Replies

Both of your posts were reasonable, and I can subscribe to most of what you wrote, with one exception:

A lot of the security research that has gone on with Windows seems to be focused on embarrassing Microsoft at the expense of customers. That's wrong. Exploiting customers because you hate MS isn't sufficient justification.

A lot of the security research that has gone on with Windows seems to be focused on embarrassing Microsoft at the expense of customers.

One problem with having any particular piece of operating system, networking, or security software be nearly ubiquitous is that such a ubiquitous item becomes a very attractive and rewarding target for hackers. IMHO, the Justice Department's case against Microsoft, if it was to be pursued at all, should have focused on this issue.

If I were to just hire some guy to write me a crude networking operating/security system, then unless I was using it to protect something highly worthwhile to hackers it wouldn't matter too much if it had more security holes than Windows since it's unlikely any hackers would bothering to attack it and find them. Unfortunately, in the last few years as Windows machines have become more and more ubiquitous on the net not only has the hacker's "reward" for finding security holes increased, but larger populations of 'infectable' machines can be turned into larger populations of worms and zombies.

In a very real sense, the real security "problem" with Windows is simply that it's become so popular. I should mention, btw, that the Microchip 16C84 microcontroller, like most others, has hardware to prevent its code from being read out. A few years ago, someone came up with a 16C84-based satellite decoder. Very attractive target. Soon thereafter, someone else figured out how to read the code from a "code-protected" 16C84.

This should not be taken as a sign that the 16C84's protection was necessarily weaker than any other micros of the time. The notion of unlimitted "free" satellite viewing, however, was too much for hackers to pass up, and so they spent more effort trying to crack that particular chip than they would for e.g. a microwave oven controller.

I don't know what the solution to these problems is, but I think having a healthy mix of operating systems in use would help minimize the effects of rogue software.

What is your main argument or evidence for this claim? I am skeptical that someone carried out security research that damaged real people just to embarass Microsoft. This isn't an attempt to bait you, just curiosity.

There have been several IIS exploits publicized recently, for example, without giving Microsoft the benefit of a warning. Clearly, these exploits were intended to embarrass Microsoft -- not make its products more secure. If you give me time, I can probably dig up the exact references; however, my memory is pretty good on this issue.