Microsoft Talks Back To Google's Security Claims 528
Kilrah_il writes "Yesterday there was a piece about Google ditching Windows for internal use because of security concerns. Now Microsoft is fighting back, claiming its products are the most secure — more than Google's and Apple's. 'When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else. And it's not just the hackers; third-party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others.'"
Some Helpful Advise (Score:5, Insightful)
When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else.
Hint: Your worst nightmares do not have open jovial dialogues with you. And if they did communicate with you or offer you a score card or report, they would want you to feel as though you are completely safe -- totally unaware and unprepared for what you may face.
You've come a long way, Microsoft, but you have much much further to go. If you measure security by percentage increase in security then the evolution from Windows 95 to Windows 7 is nigh impassable. But that in no way means you're number one in the security scores. Run your marketing campaign with setting the "facts" straight but people like me know. With what little (journalistic) evidence you presented, there's no way I can build a conclusion that backs up your statement. And there's no way around that. It would better prepare you to look into the several thousand anecdotes found daily [krebsonsecurity.com] revealing the issues with Windows and Internet Explorer.
Re:Some Helpful Advise (Score:5, Funny)
Microsoft's products are completely secure!! Completely! You don't even need to bother with any more security "research". In fact, I've even seen Bruce Schneier running Windows on his laptop, so it's completely safe!!
Re: (Score:2)
Re: (Score:3, Insightful)
I love the weasel words that come out in these kinds of discussions. "Most" - what is "most"? One competitor? (Maybe, Apple?). Because it certainly does not include (on an OS level) Linux, BSDs etc. Heck I'd be surprised if you could say definitively that MS trumps Google (I certainly don't think that's the case)
Re: (Score:3, Insightful)
Re:Some Helpful Advise (Score:5, Informative)
I seem to remember the person that won the P0wn20wn contest stating that there are several security enhancements with regards to the memory stack that are not present in OSX but are in FreeBSD, Linux, and Vista.
But this may be things like the windows login being provably secure, but the firewire driver allowing you to end run the login screen.
Windows has security features that on paper make it look like it could be a very secure system, the problem is that once you have locked it down to use all the security features, you probably have to write your own applications, as most off the shelf windows software does not run in that type of environment.
Re:Some Helpful Advise (Score:5, Insightful)
That's entirely the point, on paper windows has a very impressive set of security features, but once you get down to trying to use them the cracks show...
The password hashing is trivially weak compared to what other systems have...
The authentication system is tied in to the hashing algorithm so it cant easily be changed without breaking things...
The authentication system is designed such that you never need to send the plain text password over the network, but you don't need the plain text password - you can just use the hash (google for hash spraying or the windows auth model is broken)...
Many of the group policy restrictions are implemented in userland applications and are easily bypassed...
Windows and its associated network protocols are extremely complex (greater complexity leads to greater chance of bugs) and in those network protocols there is often no clear demarcation between what functions can be accessed pre-auth and whats available post-auth... RDP for instance establishes a full gui session *before* you log in meaning any of those gui functions are open to attack by unauthenticated attackers...
File extensions are used to differentiate between types of file and wether a file can be executed or not, although windows does implement execute permissions through acls they usually allow execute by default. a remote web/ftp/whatever server can control the filename but not the permissions...
The complexity of the windows security system means that very few people try to use it fully, and those who do need to expend significant effort to get things working with it. Because so few people harden their systems in this way, very few applications are designed to run in such an environment and many simply don't.
Windows is generally not modular, so removing things you don't need is far more difficult than it should be, win2k8 has gone some way in this regard but its still a long way from the package managed modularity of linux.
Windows has a very messy filesystem layout, files are randomly lumped together in the windows and system32 dirs, unix has a far more sensible design which lets you do things like keep core parts of the system on read-only media.
Windows is an unholy over complicated mess, consisting of parts of a relatively well designed OS (NT), merged with parts of an extremely poorly designed OS (win9x) and various poorly designed subsystems on top...
Unix on the other hand keeps it simple, its easy to know exactly whats going on with a unix system, and the more you understand about a system the better you can monitor and harden it.
Re: (Score:3, Insightful)
That really can't be blamed on the user. The blame rests squarely on both Microsoft who encouraged it with their "Home edition" and large scale computer distributors (HP in particular) where the default is auto-login. And not just any auto-login but administrator auto-login. It comes
Re:Some Helpful Advise (Score:4, Insightful)
He didn't say nobody gives a shit about apple. He said, nobody gives a shit about attacking apple's products (Mac's in particular).
Here's a hint. Say you are going to write a mean nasty program whos sole purpose is to make you money, and tons of it. Will you, a) target 5% of the computers in the world, or b) tartet 90% of the computers in the world?
I know which one I would do. And if you answer differently, then you either aren't being honest, or you have a very warped idea of how malware writers think these days. It's all about return on investment, and they are spending a LOT of money buying 0 day vulnerabilities and writing tons of code to exploit them, rootkits, etc.. it's not just kids in their parents basement trying to put penises on peoples screens anymore.
Nobody gives a shit about the "challenge" of the hack, if it doesn't make them lots of money.
Re:Some Helpful Advise (Score:5, Funny)
"Here's a hint. Say you are going to write a mean nasty program whos sole purpose is to make you money, and tons of it. "
Alright, who leaked Bill Gate's business plan?
Re:Some Helpful Advise (Score:5, Insightful)
tired response is tired.
The money is on UNIX systems. That's where the large banks are running their transactions, where stock is being traded, where the military is running it's services, where engineering designs are stored, etc. omgponies you hacked grandpa's 10 year old computer, and added it to your botnet...just what did that get you, really? For just a few $k a month I could build an ec2 cluster that would destroy any botnet in sheer computing power...mostly because I wouldn't have to deal with crazy queing mechanisms, or nicing the tasks down enough to not be noticed by the user.
The reality is, more than anything this tired "people hack windows boxes because they can win more" response pretends to suggest, that UNIX is phenominally more secure on a basic, fundamental, architectural level than Windows. Out of the box, I can trust an app on a RHEL os. Out of the box, I can't even plug a windows machine in to a network without being behind a firewall. I've literally seen, with my own eyes, windows machines get compromised in less than 20 minutes of being online. Sure sure, sample sizes and all that...except, I've also managed hundreds of unix machines at a time without any concerns on them.
Re: (Score:3, Interesting)
Now we are comparing UNIX boxes that run financial institutions to Windows XP boxes run by 14 year old girls who's primary concern in life is weather or not facebook.com loads?
Hilarious.
UNIX systems in Banking institutions are run by competent people and sit on network secured by competent people. It's much easier and less risky to take control of 100,000 Windows machines run by people with zero knowledge of security and next to zero chance of figuring out they are infected than infiltrate a corporate netwo
Re:Some Helpful Advise (Score:5, Insightful)
What a ridiculous line of reasoning. The money is in lots of different systems. Unix, Windows, but largely IBM Mainframes running OS's like MVS.
But what OS is used is irrelevant, because those systems are well protected by more than just the OS itself. Further, those systems have the power of the FBI, CIA, NSA and others behind them to track down anyone who might be capable of penetrating the impressive outer security to get to the OS itself. No (sane) hacker wants that reign of hurt to come down on them.
Then, even if you get access.. then what? You have to figure out how to get the money out. That's not an easy thing to do, since there are tons of safeguards in place to prevent money from just evaporating.
It's *MUCH* easier to compromise low-security desktop machines and take over someones checking account, transfering a few hundred or thousand dollars using the users own credentials to someplace offshore. Or, it's even easier if you get the user to do it themselves (ala fake anti-virus).
Your "reality" is not any kind of real "reality".
Wow, you hook a 10 year old operating system up to the internet without any kind of security, and it gets compromised in 20 minutes. Great. I guarantee you a 10 year old copy of Linux could get compromised just as easily if someone had merely had the motivation to write the code to do it.
And trust me, a 10 year old unpatched copy of Linux probably has 10,000 or more vulnerabilities that could be exploited to do so... if anyone cared to.
Re: (Score:3, Insightful)
The money is on UNIX systems.
Which are professionally managed and monitored. Why would you target them, when you can target the (typically) very UNprofessionally managed and monitored client machines, which have access to everything that matters on those central systems.
Obligatory car analogy: would you try and steal the locked car kept in a brightly lit garage with a guard watching it 24x7, or would you try and steal the unlocked car parked in a dark back alley on the edge of town that's only driven a
Re:Some Helpful Advise (Score:4, Insightful)
Let's see, where to start... Ok, yes, large computing operations are all done on *nix. I manage THOUSANDS (note the plural) of *nix servers (and nearly as many Windows servers), and while I'm much less concerned about their default installs on a *nix, even those are just as capable of being compromised, especially depending on the distribution. And no, RHEL is not what I'd consider one of the more secure ones, unless you're also leaving SELINUX enabled, which robs the machine of a great deal of functionality and connectivity: put a default Plesk install on a *nix machine on a non-firewalled publicly addressable IP and watch how long it takes to get compromised - I can do it in under 3 minutes. You also probably have no idea just how many production *nix servers are hopelessly behind on kernel and other system updates, leaving them vulnerable to a dizzying array of compromises and exploits against everything from HTTP to SSH to webmin/usermin. Much like a Windows system, even *nix systems need some post-install configuration to ensure their safety, as well as continuing maintenance and updates, otherwise over time they become just as vulnerable as anything else, and there is no dearth of noob *nix admins who think that simply using a *nix makes them invincible and regular security maintenance unnecessary.
Also, yeah, let's see how long your "few $k a month" server(s) stands up to 10GB/s sustained DoS from Zeus or the remnants of Mariposa - unless it isn't connected to a switch that is in turn eventually connected to something else, in which case it's more or less useless for business. Botnets aren't used for computing power, and if they in fact were, I do believe you'd be rather chagrined by your above statement. There's a REASON that the various BOINC [berkeley.edu] projects have been running so long, and not just because it's cheaper: it's because they crunch far more data in these distributed applications than they could do in their own server farms at any reasonable cost. Once again, this isn't the point.
Additionally, you missed the points raised by other posters above re: low-hanging fruit. You don't go after the better-administered (and a lot of Windows server admins use Windows because they have no admin skills at all), better secured servers, you go after the easy ones. Ones you can get a trojan on a 5 million Windows desktops and servers, stealing passwords and credit-card information from the former and using the latter to host the attack sites distributing your malware.
As man_of_mr_e said, especially if you live in a civilized country (which does not include China, Russia, N. Korea, Iran or Brazil, IMNSHO), then attacking a corporate system with the risk of the FBI etc. coming after you is not remotely worth it, especially when you can go after individuals who are unlikely to ever successfully initiate any sort of law enforcement action. "Grandpa's 10 year old computer" probably has his bank password on it, however.
Re: (Score:3, Informative)
Uninformed response is uninformed.
The easy money is not on Unix, it's on Windows. So Vladmir Q MalwareWriter wants to build a botnet to sell to spam or DDOS services, is he going to pick 1% of the worlds most powerful but well protected computers or 90% of computers where at least 60% of that market doesn't care about security in any meaningful way.
Yes, the big money is on UNIX, banks, stock exchanges and so forth but these orgs have dedicated security teams monitoring the sy
Re:Some Helpful Advise (Score:4, Interesting)
the point is that the value isn't by building a bigger botnet, it's by getting prime targets. If it takes you 10,000 times more effort to get on the large banking system than it does to break on to a windows7 box someone uses at home...so what, it's likely going to be that much more valuable. Even with massive, massive numbers of compromised systems, botnets aren't a money-making venture. Getting that random keylogger to get access to someone's bank account is FAR, FAR more difficult than shooting a spam email to 100,000 people just asking them for the info - you'll get it from a few of them. No need to actually break on to a box for that sort of thing, you just break the person. The OS is thus irrelevant.
Linux isn't less of a target, it's *more* of one. There is less success hacking it not because people don't want to hack it, but instead...wait for it...because it's more secure. I could go over the reasons why in detail, but if you haven't figured it out for yourself after all these years, then...hey, fanboi away.
Re: (Score:3, Insightful)
You are confusing "vulnerable" with "exploited". I guarantee you that your system is vulnerable. There are several high profile apache vulnerabilities, for instance. I'll also bet you've applied security patches, which is not the same thing as taking a stock, unpatched system and connecting it directly.
I'll also bet you've enabled and propertly configured the firewall, something most people simply won't do.
Re: (Score:3, Interesting)
Er... stupid 4chan meme is... lame and old and tired and, well... stupid.
I honestly don't know what the fark you are talking about.
Also, yeah, let's see how long your "few $k a month" server(s) stands up to 10GB/s sustained DoS from Zeus or the remnants of Mariposa
Wow. Well, you um...quoted part of that sentence, and either ignored or didn't understand the rest. Let's repeat it, shall we?
"For just a few $k a month I could build an ec2 cluster that would destroy any botnet in sheer computing power"
Unless y
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
The part you keep forgetting is that 100% of the mac market isn't anywhere near as lucritive as 10% of the Windows market. So having 100% of the mac market (even if you could get that) won't make you as much money as infecting 10% of windows boxes.. yep, you know where they're going to go.
Re: (Score:3, Insightful)
Whether or not Windows is "low hanging fruit" or not is a matter of opinion, but the fact is.. it doesn't matter.
Even if windows were 100x more secure than any other OS, it would still have the majority of the malware. Guaranteed. Because it has the majority of the reward.
Hackers may be lazy by nature, but they will do whatever work is required to get the job done (and usually no more). So one cannot look at the amount of exploitation as an indication of the level of security, since one also has to look
Re:Some Helpful Advise (Score:4, Insightful)
Posting from a mac here, so dont get me wrong. But apples market increase is not about macs, its about iphones ipods and now ipads. Macs are great things, aint no doubt about it, solid well engineered and damn reliable machines, but its still undoubtably a minority platform.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re:Some Helpful Advise (Score:5, Interesting)
Linux and FreeBSD boxes get hacked all the time. One can claim it's because people use weak passwords or use the same password on their box as they do on every site on the internet, and there are probably a lot of those boxes that compromised that way, but a lot are also do flaws in software installed on Linux boxes. Spend some time going through sites like Zone-H [zone-h.org] and you'll see that Linux sites get successfully attaced as much, if not more so than Windows servers (the numbers change from day to day).
You're living in a dream world if you think Linux security is any better or worse than anyone elses. Most Linux boxes have 1000x more software installed on them, and each software package is a potential security flaw waiting to happen. Most of those can only compromise the account it runs on, but attackers are getting smart and creating blended attackes that include multiple vulnerabilities, including local root vulnerabilites that get executed via a user-level remote attack.
But really, the only people who attack Linux boxes are those looking to either brag, or those looking for fat pipe DDoS zombies. Malware authors, who target stupid users who will pay $50 to the fake virus writers are going to target the vast majority of systems.. ie windows.
Ford and Microsoft (Score:4, Funny)
I love the weasel words that come out in these kinds of discussions. "Most" - what is "most"? One competitor? (Maybe, Apple?).
This reminds me of that Ford commercial I saw a month or two ago, where some dude is talking about how Ford won some kind of "most improved" award. That's like a retarded child who goes from flunking everything to getting straight C- grades ... relatively speaking, that's a far greater improvement that the straight A student who starts getting a few A+ grades.
Nobody cares that Microsoft's "focus and investment continues to surpass others". When Microsoft's boat has thousands of holes in it and is sinking faster than the Titanic, is it anything to boast about that you have a great investment in a massive number of people highly focused on sticking their fingers in the holes? Compare that to Apple's boat, where they only have a modest investment because there are only a few holes.
Re: (Score:3)
That's because they've already patched the gaping holes with the arms and legs of early iPhone and iPad adopters!
Re:Some Helpful Advise (Score:5, Insightful)
Server rooms around the world disagree. As do smartphones, netbooks and all manner of embedded devices.
Re: (Score:3, Funny)
Running a server on windows is like taking your head and slamming in a doorway 100 times, its painful.
Not only painful, but the risk of brain damage is higher too!
Re: (Score:3, Funny)
Re: (Score:2)
That's a story about using your kid's unmanaged Windows PC for the first time to manage your finances.
MS security record is far less than impressive, but that's an awesome case of PEBCAK.
[OT]Oh god, I need to sleep but I keep getting given things to do. My fault for wasting half the afternoon on /..[/OT]
Re: (Score:3, Insightful)
Re:Both have problems (Score:5, Insightful)
Re: (Score:3, Insightful)
Hmm, I must've missed MS beating out OpenBSD for security.
It's easy to be secure when you don't do anything.
Re:Both have problems (Score:5, Insightful)
No, now that you mention it - I know about 3000 kids using Windows, and one kid using OpenBSD. And, now that I think about it, at least 2500 WIndows users have nuked and reinstalled multiple times. That nerdy little BSD kid just keeps on going, and going, and going, and going. I think maybe she's getting some of the Energizer Bunny.
Re:Both have problems (Score:4, Funny)
Okey, I'm calling your bullshit.
Re:OpenBSD Security is a Myth... (Score:4, Informative)
First line of the blog.
Firstly, I would to apologize for, and clarify the title of this article. I wanted to use a title which would hold attention and encourage discussion while remaining true to the argument I make. I certainly don’t mean to imply that OpenBSD is a horribly insecure operating system – it isn’t.
Re:Both have problems (Score:5, Informative)
All of these work without any user intervention, by default, on all running programs. Part of the OpenBSD developers' philosophy is that all code is buggy, and the system should do everything that it can to minimise the security impact of running buggy code.
Another part is that no one uses optional security measures. Windows NT has had fine-grained ACLs on all kernel objects from the start, yet people tend to leave Windows permissions wide open because they're hard. Even now, Fedora and Ubuntu documentation often says 'disable SELinux' for various things to work. It doesn't matter how secure SELinux or UAC is, if the end user disables it.
Re: (Score:3, Insightful)
Re:Both have problems (Score:5, Informative)
I always figured they hacked the prize they valued most and that's why Windows was on the bottom of the list.
Wrong. They always hacked the Mac because Apple is way easier to hack then Microsoft [threatpost.com]
From the links article:
This came in via e-mail: Many pundits have made a lot of the fact that the Mac was the first to be exploited in the Pwn2Own contest. Was the choice of the Mac as the first target because the hardware/operating system combo was more desirable as a prize than the commodity Windows laptops of the other competitors? Or was it just because Macintosh exploits occur with much less frequency than Windows exploits and would therefore be more newsworthy?
So until this year, applications on Apple were way easier to exploit than Windows. This is because Apple had weak ASLR and no DEP while Windows had full ASLR and DEP. This year, Snow Leopard has DEP, so its no longer trivial to exploit. In fact, I have lots of bugs in Safari that I easily could have exploited on Leopard but will be very difficult on Snow Leopard. So it used to be that that it was much worse, but now its mostly comparable (although still slightly behind)
And this is from Pwn2Own 2010.
Re:Both have problems (Score:4, Informative)
No, they aren't granted physical access. But they are allowed to set up a web server serving arbitrary content, for example, and then direct the person (who isn't one of them) using the laptop to open an URL on that website in the browser. I.e. it does not require the user to be entirely passive.
Re: (Score:3, Insightful)
In a corporate environment this can happen. It's quite easy to get some tradesman's clothes and pretend you're there to service a computer. You might want to read The Art of Deception by Kevin Mitnick.
Re: (Score:3, Insightful)
Am I to gather from this that the hackers are granted access to the machines? That isn't very realistic...
It's absolutely realistic. The vast majority of users are more than happy to do whatever it takes to see the dancing bunnies.
Re: (Score:3, Interesting)
The latest results I could find was from 2006. Do you have a link to a new competition?
Re:Both have problems (Score:5, Informative)
I don't like MS, though the truth is that with this last Windows, they are really more secure than others SO's, if you guys pay attention in the hacker championship, that one the gives a prize for the fastest hacker that invade one system, the fast invasion happens into Mac OS X, then Linux and Windows for last.
Oh, you mean Pwn2Own? 2010? Nope, Linux not tested. 2009? Nope, not tested. 2008? Can't be, the Sony Vaio running Ubuntu was never cracked [tippingpoint.com].
Anybody got results from 2007 or earlier? I can't find them.
Re:Both have problems (Score:5, Funny)
So what you're saying is that for the last two years Pwn2Own has been some sort of security Special Olympics? That's actually very interesting.
Did they ever have a BSD?
Re: (Score:3, Insightful)
Here is a little hint for you. The dangerous hackers, the ones that are actually committing crimes in the wild, don't go to hacker competitions.
ROFL? (Score:2, Insightful)
Security? (Score:5, Insightful)
Re: (Score:3, Insightful)
Re:Security? (Score:5, Insightful)
They've added a lot of security. For example, when I debug an application on Windows 7, I have to click four dialog boxes instead of just one. If that isn't real security, I don't know what is.
Re:Security? (Score:5, Funny)
They've added a lot of security. For example, when I debug an application on Windows 7, I have to click four dialog boxes instead of just one. If that isn't real security, I don't know what is.
Well, four is greater than one. A car has four wheels and a unicycle only has one. A car is more secure than a unicycle. In fact, in a collision between a car and a unicycle the passenger(s) in the car will always be safer - even if the car isn't moving. Based on the preceding car analogy I can confidently declare Windows 7 is more secure than a unicycle.
Re: (Score:3, Insightful)
Everything in Windows 7 takes four times as many clicks as in XP so that's simply consistent user interface design.
It's a shame that the one and only aspect of the Windows 7 interface that is consistent is somewhat of a negative one.
Re:Security? (Score:4, Insightful)
This is the total point, it shouldn't matter if your apps have holes in them or not (although "not" would be best), they should never have the kind of privileges that allow things to take over (do a little search for "smitfraud" and you will understand what I mean).
They seemed to be going top-down for a long time, when only now are they starting to realise that sandboxing (UAC) the user from the OS is a good idea, not the best, not 100%, but they are almost on the cusp of "getting it" at last :)
Re: (Score:3, Insightful)
Sandboxed so far as user limits (as in linux) or even browser windows (like in chrome browser), yes it does have overheads, but really, isn't security worth a little extra CPU time since without all those anti-virus and anti-spyware apps running we can free up a whole lot of resources?
Re: (Score:3, Informative)
I think you have been living in the Windows reality distortion field too long. An application doesn't need "low level access" in order to do useful or even powerful things. To write a 3D modelling app, you don't need a kernel module to gain direct access to memory -- you just need good, proper, APIs such as OpenGL. User-mode drivers have proven to be quite useful in *NIX... take for example "fuse" file systems and the like. How nice would it be in Windows to be able to mount a CD/DVD ISO image or some o
Re: (Score:2, Insightful)
True.
One argument that seems to come up over and over again when the topic of security comes up is that Windows is targeted because it's more popular. The fact is that modern networked equipment, from routers to printers to VoIP gateways, to gaming consoles, to cable modems, to smart phones, etc. run an OS with a network stack. Often many of these devices go for years without patches. I would argue that there are more non-Windows based networked computing devices than Windows PCs. I would also argue tha
Re:Security? (Score:5, Insightful)
Security is NOT about patching holes, a system must be designed from the ground up to be secure. Doze and it's predecessors were NEVER designed this way.
Is that why Ubuntu 8.04 prompts me to install some hundred or more security updates after installing it? No software is perfect and anyone who thinks that the only secure system is on that is "designed from the ground up to be secure" either A) has never worked on a large software project and/or B) doesn't have a clue what they're talking about.
What is so fundamentally more secure from a design perspective about the Linux kernel compared with the WinNT kernel? How about a distribution like Ubuntu compared with Windows XP/Vista/7? Since one was "designed from the ground up to be secure" I sure hope you can point out a few design choices specifically.
Since all software (even the Linux kernel and its ilk) have security holes, the ability and speed at which you discover the exploits and issue fixes for them is at least as important as the initial design and coding of the program. It's naive and obtuse to think any complex system will be perfect from the get-go.
Re: (Score:3, Insightful)
But.. but.. you don't know what you're talking about...
Security patches on Linux are evidence that Linux has such a secure system that patches can be found so easily. Security patches on Windows are evidence that Windows sucks.
Get with the program.
Re: (Score:3, Insightful)
Security is the opposite. Great design should not be your focus. It helps, but you cannot forsee everything.
Microsoft not only never planned for the internet but they failed to be a moving targe
Re:Security? (Score:5, Insightful)
Some of these things MS has fixed, but most of it is just whitewash. The internet was never something they planned for. And it took them a really long time to even consider stopping to just fix things properly. Sure they may spend more time and money on security than the competition, but is it being productive. The actual effect is what's important, not the amount of resources.
Re: (Score:3, Informative)
UAC in vista was more or less completely worthless because it was so intrusive that nearly everybody turned it off.
Only people who didn't read the directions turned it all the way off.
I turned it down so that it only pops up if I'm about to install something. Now it only pops up if I'm about to install something. Oboy, click this box to install; yeah, I meant to install that, thank you for checking. Like that's a big hassle. In general, because of the improved installation system, it's still a lot fewe
Re:Security? (Score:4, Insightful)
So let me get this straight, UAC is both:
1) Too easy to ignore as you just have to click 'yes' every time
2) Too intrusive as it pops up whenever a program requires administrative privileges
Sure, don't bother to respond to what I post when you can just make stuff up instead.
At least as far as point 2 goes, mac os and many linux distros are "worse" as they not only prompt, but require your user name and password.
Like that.
Linux occasionally asks for my password or the root password (depending on the distribution) when I'm performing some kind of system maintenance. The only time it asks for a user name is when I log in.
Windows asks me to click yes to allow SuperFoobarScreensaver wants to access the program files directory; how the hell is anyone supposed to know whether it's trying to update a configuration file that the dumb developer stuck in the program files directory, or install spyware into IE? Worse, it happens so often running ordinary everyday software that pressing 'yes' becomes second nature.
Windows 7 has an OK kernel with a bazillion lines of crud on top in order to support old software that thinks it's running on a single-tasking DOS with no security. That is why Windows will take at least a decade to be anywhere near as secure as a real operating system, because it has to burn off the crud first.
The concept of Windows's UAC is fine, it just boils down to poor UI design.
Which is what I said.
Re: (Score:3, Informative)
Re: (Score:3, Informative)
All daemons with the exception of x.org were running under their own restricted user name accounts that were locked down enough to not touch the rest of the system while Windows runs daemons under various accounts including SYSTEM, LOCAL SERVICE, NETWORK SERVICE which all have varying degrees of access to the rest of the system which is how many Windows worms are capable of accessing the rest of the system.
It's perfectly possible to run services under other accounts, so it's not a security model problem.
This is more of an issue with default configuration, which no-one really bothers to change. I agree that it is still a problem, by the way, though there have been some changes in that department in MS products - e.g. SQL Server installer will try to force you to create a separate user account for its services.
I don't see how, gksudo is not wrapped around applications waiting for them to perform some operation that requires extra permissions and then prompting about it. It requires you run the command in question as the given user if you wish to do so.
That is precisely how UAC works, actually. A process cannot elevate itself via an UAC prompt. It can o
Re: (Score:3, Interesting)
A security model ain't worth crap when so many applications won't run if you're not an administrator.
That's not a problem with security model. It's a problem with applications. Most of them don't have to be designed to, say, write to "C:\Program Files" - indeed, most can be trivially changed to avoid this - but they still do, because developers are lazy, and because you could do that in Win9x. This has nothing to do with XP as an OS at all.
Probably because you're talking crap. People don't complain about gksudo because they hardly ever see it, and generally only do so when performing some kind of operation that absolutely requires admin priviledges; UAC comes up routinely when you run ordinary every day pre-Vista software and with some that's not even that old.
Again, "UAC coming up routinely" is not part of the OS security model. It's a problem with badly coded legacy applications.
Note, I'm not arguing that it's not a problem.
Cisco (Score:5, Interesting)
Well, I can tell you right now that a lot of Cisco's engineers use Macs, and server-side it's Linux. That said, I imagine Cisco management, marketing, etc. are mostly Windows-based.
Re:Cisco (Score:5, Insightful)
That resonates with my own reading of the quote: all companies who are on the receiving end of M$' security investments praise the investor.
And obviously anti-virus companies would tell that Windows is better: without the swiss cheese OS they would be out of job.
Microsoft? (Score:5, Funny)
Secure products?
Crap.... woke up in the wrong universe again.. I hate when that happens.
Awwwwwww, crap! (Score:2)
Re:Awwwwwww, crap! (Score:4, Funny)
Damn you, now i sprayed my tea all over my keyboard with the image of Steve doing a ventriloquist act with a puppet of clippy :) (since bill doesn't work there any more)
Waitaminit, which Steve? (Score:2)
I had the wrong Steve in mind, making for a very different "Hi, I'm a Mac" commercial...
Cheers,
That guy doesn't understand what irony means (Score:2)
In a rough sense, irony means a contradiction. In which case, can someone please explain how this:
"There is some irony here that is hard to overlook. For starters, check out this story from Mashable a few months ago where it was reported that Yale University had halted their move to Gmail (and their move to Google’s Google Apps for Education package) citing both security and privacy concerns."
makes sense as a comparison, let alone counts as irony/ironic? What the hell is ironic here?
The fact Google i
Re: (Score:2)
Come to think of it, maybe Yale backed out of the Gmail deal because Google staff were running Windows.
Focus and Investment (Score:5, Insightful)
Nice zero content marketingspeak there:
"...third-party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others."
Focus and investment. Notice "results" aren't on that list.
As a side note, I'd also like to add that lately BP has had a huge focus and investment on cleaning up oil spills. More so than any other oil company. But still - nobody loves them this week. Wonder why?
Re:Focus and Investment (Score:5, Funny)
Nice zero content marketingspeak there:
"...third-party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others."
Focus and investment. Notice "results" aren't on that list.
SECURITY ANALYST: WTF? You invest billions and billions of dollars trying to fix your software, and this is the best you can do? Christ on a kebab, man! Do your developers even know how to tie their own shoelaces? What do they do, sit their slack-jawed at their desks all day, watching the grass die on their Farmville plots and pissing their pants because they can't even remember where the toilet is?
MS MARKETING PERSON: sotto voce Hmmm, billions spent... developers unable to leave desks... Ah!
[WRITING] "industry leaders tell us regularly that our focus and investment continues to surpass others."
Microsoft products are the most secure? (Score:3, Insightful)
Microsoft has come a long, long way in security, yes, that's true. But the most secure? No way. Not compared to systems designed around security from the ground up like OpenBSD or a security-hardened Linux distro with SELinux and the like. I really like the progress that Microsoft has made, and Windows 7 is much improved over previous Windows versions, but if I want a system that's truly secure, it's not a system I'm likely to pick.
Microsoft products are the most secure lawnmowers (Score:5, Interesting)
Poor chaps, they can only make a "c2" grade in the old orange-book (U.S.Department of Defense) grading by removing the networking, while a mainline Linux distro hits b1 (courtesy of the CIA).
--dave
Hi, I'm a hacker... (Score:5, Funny)
Re: (Score:2)
Keep saying it and one day it might stick (Score:4, Insightful)
All I know is that for more than ten years I made good money removing malware from Windows boxes. In all fairness tho Windows 7 is a much better effort at a secure OS but saying that 'hackers' are making such comments is just not all that believable. Any serious geek will tell you the long sorded history of windows and all its memorable virii, malware and hacks is nothing to be proud of but I guess if you start telling people what you want them to think and keep at it one day it will stick. I think a few statistics should set the record straight.
Re: (Score:3, Interesting)
Any serious geek will tell you the long sorded history of windows and all its memorable virii, malware and hacks...
Where are the equivalent virii in 2010? I remember Code Red and Slammer and the really malicious code that was raping any system stupid enough to expose 135/137 and 445 to the world. I don't remember any malware of that league in recent memory. The worst malware these days seems to be the AntiVirus 2010 and its related ilk. The malware itself is insidious and requires a pave and rebuild "ju
Re:Keep saying it and one day it might stick (Score:5, Insightful)
That's because modern spyware is more focused on hijacking your machine to be part of distributed botnets. That means you don't want the user to realize the machine is compromised. As such, vandalism is less prominent in favor of the lucrative enterprise of selling access to the botnets.
Re:Keep saying it and one day it might stick (Score:4, Interesting)
You are right that the focus has changed. The infection vector has also changed. The old vectors don't work, or if they do the access to them has been mitigated on the client by the software firewall, and on the network permimeter by hardware firewalls. The operating system has been hardened to the point that most of the exploits are targetting applications. That is an improvement. Once they figure out how to properly sandbox the applications, the entire system will become more stable. Whether or not Microsoft is really up to the task is debatable.
Weasel words... (Score:2)
If indeed "hackers admit [you're] doing a better job making [your] products more secure than anyone else"
then that just means your product is less secure in the first place, and you have to do more work to patch the holes
Other OS's need not put so much effort in on a release-by-release basis
the basic security of Unix was the there 35-40 years ago, and remains largely the same
Extra security features (SELinix, AppArmor, non-root-X, etc.) come along every so often
but agreed, no-one puts the sheer level of effo
Security claims (Score:2)
Uh huh (Score:5, Interesting)
And all those idiotic corporate restrictions on email attachments can go, too. That'll be a great relief, because right now I can't even attach a zipfile without Outlook complaining about it.
And those flashes of screen content that appear when I reconnect to a locked Remote Terminal session, those are just in my imagination. No information exposure there, any more. Good, cause that was really stupid. Wait, I'd better check. Nope, still there.
And those irritating and needless messages requesting permission after I've launched an Active Directory management window, those are gone too, right? Because now the system has finally caught up to the X Window System technology available back in 1993?
Oh, no. Actually, I just checked, and it hasn't.
Wow, Microsoft. I am impressed. You actually drank the kool-aid to prove that it was harmless. Except that it's not.
Re: (Score:2)
Amen! I've started having emails silently dropped by customer's email systems for having links in the email to driver downloads requested by the customer! The customer is usually unaware of the changing rules on incoming emails, so I get to troubleshoot it for them when they complain about a lack of response. I now break up any URL into a base on one line and a file on another line, but who knows how long that will work. In conclusion, I close my rant w
Vista reinstall (Score:5, Insightful)
Oh please (Score:3, Insightful)
I'm sure that if you install linux from a distro that's 2-3 years old that updating all of that goes really quickly and smoothly.
Google is the competition.. (Score:3, Insightful)
Google is Microsoft's #1 competition right? Of course Microsoft wants Google to continue to use Windows.. not using Windows puts Google at an even further advantage.. its not like Microsoft can drop using Windows for its internal systems.
Focus and investment != results (Score:5, Insightful)
Certainly Microsoft's focus and investment surpasses everyone else's. That's because it needs to simply to tread water. The problem is that most of Microsoft's security problems aren't bugs, they're design features of their system.
There's a quote from a boss: "I don't want the industrious guy who'll keep busy doing things over and over. I want the lazy guy who'll do it once, right, so he doesn't need to keep doing it over."
Damned by faint praise (Score:2)
When it comes to security, even hackers admit we're doing a better job making our products more secure than anyone else.
Yeah, that's why the Google breach in China was traced to Windows exploits, because hackers always go after the strongest link in the chain.
I'd be the first one to admit Microsoft has come a long way on security. Vista and Windows 7 are better but you still won't catch me surfing the net with Windows or using it to access my bank account online or for anything that requires higher se
No, you! (Score:2)
Shut up, Microsoft, just shut up. (Score:4, Insightful)
When you finally get rid of "hurr, this file is a program because it ends in .exe" and stripping executability from incoming files, then maybe you can start talking about security with the grown-ups.
But until then, go back to the kiddie-table with CP/M.
--
BMO
Absolute vs. Relative. (Score:5, Interesting)
When we speak about GNU/Linux functionality, nobody takes relative values into account. They only take into account the absolute final result. Example, nobody takes into account the great hardware compatibility considering 99% of all drivers were written by the community after reverse engineering the hardware and/or other OSes privative drivers. People (including microsoft) only mention that GNU/Linux doesn't support all features of X hardware, and windows does, and therefore it's better.
Same thing for apps, marketshare, etc. They only say "More people have windows, it supports more apps, whatever, period. ".
So, why should we take into account relative values when talking about windows?
I don't care if they are trying hard, or if they have more marketshare, or about any other factor. The ONLY operating system that requires antivirus, antispyware, and other crap is windows. It is also the only operating system that is consistently, publicly and massively cracked around the world all the time. There are several botnets around the net that are the source of most spam, and this botnets consist of windows machines only.
So, in absolute terms, the most secure OS is OpenBSD. The most insecure is Windows.
Re: (Score:3, Insightful)
Except you don't need antivirus/antispyware on Windows. The only people who need it are those who disable the security features right after a fresh install, and people leaning heavily toward illegal activities. Since Vista you really didn't need it.
You'll see how quickly a Linux box gets owned if I send grandma 100 free smilies with instructions about how to set exec permissions and how to sudo (similar to what you need to do to get "pwned" by an attachment in a default Win7 install).
10 years without anti-v
Re: (Score:2, Insightful)
On linux I can open a shell and go
rm -rf ~/.mozilla
Can I do that on an ipad?
Re:iPad (Score:4, Insightful)
A closed device could make life much worse for privacy. How does one know that history and cookies are actually deleted, as opposed to saved off to a protected area? And of course, there are items like Flash/Java shared objects that are normally not deleted and on a closed system, there likely is no way a user can delete those. And there is always the ability to have an undocumented add-on which reports a unique ID to any Web server that asks for it.
Privacy on normal computers is an uphill battle, but at least if worst comes to worst, you can run your Web browser in a VM, or on Macs, do your web browsing as guest and log out periodically so all files are deleted. If a platform is closed, where one has to trust the Web browser to guard privacy, does it really do so? Cookies are not the only way to uniquely identify a machine.
I can see in the future this becoming a tool for "law enforcement" -- because most devices that are closed are tied by some sort of unique ID to some central place, it wouldn't be hard to push an update to a device to upload those "deleted" cookies and other data. The end user wouldn't know, and if he or she did, there would be nothing they could do other than trash the device. Or push a program out on a mass scale to look for certain items (say a MP3 file that was leaked), confirm it was on a number of devices, then file a large amount of lawsuits.