Re: Wintards say Vista & XP Security is better than OS X while millions of bots spam the planet


"El Diablo con Queso" <queso.mal@xxxxxxxxxxxxxxxxxx> wrote in message news:13mu39uc1gt5gd2@xxxxxxxxxxxxxxxxxxxxx
PC Guy wrote:

"El Diablo con Queso" <queso.mal@xxxxxxxxxxxxxxxxxx> wrote in message news:13ms1cojl1rdf4b@xxxxxxxxxxxxxxxxxxxxx
PC Guy wrote:

"El Diablo con Queso" <queso.mal@xxxxxxxxxxxxxxxxxx> wrote in message news:13mqjtfo05457b9@xxxxxxxxxxxxxxxxxxxxx
gimme_this_gimme_that@xxxxxxxxx wrote:
Wintards think securty is having to answer every stupid question with
a yes or no.

Meanwhile the *FBI* says over 1000000 machines have been turned into
spam bots

http://www.networkworld.com/news/2007/061307-fbi-operation-bot-roast.html

Wintard==Hookwinker



Many of those machines are kept up by people that don't know how to secure their machines. Of course, Microsoft should have taken things like this in to account and tried to work at thinking about security first but features always sell mass consumer products. Of course this was the same company that thought the Internet was a fad and when they realized it wasn't a fad they integrated the web broswer in to the operating system to gain an advantage. This of course simultaneously created the largest vector for exploitation ever.

People don't care about security. They say they do. But they don't.

Tell that to every business that has lost a day or more of business after cleaning up after an exploit.

I don't have to. Having worked in large corporations I saw all too well how security was relaxed for convenience. Yes, companies and people want to be secure until it comes at a cost of inconvenience. Vista's UAC is a prime example. How many times have we heard how annoying it is? One computer company, who shall remain nameless, went so far as to create a commercial about how bothersome it is. Bothersome/annoying as it may be (though I disagree) it increases security. But some people, including some found in this forum, recommend staying away from Vista citing UAC annoyance as one of the reasons. The same can be said about those browser warning dialogs that appear when switching between encrypted/unencrypted pages. How many of us check the little box that says "Do not show this warning again"? Just about everybody does. These are just a couple of examples.


The UAC dialog boxes do not make Vista secure.

It allows the user to run with LUP and therefore, indirectly, makes Vista more secure.

One of Microsofts biggest blunders was ActiveX and soley basing the security off of the user as the final arbitrator of whether or not something is safe to run.

Unfortunately that's a fact of life that no operating system is going to be able to avoid.

Signing the scripts and having "trusted" signers takes away from that some but then you are adding another layer of the onion. You normal human being doesn't understand how their car works, so they take them to mechanics for upgrading. Computers are much like cars to the average person, they can use them but don't actually understand them. You can't have somebody over your shoulder while running your computer all the time and asking whether or not it is ok to run something does little good for the average user. ActiveX should have been sandboxed from the start and Windows wouldn't have exploits numbering in the hundreds of thousands. Good design goes a long way, ActiveX was poorly designed.



Bruce Schneier has it right that
software companies have no incentive because there are no laws governing it and also insurance companies need to get involved in it. Imagine if you took out a policy and a zero day exploit costed the insurance company a good amount of money on many clients. They'd probably be inclined to tell you to not use that software anymore if you want coverage.


.

Relevant Pages

  • Re: SSHD revelaing too much information.
    ... hundreds of machines and really don't see this as a problem. ... The 'green' banner does not attract any ... This goes against my security ... > networks) then make sure you're running a known secure version. ...
    (FreeBSD-Security)
  • Re: Biometrics
    ... keeping them disconnected and physically secure is sage advice. ... great grasp of the security aspect of protecting computers. ... Use Windows 98 Second Edition Machines as a safety internal protocol ... Maintain certain machines as off-line only in locked and secure rooms ...
    (microsoft.public.security)
  • Re: [Full-Disclosure] Gates: You dont need perfect code for good security
    ... on the internet trying to hack it and 20+K users pumping mail thru it 24x7. ... doesn't seem to matter when we talk about security so.. ... that it is indeed a secure product and that security is not just a marketing ... an ISP, the internet IS our internal network for many machines, as the world ...
    (Full-Disclosure)
  • Re: IIS6 in a DMZ with Win2K AD and Non MS Firewalls
    ... >difficult to manage, and what about a webfarm of more machines, all security ... They all start off with "apply the member server baseline security ... it's a lot more secure than its predecessors. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Windows Vista = Over 180 million licenses sold
    ... Yep, really secure. ... Internet Security and installed Avast. ... 'Windows Vista - Wikipedia, the free encyclopedia' ... And if you don't like the warning pop-ups, ...
    (microsoft.public.windows.vista.general)