It's Jim Allchin. Because he fled this train wreck by hopping off as the train left the station and is now enjoying his island paradise. He's so far away you can't hear him chuckle. But giggling he is.
If you can't trust the installation media, you have no hope of building a good system, no matter what. If you have a firmware virus, same deal.
OTOH, using a built from scratch restore image that hasn't touched the network evades all other malware problems. It's the best you can do.
I don't quite assume a pristine image -- I only posit that if you don't have one, rebuilding after an infection is the ideal time to make one. Having the forethought to create one beforehand is of course preferable. I do assume either a pristine image or installation media. If you don't have either of those you've got bigger problems than just malware.
Not making a pristine image when you restore, or forgoing the restore in preference for "cleaning" are both options that are not best practice.
A Microsoft security official recommends that big businesses invest in an automated process to wipe hard drives and reinstall malware-infested operating systems.
Lots of talk of late about moving to less frequent refresh cycles. The bathtub graph of failures is more like a hockey stick, and the PCs in place have the processing power to meet people's needs throughout the current fiscal difficulty.
Software support is of course an issue, but there are no fixes for this either on offer or projected through FY2011.
Correct me if I am wrong, but, you don't even BEGIN to mention how to clear a shot bootsector did you?
You're wrong. Wipe and reinstall from known good media does clear the shot boot sector, as well as everything else. The only malware that can survive this process are either on the installation kit (none currently available, though it has happened in the past) or firmware (also, none known, a theoretical threat at most).
Of course I assume a pristine image backup. A good image backup is a necessary part of first line support for every PC. Whether a user is supporting their own system or tech support falls to some third party, gradually installing all the software in a useful desktop PC takes time. Performing a clean install from source media is an essential step of preparing even a new PC in order to eliminate OEM included software nonsense. clonezilla is fast, reliable and free. It's good professional guidance to tell people to build an image with known-good software with all available patches and make an image backup before connecting to the network and again after all the software that must be "activated" has phoned home. It's work but it's background work every PC needs to operate in the current untrusted network environment. This practice pays off with just one restore and systems should be restored from a known good image periodically whether compromise has been detected or not because sometimes compromises go undetected and systems develop cruft over time that destroys performance and distracts from the work of the day. Guiding people away from that sane "provably safe foundation" principle borders on malpractice.
It's also good guidance to recommend that people operate from a restored snapshot image rather than just taking one. That way they know for certain they can restore the snapshot from a tested backup and it will work.
If people don't have a clean image then recommending they build one as part of the recovery practice while wiping and restoring to recover from a rootkit is sound guidance also. The only problem with this is when people don't have reinstall permission, rights or media. Those people aren't going to listen to anything you tell them anyway.
Again: Please don't tell people to try to "repair" rootkits or viruses. Repair is not reliably possible. At worst it communicates to the undetected and unrepaired malware that the unit is a real person, not a honeypot, and that they're clueless about security. In that way it makes them more of a target and decreases rather than increases their security.
Please don't tell people to use FIXMBR to repair a root kit. It's not an appropriate or effective repair for a system that's been compromised. As a repair it's worse than useless - by giving a false sense of security it leads to greater risks.
I explained that in my post. Many companies refuse to use GPL code because of its viral nature. That cripples adoption of GPL software.
Cripples in the same way that my internet radio idea is crippled by the RIAA. If you want to use the copyrighted content, you have to comply with the license - until we do away with this stupid software copyright idea anyway.
Not voting is not a good way to express opposition for all of the options if you have an option to write in "none of the above". Not voting in this case expresses disinterest, or "don't care" - which is what your "lack of vote" is counted as. If you in fact do care, it's best to go to the polls and put your opinion in. And if your option truly was "don't care", well, then my message wasn't for you. I have no interest in what you want -- and you prefer it that way.
OTOH, not voting is a good way to express opposition for voting in general if you follow it up with some sort of protest action along the lines of waving a poster outside a polling place that says "voting is teh evil". If you have problems moral, ethical or religious with the practice of holding polls to set public policy and choose its executors there are probably better places to live where the people and government are more sympathetic to your views.
If your polls don't allow write-ins, well I'm sorry. You should probably do something about that. I'll warn you though -- the process may have something to do with "voting".
If Bill Gates/Microsoft and Google really pushed for this then you KNOW it is for the good of the people and not some attempt at corporate financial padding.
Those are a software and a services company. They're not hardware companies or ISPs. The ISPs and the people who own the wires have the most to lose here, because if you can get a mesh router with 100mbps bandwidth and a 2 mile range, the last mile problem goes away in a big way. That's why they opposed it with a battalion of lobbyists and lawyers. An intermediate business would be to "anchor" the mesh at favorable locations in exchange for advertising rights or something. Hardware companies that are positioned to sell into this market stand to gain a lot -- a whitespace mesh router is also a repeater in addition to giving you a net connection to the "anchor". There's no "selling" to this product. It's the big "duh".
And a wireless mesh network with this kind of range and multiple anchors isn't as susceptible to power outages, filtering or government monitoring. This could get interesting very quickly. Buildout to low density or impoverished areas could accelerate immensely. The OLPC project has a good mesh stack. Call quality with voip would be abysmal probably, but whitespace mesh cellular could become interesting also if QOS is built into the mesh. Linksys and DLink should have these products available within a year - the radio space is unregulated and they already have the router side figured out, so it's a frequency change a little testing and off to the factory in TaiPei. They don't even have to worry about interop. This is undiscovered country and real pioneers are seldom fussy about standards - they're more interested in staking a claim and holding it. The guy with the most swag in the interop standards conference will be the guy with the most stakes planted in the field.
This is nothing but money for companies that sell services and software because it grows the size of their potential market. Imagine being able to get online anyplace you currently do, with 1mbps wireless bandwidth, for the one-time cost of a "whitespace mesh router" and having to click through an anchor ad to get to the 'net - just like you would do if you were at a hotel. Just the consumer data on the unencrypted traffic might be marketable enough to pay for it without ads. A lot of people will use this who currently just can't.
The year of the linux desktop will never come until "making everything work" for 80% of the population requires precisely zero command line interactions, and precisely zero edits of obscure text files. And that most google searches for help end with instructions telling the user how to fix their problem or get their whatever working must also use precisely zero command line interactions, and precisely zero edits of obscure text files.
Taking Windows from as-shipped to "ready for the corporate desktop" involves the same amount of work as Linux does. Not that it matters to the end user. Corporate desktops are prepped by professionals to be targeted at people who couldn't find their network storage if it wasn't the universal default in all applications, and installed by professionals that handle such niceties as selecting display resolutions and tailoring settings for each customer's special needs. None of Windows, Linux or OS-X requires either less or more. The first part, building the "golden image" is handled by a small group and their efforts are leveraged against thousands of users so if it takes an extra week or two to do one or the other it makes little difference on a per-user basis. More time, and more valuable time, is probably spent deciding on technologies and policies that drive the bit diddling. The second part, customization service and training is labor intensive and the factors that cause an individual to consume more service on average are not "technical".
For support after installation? Also a wash. What, are you going to not have support people? That's crazy talk.
I think what matters in the enterprise space is compatibility and consistency. Each version should have a logical progression from the last to the next, so people get a comforting sense of familiarity with it. The enterprise has a lot of applications with a lifecycle of 10-15 years, and some larger enterprises are hoping to build a reliable roadmap to the future that goes continuously into the past. Architectural changes and toolchain revisions that reliably break that road without a clear bridge - or even a clear reason why other than "we need a new version if we're going to sell you another copy" - are not eagerly accepted. Open source gets the advantage here.
Consumer desktops? They run what they get, or they know better. Those that know better are not afraid to tinker. Those that don't at this point deserve to have to accept what they get - the vendors sell access rights to install stuff on the box. It's 2008 for goshsakes.
Federal desktops? Don't get me started on the brain damage that they require. I'm not only not interested in doing it, I'm not interested in having one. If you make the box that idiot proof, only an idiot would want to use it.
Let's talk about support: Sure, if you're a big org, Microsoft will send out someone to help you adjust your infrastructure to accept a new product, or track down a pesky bug. Unfortunately, after some serious analysis and consideration their answer is going to be "oh. You need to replace this third party product with this Microsoft product and then all will be fine. Personally I would prefer it if the salesmen would come dressed in a polo and take me out to lunch. Pretending to be tech support is disingenuous and not helpful.
Now I'm arguing with a famous anonymous coward. Cool. Y'know, Rob Enderle gets himself into print a lot too.
Wiping and reinstalling doesn't have to be painful. If you catch a good image with clonezilla you can restore in just a few minutes. It's actually faster than scanning the whole PC, don'tcha know.
Oh, and I don't need any blue ribbons on my shirt to point out the blatantly obvious.
Are you listing better advice here, to help others?? No. I don't see it...
I had a nice writeup on this in my journal, but it's gone now. There's only one reason I can think of not to wipe and reinstall if you find your system's been compromised by any malware at all: if you're running a honey pot and you want to see where the traffic goes.
Otherwise, it's wipe and reinstall. Always. Just like I wrote above. One of the first things malware does when it gets its toe in is it worms its way deep into everything it can - some active and some hidden with time delays so that it can be persistent despite cleaning attempts. Some of it you'll find, but can you find all of it? Is there any way to be sure you found all of it? No. Wipe and reinstall. Always.
Slashdot Mirror
It's Jim Allchin. Because he fled this train wreck by hopping off as the train left the station and is now enjoying his island paradise. He's so far away you can't hear him chuckle. But giggling he is.
He got his.
If you can't trust the installation media, you have no hope of building a good system, no matter what. If you have a firmware virus, same deal.
OTOH, using a built from scratch restore image that hasn't touched the network evades all other malware problems. It's the best you can do.
I don't quite assume a pristine image -- I only posit that if you don't have one, rebuilding after an infection is the ideal time to make one. Having the forethought to create one beforehand is of course preferable. I do assume either a pristine image or installation media. If you don't have either of those you've got bigger problems than just malware.
Not making a pristine image when you restore, or forgoing the restore in preference for "cleaning" are both options that are not best practice.
Where I explained this process back in April 2006.
I expanded on this with a journal article, but it's gone now. Maybe someday I'll put up an update.
Oddly enough, it's from the article Microsoft Says Recovery From Malware Becoming Impossible. If you won't believe me, believe them:
A Microsoft security official recommends that big businesses invest in an automated process to wipe hard drives and reinstall malware-infested operating systems.
Lots of talk of late about moving to less frequent refresh cycles. The bathtub graph of failures is more like a hockey stick, and the PCs in place have the processing power to meet people's needs throughout the current fiscal difficulty.
Software support is of course an issue, but there are no fixes for this either on offer or projected through FY2011.
GPL does NOT dictate use, only redistribution.
Correct me if I'm wrong here but in relation to internet radio and the RIAA, the "use" is "distribution".
Correct me if I am wrong, but, you don't even BEGIN to mention how to clear a shot bootsector did you?
You're wrong. Wipe and reinstall from known good media does clear the shot boot sector, as well as everything else. The only malware that can survive this process are either on the installation kit (none currently available, though it has happened in the past) or firmware (also, none known, a theoretical threat at most).
Of course I assume a pristine image backup. A good image backup is a necessary part of first line support for every PC. Whether a user is supporting their own system or tech support falls to some third party, gradually installing all the software in a useful desktop PC takes time. Performing a clean install from source media is an essential step of preparing even a new PC in order to eliminate OEM included software nonsense. clonezilla is fast, reliable and free. It's good professional guidance to tell people to build an image with known-good software with all available patches and make an image backup before connecting to the network and again after all the software that must be "activated" has phoned home. It's work but it's background work every PC needs to operate in the current untrusted network environment. This practice pays off with just one restore and systems should be restored from a known good image periodically whether compromise has been detected or not because sometimes compromises go undetected and systems develop cruft over time that destroys performance and distracts from the work of the day. Guiding people away from that sane "provably safe foundation" principle borders on malpractice.
It's also good guidance to recommend that people operate from a restored snapshot image rather than just taking one. That way they know for certain they can restore the snapshot from a tested backup and it will work.
If people don't have a clean image then recommending they build one as part of the recovery practice while wiping and restoring to recover from a rootkit is sound guidance also. The only problem with this is when people don't have reinstall permission, rights or media. Those people aren't going to listen to anything you tell them anyway.
Again: Please don't tell people to try to "repair" rootkits or viruses. Repair is not reliably possible. At worst it communicates to the undetected and unrepaired malware that the unit is a real person, not a honeypot, and that they're clueless about security. In that way it makes them more of a target and decreases rather than increases their security.
Please don't tell people to use FIXMBR to repair a root kit. It's not an appropriate or effective repair for a system that's been compromised. As a repair it's worse than useless - by giving a false sense of security it leads to greater risks.
Technological solutions to social problems don't work.
If you're coding at this level, you're not wasting your time on slashdot. You have real engineers to ask questions of and more importantly, samples.
I explained that in my post. Many companies refuse to use GPL code because of its viral nature. That cripples adoption of GPL software.
Cripples in the same way that my internet radio idea is crippled by the RIAA. If you want to use the copyrighted content, you have to comply with the license - until we do away with this stupid software copyright idea anyway.
I covered that.
Not voting is not a good way to express opposition for all of the options if you have an option to write in "none of the above". Not voting in this case expresses disinterest, or "don't care" - which is what your "lack of vote" is counted as. If you in fact do care, it's best to go to the polls and put your opinion in. And if your option truly was "don't care", well, then my message wasn't for you. I have no interest in what you want -- and you prefer it that way.
OTOH, not voting is a good way to express opposition for voting in general if you follow it up with some sort of protest action along the lines of waving a poster outside a polling place that says "voting is teh evil". If you have problems moral, ethical or religious with the practice of holding polls to set public policy and choose its executors there are probably better places to live where the people and government are more sympathetic to your views.
If your polls don't allow write-ins, well I'm sorry. You should probably do something about that. I'll warn you though -- the process may have something to do with "voting".
If Bill Gates/Microsoft and Google really pushed for this then you KNOW it is for the good of the people and not some attempt at corporate financial padding.
Those are a software and a services company. They're not hardware companies or ISPs. The ISPs and the people who own the wires have the most to lose here, because if you can get a mesh router with 100mbps bandwidth and a 2 mile range, the last mile problem goes away in a big way. That's why they opposed it with a battalion of lobbyists and lawyers. An intermediate business would be to "anchor" the mesh at favorable locations in exchange for advertising rights or something. Hardware companies that are positioned to sell into this market stand to gain a lot -- a whitespace mesh router is also a repeater in addition to giving you a net connection to the "anchor". There's no "selling" to this product. It's the big "duh".
And a wireless mesh network with this kind of range and multiple anchors isn't as susceptible to power outages, filtering or government monitoring. This could get interesting very quickly. Buildout to low density or impoverished areas could accelerate immensely. The OLPC project has a good mesh stack. Call quality with voip would be abysmal probably, but whitespace mesh cellular could become interesting also if QOS is built into the mesh. Linksys and DLink should have these products available within a year - the radio space is unregulated and they already have the router side figured out, so it's a frequency change a little testing and off to the factory in TaiPei. They don't even have to worry about interop. This is undiscovered country and real pioneers are seldom fussy about standards - they're more interested in staking a claim and holding it. The guy with the most swag in the interop standards conference will be the guy with the most stakes planted in the field.
This is nothing but money for companies that sell services and software because it grows the size of their potential market. Imagine being able to get online anyplace you currently do, with 1mbps wireless bandwidth, for the one-time cost of a "whitespace mesh router" and having to click through an anchor ad to get to the 'net - just like you would do if you were at a hotel. Just the consumer data on the unencrypted traffic might be marketable enough to pay for it without ads. A lot of people will use this who currently just can't.
It's innovatin' time! Let's get to it!
Actually guys, I could care less what we call it. Could we get on with building it please?
Did you consider returning the motherboard for replacement by one that wasn't broken?
You need a step 2.5:
Throw the specification over the wall to the developers.
Otherwise you run into derived copyright issues.
The year of the linux desktop will never come until "making everything work" for 80% of the population requires precisely zero command line interactions, and precisely zero edits of obscure text files. And that most google searches for help end with instructions telling the user how to fix their problem or get their whatever working must also use precisely zero command line interactions, and precisely zero edits of obscure text files.
Taking Windows from as-shipped to "ready for the corporate desktop" involves the same amount of work as Linux does. Not that it matters to the end user. Corporate desktops are prepped by professionals to be targeted at people who couldn't find their network storage if it wasn't the universal default in all applications, and installed by professionals that handle such niceties as selecting display resolutions and tailoring settings for each customer's special needs. None of Windows, Linux or OS-X requires either less or more. The first part, building the "golden image" is handled by a small group and their efforts are leveraged against thousands of users so if it takes an extra week or two to do one or the other it makes little difference on a per-user basis. More time, and more valuable time, is probably spent deciding on technologies and policies that drive the bit diddling. The second part, customization service and training is labor intensive and the factors that cause an individual to consume more service on average are not "technical".
For support after installation? Also a wash. What, are you going to not have support people? That's crazy talk.
I think what matters in the enterprise space is compatibility and consistency. Each version should have a logical progression from the last to the next, so people get a comforting sense of familiarity with it. The enterprise has a lot of applications with a lifecycle of 10-15 years, and some larger enterprises are hoping to build a reliable roadmap to the future that goes continuously into the past. Architectural changes and toolchain revisions that reliably break that road without a clear bridge - or even a clear reason why other than "we need a new version if we're going to sell you another copy" - are not eagerly accepted. Open source gets the advantage here.
Consumer desktops? They run what they get, or they know better. Those that know better are not afraid to tinker. Those that don't at this point deserve to have to accept what they get - the vendors sell access rights to install stuff on the box. It's 2008 for goshsakes.
Federal desktops? Don't get me started on the brain damage that they require. I'm not only not interested in doing it, I'm not interested in having one. If you make the box that idiot proof, only an idiot would want to use it.
Let's talk about support: Sure, if you're a big org, Microsoft will send out someone to help you adjust your infrastructure to accept a new product, or track down a pesky bug. Unfortunately, after some serious analysis and consideration their answer is going to be "oh. You need to replace this third party product with this Microsoft product and then all will be fine. Personally I would prefer it if the salesmen would come dressed in a polo and take me out to lunch. Pretending to be tech support is disingenuous and not helpful.
I gave up on their products so many years ago I had to look up what an X-Fi sound card was.
But yeah, cool.
That you don't know of him is interesting.
I was thinking aethernet but it's a lot too close to that other ubiquitous network.
You pirate! I'll bet you have the drivers installed in more than one machine, too.
In one year. Let's call it the Cloud.
All patents and copyrights shall be for a period of fifteen minutes, with no renewals.
You can use it to write "none of the above". There. If you think all the choices are evil, you've voted against evil.
Now I'm arguing with a famous anonymous coward. Cool. Y'know, Rob Enderle gets himself into print a lot too.
Wiping and reinstalling doesn't have to be painful. If you catch a good image with clonezilla you can restore in just a few minutes. It's actually faster than scanning the whole PC, don'tcha know.
Oh, and I don't need any blue ribbons on my shirt to point out the blatantly obvious.
on slashdot. Please don't share it around.
Are you listing better advice here, to help others?? No. I don't see it...
I had a nice writeup on this in my journal, but it's gone now. There's only one reason I can think of not to wipe and reinstall if you find your system's been compromised by any malware at all: if you're running a honey pot and you want to see where the traffic goes.
Otherwise, it's wipe and reinstall. Always. Just like I wrote above. One of the first things malware does when it gets its toe in is it worms its way deep into everything it can - some active and some hidden with time delays so that it can be persistent despite cleaning attempts. Some of it you'll find, but can you find all of it? Is there any way to be sure you found all of it? No. Wipe and reinstall. Always.