Time to DEMAND proper OS protections

      Microsoft has generated a lot of negative publicity over the years because of security glitches with their software, and I agree they need to do a better job.  It seems every month Microsoft frantically warns us of a security hole (usually after it has been discovered by a 3rd party) and pleads with its customers to install a patch. 

      I believe the next major version of their operating system, code-named "Longhorn," will have far more advanced security features than its predecesors.   Also, as has been mentioned, the upcoming Service Pack 2 for Windows XP is supposed to have a bunch of security updates and improvements.

Don,

I can understand your frustration.  And there's a lot of truth in the earlier post giving a car analogy.  You cannot make something 100% protected.  Just attempting it can result in reducing the usefulness of what you're trying to protect.

There are two primary ways for a virus/worm/trojan to get onto a PC.  Either installing itself over a network by exploiting a weakness, or by using 'social engineering' to get the user to run it themselves.

The good news is that in XP SP2, which is coming out sometime later this year, MS is supposedly planning (it's reportedly in the beta version that testers are using) a greatly enhanced firewall over the simplistic ICF they have in the current version of XP. Of course, older machines, or newer ones where the user fails to install SP2 will still be vulnerable; but over time attrition of the old machines will drive to a greater population of those with the firewall.  As I mentioned above though, adding protection can come at a cost; MS is openly saying that some programs will not run with the default settings of their new firewall package.

The second vector is more problematic.  Until users understand that running an unexpected executable without confirming the source is a bad idea, these will continue to spread.  Even with an anti-virus program, there's a window of opportunity between when the virus is launched and when the signature update is applied.  If MS were to bundle in an AV program again, you would have a huge clamor from competitors and anti-MS folks yelling about unfair leveraging of their market position to try to take over another market.  Personally, I prefer having multiple AV programs available.  It makes it much harder to write a virus that can disable every AV program when it launches (many new viruses and spyware try to accomplish that now).

The best bet is to protect your machine with the tools that already exist, and help those around you (friends, family, co-workers, etc) to do the same.

Don, while I hear where you're coming from, it's kind of like demanding that auto manufacturers stop making cars that crash into each other so often. The alternative is really to get off the road.

Linux, anyone?

Message Edited by ddeerrff on 02-21-2004 05:52 PM

I agree.  The ISP's need to take more responsibility, on multiple levels.  They need to provide firewall software with broadband connections (at the very least, instructions on how to activate XP's built-in ICF).  Many ISPs already do a virus scan on incoming emails, they also need to scan outgoing, and notify a user if their machine is sending emails with virus attachments.

The OS can be made somewhat more secure (note: not 100%, that's a practical impossibility unless you disconnect the PC from the internet completely, and even then an infected floppy can cause problems).  A few simple changes can go a long way, and Microsoft is starting to make some of those changes.  First, they're working on a more advanced firewall for SP2 of XP.  They have also begun disabling Messenger Service by default, rather than having it running.  However, last I looked, several other unneeded services are still set to be running by default.  UPnP and DCOM are two of the potentially riskier ones (a decent firewall can protect from the risk on these two services, but they're still running for no useful purpose).

In the end though, it still comes down to user education.  You can make a computer more-and-more idiot proof; but there's always a better idiot just around the corner waiting to foul up the works, no matter how much protection is put in place (read that as a PC user saying: "hey, an email from someone I don't know with what they say is a humorous attachment - sure I'll open the attachment, what harm could it do ...).

Message Edited by AllynKC on 02-22-2004 03:57 PM

I agree that Windows comes configured with too many unnecessary and vulnerable services activated. As a new user, it took me about a year to come to grips with the callousness of the Windows default configuration and to find sites like grc.com, and hundreds of other sites offering basic improvements. I would fault Microsoft and it's vendors for not taking steps to minimize the vulnerabilities passed along to their customers.

As a beginner, it took me about a year to discover many of the unnecessary vulnerabilities included with Windows and to realize that my anti-virus software was ignoring the adverse effects of less-contageous malware. And it has taken me another year to round-up links to the numerous sites advising user's of the configuration options and applications available to enhance Windows privacy and security. The challenge for me now is to consolidate all that information into a procedure to use following Windows installation.

I appreciate seeing Microsoft continue to be pressured to provide a more secure default configuration of Windows, and I would like to see all vendors emphasize the requirement for (and offer installation and configuration of) anti-virus, firewall, and anti-malware software - at least for new computer users. I see Dell has recently added a "Dell's Response To Spyware" post that offers an anti-spyware upgrade to Norton and McAfee or the commercial product Pest Patrol. This is a small step in the right direction, but DELL-ChrisM should be commended for acknowledging the favorable reviews achieved by AdAware and Spybot S&D. The virus information and removal board is great, although "and other malware" needs to be added to the title to clarify that virii are only part of the problem.

I would not agree that security applications need to be integrated by Microsoft, except to provide standardization for their installation and operation. It seems apparent that Microsoft's market interests contradict user privacy and security requirements, and Microsoft's integration of applications effectively cripples the development and implementation of competitive, often superior products. The standardization of installation/uninstallation mechanisms and user interfaces for configuration and operation of security applications would be beneficial.

I see a significant opportunity to enhance end-user's privacy and security by modifying the default Windows configuration and adding third-party security applications at little to no cost.

GM

        Cnet.com has a new video showing Bill Gates and an associate explaining the new security features included with XP SP2.  It runs about 7 minutes.

http://news.com.com/2009-7355_3-5163628.html?tag=nefd_lede