Messages in this thread | | | Date | Sat, 22 Jul 2000 20:58:20 -0400 (EDT) | From | "Mike A. Harris" <> | Subject | Re: TO HELL WITH IT THEN......(re: disk-destroyer.c) |
| |
On Sat, 22 Jul 2000, Pollei wrote:
>> produced code any clueful Windows virus writer can add to something like >> ILoveYou and wipe out millions of windows pcs where thre isnt even a security >> model. >That just simply means they should be working on a migration stratagy to >something that does have a security model with a domain of separation etc. >With the new outlook flaw found where it starts executing code even before >it hits your inbox... At least ILOVEYOU needed someone to actually open >the attachment. I wonder how many outlook users applied the corrective >patch yet? >Mix latest outlook flaw with disk2brick and that could get ugly.
My guess is that now that words have been uttered, ideas abound, and it will happen. As much as I'd like to see windows destroyed and see everyone using Linux, I hope to hell that no innocent people out there have their machines destroyed as the deciding factor. Sad indeed that it _could_ happen. Lets hope idiots out there are not so evil.
It does point out though that the windows security model is flawed enough that the only thing keeping it alive is "time". The virus authors out there so far have been MILD compared to what can be really done. The more I hear stuff like what we're talking about now, the more I want to ramp up security on every machine I pass by, and rip out windows. I dont even want windows running in VMware with access through a firewall. Too dangerous.
>> Perhaps when your abuse of power ends wiyh your relatives wanting to know how >> they get their windows machiens working again you'll realise what an idiot >> you were being >I would hope that people in the know would just warn their relatives that >running windows95/98 is a hugh security problem waiting to happen.
They do. Nobody listens. They want to run the cool apps that they see everyone using. The numbers of people using Windows and the apps have power in numbers. If they can run all their games and software, or exact equivalents under Linux, and it is 100% comparable experience, I'm sure they will. Until then, it wont happen. Not unless 8 out of 10 people they know are complaining about computer hackers all day long while they use windows, and losing their hard disks, etc.. Human nature unfortunately.
>At least have them run NT or win2k.
Only slightly better. The outlook bug affects Outlook, it doesn't matter wether it runs on NT or W2K. The Microsoft advisory explicitly indicates that. So, it wouldn't help much.
>Better yet maybe mention linux or BSD.
I agree, but again, that wont be taken seriously by most people out there. Unless they see a real viable threat, and see the risk as being very high, they'll stay with what they're used to. FWIW, I would too. I know a few people that use the computer as a game machine, and an internet experience. Linux can handle the latter, but they'll lose Getright, Cuteftp, ICQ, Roger Wilco, and countless other apps to which no 100% equivalent exists in Linux. There are countless clone attempts of those apps, but none are remotely close to 100%, and unless they are, and the games all work too, it wont happen. This is just the gamer type. There is the office application guy, and on down the line. Many people can go do Linux, but many wont because it is like telling a Truck driver to use a VW beetle. Or vice versa. It doesn't do the same job. Both get you from point a to b, but the beetle won't handle the load of wood that needs to be towed.
I do constantly push them to try Linux anyways nonetheless.. I am making some progress... but their arguments are very valid I'm afraid to admit.
>Pointing out a flaw isn't bad as long as you also have a solution. >BTW I think adding check for CAP_SYS_RAWIO is a good solution for linux. >Windows 98 or lesser users simply need to think about migration. >Andre's announcements didn't change that at all.
Yep.
>P.S. I don't really trust winnt or win2k for security either but at least >they have some security features.
Yeah, I think of the security in NT/2K like running UNIX on a CPU with no MMU. The security (if any) can be circumvented if you really want to. It's more of a "I'll make it more difficult but not impossible" thing.
TTYL
-- Mike A. Harris Linux advocate Computer Consultant GNU advocate Capslock Consulting Open Source advocate
... Our continuing mission: To seek out knowledge of C, to explore strange UNIX commands, and to boldly code where no one has man page 4.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |