The Windows Security Nightmare 969
latif writes "Microsoft has set aside a $5 million fund for paying off informants on malware authors. In my opinion a good chunk of this money deserves to be paid to individuals who help catch the Microsoft employees behind the design of Windows Registry and Windows Update. As I found out, the two mis-features work together to deprive Windows users of all protection from malware. The details of my experience are in the article Why Windows is a Security Nightmare." In a related story, Anonymous Wussie writes "This guy had family with a problem: A Windows XP computer hit by worms that couldn't stay on-line long enough to get patched. His solution? A CD. This article describes the custom made CD he sent to his family member with patches, tools, and instructions to make a fresh install of Windows XP Home Internet safe. I know I'll be doing this in the future."
Uh huh! (Score:5, Funny)
Thats why I'm such a FreeBSD/Mac advocate.
oki, here is a nice solution or two : (Score:4, Interesting)
There is a solution that any knowledgable admin can use : whenever a new service pack is out, you create an updated Windows installation cd (or dvd) that include the latest service pack => When reinstalling, you do that from SP4k or whatever, and it gives you an nice, almost secure config to start updating from...
Also, a standard practice in my home is the use of Ghost just after the installation of all the basics softwares and updates...=> ditto.
Now, a solution I have personnaly used on a friend computer after the usual "crashed before it even updated" episode : I booted her compuer using knoppix, downloaded the latest service pack and quite a bit of separate updates on a separate partition and then made an install without the net on...Ironic, using Linux to get a windows install running...
Also (but that is only true on my own home network) I use a dedicated firewall (yeah, Linux) on my network, and I only keep open the ports I need...So, if I need to make a "virgin" Windows install, the firewall protects me from the nasty worms/exploits/whatsoever...
Repeat after me : No Lusers in my Computer room ! 8)
(Happily supporting my dad since Windows 3.11, I made my preceding comments a rule... backup often, streamline your updates, use a dedicated firewall...and NEVER let your dad (or any Luser) with a root/administrator account...btw, he's still using 98...
Re:oki, here is a nice solution or two : (Score:5, Interesting)
2) you outline a problem - using anything but windows update for updating a machine is the domain of super-l33t windows geeks. Not normal people. I know my way around a windows box very very well, but trying to update anything on a win box without the updater I find nearly impossible. Yes, there are admin downloads, but I find them outright scary to slog through.
IMHO, they need something simpler - 2 things.
a) a way to generate an updater CD to re-apply all windows update patches currently installed on your PC (for when you wipe) and b) up-to-date updater CD ISO's available to download for each currently supported MS OS for when you need to set up a friends computer. I recently set up a friends '98 box and it was a headache - a nice "download this disk and burn it for patching" that I could launch from XP would be ideal. If they're concerned about bandwidth, throw some of their mass of coders to make an MS torrent-a-like for said ISOs.
Re:oki, here is a nice solution or two : (Score:4, Informative)
True but then you do:
Actually I tend to do:
Of course there are better ways of handling this in Unix world, things like ole good 'tar' or 'dump' come to mind.
As for the other stuff, sure its nice but it costs pretty penny and you need to upgrade the crap all the time, not to mention the always popular proprietary software trap. A bootable business-card Linux (like Linux-BBC for example) and some custom scripts are all you need to achieve most of these tasks and you get to retain full control of the entire process.
Re:Uh huh! (Score:5, Interesting)
Maybe microsoft should pay the money to themselves and redesign their software
You know, if the next version of Windows(TM) pulls what Apple did with their OS X, built a bsd underbelly to it and didn't allow backwards compatibility outside of a sandbox of sorts I wouldn't cry. Then it would be possible to secure the system and hopefully they'd get rid of their god forsaken registry / file and drive permissions / insecure nature for the most part.
It won't be infallible, but simply less insecure for the current vulns out there.
Then again, MSFT might implement this shiz so badly and incorrectly that we'd be stuck with a bunch of new prolems of which we haven't a clue to fix.
just my 2cents
Re:Uh huh! (Score:4, Funny)
Admittedly, I can't either, but it sounded kinda cool, so I wrote it.
offended (Score:5, Troll)
"so simple, even my grandmother could implement it."
As a 48 yo grandmother, I am offended that technical incompetance is equated with being a grandparent. I don't think anyone would have said "so simple even my grandfather could implement."
I am incidentally, a C programmer of 20+ years.
A grandmother can do it (Score:5, Funny)
"(AP) Dateline August 12, 2008. National and international commerce was brought to a halt as the "SugarCookie" worm infected and seized up the installed base of Windows 2006 computers. An FBI task force was able to determine that the worm was written by someone's grandmother who thought she was entering a cookie recipe into her computer. She was quoted as saying 'I did not know that Windows was so insecure that you could bring down networks with accidentally-written worm programs'"
Re:A grandmother can do it (Score:5, Funny)
Whether you are offended (Score:4, Insightful)
But, if you don't believe me try this little test:
Take an iPOD, a Laptop with a wireless card in it, and a wireless access point to a retirement home. Place them on a table right next to an Internet connection of any kind. Now ask if any of the residents can get a song from the iTunes store onto the iPOD.
I'll put dollars to doughnuts you won't find a single resident who can do it. Not because they aren't capable of learning how, but because they really just don't care about that kind of thing anymore.
$.02
Re:Whether you are offended (Score:5, Interesting)
"Now ask if any of the residents can get a song from the iTunes store onto the iPOD.
I'll put dollars to doughnuts you won't find a single resident who can do it. Not because they aren't capable of learning how, but because they really just don't care about that kind of thing anymore."
Then again, you might be surprised. I once did a benefit ambient gig at a retirement home, and then wound up giving a seminar on my set-up after the gig, as a pile of people crowded around my gear to ask me how I got all those sounds. My impression was that this retirement home was a pretty boring place, and a guy showing up with a bunch of synths to crank out strange quiet downtempo stuff sorta made their day...
Re:Whether you are offended (Score:5, Insightful)
My grandparents are in their 80s...and you are probably right, but the generation(s) in their 50s-60s are more likely to have been exposed to technology and it's increasing role in our day to day lives to completely invalidate your theory.
Even more so, each year that passes you will have more grandparents who are moderately tech saavy...it's not in anyway a question of age, but experience. There are still quite a few people in their 20s, 30s, etc who would also not be able to pass your IPOD+ITunes test, because (brace yourself for the shock), they don't drool over tech items like the majority of slashdot readers do.
It's just depressing to see that the rampant ageism that is applied to older people is still going strong in the tech industry...and does not seem to show signs of stopping.
The original poster was offended because she was both a grandparent and a woman into technology, and admittedly, she is a rarity even now....but the real point is that the more time passes, it's more and more possible that this will not be an exception to the standard. And in the spirit of fairness, she was kind of silly to be up in arms about it anyhow...although her point *was* and *is* valid.
Re:Whether you are offended (Score:5, Funny)
Take an iPOD, a Laptop with a wireless card in it, and a wireless access point to a retirement home. Place them on a table right next to an Internet connection of any kind. Now ask if any of the residents can get a song from the iTunes store onto the iPOD.
On the other hand, if you tell them that they can use it to download pictures of their grandkids, they'll probably have it up and running faster than a 19 year old nerd could :).
Peace be with you,
-jimbo
Re:offended (Score:3, Funny)
Re:offended (Score:5, Informative)
After looking at andy666's posting history, the moderator should have known that andy666 really is a French grandmother named Andrea Tilley, who apparently has a grandchild old enough to post the parent article, and isn't happy that her grandchild considers her technically inadequate for this job. Wow - French and thin-skinned; but I repeat myself.
It's SlashDot - what do you expect?
Use the Firewall (Score:4, Informative)
Re:Use the Firewall (Score:5, Interesting)
Too bad the firewall software loads *last* in the startup sequence, leaving a gaping hole of anywhere from 20 seconds to two minutes (on a slow machine) when your machine is on the net and unprotected. And during the height of worm activity, that's *more than enough* time to get infected.
Re:Use the Firewall (Score:3, Insightful)
Re:Use the Firewall (Score:5, Insightful)
...and I don't believe obtaining a DHCP lease would be a problem through this.
Asking users to plug/unplug their network cable is just plain silly.
Re:Use the Firewall (Score:5, Insightful)
I'd have to disagree. I think making someone work for something might make them a bit more appreciative of what needs to be done to maintain it.
I told my father to take his computer to a local shop to have it fixed rather than drive up to me. Once he learned how much it costs to have things fixed that can easily be avoided he seemed much more interested in learning how to take care of things than thinking "this thing should just do as I want it to" (and he stopped downloading stupid ass screensavers.
A little work goes a long way.
the kid is educating his dad (Score:4, Insightful)
I think a lot of people honestly do not know that the primary reason they might get hacked is not to get their personal information, but to use their machine to distribute hacked warez and spam email and kiddie porn. So, it's much better to do what it takes to help people understand the ramifications of their actions-or non actions, and to perhaps take a more critical look at the software they are running. To me, it's like a traffic ticket (paying to have your machine cleaned and fixed), you are SUPPOSED to learn something (stop being a no-nothing lamer) about your behavior driving your car (computer) on the public road (internet).
Once people are REALLY aware of it, then they have a chance to correct the problem. If you can't get their attention in the first place, they won't ever learn. Sometimes it takes a fine to do that.
I FULLY support ISPs or private network admins yanking access to the network from infected machines. They don't do it enough, IMO, and if it happens to me because my machine gets hosed and zombied and I don't deal with it in a timely manner, then too bad for me, too. I'd rather be told about it if I don't know myself, and losing your net access is both protecting the innocents, and getting your attention for a problem. And if THAT then kept being pushed back up the food chain to the vendors, where they had to code better, release less often, and be forced to offer products good enough they could be warrantied, then I'm all for that, too.
It shouldn't take 20 years to come up with a more secure out of the box operating system that is network capable, is the real bottom line, no matter which one you are talking about.
You'd see it get chaotic in meatspace if any manufacturer were allowed to sell "caveat emptor" products with no government required warranty, of course they would skip doing quality work then, because there would be very little risk to them. It's time software played by the rules every other manufactuer has to play by, especially if they demand IP ownership and patents and huge profits. They want it treated like a normal product, swell, but let the law treat THEM like any other product as well.
Re:Use the Firewall (Score:5, Funny)
That is a great solution. Maybe Microsoft should make a KB article and send it to all the upperlevel business types in corperate America. I can see all the suits in their lavish office hundreds of feed above the city streets doing the Microsoft Shuffle. Now all they need is a catchy pop song to go with it and they'll be on Casey Kasem's Top 40.
I'd rather just use my Mac.
Re:Use the Firewall (Score:5, Insightful)
It's a rational expectation that a brand new machine, or one restored to factory configuration, should have no fatal problems - we certainly expect that the wheels don't fall off our cars just after we drive off the new car lot. We shouldn't have to *know* that we have to tighten the lugnuts or get new tires because the ones I juts bought are about to explode, and I shouldn't have to immediately change the locks because everyone and their grandmother can pick the one I just bought with a toothpick.
Perhaps I'm taking the analogy too far, but can you name another product that is widely sold brand new with massive known defects?
Re:Use the Firewall (Score:5, Funny)
Ask me again on election day.
Re:Use the Firewall (Score:5, Funny)
Yeah, that's an elegant solution:
Re:Use the Firewall (Score:5, Interesting)
+5 Funny. This reminds me of a situation at work. We sort of have two separate halves of the software development department: Java and the Microsofties. One day I wandered by the server room where the most brilliant of the Microsofties was installing some sort PDF-indexing engine on one of their Windows servers. They were being thwarted by some dialog box that kept comming up during the install. His solution to the problem at the moment that I happened by was...I swear to god...to jam a penny into the keyboard such that it kept the return key held down, so that the key-repeat would dismiss the dialog box over & over again, in hopes that it would happen rapidly enough to get through the install.
I swear, it's a totally different culture. Some of us insist on good software architecture. Others have an amazing capacity to assfucked by bad software architecture and keep going back for more. You can bother about yanking and reinsertintg your ethernet if you really want to. I'll work around the problem by being a more selective consumer, thank you.
Re:Use the Firewall (Score:4, Interesting)
But now the company has been taken over by the Microsofties. One of them told me the "secret" to development in Windows: just do what Microsoft wants you to do. Everything is designed to be done in one particular way, and if you don't do it that way you'll end up working ten times as hard.
Re:Use the Firewall (Score:4, Insightful)
Re:Use the Firewall (Score:5, Insightful)
Re:Use the Firewall (Score:5, Informative)
Usually the process is launched by init as root, the port is bound, and then the process forks, calling setuid and setgid to loose root privileges. It's also not unheard of to chroot the fork too. So you're left with a program running in a sandbox without root privileges, bound to a privileged port.
* - bold added to separate GP quote from parent quote, not for emphasis on any particular content in the quote.
Re:Use the Firewall (Score:5, Funny)
Wave you hands in front of the antenae to block the signal.
Re:Use the Firewall (Score:3, Informative)
Considering it's all a hassle... Isn't SP2 supposed to resolve the issue with the Firewall loading last?
Re:Use the Firewall (Score:5, Insightful)
You see, it takes 20 seconds to 2 minutes from the network activation to the firewall start every time you turn on the PC, not just when you're getting the latest update. And if you think you only need a firewall when you're running Windows Update, then you're missing the whole point of having a firewall.
Re:Use the Firewall (Score:5, Interesting)
If that number turned out to be unusually low, perhaps the key is to really shove this sort of education down people's throats. How? I don't know. A series of ads on TV? Not likely. Get it into the headlines? Not likely. So I'm just not sure how this could be done.
One thing's for sure, my mom wouldn't know what a firewall is, nor how to turn it on, and I shudder at the thought of trying to explain it. Honestly.
Re:Use the Firewall (Score:5, Funny)
You can still get one from a foreign country
Re:Use the Firewall (Score:5, Insightful)
Re:Use the Firewall (Score:5, Informative)
Re:Use the Firewall (Score:3, Insightful)
Its funny how MS is now going to include such stuff.. seems their innovation has other priorities then making their products usable most of the time...
This all should not be a problem initially however for installing a windows machine beind a firewall and trying to run update.. tho I rather prefer
Re:Use the Firewall (Score:4, Interesting)
Obviously, since this technology hadn't existed before, Microsoft hadn't anticipated that some folks would hijack the API and use it to get people to install software that will spy on them. You can't plug holes in a bucket you haven't made yet! And now that these companies are out there, even Microsoft locks things down tight as can be, there will still be shady types instructing people on how to bypass their own security to install some bitchincool new screensaver (with only a few hundred added pieces of malware).
The reason for this is that it's just too easy to fool people in the digital world, because they don't care about the precious data on their computers as much as they do pretty widgets. Windows software is attacked not because it is inherently insecure, but because so many people who just don't care use it.
Of course, one wonders how useful it is to spy on people who do nothing with their PCs but install spyware...
Re:Use the Firewall (Score:5, Interesting)
When I minimized I saw my first experience with the new and improved firewall, it was a nice message in the center of the screen that had been obscured by the player stating "The Program: Windows Media Player is trying to access the Internet, should I: Block this program, Unblock this program, Block this program but ask again in the future" (I'm paraphrasing there) even though I hadn't told it to unblock the program, it was allowing it download content from the web.
I thought this was odd, and assumed maybe it only received stuff but wouldn't allow sending. Well, when I used Yahoo Messenger the first time, same thing popped-up, so I left the box on screen and did some IMing, and sent some files to friends - all without interacting with the firewall. So I must assume the the firewall by default lets anything go through until told otherwise. This is security? I've noticed this behavior with many programs, and telling it to block does work, but until told to block it leaves the holes open.
Re:Use the Firewall (Score:4, Insightful)
Sorry, but Zone Alarm, Black Ice, etc. are all PIECES OF SHIT. You have no idea how many times I've been troubleshooting broken internet apps only to find out that Zone Alarm/Black Ice is installed. One of my first questions now is to find out if those things are installed. The sole purpose of those software packages is to annoy you every time it blocks a connection and try and convince you to pay money for the enhanced version of the nagware.
You declare that the SP2 firewall broke your ability to print, but you do not know why. You just take a reactive stance and jump back to what works now instead of finding the underlying problem and solving it. I'm sorry, but I just don't believe that the firewall broke your ability to print unless there was an underlying reason. Outbound connections are not blocked by the firewall. The same statement goes for seeing others on the network. Maybe you were just impatient and didn't wait for browsing to stabalize which takes up to something like 15 minutes in a single broadcast domain. If you're really that anxious to connect to another computer and can't wait for the browse list, do a start | run | \\COMPUTERNAME.
If you want the computer to be seen on the network, create an exception list in the firewall configuration! It already has a preset [microsoft.com] for file and print sharing one tab over from where you enabled the firewall for crying out loud!
God I hate seeing ignorant fucks blaming the software vendor for their own ignorance, then getting modded up for it. It's not Microsoft's fault that you don't RTFM or open your eyes to see that there's other configuration options when you use a feature. Blaming Microsoft may be fun, but it's not always the answer.
-Lucas
Re:Use the Firewall (Score:5, Funny)
Uh, yeah...me too.
Burn a cd? (Score:5, Funny)
Better make that a rewritable...
Re:Burn a cd? (Score:5, Interesting)
Re:Burn a cd? (Score:3, Insightful)
that's easy... (Score:5, Funny)
my windows security nightmare.. (Score:5, Funny)
Heh not me. (Score:3, Interesting)
This article describes the custom made CD he sent to his family member with patches, tools, and instructions to make a fresh install of Windows XP
I took the extreme opposite approach: I don't help family or friends with their Windows problems if they've asked me for advice and gone against it. (as written about in my journal [slashdot.org] last March.)
Re:Heh not me. (Score:3, Insightful)
your dad says... (Score:5, Funny)
New "casino" concept is needed (Score:5, Interesting)
Small price for Microsoft, great effect on security.
Big problem (Score:5, Insightful)
This is a serious problem, actually. During the height of the worms last summer, we saw hundreds of machines that got infected while in the middle of downloading updates. It even got to the point that the WinXP "firewall" wasn't good enough, since it loaded *last* in the startup sequence, and there was a good 20 seconds to 2 minutes (depending on the speed of the machine) when the machine was on the net and unprotected, even if you had enabled the firewall settings.
It's the bigger problem of running services by default. The average user doesn't need half of the services that run. Linux figured that out years ago - most services are off these days, and those that are on are fairly secure (ie: sshd). Even if some of these services are required for system operation (like some folks have claimed), there's no reason for them to be listening on addresses other than 127.0.0.1.
Re:Big problem (Score:3, Insightful)
There is a system called "unplugging th
Re:Big problem (Score:4, Insightful)
Re:Big problem (Score:5, Insightful)
1) Switch on computer
2) Login
3) Wait until everything is loaded and the disk stops chunking
4) Plug in network
Is that really hard?
Try telling that to an end user. They don't want to be bothered with that. And also, people forget to do things sometimes. And the one time you forget, you'll get infected.
Yes, yes, we all know the most secure computer is the one that doesn't have a network connection. But really, providing firewall software, and loading it last in the startup sequence, instead of immediately following network device startup is sloppy and wrong.
Re:Big problem (Score:4, Informative)
That is still wrong.
You enable the firewall, set a default deny all rule, enable the interfaces, and start loading your rules.
You can't load them beforehand if they depend on characteristics of the interface (address etc) but that means you will still have to be extremely carefull in which order you load them.
A safe way of acomplishing this is to insert the deny all rule as the first rule that your firewall will occur and only remove it once all has been setup properly.
Leaving a window bewteen bringing up your interfaces and having a workign firewall always brings the risk of compromise, and it just takes a slightly determined hacker/work/virus/whatever to get through.
You Mean digital? (Score:5, Informative)
Ah yes, brought to you by the letter V, as in VMS. IIRC it was a few digital VMS engineers that left and help build many of the more functional components of WinNT. And apart from the ACL, i believe the registry (at least for pathworks) was another digital innovation...
Never forget there is very little you can credit Microsoft with...
all he had to do (Score:5, Informative)
Ignoring the root cause and fighting the symptom (Score:5, Insightful)
Microsoft takes the approach of fighting the symptom (malware,
This is the same way many governments approach things like terrorism. They address it like a security problem only, that Intelligence Agencies and the Military/police handle. Why these ideologies developed, and what are the social, economic, and political reasons that lead to it is never even attempted.
And it is not only America, this has happened before in Ireland, Spain, Egypt and elsewhere.
Unless the root cause is studied, a correct diagnosis is made, and then remedial actions are taken, no amount of policing will fix the problem for good.
Custom patch CD (Score:4, Insightful)
But, then again, I've sent many times more Linux distro CD's to my friends.
Registry and update? Nah. (Score:4, Insightful)
If you're going to go after Windows employees, don't bother with the registry and update guys. Nail the guys who made ActiveX and Outlook.
There ya go, I'm an informant now. When can I expect my check? =)
Weaselmancer
Update CDs for family (Score:5, Interesting)
Case in point-
I return home for the semester break, and my sister's pc is riddled with spyware, malware, you name it. The thing is no longer functional, so I had to format the hard drive, yadda yaddda yadda...I gave her a full lesson, and made sure she knew exactly what to do. Yet a month later, the computer was back in the crapper again...She stated that she lost all of the programs she liked when I fixed her computer-
That's the problem...Unless I boot linux and pull the internet from the back of the machine, her pc will never be secure...No matter how many times you teach/tell someone about computers and online security, for most noobs or non-users, it just doesn't seem to click...
As far as issues with Windows Update...Best bet is to download from someone else's high-speed pc. I had a similar incident with SoBIG and a reinstallation of XP.
Re:Update CDs for family (Score:4, Insightful)
Why would booting to Linux be any more secure, for that user?
She appears to be the problem, not the OS.
i use windows (Score:4, Interesting)
Re:i use windows (Score:5, Insightful)
Quoth the parent:
I read that and nearly spit coffee on my keyboard. OK, let's assume that the parent poster is being 100% honest, that he made "a few grand" selling home-burned CDs outside Best Buy at $20 a pop. That's, conservatively, 100 CDs!
In other words, at least one hundred people were perfectly willing to shell out money -- cash, presumably -- to some random guy in front of a store, then take this guy's CD home and blindly install whatever the hell he'd given them!
Folks, talk all the shit about Microsoft that you want, but there's your security problem! If this guy is on the level, we've just had a prime lesson in the reason why Blaster, et al spread like typhoid.
You know, don't you feel sorry for Microsoft, sometimes -- just a little bit? I mean, imagine you're a Microsoft engineer. You're hard-working. You really do try, given the massive user base you have to support and the cruft of legacy code you're stuck with. Reasonably fast patching for security holes, updates -- hell, they'll send you a damn CD of updates for free!
And then you read something like this. And request an immediate transfer to the Office development group...working with Clippy would seem like a joy.
And for all the linux advocates out there -- especially the zealots, the Stallman's Witnesses -- this is a cautionary tale. If and when linux starts to hit the desktops, you're going have this same problem. If 100 users are willing to take some guy's CDs and install them, no questions asked, they're not going to flinch when he says, "Oh, and it will prompt you for your administrator password. You'll need to enter that in order to make sure the system is scrubbed." Play out your own nightmare scenario, there. Linux is inherently more secure? Really?
Social engineering-based cracking can't be stopped. Not by Windows, not by Linux.
A Different Perspective . . . (Score:5, Funny)
Maybe something that strips out the entire TCP/IP stack - a castration of sorts for the good of all mankind
My name is Bill and I pronounce Windows -- WeenDOHS
this is just a good example of... (Score:4, Informative)
Just because its made by microsoft, that doesn't mean an idiot should administer it. It certainly doesn't mean its going to be secure and stable out of the box.
The huge divide between Unix/Linux and Windows is that Unix/Linux forces you to know what you're doing when you install something on your computer. Windows assumes the opposite.
However, if you do know what you're doing with Windows, problems of this nature are not really problematic. Fixing Windows without reinstalling is easy for competent administrators. Jeez, I can get around in Windows without a mouse and without explorer.exe.
Here's a hint guys: if something breaks on Windows -- don't install a program to fix your computer. It will break it further. Don't install registry cleaners -- they suck. Slick your system, ghost your system, take registry snapshots now and then. Don't install third party software on production machines without testing on crap boxes first. Do know your system in and out.
What a bozo! (Score:4, Insightful)
The author's slanted raving is over the top. I could just as easily read about some Linux newbie's nightmare experience trying to get all of his hardware to work or how they had to rebuild the kernel after applying some new module to their system.
My main gripe with how things are is that all new PC's should be delivered fully patched as of their configuration date. And since Microsoft has switched to their license subscription model they should ship out CD's to all licensed customers with all rollup security packs available. Just like a TechNet subscription operates for previewing beta products. I don't mean a user calls into Microsoft to request a CD. It's their place to send them out. Just like an auto company would mail out recall notices.
Custom CD: "Sysprep", Slipstreamed service packs (Score:4, Informative)
You can integrate the service pack into the setup (which will be especially useful when SP2 arrives) so that it's installed at the same time. This works with Windows 2000 and up.
You can then use Sysprep (brief introduction [microsoft.com]) to automatically deploy the latest patches the first time the machine boots.
Here's a nice article [thetechguide.com] on how to burn the result to a bootable CD.
It's a bit of work, and requires constant maintenance but it saves a lot of headaches in the long run.
An easier method, if you have a lot of machines with identical specs. Build a template machine with the OS installed, adding all the service packs, patches, etc. Use software like Ghost [symantec.com] to make an image for deploying to multiple machines.
Who says the stuff you learn on an MCSE isn't useful?
Teddy Bears of Doom and Windows networking (Score:3, Interesting)
That's what the "Teddy Bears of Doom" are/were all about. They were the people that beat up the programmers for buggy code. They were immortalized as one of the four random faces in the Windows 3.1 Easter Egg (I believe Gates, Ballmer, I forget but I think it was the project manager who left after 1 year cycling sabatical, and the Teddy Bear).
My wife uses Windows 98... (Score:3, Interesting)
I run Linux and have been hacked once about three years ago (back when I had a cable modem connection). The only reason I knew they hacked me was when I noticed an extra user with several p0rn media files in their home directory. It has gotten me into the habit of patching Linux regularly and being much more strict on my firewall rules.
I think the only real difference between Linux and Windows from a security standpoint is that in Linux you can usually turn off the offending service much more easily until a patch is available.
Sounds like one man's rant (Score:3, Insightful)
A typical Windows system follows a simple lifecycle: it starts out with a clean Windows installation, which gradually deteriorates as programs are installed, and uninstalled. Eventually, the Windows registry accumulates so much crud that the user is forced to do a clean install. When a user does a clean install that user's system loses all the previously applied security updates, and becomes a sitting duck for worms and other malware.
A Windows system doesn't deterioriate if you know what you're doing. The author clearly assumes that the uninstallation packages actually work. This is a fatal mistake. I always manually look in the registry for left-overs when I do an uninstallation. I just uninstalled Mozilla? I find all Mozilla folders underneath HKLM/HKCU and delete them too. This tends to work well except when dealing with COM object registration (which is a nightmare).
Then he tries to run a registry cleaner on his system. You know those warnings that say "MAKE SURE YOU BACKUP YOUR REGISTRY"? Well they say that for a reason. Back it up. Then when the shit hits the fan like the author said, he can restore from a boot disc.
Yeah the registry is a pain sometimes, but combined with some experience and know-how, you can keep a system running without having to reinstall.
Sucks, but he's right (Score:5, Interesting)
The amount of "repair" functionality inside of MS products is a huge sign that users and developers are sick of the reinstall cycle, but that the OS design makes it very difficult to fix. Internet Explorer, Outlook Express, Office all have "repair my installation" tools built in, XP and ME have System Restore.
I have watched users get the Sasser virus, run system restore, have system restore break the XP firewall, cause a port lockdown, resolve the port lockdown so they can run windows update, only to become reinfected with the sasser. Maintainence of Windows is hard, OS reinstall is easy. OEM aren't value adding to the OS by providing solid maintanence tools, their providing restore disks, because writing such a maintanence tool is INCREDIBLY difficult.
I understand MS's need to stay commited to this design, at least through Longhorn and it's revs. But as long as you are, MS, please give us a non network dependent tool for maintaining and distributing patches and updates. Let OEMs and (in my case) ISPs ship critical fixes on CD so that we can help our users. Make System Restore a fine grained tool, where I can back up critical system files and DLLs, as well as the registry. Don't force me to go to a third party for a "registry cleaner". Provide me with the OS for the tools that I need and that vendors need to maintain the OS.
Run QNX on the desktop (Score:5, Informative)
The free version of QNX comes with no inbound services enabled. Most of the standard UNIX-type services are available, but they're not installed by default. It's a pure client. In fact, it's very close to what the iOpener ran. Both dial-up and LAN connections are supported.
Mozilla 1.1 runs, but without Flash. There's a word processor, ABIword. The whole GNU toolchain is available. Unfortunately, OpenOffice hasn't been ported.
It's refreshing to run a system without all the Microsoft crap, or the Linux emulations of it.
Small private subnet and proxy fix windowsupdate. (Score:4, Interesting)
1) add private network ip address (10.0.1.1) to existing public server
2) do no NAT or other routing on this ip
3) have squid running on 10.0.1.1 to accept connections from a handful fo addresses in 10.0.1.x or do proxy authentication
4) when installing/updating/troubleshooting windows boxes assign them a 10.0.1.x address and set windowsupdate to use the proxy
Windows update runs, the machine is on its own tiny network isolated from all legit traffic and can't compromise your network plus it it can't be infected from outside as it's safe behind the proxy. When you feel it's safe (you've got all patches, firewall, etc configured) restart with DHCP and get an address on your "real" network.
Or you could roll your own installation cd with the correct service packs and security updated included, but why fix a software problem with software...?
-dameron
I am asking for it but here goes.... (Score:4, Insightful)
I could not help but find myself in quite a humorous state as I read that article. As a Support Analyst for a Fortune 50 company, I see many of the errors that the user was describing in the beginning of the article. Unforunately for him, he reinstalled the OS. All he needed to do was recreate his Windows profile.
The right click locking explorer and the functionality loss of Mozilla were most definely not caused by the Reg, but more likely caused by a corrupted NTUSER.Dat file in the profile folder of his machine.
Furthermore, if you are currently reading this article on your home PC and not sitting behind a firewall of some sort, please send an email to banme@slashdot.org with the attention line reading I am no longer worthy.....just kidding just kidding.
Not a very convincing article (Score:5, Interesting)
Cry me a river. A tool like Norton System Works that has both an installation watcher and a great Windows configuration diagnostic/repair tool would've solved his problems. Grabbing the first tool listed on Download.com when you type in "Registry Cleaner" is not the inteligent way to go about system maintenance.
"They don't recognize them as usability problems" (Score:5, Interesting)
Unfortunately, this extends far, far beyond Windows. This is a problem for the entire industry.
It reminds me of the way nuclear power plants are (were?) licensed. If, during review, the nuclear regulatory commission finds a safety issue that is unique to the particular installation, the licensee must address it before it can be licensed. If, however, the licensee can demonstrate that the issue is actually "generic"--that is common to all nuclear power plants--the licensee need not do anything about it.
In the PC world, any problem that persists for more than a few years is not longer perceived as a problem. It becomes "generic."
The phenomenon is even getting worse over time, thanks to the general public's increasing familiarity with computers. During the eighties, when manufacturers were trying to seduce individuals into buying home PCs (and IT managers into abandoning those hard-to-use green screens for easy-to-use GUIs), usability disasters were treated as important. No more.
Computers hit their peak of usability sometime in the eighties and have been in steady decline ever since.
One of the biggest issues noted in the article is the instability of Windows over time as software packages are installed and uninstalled. But this is hardly limited to Windows. The irony here is that the ability to uninstall software properly was supposed to be a logo requirement for Windows NT 4.0 software, and one of the features that Microsoft used to urge its superiority to 3.5.
Unfortunately, software installation and uninstallation is not a trivial problem. To do it right would require a great deal of functionality that can only be performed by the OS, which would need, for example, to track which system components were in use by which applications. And it would need to have the ability to associate specific versions of system components with applications, so that it would not be vulnerable to the assumption that Version 3.6.1 of the Frammis Service is absolutely guaranteed to have fewer bugs and be totally backward compatible with every previous version of the Frammis Service that has ever been released.
And before sixteen people reply explaining that
Microsoft didn't solve the problem. They just sort of declared that it had been solved. Installshield and friends kludge their way through installations, merrily making clumsy guesses and assumptions about the history of the system and the needs of other applications and overwriting files and changing registry settings. SQA departments are happy if the installed application runs after installation on a clean OS with no other software installed and don't have the time or the mission to make sure that (say) installing the application doesn't break anybody else's application. (Indeed, one suspects that in some parts of the industry, it's consider a plus if installing one application breaks other applications, if they happen to be competing applications).
I could go on and on. (Indeed, I already have). In the world of PC's (and I include both WIndows and Macs--and nothing I've read makes me think Linux is very different), an awful lot of things don't work very well and NOBODY SEEMS TO CARE because it's "always" been that way. Laypeople have gotten accustomed to blaming themselves ("my computer hates me,") IT departments don't even expect computers to work properly after about three years; developers/hackers/sophisticated users enjoy the challenge of troubleshooting the latest glitch...
Problems is Computers = Windows for most people (Score:5, Insightful)
And yet, people still want Windows. I work in a high-tech call center, and people still look at me with blank stares when I tell them I don't use Windows at all at home.
Q "What do you run for anti-virus?"
A "Nothing. Linux isn't as succeptible to viruses"
Q "What about spyware?"
A "Same thing. I don't run anti-spyware either because I don't get it. Oh, and I can update my computer without rebooting too"
I've even had a laptop running nothing but Slackware, and technical people _not_ believing that Windows wasn't somehow still on the machine! People just don't see computers with anything other than Windows. If computers = Windows, then how can people get sick of Windows and not be sick of computers? The fact is, Microsoft has done a brilliant job of equating computers with Windows, to the point where even most technical people don't see any other option.
I think my job as an Open Source advocate is to just let people see Linux run on a computer, and let them follow the inevitable logical conclusion themselves.
Not Windows, third party apps & drivers (Score:4, Insightful)
If Linux were as popular as Windows, there would just as much poor quality crap coming out for it trashing
I ran Windows 2000 for 3.5 years with the only problems coming from Creative Labs DXR3 and SoundBlaster Live! drivers, and Mozilla's graphics resource eating issues. I won't buy anything from Creative Labs again, and Mozilla have fixed their bugs. I only had to re-install Windows after I accidentally trashed the first part of its partition playing around under Linux (Grub, Lilo, dd
First thing I do with a new Windows install is... (Score:5, Interesting)
2) strongly suggest not using Outlook
3) Completely lock down the "Internet" security zone in IE and force users to add sites that don't function properly (due to scripting turned off) to "Trusted Sites" (which has scripting on)
4) Strongly suggest that users use Firefox instead of IE wherever possible
5) Install antivirus software
6) Install Spybot Search & Destroy and AdAware
This keeps most spyware, virii and worms out.
As a curious side-note, the first thing I do with a new OS X install is...
1) Apply security patches
2) There is no Step 2
Firewalls!! (Score:4, Informative)
Try to hack a default OS X install, or many default Linux installs - sorry, *no* ports are open by default, so what can you attack? At best you minght be able to DDOS the box, or some upstream piece of network equipment, but you can't crash or hack the box itself.
On my OS X box all I have open is SSH and everything else configured to only listen to localhost. If you manage to crack that, I have a lot more to worry about.
Fixes are not as simple as they seem... (Score:4, Interesting)
Well, first off, there's nothing to stop you doing this now. You can just download all the patches individually and burn them to a CD. But what's the problem with this?
The short; this just means you'll be distributing virii by sneakernet. (Which is, admittedly, much slower than the Internet, but none the less...)
You know, back before we had this newfangled "interweeb", we still had virii and worms. They were passed around on corperate networks, from networks to other machines and networks by floppy disk, and also they were sometimes distributed on BBSs with sloppy sysadmins.
A "sharable" disk means that, instead of going through the effort of downloading those hundreads of megs of patches, I can just go copy a friend's disk. A copy of a "friend or an aquaintence"'s disk, however, is not a copy from a trusted source. Where did they get the disk from anyways? Who did they copy it from? It would strike me as very easy to craft a disc which would install a few intentionally malformed patches.
There are a couple of solutions to this problem. You could, for example, make your machine compare a the cryptographic hash of each patch against a known cryptographic hash. In order to get the known hash, however, you'd have to connect to that ol' public network again, with an unprotected machine. Since this functionality does not exist in current versions of Windows, you would also need some kind of initial patch from Microsoft to pull this off.
Another fix would be to cryptographically sign everything with a public key cryptosystem. This works great, so long as noone breaks your cryptosystem and/or finds the private key. Again, the functionality doesn't exist in today's implementations of Windows, so you still need another initial patch. (At least, as far as I know... I suppose XP might have signed updates; I've never tried to forge one.) This might be promising for future versions of windows. Microsoft has already bet your system security on a public key system with signed .NET objects, so this isn't so bad.
Both of these can easily be circumvented by a "sharable CD" that uses autorun to install nasty things before you install any patches at all. Of course, autorun is another feature of windows with questionable security.
In the end, the public network isn't really such a bad tool for delivering patches. Microsoft's implementation could be improved upon; upon installation of a "fresh" copy of XP, for example, the install could connect to the net and download all required patches prior to opening any ports on the system. (You don't need RPC to download patches, afterall). This is, more or less, the idea behind having the personal firewall enabled by default (only that's a little more kludgey).
Downlaoding all "Windows Updates" is possible (Score:5, Informative)
The following URL describes how to do it: http://support.microsoft.com/default.aspx?scid=kb
Basically, go to Windows Update, click on "Personalize Windows Update", and then turn on "Display the link to the Windows Update Catalog", and save. You then go back to the main page, where you can access the windows update catalog and download to disk all current patches for a particular OS automatically.
When I found that I was very pleased.
I think there is software to automatically install it all from disk, too, but I haven't had time to look for that, yet.
Re:Custom CD (Score:4, Funny)
You can get the same from MS, free.
RTFA. (Wow, what a concept!) He covers that.
Re:Custom CD (Score:4, Insightful)
Microsoft's Windows Security Update CD is great in theory, but almost worthless in practice. The lead time for delivery is so long, by the time you get the CD, another batch of viruses/worms are out exploiting newly discovered vulnerabilities.
Re:Not so fast, sir (Score:5, Insightful)
Re:Not so fast, sir (Score:3, Insightful)
The value of a system isn't in the cash-and-carry price of the components; it is in the data and applications running on it, the time and effort to get it configured properly, and the opportunity cost of not having it in operation. $79 isn't much against those costs.
Plenty of corporate travellers do just that, yes. But in the scenario presented he on
Re:Not so fast, sir (Score:4, Insightful)
Do you people have this same level of expectations for other products you buy? If something, right out of the box, is shitty to the point where it's humorous, why is it so wrong to say so?
You may not thing what you're saying is a joke, but it sure is damned funny. I wonder what other hoops we could get you to jump through.
It's especially ironic that you recognize time and effort as part of the overall cost, but you still find your suggestion reasonable.
Re:Not so fast, sir (Score:5, Insightful)
Wow. Think of what you're saying. You're telling users that they need to shell out almost a hundred bucks for a device that will allow them to safely download updates. Has Microsoft security gotten so bad that we're just going to accept that you need to buy a firewall just keep your OS up to date? Does anyone else see a problem with this?
Re:Not so fast, sir (Score:4, Insightful)
Our office lan has a hardware firewall and a network installed virsus scanner. I think every network should be secured.
As a home user, do you trust Cable One, AOL, or a generic small time ISP to keep you safe? Are they responible for filtering all network traffic before it hits you? I'm going to say they should have hardware firewalls of there own.
The
Re:Not so fast, sir (Score:4, Insightful)
The total cost of his solution was the cost of the CD--your solution costs $80, and it isn't even complete.
He mentioned installing a firewall (such as ZoneAlarm) which is free and would do as effective a job as your $80 solution.
Also, one of the other large problems today is spyware (or hijackware as it should really be called), and that comes over the browser on port 80. Your $80 firewall is not going to stop that. However, the author of that article offered several free (and wise) solutions to combat this problem.
I know I'm not supposed to feed trolls, but common, at +5 I just had to respond.
If you're really pushing this $80 solution over a perfectly reasonable free solution, then you either work for D-Link or you shouldn't be taken seriously.
Re:Not so fast, sir (Score:3, Insightful)
Re:its not that bad (Score:4, Insightful)
How do you know? If its not running a virus scanner how would you tell if it had a virus or not?
Re:its not that bad (Score:3, Insightful)
It IS that bad (Score:3, Informative)
First, you have an incredible problem with overwritten patches-- something can easily happen which will overwrite a patched file with an unpatched one (I have seen this happen several time with production IIS servers, and in my experience this is the largest source of security compromises). Second, the firewall with Windows XP is not enabled by default for supporabili
RTFA (Score:5, Informative)
Re:Microsoft will mail you a CD (Score:3, Informative)
Re:Couple points here... (Score:4, Interesting)
If the registry or the filesystem gets bloated because of malfunctioning application uninstallers, how is that MS' fault?
-----
The registry was a bad idea from the start. The registry may have been designed and implemented for storage of specific useful information which would contribute to interoperability between applications but it doesn't take a brain surgeon to look ahead and see that every screen saver, toolbar, and "neat app" author would start filling the registry full of excess junk keys that mean nothing to the rest of the system. Additionally there are more than a few ways to hijack
That is why I blame MS for the registry. It would be a good idea if the user was consulted for every new key added. That can't be done because the user can't be bothered. Unfettered, unrestricted application access to a housekeeping system with as much clout as the registry should plain not be possible. Since it's impossible to secure the registry the registry never should have been implemented.
KDE and Gnome are following the same path to h-e-double-toothpicks.
Re:This article is a disgrace to slashdot (Score:5, Insightful)
The author of the article is either inept or trolling. Unless you are doing something dumb like downloading tons of shareware apps, installing them briefly, then uninstalling them, the registry should be fine.
Of course, he *does* seem to be the kind of person that does exactly that, based on his "I downloaded a random 'registry cleaner' program and trusted it with my computer's stability, and now my PC doesn't work!" thing.
The hotfix issue is a legitimate complaint, but anyone who is running Windows 2000 (an enterprise operating system) at home should be comfortable with making slipstreamed install CDs - especially if the user is someone with dialup access who regularly formats and reinstalls their system.
I'm sure MS would be happy to provide physical CDs with the updates on them if more than a tiny fraction of users were willing to pay a small fee for the convenience. It's not like Linux users get magic free CDs mailed to them from the groups that package the distributions.