policies that've given me a 25+-year clean track record.

Oh, and one of those policies? No Microsoft software unless absolutely necessary, and when necessary it's use should be heavily controlled and restricted to only those things it's necessary for.

Re:A few problems...

[Hatta]

And none of those problems mean a thing to the politicians Microsoft will bribe to mandate Trusted Computing.

Re:A few problems...

[Bengie]

well, I've been using Windows since Win95 and I've only have one infection and that was when I was a kid playing around. So, 1 infection in 15 years. I skipped Win3.0 because I liked DOS better.

Actually, I recently got malware installed on my computer at work. Seems one of my regular sites Slashdot/Arstechnica/Tomshardware/etc had an ad that made use of a Java exploit to elevate and execute. Stupid Java. I'm not sure which site because I typically have ~25 tabs in Chrome opened at once. Chrome had an update, so I installed, and when Chrome reloaded all of the pages, a JVM icon popped up in my tray and about 2 seconds later some malware was claiming to have found virii on my machine.

Man, if only I had disabled Java. AT the time, it was patched up-to-date. Quick google and I found there was a know exploit for several weeks. Which is also funny because around that time, there was a known elevation+execution exploit that was known in Linux for over a year. Luckily, no one cares about exploiting Linux....and your code would've had to found a way to be ran as a user on a Linux machine. but it was still there.. for over a year!..omg.

Actually, being half-way awake, I figured it out. It's not that Linux is more secure, but that the GNU community as a whole creates free software for almost anything you can think of. If you need a feature, you can get it from a well known open-source group. You don't need to find some unknown 3rd party with a closed binary that does who-knows-what on your machine. Also, with the lack of accountability of a closed binary, whomever makes the software doesn't give a crap how they implement their features.

When you go Linux/*nix, you don't get a great OS, you get a great OS and a great community. This as a whole is what makes GNU software awesome.

Anyway, you Linux freaks, help get Wine DX11 support so I can switch over!

How about ....

[AHuxley]

Just coding a real OS, with real security, with real support?
Copy what works in OS X, Linux, Unix and any bespoke or research OS.
Put all that wasted outside effort into a new clean MS OS, port/code over the Office/productivity/games and release low cost consumer dev tools.
Like a big console for todays next gen Intel/AMD/ARM based hardware.
As every product is an app and gets 'tested', most of the basic legacy MS malware should be cleaned out.
Drivers are written for the OS under strict new testing and NDA controls.
A shorter list of new hardware. No more "Linux" ports or other strange license options, quality DRM is a must. Apps can be free (code free so the young can learn to make apps and later earn from their efforts in the MS way), small cost or consumer/prosumer ect.
Call it MS ~ Newstart, add the new "BIOS" efforts so it starts real quick.
Add some subsidised Youth Allowance and MS Study so the young and university staff can be guided into code and app development.
For countries with populations where cash flow is still an issue, roll out MSAid ~ MS Agreement for International Development.
Well funded local community plans to ensure the generational use of MS products.

Another guise for Trusted Computing

[khchung]

Who gets to decide what constitutes "fully patched", I guess Microsoft? So if I refuse the WGA patch, my machine will be quarantined?

Of course, to make this work, program doing the detecting (ie Windows) must be running on a trusted base. Um, didn't we heard something like this before, like Trusted Computing?

We all know this is not about security. This is about control, MS just wants to have its own walled garden, seeing how profitable Apple's garden is.

What do you bet...

[TechForensics]

Now! Download your Microsoft Health Advantage certification application! (Note, validation required.)

Re:What do you bet...

[Dewin]

I read that as Windows Health Advantage and went "WHA?"

Predicated on "trusted computing"...

[adjuster]

It seems like most everybody doesn't understand (or notice footnote 14 on page 5) that, in order for this to work, all the subject devices must have trusted processing capability. That means "TPM" chips, signed OS kernels / hypervisors, and the inability to run untrusted root-level code. Take a second to laugh at the idea that anyone will be able to introduce a bug-free hypervisor / TPM environment that can't run unsigned and untrusted code. After you're done laughing at that I'd recommend being angered at the notion of such a thing, since it will effectively eliminate control of the devices owned by consumers.. turning every device with a "clean bill of health" into a walled-garden appliance. As long as consumers own and control their general purpose devices there will never be a way to do what this paper describes. Frankly, I'm alright with that. We'd do a lot better to just assume that every device is untrusted and act accordingly.

Re:Predicated on "trusted computing"...

[Microlith]

Well the one leading this charge certainly seems to be Apple. I pointed this out in another article, but everything bad about Trusted Computing is getting its test runs in the mobile space.

Motorola has already shown that they can lock down the boot loader and kernel well enough that end-users can't replace them. Combine that with HTC's "self-fixing" system that un-roots a phone and you're in anti-user lock down heaven. The irony was me being told "not to buy it." Well, if this continues up the stack you'd better be happy not working with computers, or the internet.

anlny

[Anonymous Coward]

the new attack of the future denial of health certificate

Imagine a world without Windows...

[geekmux]

"... while bot-infected PCs might be barred from the Internet."

So, with the three Windows computers left on the Internet after this happens, I wonder what it'll be like...

Re:Imagine a world without Windows...

[Nyder]

"... while bot-infected PCs might be barred from the Internet."

So, with the three Windows computers left on the Internet after this happens, I wonder what it'll be like...

I know my eq2 games will be boring.

Wait, WTF?!

[wbav]

I often find the internet vital to download the latest updates to programs like Spy Bot, how am I going to do that (and get rid of the infection) if my computer is banned from the net?

At an ISP level, it wouldn't be just the infected machine.

And what about wireless hot spots?

Re:Wait, WTF?!

[phantomfive]

Simple, if you weren't 'approved', you would only be able to access certain sites. If your vendor's site isn't on the list, tough beans. It's not very pretty, but there are solutions to all these problems.

Wireless hotspots? Only approved wireless routers will be allowed on the network, and those wireless routers will only allow approved computers to connect. This is the kind of world we would have if Microsoft had their way.

What could possibly go wrong?

[kurokame]

Wait, it's actually sort of obvious. It won't work for its intended purpose, it will annoy users and keep them from getting work done, and people will exploit the system to knock computers offline.

Re:What could possibly go wrong?

[AHuxley]

Jailbreak for MS?

Very Profitable

[MarkvW]

Pay me money to certify your computer, or you can't access the Internet. I won't guarantee anything, mind you.

So systems not runing a M$ os will be locked out?

[Joe The Dragon]

So systems not runing a M$ os will be locked out?

will they also say when windows 8 comes out that all xp, vista, and 7 systems will be locked out?

So this is M$ answer to a problem created by them

[aphelion_rock]

Let me get this straight M$ designed and still releases operating systems that are riddled with security issues. M$ charges more or less the same amount for their OS no matter which country it is sold in. It takes the consumer on the average wage this many years in countries such as China (20 years) and India(40 years) - (this has reduced in more recent years with office workers in China now taking much less), providing they lived on air, and saved every bit of money they earned, in order to save up enough money and purchase a legitimate copy of M$ Windoze. M$ issued WGA to identify machines that were installed without an authentic license. Once identified as non genuine, M$ refused security updates to those machines to protect them from infection through vulnerability. These machines get compromised by malware due largely through lack of adequate security protection and are then used for malicious purposes on the internet. M$ answer is to deny these user access to the internet.

And just who?

[ma1wrbu5tr]

The funny thing about this... older versions of Windows are being exploited less and far fewer malwarez are currently being written that even support them. So, if I have a windows 2K box that I only play game "X" on, then I would not qualify for a "health certificate". Patch that, Charney!

Secondly, what about non-M$ OSes?

I hope no one at M$ is making the determination as to how secure my nix distro is. They can't secure their own OS, much less mine.

Lastly, WHO is going to be in charge of this? The government? ISPs? M$? The FCC? Not one of those sounds even a little qualified to do the job.

In other news...

[InvisibleClergy]

In other news, suddenly no Linux machines can connect to Windows servers.

Two Words: "Microsoft's trustworthy"

[tomhudson]

They lost me at "Microsoft's trustworthy $INSERT_ANYTHING".

Sorry, but Microsoft lost my trust more than a decade ago. Microsoft is like an abusive boyfriend who says "Trust me - I've changed, this time is really different ..."

The only right response to both is "Drop dead!"

-- Barbie

Re:Two Words: "Microsoft's trustworthy"

[Hylandr]

What this really boils down to is:

We are sorry, XP is no longer supported and a patch is not available. You will not be allowed to connect to the Internet. Here's a $7 Rebate for Windows 7.

- Dan.

What a great idea, and cheap too

[gone_bush]

This would be very easy and cheap to implement. Let's see:

if( os == "windows" )
return "access denied";

Re:What a great idea, and cheap too

[mSparks43]

LOL.
At least that would keep the Bing servers connected.

You asked...

[znerk]

Why in the devil do you have ssh available to the world?

I almost automatically moderated this up, but decided instead to respond.

ssh is Secure Shell. It is supposed to be a secure method of accessing a system (remote or otherwise). It does this job well.

So well, in fact, that there are computers out there whose job it is to bounce username/password combos off machines, slowly, in order to attempt to compromise them. Some (most?) of these machines are simply poorly secured systems that have been previously compromised, and are now doing the bidding of an outside force. Many of these "compromised hosts" can act in concert, spreading the attacks out not only over time, but also over IPs, making them difficult to detect and/or block.

One solution is to watch vigilantly for these attacks, and block the IP addresses of those machines from your ssh port, or (as is more common) to block them from touching your network at all. Those machines will get lonely, eventually...

Another solution is to implement some other form of security, either replacing the default security (using ssh keys instead of passwords, for example), or augmenting (read: hiding) it (using port-knocking, non-standard ssh ports, etc). These methods can be combined, to make an even more secure system.

Unfortunately for all of these methods, the average user is unable or unwilling to perform them, due to complexity. Unfortunately for all of us, the moment it becomes simple enough for the average user to figure out (and thus use) these methods, there will be an exploit that attacks the newly-simplified access method.

In short, having sshd open to the world, on the standard port, is probably an indication that a system can be broken into more easily than one which does not appear to be running sshd on the standard port. This really says not much about the security of the system itself, and the only reason to secure your ssh more than the default configuration already is (valid username/password required) is to keep from having huge log files full of failed attempts to crack into your system.

Personally, I use a combination of several of the ideas I offered above, because I am lazy and hate reading logfiles, especially when it seems critical that I must do so (30 attempts to crack my ssh key in an hour? bad monkey, no cheeto!) It is much easier, less stressful, and not time-consuming in the slightest to have my firewall simply drop all packets destined for port 22.

Re:You asked...

[jojoba_oil]

You can also use DenyHOSTS to automatically add rogue hosts to a blacklist.

Re:You asked...

[micheas]

Why in the devil do you have ssh available to the world?

I almost automatically moderated this up, but decided instead to respond.

ssh is Secure Shell. It is supposed to be a secure method of accessing a system (remote or otherwise). It does this job well.

So well, in fact, that there are computers out there whose job it is to bounce username/password combos off machines, slowly, in order to attempt to compromise them. Some (most?) of these machines are simply poorly secured systems that have been previously compromised, and are now doing the bidding of an outside force. Many of these "compromised hosts" can act in concert, spreading the attacks out not only over time, but also over IPs, making them difficult to detect and/or block.

One solution is to watch vigilantly for these attacks, and block the IP addresses of those machines from your ssh port, or (as is more common) to block them from touching your network at all. Those machines will get lonely, eventually...

Another solution is to implement some other form of security, either replacing the default security (using ssh keys instead of passwords, for example), or augmenting (read: hiding) it (using port-knocking, non-standard ssh ports, etc). These methods can be combined, to make an even more secure system.

Unfortunately for all of these methods, the average user is unable or unwilling to perform them, due to complexity. Unfortunately for all of us, the moment it becomes simple enough for the average user to figure out (and thus use) these methods, there will be an exploit that attacks the newly-simplified access method.

In short, having sshd open to the world, on the standard port, is probably an indication that a system can be broken into more easily than one which does not appear to be running sshd on the standard port. This really says not much about the security of the system itself, and the only reason to secure your ssh more than the default configuration already is (valid username/password required) is to keep from having huge log files full of failed attempts to crack into your system.

Personally, I use a combination of several of the ideas I offered above, because I am lazy and hate reading logfiles, especially when it seems critical that I must do so (30 attempts to crack my ssh key in an hour? bad monkey, no cheeto!) It is much easier, less stressful, and not time-consuming in the slightest to have my firewall simply drop all packets destined for port 22.

It was pointed out on the freebsd security mailing list that changing the port of sshd is only a stop gap, what you need is a way to deal with a large number of invalid attempts to log into the machine via ssh.

Eventually, what ever port you have sshd running on will come under attack, and it would be best to have a plan for how to handle the malicious traffic.

The best advice is move sshd off of port 22, establish and configure your IDS and response, move sshd back to port 22.

Re:You asked...

[TheLink]

ssh is Secure Shell. It is supposed to be a secure method of accessing a system (remote or otherwise). It does this job well.

But it still has had bugs over the years. So running on a nonstandard port buys me time to install patches. Lots of time probably - see below.

Eventually, what ever port you have sshd running on will come under attack, and it would be best to have a plan for how to handle the malicious traffic.

On my own server I have had ssh running on a nonstandard port for years and I have experienced ZERO of those ssh brute force attacks.

In contrast, that same server's firewall logs has port 22 connection attempts many times a day. I won't be surprised that if those connections had succeeded they would be followed by a brute forcing attempt, because at my prev workplace, our servers scattered around the world were listening on 22 and would get ssh brute force attacks on a regular basis.

If I ever get a brute force attack on my nonstandard port, there would be a high chance someone is targeting me specifically. The action to take in such a case would often be different compared to those "nothing personal" attacks.

Even if I had an IDS/IPS I would still have external ssh access on a different port. Why waste resources (machine and human) on this? Let it protect my nonstandard port.

It's not like I'm running an ssh server for the general public.

To be honest, my ssh server is actually listening on port 22. But 127.x.y.z:22 to be exact. The server's firewall has to be active and redirecting the nonstandard port to 127.x.y.z:22 in order for external connections to succeed. Feel free to guess the correct values of x, y and z. I ain't telling...

So if the firewall gets turned off or the rules get removed/disabled/bypassed for whatever reason, external ssh access could become harder :).

Re:You asked...

[Hatta]

In short, having sshd open to the world, on the standard port, is probably an indication that a system can be broken into more easily than one which does not appear to be running sshd on the standard port.

A machine not running SSHD is more likely to be a Windows box which is more easily broken into.

Re:You asked...

[secolactico]

The best advice is move sshd off of port 22, establish and configure your IDS and response, move sshd back to port 22.

I once considered doing that. Instead I firewalled the whole network and the only way to ssh into a box is to access via VPN (with password policies enforcement instead of certificates) and from there ssh into the machine.

If the VPN is down, tough. I'll have to have someone onsite to fix things.

Of course, one size does not fit all. This is the way we chose to do this at my place of work.

Oddly I've never seen evidence of someone trying to brute-force a vpn connection.

Re:You asked...

[znerk]

In short, having sshd open to the world, on the standard port, is probably an indication that a system can be broken into more easily than one which does not appear to be running sshd on the standard port.

A machine not running SSHD is more likely to be a Windows box which is more easily broken into.

Good point.

Re:You asked...

[znerk]

The best advice is move sshd off of port 22, establish and configure your IDS and response, move sshd back to port 22.

I disagree. The best advice (in my opinion) would be to configure your box behind a firewall, and only move it out into the "world" once it is patched and secured.

As far as securing ssh, what's wrong with port knocking? I've heard some security professionals claim that port knocking is security through obscurity, sure, but... with > 65,000 ports to choose from, picking the correct ports to "knock" on, with the right tcp flags in the packets, with no mistakes between them, and then logging in on the correct ssh port within the time limit before the port automatically closes again...

... kinda like walking around a house, hoping to knock on the correct number of bricks, in specific locations all around the house, then getting to where the door is in time to insert your key... without knowing where the door is ahead of time, either.

In other words, good luck. The only open port on my entire network is 80, because the only public service I'm running is a web server.

I don't even bother logging the attempts to brute-force my ssh, because 22 isn't open.

Re:You asked...

[jep305]

Anyone who finds it too complicated to set up a key pair and disable password auth in ssh should not be allowed to connect anything to the Internet.

Really?

[sjames]

Let's take a trip back in the eayback machine, all the way to 1996. Remember the "good times virus"? The hoax email that kept getting forwarded around because the very idea of a virus you could catch through email was funny?

Am I REALLY supposed to take security advice coming from the organization that actually turned that joke into nightmarish reality seriously?

It's not as if nobody predicted that their foolish conflation of opening a document and running a program would result in disaster. Pretty much everyone not waving the MS flag predicted it loudly.

If we're REALLY serious about cleaning up the viruses, ban Windows from the net until they rip that abominable idea out of their OS by the roots.

Re:Really?

[jmorris42]

> Remember the "good times virus"?

Oh yea. Outlook got exploited on a regular basis and still does. However we in the Free world should not start sucking each others dicks quite yet[1] either. Remember there was a remote exploit for pine[2]. libgif, libjpeg, libpng have also had security patches. The old theoretical division between dead data and live code never really existed. And while pretty much everyone else's code is better than the poop that Microsoft inflicts on the world the Free Software universe needs to pay a lot more attention to security lest we suffer a never ending string of exploits as well should we ever achieve 'world dominiation.' And the time to worry about security is now, not then because then it will be too late. Ask Microsoft.

[1] Do I have to point out this reference? Nah.

[2] Ok, it was really a metamail flaw but a Pine user could indeed get zapped simply by reading their mail.

Re:Really?

[sjames]

I do remember that. Security is an ongoing process. The difference is that the metamail problem wasn't a deliberate design decision ignoring a loud chorus of NOs. It was also fixed rather than stubbornly maintaining that it's the way of the future.

Mistakes happen. They're made all the time. It's refusal to admit it was a mistake in the face of a mountain of contrary evidence that creates the real problems.

But yes, not making that particular huge mistake doesn't mean we get to go to sleep now.

give me a break

[madcat2c]

Because fully patched pcs, with updated antivirus, running a firewall, never get compromised right?

Ah great idea! Here is a shortcut implementation.

[Kaz Kylheku]

May require a bit of a portability layer to run on some systems.

#!/bin/sh
case "$(uname -s)" in
Cygwin )
      echo "dive for the network cable and yank it out, as fast as you can!"
      echo "also, flip the wireless switch to off!"
      exit 1 ;;
* )
    echo "good to go"
    exit 0 ;;
esac

To put it simply

[eonduckem]

"No thank you"

Security theater

[Dracos]

This is another episode of Microsoft's security theater. While they'll portray this as making Windows more secure, it actually won't have much, if any, real benefit (a la UAC), and is actually designed to stifle other operating systems.

Apple, Oracle, and other big OS vendors will be given the opportunity to buy their way on board, but all the small players, including Linux distros, will be shut out.

I have a saying about Windows, and I've been accused of trolling with it: Windows is designed to be sold, not designed to be used.

By sold, I don't necessarily mean the retail box sale or the initial rollout of a service contract, I mean every dollar and minute spent to maintain Windows as well. From your tech-illiterate uncle taking his PC to Geek Squad, all the way to this blatant (to the people who know what to look for) extortion scheme.

Microsoft created all of these issues. They know it's not profitable to actually solve them.

Re:So systems not runing a M$ os will be locked ou

[mysidia]

There is an Open Source alternative to Microsoft's proprietary system, called PacketFence.

Systems not running a M$ OS will be fine as long as there is either an exception established, or a NAP agent Installed: Microsoft has promised to make the technology available so people can develop NAP agents for Linux and MacOS.

UNETsystem announced NAP compatible versions of their AnyClick product for Linux and Macintosh OS X operating systems.

I don't think this is really intended to lock other OSes out, although it may make things more expensive, be a slight annoyance, and more annoying (with no real benefit for these other OSes), if you have to buy some proprietary product for them.....

And it can also be a unique problem for the likes of Knoppix... won't fit well into a NAP scheme. Thus forcing Linux on the network to have some of Windows' inflexibilities, unless you set aside special IP address ranges for Linux boxes and exclude them from the NAP scheme.

--

--Mysid__2010 1007 bcf68101-61e9-32b5-bd2a-e671f9d2f379

Did they think it through or playing stupid?

[mxs]

Even if you buy the premise that this would work the way described and actually "increase" security and "decrease" the botnet problem, and even if it works 100% of the time, and even if they somehow also do this so that OSX, Ubuntu, and 1000 other operating system variants can take advantage of it, and even if you then do not run into the problem of the computer behind the computer/router having been certified (remember NAT?) being infected ...

Even then, do you really think that if this infrastructure were pervasively implemented, it would not then get used for something entirely different? I mean, you are already looking deeply into the system, you are already cutting off internet access permanently ... Why not simply check for Limewire while you are at it? Or uTorrent? I am sure the right lobby could persuade Microsoft to do that with a wad of cash or some juicy contracts for their media division ... And really, LibreOffice is not certified secure (all those homeless, stinky hackers working on it for free never really got a proper Microsoft Certified Security Expert badge, they probably don't even know what security is all about ... so better not allow subversive freeloader-stuff like that to run, either. Oracle OpenOffice is OK, after all, they are a big company and MS really needs that patent exchange deal with their database folks, right?
And everybody knows people get their viruses and worms via social networks, especially the newfangled ones like Ping or newcomers ... Surely facebook can secure their stuff (they can pay MS Security experts with badges to secure their Windows servers, after all), but twitter? Those guys don't even have a revenue stream. Better to just cut off access to that as well.

Granted, I need to patch some holes in my tinfoil hat, but is it really so far-fetched to assume MS or whoever were to be in charge of it would not abuse it? And if they are all ethical, reasonable people who will not at all abuse their power when given the chance, do you really think they could secure their own services so that they are beyond reproach? Why develop a botnet to take down Amazon.com when you can simply flip a switch and take half the planet offline?

Arbitrary censorship?

[QuietLagoon]

Is this new initiative going to be used to arbitrarily remove "troublesome" PCs from the Internet?

.
Questions that need to be answered:

1. what sort of transparency is involved in the reasons for removing a computer from the Internet?
2. is the routine judicial process being used to determine innocence or guilt, or is the judicial process being bypassed?
3. what appeal rights are being put into place to prevent abuse?
4. are those appeal rights within the judicial system?

Re:Arbitrary censorship?

[QuietLagoon]

Trustworthy Computing == Microsoft allowed computing.

.
Be afraid, be very afraid.

Class action lawsuit

[mooneypilot]

Instead, how about a class action lawsuit against MS for all this nonsense? (ya ya..I know...eula says they can abuse me..but just sayin!) For the all the sys admins who have worked all night to fix infected servers..over and over. For all the customers who waited for the sys admins to fix their infected servers. For all the money spent on nonsense like anti virus programs, spybot cleaners and malware removers that don't work. For all the businesses who spend millions and endure downtime during insane repetitive patching that never ends, and never will end. For all the people who had to deal with a infected home PC by enlisting Geek Squad geeks or others, over and over. For all the computer geeks who continually get called to family and friends houses to fix infected windows PC's At even 10$ per hour spent on all this nonsense worldwide, you could instead feed all the hungry on the planet and have money left over. Are we so accustomed to this insanity that everyone has given up and just accepts this status quo? Is there no one else, but me, who feels this way ?

I eye MSFT with a jaundiced eye

[newdsfornerds]

SharePoint is the shit! Not figuratively, literally. Heaping mounds of steaming shit.

Geez!

[The Wild Norseman]

Every single time I see the stupid little popup telling me my Windows machine is possibly infected, I click on it.

WHAT ELSE DOES MICROSOFT WANT FROM ME?!?!

Windows

[magical liopleurodon]

"To block botnet-infected computers from connecting to the Internet. Under the proposal, PCs would be issued a 'health certificate' that showed whether the system was fully patched, that it was running security software and a firewall, and that it was malware-free. Machines with deficiencies would require patching or an antivirus update, while bot-infected PCs might be barred from the Internet."

I'm sure the machine will have to run windows to get the health certificate.

Catch 22

[1 inch punch]

So how are these Windows PCs going to download the patches if they are banned from connecting in the first place?

oxymoron?

[Nyder]

Microsoft's trustworthy computing group

cure worse than the problem

[frovingslosh]

I don't keep my systems "up to date". The system I'm posting this from is still on XP SP1. And there is a good reason for that. I've only ever had one problem with anything that I got from the Internet. That one thing was a "Microsoft Security Update" that apparently managed to rewrite my NIC start-up parameters (all modern NICs have flash memory) in such a way that any OS that trusted the NICs start-up settings would be unable to use the interface. And guess what, Windows didn't trust the start-up configuration stored in the NIC but Linux did!

After that experience I decided that I was better of not trusting Microsoft to not deliberately muck up my hardware any way that they could. Of course, many others have suffered other ways in adopting Microsoft patches, or even have them forced on them without consent. I'll continue to trust my own ability to defend against the bad guys on the Internet, as far as I'm concerned Microsoft is one of the bad guys.

I still have a no longer supported copy of Win98 running on one system, quite happily and safely. I'm sure that Microsoft would love to pop up a message saying that since they no long want to support my old OSs that I can't use them to connect to the Internet any longer.

Re:cure worse than the problem

[mcgrew]

I had a very similar thing happen to me, and it involved the NIC as well.

My system got hosed when my daughter ran XCP, never dreaming that a big company like Sony would distribute malware on a music CD. I couldn't find my Win 98 CD so I bought XP, installed it, and reinstalled all my apps (pain in the ass). XP didn't like the CD burning software that came with the burner, and every boot displayed a message saying that windows had disabled the burner software.

One morning I was ready to reinstall everything except the burner software, and I couldn't get on the internet. The cabel modem was on the floor, so I assumed the cat had knocked it off and broken it. I called Insight (my ISP at the time) and they said "no, your modem's fine, we can see it but we can't see your computer. Your NIC must be bad." I tried a different network cable just to be sure it wasn't the cable, and was all set to buy a ten dollar network card but reinstalled Windows first. Lo and behold I had the internet back -- until I let Microsoft update itself. It again no longer would get on the internet.

Microsoft had replaced the perfectly functional network driver that had come with the motherboard with one that just plain didn't work. IIRC that's when I started trying out different Linux distros. My homw is MS free these days.

Re:cure worse than the problem

[dupeisdead]

The culprit wasn't microsoft. The motherboard manufacturer took an off the shelf network card (vendor x), modified it slightly and used it on the motherboard (vendor y). When you use the customized motherboard drivers from the cd or their website it works great. The problem is, microsoft's windows update does a search and says hey that looks like vendor x card, hmmm they have sent us version 2.0 and your drivers say they're version 1.0... do you want to do the update?

Microsoft only organizes drivers that vendors gives them, they dont make any of them. To repeat, Microsoft has NOTHING to do with the drivers listed on Windows Update.

You really should blame either vendor x for giving microsoft crap drivers or vendor y for customizing the drivers.

Also to note, this is a feature that can be disabled entirely or for a specific driver.
As well, there is a VERY easy method to roll back a driver install. I've had drivers do this before (even from the manufacturer) and you can simply rollback to the previous driver (stored on your computer), reboot and problem solved.

Re:cure worse than the problem

[PingPongBoy]

I don't keep my systems "up to date". The system I'm posting this from is still on XP SP1.

You're doing all right. I'm just using Morse code but I did recently upgrade to SP4, you know, where I soldered a grounding wire to my chair.

Crooks will send thank you to MS?

[kanweg]

Perhaps crooks are quite happy with a more homogenous (and still "open", wink wink) MS OS landscape. All systems will be provided with the latest patch (read "new hole").

Bert

Re:Cisco already does this...

[znerk]

They sell a product called Cisco NAC, formerly known as "Clean Access," which requires a host to prove it has Antivirus installed and running and the latest patches.

How does it handle a Linux client? Will it accept ClamAV and some sort of indication of my kernel version?

How about we just tell the new internet version of the SS to go fly a kite?

Just cut them off.

[miffo.swe]

I like the idea of cutting all those Windows boxes off the net. It would be very interesting to see what all those millions of users do once they realize Microsoft has sold them crap that they cant use on the internet because its a steaming pile of security holes. Today most people wont notice their computer have been owned, cutting them off would change that pretty clearly.

TPM etc are just thrown in by Microsoft to use this as a way of cutting non-windows systems.

The way this would better security isnt that the computers are cut off the net. It would work by making Microsofts users start to see clearly the downsides of bad security and start demanding better security from Microsoft instead of todays lipservice. A couple of million users without access to the internet wont accept Microsoft sidestepping the blame with UAC, they will demand them fixing the underlying issues.

With grandmaster strategies like this...

[Mysteray]

Next time you hear a politician talking about "securing the Internet" through legislation, remind them of this:

Granny's medic alert device failing to summon help from Symantec's "beg for mercy" captive portal would make a dynamite campaign ad, wouldn't it?
http://bit.ly/adEngl

So unless US politicians really want to shut off the home internet on a majority the voters, every Netgear, every Linksys, every tablet and iPod, every Wii and Playstation, every home alarm system, every voip phone, every digital picture frame, you name it, which is made before this "grand solution" can imposed will end up with a blanket exemption.

That's pretty much everything with an ethernet port or wifi.

Except, of course, those systems from Microsoft and any other vendors that might go along with the plan. But look out! If their big power play is successful, they've won themselves the ability to f*** with their customers' network connections!

Way to go guys, let us know how that works out for ya.

Quis custodiet ipsos custodes?

[kubitus]

who will decide?

and to whom to complain about false positives?

I've been talking about this for years

[crossmr]

every time we have a story about this I've mentioned this idea. Botnets have specific behaviour. They do things which are bot-like. They send mass amounts of e-mails, connect in certain ways, etc. It should actually not be that difficult for an ISP to determine if one of their customers is infected by checking logs for certain patterns.

The solution to botnets, spammers, and others like that has always been very simple. Cut them off.
Then have the "good" ISPs who cut these people off blacklist any ISP that won't do it. If someone wants to be a haven for spammers and malware distributors I can't really see the need of doing business with them.

This shouldn't be a pre-emptive thing. it should be responsive. Give people the benefit of the doubt. Let them make whatever choices they want. But if it appears they're infected with a bot net, give them a chance to either clean it up, or cut them off. It's trivial to add that customer to an automatic group whose only access is to a local intranet where they're given a choice of a wide variety of free and paid applications (along with all recent definitions) to clean up their machine. After doing so, they can be moved back into the general public.

DEP

[orange47]

The whole idea reminds me of "Data Execution Prevention": http://en.wikipedia.org/wiki/Data_Execution_Prevention and "restore points", etc..
yeah, that worked great :rolleyes:

Microsoft Big Brother

[DaveDerrick]

Sounds like their chasing their dream of dictating what you install & run on your PC, and who is "allowed" to connect to the internet. Think we all know where they can stick that certificate.

Requires benevolent authorities

[dugeen]

Good to see that almost no-one on here has any confidence that the ostensible purpose of this suggestion is the real one.

Broken Promises

[alexhs]

This time it's gonna be different, trust me.

Mandated upgrade

[dheltzel]

We should promote a policy that any Windows systems that are not fully patched be automatically upgraded to run Linux. That nicely solves the problem of them joining botnets and means that MS doesn't ever have to worry about those systems again. MS shouldn't care because they've already made all the money they are getting from these systems anyway (since the owners have demonstrated that they are not going to ever pay for an upgrade). This way, older systems would eventually all convert to Linux, a much safer thing for the internet,

And this blows up as soon as...

[DigitalSorceress]

And this idea blows up as soon as spammers/phishers/bot herders just start building fake "your computer has been infected" homepage redirects that take clueless users to their own fake "here's the tools you need to install" page.

There is no software in the world that will cure stupid.

That dog just ain't gonna hunt.

[Syberz]

Deny internet access because you're not fully patched? That's never going to fly!

In several regulated fields (such as for medical software) you can't install a patch before testing the regulated software on a patched test system. If the tests pass, then you can install the patches on the production system.

They expect us to run a battery of tests everytime MS releases a patch just so the system can keep its internet access?

Already exists

[dragin33]

Systems like these already exist from vendors like Cisco and Trend Micro. Besides.. My PC is already protected with Antivirus 2009 and Windows reports that I'm fully protected!

I worked on software that does this

[mdarksbane]

Something like six years ago... It essentially sat between the DHCP server and the client, requiring that you had the a certain patch level and virus protection/firewall settings before you were allowed on the network. Seemed like about as much of a pain as most security products are, but it worked for the general case. Malicious people could still bypass it, but if random marketing guy plugged in his vulnerable laptop it generally kept it from infecting anything.

ENDFORCE was the name of the company then, but there were other competitors out there.

Isn't this pretty much already here?

[Junior J. Junior III]

I believe that the capability already exists in Active Directory to isolate systems that do not pass muster when it comes to security patches and a recent malware scan showing the system to be clean. All that is required is for ISPs to mandate that their users be joined to an AD forest maintained by the ISP in order to get "full" internet service. If your system fails the security checks, it gets shunted to a walled off network where the only thing you can do is download WSUS updates and antimalware definitions updates and removal tools, until such time as you have installed them and can recertify that your system is safe to be on the real network once again.

It's already here, in terms of capabilities; it just remains to be implemented. There's plenty of business and political obstacles to that happening in non-corporate environments like residential ISPs, but my hunch is that it's all but certain it'll just take a cyber-9/11 event to get the necessary laws passed to overcome those obstacles.

Client-side?

[js_sebastian]

A network protection scheme doesn't have to verify that Macs, ubuntus etc etc are "compliant", because those are noise in the signal as a percentage of customer endpoint equipment. A network protection scheme has to keep people who want to continue running MS stuff up to date and patched. It doesnt' ahve to keep windows power users from getting on the internet if they can read about registry hacks or whatever,

If this is client-side, what stops malware from performing those same "registry hacks or whatever" automatically on behalf of the user?

Re:Client-side?

[Jeremiah Cornelius]

NAP is a "health" technology - not defense against a rogue operator or the trump in malware arms races.

In an enterprise, signing based on AD membership is the technology for attesting authenticity of health certificates and preventing replay, spoofing, etc.

I do not see an obvious root for this trust in the Internet model, versus the AD model.

In the model I'd proposed earlier, we assumed signing keychains from the participating banks, merchants, etc. Not perfect defense - but again, that's not the objective of the exercise. Without signing, or an equivalent validation, a NAP scheme could just as easily turn into a DoS method.

With signing, you can begin to federate. "Ah. I trust AmeX's signing of the health certificate that this client presented, so I'll admit them to Amazon's shopping cart function, without re-running a check." This is again, an ELECTIVE participation by providers and vendors - and not a policy mandate defining classes of general network access. Network access is not what should be quarantined by vendors - but application access is reasonable.

Quarantine should NOT be to impose any restrictions on a class of client as an end-in-itself! It's objective in an Internet model is to raise awareness of clients in maintaining computer hygiene and creating a public-interest consortium for making updates and protections available.

Good iead, but will still fail....

[hesaigo999ca]

Good idea, but will still fail....because, once the culprits who write the malware know what the certs are, and how to fake or manipulate them, we are just back to square 1. I have said once before, the main spam problem can only be rectified one way...by charging per email, .01 cent! with a cap of about 50$. That's it, your ISP provider will send you off a bill at the end of the month, of which if you hit 50$, you know you are infected seeing as you have not sent any mail, you will disconnect yourself, and bring your pc to a tech who will clean it for you, or install legit windows for you, and then you will be back on the internet.

Once back on the internet, if it happens again, you will know next bill. Not only will this help pay the ISP for all the bandwidth they are loosing, but also make it impossible for spammers to spam legitimately....it would be too expensive, and the reason most malware exist, is to send spam, so if you block the spam, then there is not much profit to be had if you can not send your emails, or are disconnected from the botnet.

Re:Good iead, but will still fail....

[Ciggy]

I have said once before, the main spam problem can only be rectified one way...by charging per email, .01 cent! with a cap of about 50$.

I doubt very much if that would work. If one machine was sending out the mail then yes, it would throttle it, but with a botnet which will have more than enough machines the spam would still be sent out, but the spam sent from each individual machine would be below the threshold and so no dent whatsoever

That's it, your ISP provider will send you off a bill at the end of the month, of which if you hit 50$, you know you are infected seeing as you have not sent any mail...

If the user of a machine also sent out enough emails, then the spam extras may not be noticed.

...you will disconnect yourself...

It's more likely that you'd complain to the ISP that they've got the traffic wrong.

...and bring your pc to a tech who will clean it for you, or install legit windows for you

[emphasis added] You've just shown the problem: Windows. I don't use Windows, so why should I have to pay for for my emails because Microsoft can't write a secure OS, despite the virus problems harking back to the good old DOS days - they've had plenty of experience of how viruses could enter their systems since BEFORE Windows and yet they've still got gaping holes; they obviously do NOT learn from their mistakes...or perhaps they do, just the learning is how to extract more money from their victims^H^H^H^H^H^H^Hcustomers.

also make it impossible for spammers to spam legitimately....it would be too expensive...

Not for them: they wouldn't be paying for their emails in the first place - the cost would be born by the customer (sic) of Microsoft who bought a licence to use Windows (as it already is in terms of anti-virus software, re-installing OS, etc)

...and the reason most malware exist, is to send spam, so if you block the spam, then there is not much profit to be had if you can not send your emails...

Except that the spam isn't blocked. It just costs the machine's owner not the spammer, so any spam sent by a spammer costs him/her very little - they just steal the bandwidth and electricity (and, if implemented, the e-stamps).

...or are disconnected from the botnet...

Losing a machine from a botnet won't worry a spammer very much as new infections will add to the botnet.

...and then you will be back on the internet.

Back in December 2003 Microsoft admitted that Windows was not fit for purpose and gave the advice that before doing anything customers (sic) needed to download anti-virus software to protect the system from the deluge of viruses and worms that target the flaws in Microsoft's software as soon as you take it online. Even if the machine is cleaned, it is very likely to be re-infected and the botnet expanded again, as well as with the "new" machines that aren't protected that become part of a botnet, even if unused for the moment..

Re:Good iead, but will still fail....

[hesaigo999ca]

>but with a botnet which will have more than enough machines the spam would still be sent out,
Unless all the owners of those machines found out that they were the ones sending out spam, and decided to fix their machines or pay the 50$

>If the user of a machine also sent out enough emails, then the spam extras may not be noticed.
You do know most botnets are programmed to send out a small amount of spam then go dormant, then turn on again later and then so on...to avoid detection. However, doing it my way, it would only take 5000*.01 cents emails to hit the 50$ cap and then guess what, you know by mail you have to do something....

>...you will disconnect yourself...
Who do you know (grandma and grandpa) are smart enough to figure these things out themselves.

>It's more likely that you'd complain to the ISP that they've got the traffic wrong.
When was the last time you complained to your ISP about traffic that was on your connection but not yours, no matter how much you try, they say you pay, end of story, if you dont like it too bad...
I know not 1 single company that goes, "oh, that was not you, ok, let me just fix that on your bill"....

>You've just shown the problem: Windows.
I agree 1000% with your point here, no way to get around it, windows was badly built and is a money making machine that will never end, until people see they have options, with little penguins all over them...

>Not for them: ...
You obviously do not own your own company, if you did, you would know you do not get paid until the service is rendered, if you are a botnet owner, and you signed a contract with a company saying they will pay you x$ for your 1 million emails, and after the first 400,000 , your botnet goes bust and cant be recovered, and you do not meet your deadline, this hurts your cashflow, unless you start using real servers of your own, to compensate, and then it comes out of your own pocket...

>It just costs the machine's owner not the spammer, ...
Well, again, being in the industry of computers, I can tell you it is not easy to write malware with all the competition out there, and then you get p0wned by the next group wanting your botnet, plus you have constant surveillance as not all are properly camouflaged, so the cost of programming and the cost of building the botnet is still quite a few man hours, which no one works for free...
might be cheaper in russia, but at some point the overall industry will feel it when you hit them with a big whammy like this....

>Losing a machine from a botnet won't worry a spammer very much as new infections will add to the botnet.
Only if the fixed machine can be compromised again and again, however, by making mre people aware by using THIS way , they will get wise, fast, as it is expensive enough (50$) the first time, and once patched with AV on etc...you will see a much lower infection rate the second time around...

>Even if the machine is cleaned, it is very likely to be re-infected and the botnet expanded again, This is if the machine is not legit and has not been patched, newest zero day attack vectors need to be programmed when the old ones stop working, this again costs money to the spammer.

Roses are red, violets are blue,
Some people need a full big picture,...well you know the rest

So if my ISP gets infected...

[Dalzhim]

I guess that if my ISP's servers ever got infected, then either they would cut their ownselves off the internet or the backbone to which they are connected would do that for the rest of the world? All ideas of disconnecting people from the internet because they are "infected" are trash. We're only treating a symptom of a problem: lack of security in application development.

Controlled by Microsoft no less

[sir lox elroy]

Well this is a great idea (replete with sarcasm), well at least for Microsoft to regain control over the whole PC market. They would get to decide whose PC is worthy of Internet access. WOW, Wonderful, Robotic Overlords, who needs them when Microsoft gets to say who can access what. Hm why am I seeing a requirement for access being Windows running on the machine?

Why I'm not surprised

[Sem_D_D]

Nothing particularly new under the sun, and then it's just the MS way... They've been incorporating this kind of things for quite a while now. About a year ago, I attended the offical MS cryptography class 2821A, aka PKI environment managing and setup. The tutor was a very bright guy, great instructor AND seller of MS-related stuff. He was also kind enough to share that some of the bleeding edge stuff they were currently doing was just like what the article announces. The weird part? It was done in Kosovo of all places on the face of Earth... It begs to differ but this reminds me of the opportunities that disaster capitalism offers to, hm, MS innovators. Being able to implement a Layer 1 or Layer 2 discriminatory network that doesn't let a single PC plugin to a simple router and get on the network without all the patches to the OS and the Antivirus soft already present - whoa, that is a whole new level of paranoia. But yet again, it was work done for their banking and financial systems - literrary being recreated from scratch, that recently had to bleed some upper management staff, due to misappropriations and money laundering. Given the ripe atmosphere of rogue law-less-ness, no wonder those boys didn't want to share the pie with some - with any - script kiddies. ;)

who controls it?

[BrianPage]

If you're deemed unworthy and internet privileges revoked... how does one get the required updates and patches to get back online? I presume they - the ISPs - would allow you access to certain websites like windows update or mcafee patch central (whatever it's called) - so how do you get on the list of allowed sites? who controls that list?

Routers?

[jthill]

I find myself wondering exactly what it should take to get a "health certificate" for any system that could operate as a NAT router.

How frequently should health certificates be rechecked?

You'd need the active equivalent of an SSL session with every device to make substituting your real computer after validation at least a little harder, maybe even as hard as it is to crack DRM now.

That's for people who want to plug arbitrary devices onto the Internet. Auntie chatting and tubing and filling out marketing surveys would have to stay current on whatever OS could get a key.

I am surprised that ISPs haven't already...

[SirKron]

I am surprised that ISPs haven't already built up terminal service farms and started renting out thin clients to grandmas. You get a thin client computer installed and setup by a tech, a fully managed desktop with most of the common software you need to get on the Internet plus they can sell you space to store your family photos. Grandma doesn't need anything more than a web browser, Office Online, and the Microsoft freebie sites. An ISP could do the same with an LTSP solution and Google Crome and Google Docs but it is just way easier to find people who have set up Citrix/terminal server farms. An even better solution would be thin provisioned virtual machines. If the ISP controlled so many of the computers I feel you would get that 100 Mbit link a whole lot faster. Back to the mainframe days. And yes, I know there are lots of barriers to this type of solution and it severely restricts grandma from running all the stupid apps she thinks she needs, but that is not the point. The point is why aren't ISPs looking to tap this market? It is there.

'Doctor, heal thyself'

[Temmokan]

I like it. First Microsoft invents an OS that is easily infected with whatever plague one can invent, now they are trying to decide whether the system is defended enough. A number of products such as antivirus tools, firewalls etc are NOT properly recognized by Windows. The result is obvious - if you use, say, ClamWin which is free and NOT recognized by Windows, you will be blocked from Internet. I hope this idiotic proposal will make some people switch from Windows to anything else, more sane. Botnet problem has the only solution: exterminate Windows as class, that's for a start. Microsoft was and is pormoting the idea that any incompetent user should be able to use computers. Now we see the consequences of that.

Who Patches The Patcher?

[jman.org]

It's not the viruses per se, but the user that lets them in the door. Are you using a mail client that defaults to HTML view and allowing JS to run? Do you click on that popup you've never noticed before that says your system is infected? Do you ever empty your temp folder (either system or user)? Do you have a decent system monitor (SysInternals procexp is good) to detect which app might be causing weird bahavior? Do you ever look in the drivers folder, sys32 or other known hangouts of "potential bad guy" files? Ever check the registry (another plug for SI, autoruns can be quite useful) to see what's happening at startup?.

This is a downward spiral. Some bright kid will make a patch to override M$'s disabling of the TCP stack. M$ will issue a patch to override that. Rinse & repeat. As usual, they're using a sledgehammer where a scalpel is preferred.

Perhaps Windoze should just incorporate Git & cron; every 5 seconds you make a hash of the hard drive, with 2 weeks of reversion available. Just click on the smiley-face & viri be gone! (Along with any recent emails, documents, installed apps. What price security?)

Oh, you *are* running the latest i7 with 16 gigs of memory on WinDoze, aren't you? Would be quite hardware intensive to keep up with such a frenetic backup schedule. Be prepared for a constant hourglass.

Not surprising where this comes from.

[Douglas Goodall]

First we had the anti-virus vendors saying, "That's a nice computer you have there, it would be a shame if something happened to it. But if you pay us protection money, and you do have a problem, we will hide our support phone numbers behind a multitude of help screens that go around in circles.

Then we have Intel building security into their processors, and Microsoft decides not to use it. A while later Microsoft and Intel decide native code writers cannot be trusted and provide system-wide controls to keep "non-managed code" from running.

Computers being certified to be free of malware is like hookers being certified to be free of STDs. The certification is good for a few minutes, and then you are back to square one.

The healthiest thing we could do for the Internet would be to ban all Windows machines until Microsoft can prove that their operating systems are robust enough to survive on the Internet. If Microsoft operating systems need anti-virus enhancements, I think Microsoft should pay for that. After several years of paying for Symantec, the anti-virus software has costed more than the computer did to begin with.

And of course what makes this even more scary is Microsoft's demonstrated ability to wag around the US Government and get whatever they want. The decision to store public data in a proprietary format continues to astound me.

And others here have mentioned the fact that a company that cannot produce a secure operating system should not be trusted to judge the health of anyone else's systems.

Just do not use Windows ... problem solved.

[isoutar]

I have had a healthy computer since 1998 ... no virus checkers needed. My family has been running Linux since then for the Internet. The first comment above is right on. Everyone would be best to abandon operating systems like Windows that can carry viruses. Ian Soutar Vancouver Island

Yet another certificate someone has to 'buy'

[niftymitch]

I can see it now....
Me: "Hello Comcast I have a problem
Comcast: Give me the certificate number...
Me: I run Gentoo and emerged the entire world yesterday
Comcast: Sorry we only work on windows and I can now see that you used a P2P download -- the download police are on their way.