Schneier on Security

Bill Bright • December 26, 2005 3:59 PM

This is the same old BS all over again – usually perpetrated by those with some obscure bone to pick with Microsoft and Bill Gates. Don’t get me wrong, I have had my run-ins with MS before and certainly believe in “trust but verify”. But let’s not forget why these exploits exists. They are there because over the years penny-pinchers in business, and budget conscience home users, insisted all newer versions of Windows, Office, IE, Outlook, etc upgrades fully support old, outdated, antiquated, insecure, legacy hardware and proprietary applications. This forced MS to weigh legacy support over security – to keep their client base happy. Now those folks (and MS) see that was the wrong strategy in the long run. Now MS is scrambling, as they should.

Let’s also put this little evaluation into perspective and address what is always overlooked in these bashings; that is, the computing practices of the user. A disciplined user practices safe computing, which involves, among other things, the following:

1. Timely installation of critical updates
2. SP2
3. Router with NAT – even with a network of one
4. PC based Firewall, such as ZoneAlarm – not Windows Firewall, which is only one way
5. In resident AV with current signature files
6. In resident anti-spyware with current signature files
7. In resident anti-Trojan with current signature files
8. Spam Blocker
9. Popup Blocker
10. Scan all downloads before opening
11. Scan all attachment before opening
12. Never click on “to stop these popups, click here” and all things similar
13. Scan all floppies and removable media

and last but not least…

1. Stay away from sites your momma would not approve of!

I will agree if you WANT to infect your machine, you can drop all other defenses and do it easier with IE. But I do not agree that a properly protected PC with a disciplined user at the keyboard will automatically become compromised, just because IE is the browser.

The existence of an exploitable vulnerability in IE in NO WAY automatically means a badguy will be able to penetrate all defenses and cause damage.

I admit that among my peers of fellow IT experts, I may be in the minority when it comes to using IE. But I feel I am doing a better service to the non-geek out there by setting the example and educating them about being responsible and confident PC and Internet users. Teaching them safe computing practices instead of using scare tactics that stretch the truth about the actual “real-world” threat against them. Nor by exaggerating about how much safer they will be just by moving away from IE, regardless of how security conscience the user is.

Don’t whitewash the threat – but don’t say someone will be infected if they use IE. Or worse yet, imply they are safe if they switch to FF! I’m not knocking FF – it’s a good browser. And certainly, if you prefer its feature set, go for it.

I contend there is NO reason any user – especially those of us who are “security aware”, NEEDS Firefox, or some other non-IE based browser, to remain safe. It takes a lot more than just changing browsers to ensure that. Furthermore, I contend these same “security aware” people, who, in their zeal to slam anything MS and insist everyone must switch away from IE or risk infection are merely fanning the fires of fear spread by the actions of lowlife hackers, identity thieves, and cyber-terrorist.

Bill Bright • December 28, 2005 9:12 AM

I agree that we should not HAVE to take these steps – but is that Microsoft’s fault? Do Crown Vics gas tanks explode by themselves – or only have someone not paying attention slams into the car? Are Palm and cell phone viruses IE’s fault too?

What does teaching grandma have to do with the topic? The topic was about FF being safer than IE – and you guys are pulling out extreme cases and calling it mainstream.

I am really amazed at some of the totally misinformed comments above.

Anonymous up there who counters every point – boy are you delusional. If we follow your advice – NAT firewalls (which do indeed HELP protect from system compromises) software based firewalls, AS, AV, and AT etc. are all useless because there are a couple pieces of malware out there known to bypass some of those defenses.

Guess what Bud? The first viruses came out BEFORE IE was born – is that IE’s fault too?

The most amazing comment is his one about the Porn sites – he seems to argue that since badguys also use sites other than Porn, why worry about Porn sites? That’s real clever thinking.

Oh, this same guy says there’s no threat from spam. Hello? Spam has not been known to carry malware?

Get real – you need all those tools to provide overlapping coverage. Is it fair? NO! But it is the badguys fault.

Is FF immune to all exploitation – NO! Is it less prone to exploitation? For now – but be certain as more and more users use alternative browsers, they will become target too.

Badguys go for the easy pickings. That’s why they target unpatched, unprotected systems.

Will I be safe if I change to FF? NO!

The comment about txt files is just down right stupid. Okay so a plain old text file is not likely to contain bad code – does it make sense to teach Grandma to scan these files and not those? Or should we tell Grandma to scan all to be safe? What if it is wrapped in a zip file – or do you think there’s no need to scan them either?

Since looking at the big picture is not something you naysayers are willing to do, you can’t argue the merits of the facts. You are intent in slamming Microsoft products because they are Microsoft products. Ok – I accept that. It totally ignorant, but I accept that are people like that.

There are some great comments up there – but many fully demonstrate total ignorance of the problem.

There is NO ONE SOLUTION to protecting your system from badguys. ALL solutions have pitfalls necessitating the need for overlapping defenses.

I will say this once more then I am out of here.

If a computer becomes infected, it is because a lot more than IE failed.