OK, I'll wade in with a couple of comments...
Andrew Plato wrote:
> I think Rob's point, one that I find very compelling, is that MS
> products were not designed or marketed to hardcore geeks. They were
> designed for mass-market consumption.
This is exactly what I spoke up about during Spaf's talk -- I think one
of the most egregious falsehoods the software industry (and especially
Microsoft) passes off on the generic consumer is the claim that their
software is "easy to use". Windows is an excellent example -- it claims
to be "easy to use" ("designed for mass-market consumption") but the
truth is that it is NOT easy to use -- as Andrew himself notes:
> Yes, out of the box, a default installation, Windows security sucks.
> But honestly, there are a lot of ways to slice and dice Windows
> machines. With a modest amount of hardening, you can turn an NT/2000
> box into a very secure machine. I've written a paper on this. Its not
> impossible, but it isn't something many people know how to do.
How can anybody claim that a system which sets up, by default, to leave
its innocent user wide open to assault is "easy to use"? Talk about
false advertising!
A significant portion of my consulting time is spent fixing things for
people who thought they were getting something "easy to use" and then
discovered otherwise. And a significant part of that time is spent
explaining to them why it takes so long to fix something that is
supposed to be "easy to use"!
Alan wrote:
> > IMHO, we need to look ahead to the time of always-on,
> always-reliable networks with minimalist client operating systems (ie,
> a simple browser), services hosted on secure servers not user machines
>
> We also need to take account that sometimes the best defense if to not
> be connected to the net at all. Current Windows versions seem to
> assume that you have a connection to the net for each and every
> machine that you have.
Personally, I am not at all looking forward to the day when Microsoft
has managed to create the "rent by the hour" model of software access.
I don't trust Microsoft to provide anything reasonable in terms of
default setup NOW (and it isn't just Microsoft -- RedHat has some really
lame default setups as well) -- I hate to imagine what a system would
look like when they take complete charge and do everything remotely. No
thank you! And you can forget about anything resembling security or
privacy in that model.
Alan also wrote:
> It becomes even worse when they allow systems with a low fault rate
> get
> replaced by systems known for their failures. (Can you say "blue
> screen of
> death"? I knew you could!)
One of my hobbies is collecting "close encounters of the Microsoft kind"
-- running into classic Windows errors in unexpected/inappropriate
places. A couple of my favorites: 1) the arrivals/departures monitor
that was displaying a "blue screen" at Norfolk airport; 2) a typical
Windows error message box ("Reformat hard drive -- OK?") on a
point-of-sale terminal in a service center store on the French "freeway"
north of Paris.
Andrew Plato also wrote:
> I think the fact that Graham designed an intrusion detection product
> (BlackICE now the core technology in ISS's RealSecure) is
> demonstrative of his commitment to building solutions that are neither
> a nuisance or an inconvenience. In fact, I would argue (although I
> have a rather obvious bias here) that Mr. Graham's technologies are
> some of the least intrusive security products that still deliver
> outstanding capabilities.
Well, for a different assessment of BlackICE, I'll point people to Steve
Gibson's article (near the bottom) -- http://grc.com/dos/grcdos.htm
Raan
This archive was generated by hypermail 2b30 : Sun May 26 2002 - 11:40:03 PDT