Comments on: Windows defense handcuffs good guys

Microsoft's PatchGuard is designed to keep out malicious code, but security firms say it just keeps them at bay.

[alegr]

The biggest security threat is user base, so far

Folks, let me tell you something about Windows.
NT-based Windows is a secure OS (don't laugh). All kernek objects have a security descriptor attached, NTFS files have user-level access rights, etc.

MS advised for long time (since NT 3.0) that any user-modifiable items, like settings, user INI files and data files, go to user-specific profile folder. But most ignorant ISVs (name any software developper, including some divisiong of MS) kept putting user data in Windows and Program files folders.

The problem with Windows XP started when MS, trying to reduce user complaints, gave all new users administrative rights by default. They didn't want complaints about that shiny game (put your favorite name here) to refuse to run. That actually might be fixed by user-level redirection, but didn't happen.

Now we have that any 10 years old sitting in front of Daddy's computer is an administrator. When that web site asks him: "want to install this cool thing?" Yes, of course, I want! Get a piece of malware...

If you run with limited user privileges, you can forget about AV, and so.

[wbenton]

What's the real deal here?

Not allowing kernel access will severely limit those applications which may require kernel access such as firewalls and other third party (non-Microsoft) products.

The real issue here is how well does Microsoft guard access to the kernel? Do they have the proper API's set up in their OS to allow 3rd parties to dock to the Operating System with Kernel or Kernel similar level access and do they authentication those processes contantly and do they have a special 3rd party certification program which would be required prior to giving such applications kernel or near-kernel access?

Microsoft will say that all of these are coming, but as they are not currently and readily available to 3rd parties... Microsoft is more or less shutting other 3rd party vendors out of the market until their 64-bit version has gained a bit of dominance.

MS will probably claim that it takes time to get all of those ready, but in the mean time... they are forcing others out of the market.

If they wanted to do it right, they should have already had the API's and the 3rd party certifications programs already activated prior to their beta release.

Some applications require kernel or near kernel level access... so blocking them all out is beyond the call of duty. But on the other hand... giving just any application full reign without any security checks/controls is the opposite end of the spectrum.

MS has been on the weak opposite end of the spectrum and now they're switching full swing to the other side of the spectrum which allows nothing.

As more and more complain about it... they'll eventually open that part up and offer similar to what I've mentioned above, but in the mean time... they're ramming their 64-bit version which supports nothing else first until it has enough to make it a near dominant monopoly again and then finally open it up to others... after they've already gained a good lion's share of the market.

Thus this story is not really too far off the mark.

Sure Microsoft needs to make it's OS more secure, but it also requires compatibility with 3rd party products which rival theirs and that's where their push and shove methods start tipping to the monopolistic methods and tactics which they use.

They could have done as I mentioned above... but hey... MS's intent is for them to continue to be the major player and what better way than this... using security as the auspicies to shut others out.

You can still have a secure operating system and allow kernel or near-kernel access... you just have to do it properly... something which Microsoft has decided against at this time but which they will be forced to allow in the future... after they've forced the market yet again!!!

Microsoft has been using ploys like this for ages and thus it's nothing new or unexpected... but it does border on anti-competition which is why sparks are starting to fly.

FWIW

[Gayle Edwards]

Another CNET discussion here...

"CNET" had another story, which is closely related to this one:

http://news.com.com/2100-1002-6103949.html?tag=tb

And, here is an interesting bit of that discussion that I have taken part in...

http://news.com.com/5208-1002-0.html?forumID=1&threadID=20070&messageID=172840&start=-1

Hope this helps...

[Mmmhmm]

Hmmm...

So.. in a nutshell Symantec is complaining because they won't have the power to go in an alter the kernel to make things more secure.. because it'll already be more secure. Gee, maybe they'll have to innovate ways to secure the areas that will still need improvement.. wouldn't that be a shame. Heaven forbid people ever have to change the way they do things, because the way things work in the computer world actually occasionally changes now and then. Perhaps people would prefer everything stays the same and nobody actually at least tries to improve things by making a significant change.

[Had_to_be_said]

Interesting bit of FUD...

Too bad its such a piece of complete nonsense...

That it doesnt even really bear dissecting...

[thefox84]

Thank you Microsoft!

Everybody complains that Microsoft OSes need to be more secure. There are billions of mac users screaming buy a mac, viruses, buy a mac, spyware, etc. Now Microsoft makes the OS more secure and idiotic companies like Symantec(just go out of business already) and others are criticizing Windows. I have no criticism for Vista, they did exactly what they set out to do . They made a safe, more reliable, more pretty, more powerful, more gaming friendly, more useful OS that everybody will be happy to upgrade. My thoughts on everyone who thinks we should go back to XP security, don't upgrade and keep buying antispyware and virus software.

[Had_to_be_said]

I cant tell... are you a BUYER, ...or a SELLER..?

...Because you sure are pumping out the MICROSOFT-LINE.

Mostly, it seems to me that, it is ONLY Microsoft, and their SHILLS, that keep demanding everyone believe that such things as MANDATORY "driver signing" - BY MICROSOFT, will in any way "improve security". Almost EVERYBODY ELSE sees this as yet another attempt by Microsoft to CONTROL THE INDUSTRY, and EXTRACT REVENUE. Maybe, you should honestly investigate the "technical arguments" that are being made.

And, as to being "happy" to upgrade...

...Its also a very well known FACT that, MOST OF THE INDUSTRY, seems to think that "Vista" is the MOST DEFINITE "hold-off on buying", on the computer-industry horizon. In fact, more and more people seem to think that "Vista" could be Microsofts BIGGEST-FAILURE, both commercially, ...and "legally".

But, I did like that "billions of mac users" line... It is simply PRECIOUS.

[sughyosha]

What about the Interests of Users and the People with the Best Solutions?

For many years, the Anti-virus companies have focussed on PC Security. We might conclude that in the evolution of their efforts they have learnt a great deal about PC Security.

Does Microsoft have the benefit of this collective knowledge? On the face of it, that appears doubtful.

So what happens to the interests of Users?

We had many vendors to choose from - Symantec, McAfee, Kaspersky, Sophos, Panda .........

We could change Vendors whenever we wanted.

In contrast, we must now hope that Microsoft knows enough to do the PC Security job. OTHERWISE - we will have to rely on the old brigade who will now be forced to work "around and against" Microsoft - NOT - with Microsoft.

This certainly does not look like progress.

[ripntime]

It was only a matter of time!

These guys are crying foul because MS has cut them out well serves you right for supporting thier platform so heavily "We know it needs it though" and trusting MS.
Any time MS has a competing product they will always lock the other guys out someway or another and then say it's a bug and were working on it.Look back at thier history! They are still the same corporate bully as allways. I think Macromedia is next on MS's hit list in the software realm soon well see that flash don't work right in vista with ie7 but sparkle works great dreamweaver sites won't style properly etc.Because of thier new competing product which will force site creators to switch to MS tools again.
But maybe these companies have a chance for survival if they move to support all platforms.
Because in microsofts eyes they maybe partners today but they will be competition sooner or later..
And I'm a MS OEM partner whoes been getting dissed
since we didn't renew our inhouse software licences because we switched em all to Fedora Core 4.......So it still happens the MS B**l-S**T.

[schief]

MicroSquash and security

I find it rather pathetic that MS would charge for a product (of unknown effectiveness) that is supposed to fix problems is MS operating systems. If MS can develop an effective product that can protect against these OS flaws, why can't they just fix the bug. Or has MS put so many features (buying or copying from others) in the bloated OS that no one can really figure out the interdependices or even if they mesh or conflict. If MS could just uncouple all products from the OS then there would be a chance for a secure kernel. I am always suspicious when a feature is added to the OS that blocks competitors (even though MS says they aide by the same rules).

[Ipod Apple]

MS can develop an effective product

http://www.analogstereo.com/ford_f650_owners_manual.htm

[schief]

MicroSquash and security

I find it rather pathetic that MS would charge for a product (of unknown effectiveness) that is supposed to fix problems is MS operating systems. If MS can develop an effective product that can protect against these OS flaws, why can't they just fix the bug. Or has MS put so many features (buying or copying from others) in the bloated OS that no one can really figure out the interdependices or even if they mesh or conflict. If MS could just uncouple all products from the OS then there would be a chance for a secure kernel. I am always suspicious when a feature is added to the OS that blocks competitors (even though MS says they abide by the same rules).