Today I reinstalled Windows

[Odd]

David Sanders wrote:
>> Even Linux is vulnerable if people behaved the same way they
>> do with Windows. They would gladly download a "screen saver"
>> and install it with root privileges if they got half a chance.
> 
> This is surely quite true. However the main issue for Windows security
> as I see it is that a huge number of applications require
> Administrator-level privieges to run. This prevented me, for instance,
> from setting all the accounts on a windows box to User-level (at least
> for <= Win XP).

Yes, a broken security model.

> Now post-Vista this situation hasn't really improved as it doesn't
> require a password to get past the UAC screens - so users just treat
> it like a Next button, or they turn it off from irritation with the
> amount of times it needs clicking. It only needs clicking this amount
> of times because most programs ask for Admin-level privileges.

MS had a golden chance to fix their security, but as always, they
screwed it up. From what I've read, Win7 is even less secure, as
people were complaining about the constant nagging. Programs
can get admin privileges without even asking the user.

> Chicken and egg, but the egg definitely came first, and the egg was a
> very very lax security model running normal users as Admin.

Still, if they actually cared about security, they would have used
a better security model. But MS has always cared more about
customers' convenience, rather than them being secure.

Imagine if MS had did what Apple did. They could have made
a sandbox for old (XP and lower) software and started with a
fresh slate to really tighten security. Their Singularity OS*,
is actually quite impressive, but it's only a research OS for
now.

Otoh, we get to bitch about their software. ;-D

*
http://research.microsoft.com/en-us/groups/os/singularity/

-- 
Odd