Who Owns Your Computer?

When technology serves its owners, it is liberating. When it is designed to serve others, over the owner's objection, it is oppressive. There's a battle raging on your computer right now -- one that pits you against worms and viruses, Trojans, spyware, automatic update features and digital rights management technologies. It's the battle to determine who owns your computer.

You own your computer, of course. You bought it. You paid for it. But how much control do you really have over what happens on your machine? Technically you might have bought the hardware and software, but you have less control over what it's doing behind the scenes.

Using the hacker sense of the term, your computer is "owned" by other people.

It used to be that only malicious hackers were trying to own your computers. Whether through worms, viruses, Trojans or other means, they would try to install some kind of remote-control program onto your system. Then they'd use your computers to sniff passwords, make fraudulent bank transactions, send spam, initiate phishing attacks and so on. Estimates are that somewhere between hundreds of thousands and millions of computers are members of remotely controlled "bot" networks. Owned.

Now, things are not so simple. There are all sorts of interests vying for control of your computer. There are media companies that want to control what you can do with the music and videos they sell you. There are companies that use software as a conduit to collect marketing information, deliver advertising or do whatever it is their real owners require. And there are software companies that are trying to make money by pleasing not only their customers, but other companies they ally themselves with. All these companies want to own your computer.

Some examples:

  • Entertainment software: In October 2005, it emerged that Sony had distributed a rootkit with several music CDs -- the same kind of software that crackers use to own people's computers. This rootkit secretly installed itself when the music CD was played on a computer. Its purpose was to prevent people from doing things with the music that Sony didn't approve of: It was a DRM system. If the exact same piece of software had been installed secretly by a hacker, this would have been an illegal act. But Sony believed that it had legitimate reasons for wanting to own its customers' machines.

  • Antivirus: You might have expected your antivirus software to detect Sony's rootkit. After all, that's why you bought it. But initially, the security programs sold by Symantec and others did not detect it, because Sony had asked them not to. You might have thought that the software you bought was working for you, but you would have been wrong.

  • Internet services: Hotmail allows you to blacklist certain e-mail addresses, so that mail from them automatically goes into your spam trap. Have you ever tried blocking all that incessant marketing e-mail from Microsoft? You can't.

  • Application software: Internet Explorer users might have expected the program to incorporate easy-to-use cookie handling and pop-up blockers. After all, other browsers do, and users have found them useful in defending against Internet annoyances. But Microsoft isn't just selling software to you; it sells Internet advertising as well. It isn't in the company's best interest to offer users features that would adversely affect its business partners.

  • Spyware: Spyware is nothing but someone else trying to own your computer. These programs eavesdrop on your behavior and report back to their real owners -- sometimes without your knowledge or consent -- about your behavior.

  • Internet security: It recently came out that the firewall in Microsoft Vista will ship with half its protections turned off. Microsoft claims that large enterprise users demanded this default configuration, but that makes no sense. It's far more likely that Microsoft just doesn't want adware -- and DRM spyware -- blocked by default.

  • Update: Automatic update features are another way software companies try to own your computer. While they can be useful for improving security, they also require you to trust your software vendor not to disable your computer for nonpayment, breach of contract or other presumed infractions.

Adware, software-as-a-service and Google Desktop search are all examples of some other company trying to own your computer. And Trusted Computing will only make the problem worse.

There is an inherent insecurity to technologies that try to own people's computers: They allow individuals other than the computers' legitimate owners to enforce policy on those machines. These systems invite attackers to assume the role of the third party and turn a user's device against him.

Remember the Sony story: The most insecure feature in that DRM system was a cloaking mechanism that gave the rootkit control over whether you could see it executing or spot its files on your hard disk. By taking ownership away from you, it reduced your security.

If left to grow, these external control systems will fundamentally change your relationship with your computer. They will make your computer much less useful by letting corporations limit what you can do with it. They will make your computer much less reliable because you will no longer have control of what is running on your machine, what it does, and how the various software components interact. At the extreme, they will transform your computer into a glorified boob tube.

You can fight back against this trend by only using software that respects your boundaries. Boycott companies that don't honestly serve their customers, that don't disclose their alliances, that treat users like marketing assets. Use open-source software -- software created and owned by users, with no hidden agendas, no secret alliances and no back-room marketing deals.

Just because computers were a liberating force in the past doesn't mean they will be in the future. There is enormous political and economic power behind the idea that you shouldn't truly own your computer or your software, despite having paid for it.

This essay originally appeared on Wired.com.

EDITED TO ADD (5/5): Commentary. It seems that some of my examples were not very good. I'll come up with other ones for the Crypto-Gram version.

Posted on May 4, 2006 at 7:13 AM • 98 Comments

Comments

guidoMay 4, 2006 7:41 AM

> You can fight back against this trend by
> only using software that respects your
> boundaries.

An eye-opening piece if it were on NYT or something. I suppose, your target audiance probably know much of this well already. Have you thought about writing in a more non-techie medium?

GregMay 4, 2006 7:47 AM

This was the main reason for switching to Linux back in the day it was not so easy to do so.
But I am pleased i did now.

This is where "trusted computing" concerns me. To be a "certified" OS will be expensive... So Linux won't be most likely. Then will you be able to connect to iTunes or use online payment options if you are using Linux? Seems to me that "trusted computing" is killing quite a few birds for M$.

But we have cracked hardwear before......

Greg

Nobby NutsMay 4, 2006 7:56 AM

I'm not sure what "boob tube" means in your part of the world, but in this part it's a cylindrical sleevless knitted fabric garment worn on the female top half - a tube to contain the boobs. I don't think that was your meaning!

PaulMay 4, 2006 7:57 AM

If you *have* to trust someone, don't.

Open source software is a great example of software you *can* trust, simply because you don't *have* to.

Swiss ConnectionMay 4, 2006 8:20 AM

Congratulations Bruce,

I did not know that security could be so much fun. In the last few post I found out about boob tubes and recipies for chocolate. A good lough every day keeps the doctor away.

You sure brighten up my day.

Andy CunninghamMay 4, 2006 8:22 AM

I think the issue here is that companies providing free software think of the world with the same model as a commercial TV station: the viewer (or software user) is the PRODUCT, not the customer. The customer is the advertiser wanting to get to them.

AOL's AIM client is a great example: you can use AIM for free, but you need to see their ads when you do.

PeteMay 4, 2006 8:32 AM

I use Ubuntu Linux, primarily for this exact reason. However, I still have fears that in 10 years time, hardware manufacturers will be in the pockets of the media companies, and I will no longer be able to buy components that permit me to run "untrusted" operating systems.

TomMay 4, 2006 8:33 AM

@Guido,

Agreed, Bruce could do a lot of good by seeking more mainstream exposure for this kind of piece. But we can also do our part by sharing them with our friends and associates.

kurt wismerMay 4, 2006 8:46 AM

"But initially, the security programs sold by Symantec and others did not detect it, because Sony had asked them not to. "

excuse me? can someone substantiate the claim that symantec and others colluded with sony to avoid detecting the so-called 'rootkit'?

it couldn't possibly be that anti-virus companies had never thought to go out and buy MUSIC cds and dissect them in order to find malware... no, that couldn't possibly be it...

Tom GrantMay 4, 2006 8:47 AM

I confess that I am growing weary of running 4 anti-spyware packages just so I can have a semblance of "comfort zone" while surfing.

I am getting closer and closer to the day when I sit down with my wife and go over the basics of Ubuntu so we can make the switch.

In my opinion, Microsoft is taking themselves out of the home user market through their inaction on spyware/adware. Additionally, they are close to losing some big enterprise clients due to patching difficulties and security issues. Companies like Big Fix and Shavlik are doing quite well cleaning up Microsoft's mess.

I am also appalled by the patching woes of Oracle lately (and only because it's been in the news lately...it's likely always been an issue with Oracle). These systems are the "crown jewels" of huge enterprise systems.

Yet there is almost zero indication of responsibility on the part of the vendor.

"We just sell it...you have to secure it." seems to be the unspoken motto.

It's time that changes. Thanks for this post, Bruce, great discussion.

Thomas ClaburnMay 4, 2006 8:52 AM

When you say "computer," you're really talking about software. And software is not owned but licensed. There's a world of difference between the two. We're all too happy to click away out rights for convenience and polish. How many people really read and understand the implications of software licenses?

CraigMay 4, 2006 9:15 AM

I think you're nearly spot on, as usual. One nit, though. You call out Hotmail as an example, but Hotmail is not running on your computer...it's running on Microsoft's computers. Surely they have the right to deliver you their marketing messages (and to stop you from preventing them from doing so) in return for this free service that they develop, deploy, and maintain?

Now, if they sold you an email server that you ran yourself on hardware that you own (as I do) and didn't let you block messages from them, *that* would be heinous.

Again, I agree quite strongly with the point you are making...it's just that this one example weakens it somewhat. That, or I'm missing some subtlty of your argument.

paulMay 4, 2006 9:33 AM

Maybe the best way to solve this problem would be for most individuals to stop owning computers. At current hardware prices, Microsoft or Yahoo or Google should be able to drop a computer on everyone's desk, configured the way the company wants it, showing the ads the company wants and so forth. Then we'd be rid of the foolish expectations that something we'd paid for was under our control.

ShuraMay 4, 2006 10:02 AM

I think it's worth mentioning that F-Secure at least did detect the Sony rootkit right from the start (in fact, they had found it and were working on it even before Mark Russinovich blogged about it).

Just to make sure that noone thinks this is astroturfing, BTW, I'm not affiliated with them in any way (other than being a happy customers), so credit where credit is due. :)

Bruce SchneierMay 4, 2006 10:03 AM

"An eye-opening piece if it were on NYT or something. I suppose, your target audiance probably know much of this well already. Have you thought about writing in a more non-techie medium?"

I try, constantly. Easier said than done, though.

JungsonnMay 4, 2006 10:04 AM

Nice essay, i agree most things are known by many. But it's fun to read it, and it can set things in perspective for some.

McGavinMay 4, 2006 10:04 AM

@paul

>Microsoft or Yahoo or Google should be able to drop a computer on everyone's desk,

I agree, but why are we still paying for cable television???

Jordan GlassmanMay 4, 2006 10:05 AM

It is truly unfortunate that mainstream computing has ended up in such a pathetic state. I will never forget the day that I accidentally clicked on a rouge hyperlink somewhere in an ad, and found my clean, guarded, but unprotected Windows install irrevocably contaminated. I decided then to format the HD, reinstall XP, and use Linux as my primary OS henceforth, regardless of the learning curve. I still use Windows, but only on those rare occasions when it is required by some particular application.

I simply do not trust Microsoft. And the idea that I need to supplement my OS with various applications to protect myself from malicious code is ridiculous. Microsoft could have written Windows and IE differently, but they chose not to.

The situation reminds me of the typical opinions held regarding the government. It is similarly unfortunate that government officials and agencies are generally considered to be corrupt and untrustworthy. Whether or not that is actually true is not the point; I am simply stating that it is unfortunate that we live in a world where most people assume that that is true, at least to some extent. In the same way, Microsoft is considered generally untrustworthy and greedy. It is a sad state of affairs, and it doesn't have to be that way.

I hope that F/OSS eventually dominates that computer world, but I believe it will take some great amount of time, possibly several generations. It is ironic that the principles that make F/OSS so strong are largely uncapitalistic; it will be even more ironic if F/OSS eventually wins out over a system of proprietary computer development which implodes due to its own capitalistic greed.

another_bruceMay 4, 2006 10:12 AM

"if the exact same piece of software had been installed secretly by a hacker, this would have been an illegal act."
i'm having trouble seeing the distinction. the sony rootkit was, indeed, installed secretly. from what i've heard, there was a permission dialogue box, but the rootkit would install whether you clicked yes or no.
hearing "hacker", many of us think of someone like kevin mitnick, but i ascribe a broader meaning to this word which focuses on the actions in question, not the status/wealth/respectability in society of the actor. i believe major corporations like sony can also be hackers, and that sony's actions broke the law. unfortunately, american society insufficiently honors its stalwart members of the plaintiffs bar. they are your knights, the only thing that can call a multinational corporation to account on your behalf in an american courtroom, the palace of your rights where you can do things that simply cannot be done anywhere else. i bailed out of the justice industry in 1995, but the ceaseless vilification of plaintiff attorneys by the defense bar/insurance industry/multinationals/media catspaws goes on and on, and the american lumpentrailertrash, being incapable of independent analysis, has largely bought into this cant. in this atmosphere, sony is seen as a respectable, public-spirited entity and the victimized users are seen as would-be lottery winners, so the collective will it would take in just one state to break sony cannot be formed. so kick your lawyer to the curb, fools; when the wolf appears at your door your lawyer, a dedicated professional who doesn't take any of this personally, will still be there to protect you from disaster as future law may permit.

JungsonnMay 4, 2006 10:12 AM

@Jordan

Yeah, the biggest mistake with IE was made by coding IE to be a "shell browser" which ofcoarse is the main reason for security risks. Mozilla on the other hand didn't. But, i can see why MS wanted IE to work like a shell. yeah: to please consumers to be able to use IE for local browsing and run progs. But it was a very wrong decision.

SteveMay 4, 2006 10:39 AM

> If left to grow, these external control systems will ... make your computer much less reliable

That rather depends how reliable my computer is at the moment. For many readers of this blog (and Wired), sure, we don't want people messing with our silicon unless we know about it and approve. But most users already lack control of "what it does, and how the various software components interact" - they quite rightly choose not to spend months learning how to do that.

They might well make their computer *more* reliable by allowing someone else to "own" it: maybe their techy best friend, or maybe Microsoft.

With auto-update we retain a theoretical veto, whereas with DRM we don't, but that's irrelevant if we can't reasonably judge whether to veto something calling itself a "critical security update". That's true whether the update is closed or open source, whether it comes from Microsoft or Mozilla.

That's not to say we shouldn't still want to retain that theoretical veto, so that we can delegate power rather than relinquish it altogether. But for many users, "control your computer" isn't useful advice because they don't know how. What's needed, if they're to make use of Bruce's advice, is a way for them to maintain strategic control ("ownership") while delegating operational control. Enforcing existing computer misuse laws against companies which abuse their operational control to modify your system in ways you haven't authorised, would at least be a start.

And ITYF it's "pwned".

BennyMay 4, 2006 11:16 AM

Bruce wrote:

"You can fight back against this trend by only using software that respects your boundaries. Boycott companies that don't honestly serve their customers, that don't disclose their alliances, that treat users like marketing assets. Use open-source software -- software created and owned by users, with no hidden agendas, no secret alliances and no back-room marketing deals."

A good idea, which I'm going to try to sell to my friends. However, its begs the question: what are the software that "respects your boundaries"? It'd be nice to have a short list of software (OS, browser, etc.) to point to when we rally people to boycott bad companies. And if we want people to consider that list seriously, software must be user-friendly enough to minimize the trauma of migrating to something new. I hope people will speak up about their favorite "boundary-respecting" software, but let's not let things degenerate into a "my software is better than yours!" screaming match.

Alun JonesMay 4, 2006 11:34 AM

@Paul: "If you *have* to trust someone, don't.
"Open source software is a great example of software you *can* trust, simply because you don't *have* to."

What on earth does that mean?

You have to trust any software you install on your systems. Unless you spend months analysing the source of each application you install on your system - including the operating system - you have to trust the word of its authors, and the experience of its users, same as you do with non-OSS.

John R CampbellMay 4, 2006 11:35 AM

One of my co-workers had been having so much trouble w/ spyware when his wife would surf over to various sites (contests, etc) and the W98 box would get dragged down.

Then I introduced him to Knoppix on a Live CD (look at http://www.frozentech.com/content/livecd.php for a whole list of Live CDs) and, once he showed her how well it worked, she's never looked back.

The advantage of a Live CD is that when you re-boot the machine, all of the cookies and any spyware that managed to get into RAM just... ahem... evaporates.

In some ways you almost need to use a Live CD image so that you don't accumulate cookies/spyware/etc... and any access to the underlying hard drive is explicitly done by the user rather than a covert process.

Of course, since then, he uses the Knoppix CD himself to browse "alternative material" so no history or cookies are retained when he performs a shutdown.

Live CDs ain't just for diagnostics and forensics no more.

Ghaith NasrawiMay 4, 2006 11:59 AM

this reminds me of something was Bugtraq'd few weeks ago. Somebody found out that blocking some of microsoft domains using the /etc/hosts file simply doesn't work and windows has its own ways to override any settings you'll try to force using the hosts file

VijayMay 4, 2006 12:18 PM

As an extension to the subject of us owning the computer:

Recently secure processors have become popular (eg. IBM Security blue), where the users
of the computer themselves cant read the contents of memory since it is encrypted using
a secret on chip key. (users cannot get to know this key).

What do people think about this?

RSaundersMay 4, 2006 12:36 PM

Perhaps we should consider this in light of the similar cycle of newspapers:
1) In the 1770's newspapers were run by people with something to say = writers. The people who bought them cared what they said = readers.
2) In the 1870's industrialization allowed newspapers to become large, carry pictures and pretty headlines. There were 11,314 distinct providers in the 1880 census.
3) Around the turn of the century, "yellow journalism" started the process of saying things to get people to think things that were financially advantageous to the author, even though they were false.
4) By 1920 most newspapers had been acquired by a few businesses and put into "chains" that said the same things.
5) By 1950 readership starts to decline as ad space exceeds 50% in most papers.
6) In 2005 they no longer ask me to subscribe to the local Big City paper, they throw it on my lawn for free because I live in a “good��? Zipcode (postal code).
7) Interesting writers continue to exist (like Bruce), and interested people still read them, just not in newspapers.

For computers:
1) Computers were made and used by people who were interested in the science behind them (Babbage -> 1950).
2) After the war, electronic computers brought the ability to analyze large data sets to industry and government. Everybody with a computer did something different.
3) In 1984, the idea of “personal computers��? that would do what you wanted even if you didn’t know how they worked changed everything.
4) Many computer vendors consolidated into three “chains��?, with the world’s largest monopoly running the Microsoft one.
5) In 2006, Computers are still approaching saturation, where every new computer is a replacement for one previously owned. Spam and ads have taken all the “fun��? out of computers for most users.
6) In 2015, companies compute it is cheaper to pay Microsoft directly to give everyone a computer that plays ads when asked to and doesn’t let users choose anything without charging them. The long sought goal of “ubiquitous computing��? will have arrived. The poor will not have been lifted up, however.
7) People interested in the science behind computers will continue to make and use computers, just without Microsoft’s help.

(Everything isn’t Microsoft’s fault, but their fault in this case is significant.)

MyCatMay 4, 2006 12:51 PM

John R Campbell pointed out that "The advantage of a Live CD is that when you re-boot the machine, all of the cookies and any spyware that managed to get into RAM just... ahem... evaporates."

Perhaps running a VMWare client with a non-persistent virtual disk image (that discards all the changes when you stop the virtual machine) would achieve the same goal? Anyone have any thoughts on this?

KentMay 4, 2006 12:58 PM

@Bruce

Excellent post. However, I don't believe "Trusted Computing" will make the problem worse. "Palladium" would have made the problem worse. Providing a link from "Trusted Computing" to your post on the evils of Palladium shows that you may also believe this. However, continuing to use the terms "Palladium" and "Trusted Computing" interchangably will only make it harder for others working towards legitimate uses of a TPM chip.

Thanks always for the insights.

Pat CahalanMay 4, 2006 1:01 PM

@ Kurt

> excuse me? can someone substantiate the claim that symantec and others
> colluded with sony to avoid detecting the so-called 'rootkit'?

There's a whole thread on this topic elsewhere on this blog, with various links and supporting information.

@ Benny

> It'd be nice to have a short list of software (OS, browser, etc.) to point to
> when we rally people to boycott bad companies.

Tough to do, because oftentimes "good" companies morph into "bad" companies as they get bigger and desire for more profit creeps into middle management :)

@ Vasu

> A senior security strategist at MS posted a blog entry stating that the
> windows vista firewall turned off nonsense was just that, non-sense

He should speak to his PR department, then, because Microsoft spokespeople are the ones that said the outbound protection would be turned off: http://news.com.com/Microsoft+takes+down+barrier+in+Vista+firewall/2100-7355_3-6065797.html

Jesper's blog (which you link to) does make a pretty good point about the problems with outbound filtering. And to some extent he's correct. Having outbound filtering be configured by an OS account essentially means that once you root the box you can just change the filtering rules, so the protection is minimal.

The right answer here is, "don't let your operating system decide what to talk to" - relying upon any host-based firewall as your sole firewall doesn't help much if you don't have protection outside the OS as well.

Pat CahalanMay 4, 2006 1:04 PM

@ MyCat

> running a VMWare client with a non-persistent virtual disk image (that
> discards all the changes when you stop the virtual machine) would achieve the
> same goal?

I do this in some instances. If you take steps to trust the host OS for the VMware, it's functionally equivalent to the Knoppix idea. That's a big "if" though :)

Tobias WeisserthMay 4, 2006 1:40 PM

Excellent article Bruce. But there's one thing that you could have pointed out in more detail:

"Technically you might have bought the hardware and software, ..."

This is not entirely correct. When someone "buys" software, he merely obtains a license to *use* the software. The ownership still remains with the original author or in most cases with the person who has been authorized marketing the licenses.

In the perception of the owners ( != the users ) it's OK to limit the usage of the software in any way they see fit since they remain the owner and merely a license to use has been granted.

This is the real problem.

Tell customers that they simply obtained the right to use the software under certain conditions, tell them that they haven't obtained ownership of anything other than a "license".

It's quite different with software that is licensed under BSD style licenses. There, you can almost do whatever you like with the software, yet you cannot obtain the original copyright. GPL software is not bad either in this respect, but from the user's point of view it's much more restrictive in regard to "owning" something.

If copyright law doesn't change dramatically no major software vendor is going to change their perception that /they/ own their customers software.

Otherwise it's a very good article. I have already sent the URL around to people.

regards,
Tobias W.

Rick WMay 4, 2006 2:11 PM

I think the real reason Microsoft does not turn on the outgoing firewall by default is that they don't want everyone to know that Microsoft Office programs phone home.

I run the free version of ZoneAlarm. A few minutes after I start Access, Excel, PowerPoint, or Word workin on local files, ZoneAlarm prompts me to ask if I want to allow them to access the internet.

I have not investigated to see if I can change Options to change this behavior.

oggMay 4, 2006 2:44 PM

Vista is simply a nice rootkit for XP with a little window dressing.

ogg

VickiMay 4, 2006 2:55 PM

Sure, the NY Times could link to this stuff, but what percentage of people who read the Times look at their blogs? Bear in mind that a lot of people are still reading that paper on paper. They could also get Bruce's permission to put it on the front page.

Since they haven't, far fewer people will see it than if they did.

The point isn't that the Times somehow has great legitimacy (though some of its readers are more inclined to believe what they see there than what they see elsewhere). The point is that it has a lot of readers, people who could benefit from seeing this information.

SecureMay 4, 2006 3:01 PM

"If you take steps to trust the host OS for the VMware"

You have to harden the host OS for the case that you catch a worm in the guest that automatically spreads over the network.

"working towards legitimate uses of a TPM chip"

As long as the user doesn't have full control over what is stored in the chip, there are no legitimate uses from the user's point of view.

"GPL software is not bad either in this respect, but from the user's point of view it's much more restrictive in regard to "owning" something."

From the point of a user (not a programmer) the GPL is perfect, because it doesn't set ANY restrictions on the use of the software, including changes of any kind. It is a distribution license. The user practically owns the software for his personal use.

kurt wismerMay 4, 2006 3:08 PM

"There's a whole thread on this topic elsewhere on this blog, with various links and supporting information."

i've read it... it goes like this
- f-secure, whose anti-rootkit technology was already detecting the software, didn't alert the public right away because they knew the information would be misused by the script kiddies (which then proceeded to actually happen) and were in discussion (whose nature is unknown) with sony when the story broke
- norman's sandbox technology was already able to detect xcp without need for a signature
- symantec was implicated by a claim that they had approved xcp but later cleared by an *explicit* correction
- multiple av vendors downplayed the threat it posed, which one fully expects in the face of their failure

Chase VentersMay 4, 2006 3:19 PM

Linus Torvalds once said that Linux is inevitable. I couldn't agree more.

It's been two years now since I've switched to this platform. When I made the switch, the reasons were entirely technical - I had gotten tired of an aging, slow, unstable Windows 2000 desktop. I didn't think I'd last a month before I came back.

Surprise surprise, it's been two years, and I can count on one hand the number of times I've used Windows (and always when it involved fixing someone else's crap).

All technical reasons aside, one of the biggest impacts this transition has had on me is that it has really woken me up to what free software really means. (The two competing terms "open source" and "free software" often refer to the same thing, but "free software" is more about freedom whereas "open source" is more about practicality. "Free software" is the stuff that keeps your computer free).

I'm actually a Gentoo Linux user. I did what's known as a "stage1" install. This means that I started with a live-cd that contained nothing but a minimal bootable Linux environment, and a tarball with a compiler collection. I then watched Gentoo compile the entire operating system (including its new compiler) from source. It's nice knowing that for anything I'm using, I can go pick it apart and change it (and I do every once in a while).

And it's absolutely surreal every time I hear about the latest Windows worm / bug / spyware / DRM. I can't believe that users aren't revolting.

Chase VentersMay 4, 2006 3:22 PM

@Tobias

The GPL does not have any direct impact whatsoever on the users of GPL programs. Users don't have to agree to the GPL in order to use the program.

The GPL applies merely to give said users permission to copy the software if they so choose, as long as they're willing to transfer that permission to those who receive the copies.

JungsonnMay 4, 2006 3:38 PM

@Chase

"Linus Torvalds once said that Linux is inevitable. I couldn't agree more."

Well, it is a fact the more linux webservers are being hacked, (not only by the fact that linux has a 70% share and MS 30%) but because most hackers have great knowledge of linux and less of a MS platform. So to state that linux is more secure is simply not true based on that standpoint. If more people will use a linux environment on their desktop, there will be also more exploits and the later on linux desktops.

Chase VentersMay 4, 2006 3:45 PM

@Jungsonn

I'm curious where you get your facts from. What you're saying is totally inconsistent with the reality I've personally seen. (Also note that I never said a thing about security; the Torvalds quote is talking about a social movement - not software vulnerabilities)

But nevertheless, it's irrelevant. This isn't so much about hackers as it is about a power struggle. GNU/Linux is a free system. This is something that is fundamentally at odds with Microsoft and their products. Windows will never be a free system, and as long as it's not a free system, neither will the users have freedom. Windows is a war-zone, and the sad thing is that its users suffer the casualties.

JungsonnMay 4, 2006 4:11 PM

@Chase

I agree, it isn't very relevant, but the topic reactions gained it's own way. But many people think that linux is "super secure" well, that is simply not the case. Every system can be compromised, some quicker than others. In that case switch to BSD. MS products are not free indeed, and even if they we're i still would prefer a *NIX platform. But face the facts that "normal" users do not have the skills and time to learn such platform, windows is their lifeline if it comes to go online, email, and do simple business things. They want easeness instead of figuring out why their favorite software doesnt run on linux, i guess there will always be two camps, the programmers one and the endusers one. The end user pays his own price by not having enough knowledge of understand other systems which are a little harder to grasp.

jonMay 4, 2006 4:14 PM

Outsiders dropping software on your PC is a fairly early stage of development. The next step is when you buy a box that will only run encrypted and signed software provided by the seller, so that you can't run open source code even if you want to.

Looked at a game console recently?

Chase VentersMay 4, 2006 4:28 PM

@Jungsonn

I still disagree with your assertions about Linux security. The operating system itself is generally quite secure; it's the things that people run on top of it that tend to have problems (such as PHP).

And I further disagree that BSD is any better. Lots of BSD users like to think so, but I've spoken with former OpenBSD developers that would also disagree that BSD is any better.

And I know that Linux isn't always as user friendly as it could be. These are things the community is working to improve. In actuality, on a system with good Linux hardware compatibility, some distributions manage to do a fantastic job of offering up a useable system. My sister (who is not a computer person at all) runs Ubuntu Linux.

SamMay 4, 2006 4:36 PM

Craig pointed out that Hotmail isn't running on your own computer; this is also true of other software-as-a-service models, of which email Web sites are just one example. But that's not a weakness of Bruce's argument; rather, the weakness is that he makes a distinction between your computer and the network, and more and more, the same issues arise in both arenas.

Take Net neutrality, for instance. If I can't get to a site, or it's unbearably slow, what difference does it make whether the problem is software on my computer or a policy of my ISP? Either way, someone else's policy about information access is interfering with what OUGHT to be my rights as a computer user. The terrifying part of this latter set of issues is that Bruce's sound advice - use open-source software (and, by the way, DON'T use software as a service, ever, ever, ever) - is only good for your computer, and has no effect on the network.

BTW, you can support Net neutrality by writing your congressperson and encouraging them to support the bill that Marty Meehan and others just introduced.

Jordan GlassmanMay 4, 2006 4:36 PM

Even if Linux/BSD is not more secure, the community is completely open about whatever insecurities may exist. I am comforted by the fact that I can stay completely informed about extant vulnerabilities, including viewing the errant source code should I choose to.

Bruce Schneier argues with regards to cryptographic algorithms, that open standards are better than closed ones, because the secret lies in the key, not in the algorithm, and it's much easier to make and protect new keys. This argument can be generalized to all security (which Schneier also does, of course) to imply that a system if more secure if its security does not depend on a black box. I sleep very soundly knowing that the Linux/BSD development community is working hard because they feel passionate about what they are doing, and I support them accordingly.

Pat CahalanMay 4, 2006 4:39 PM

Let's not turn this thread into a "this OS is more secure than that OS" discussion.

For one thing, "OS" is poorly defined. When you say "BSD is more secure", are you talking about FreeBSD, OpenBSD, NetBSD... and what sort of installation are you talking about (since choosing "server" over "workstation" can have a huge impact on what's running on the box and what ports it is listening to...)?

Is a default RHEL4 workstation installation more secure than a FreeBSD 3.5 installation? Sure (3.5 is older than dirt). Is an OpenBSD installation running apache more secure than a Windows XP box that isn't plugged into the network? Absolutely not.

You know what's secure? A powered off computer that's had the hard drives removed, multiply-degaussed, and shredded and all of the bits encased in concrete. Anything else is just religious conviction.

AnonymousMay 4, 2006 4:57 PM

@ Pat

But I think this is a thread about this OS vs. that OS.... although what you say is absolutely true. Making broad stroke statements about particular kernels doesn't make a lot of sense.

To quote Bruce from above: "Use open-source software -- software created and owned by users, with no hidden agendas, no secret alliances and no back-room marketing deals."

This statement is a subtle endorsement of open-source software as generally more secure because of philsophical differences in the development process. And of course it doesn't make any references to Operating Systems, just software.

Pat CahalanMay 4, 2006 5:48 PM

@ Anonymous

> it doesn't make any references to operating systems, just software.

Right, that's kind of my point - don't digress a discussion about software in general down into an "OS religious" fight in particular.

There's a difference between "how secure" something is and "how free from agenda" it is. Bruce's endorsement of open source software in the context of this article comes from the belief that open source software in general is less impacted by agenda than commercial software.

Generally speaking, I agree. Commercial software products (lacking anything resembling a real guarantee) come loaded with a corporate agenda that is absent from open source software.

However, lots of open source projects can have their own agenda-related problems. Not everyone who leads an open source project has an agreeable personality, for example.

Anecdote: a particular discussion thread on an open source project between a friend of mine and the project leader ended with a denial of service attack on my friend's site when the project leader lost his temper and made some suggestive comments on a mailing list. It may not have been intentional, but the results were the same.

Beware agenda, regardless of the source :)

False DataMay 4, 2006 8:59 PM

We spend a lot of energy thinking about who owns* the computer in the beige box. Maybe we should also consider who owns the computer in the cell phone, the iPod, the PDA, the automobile, and so on. All those computers potentially have access to sensitive data. They're simpler, so there are fewer places to hide malware, but their manufacturers have much more control over their pre-packaged code's behavior.

* In the sense of "controls", as Bruce used it, as opposed to the sense of "has legal title to."

ordajMay 4, 2006 9:53 PM

Getting ina twist over individual PC control is tame compared to the efforts over who owns the network. Net neutrality.

The greatest benefit of computing comes through *networking* and it's going to be seriously compromised by the teleco and cable companies.

You can always disconnect from the network and then nobody would own your PC.

Stephan SchwabMay 5, 2006 12:06 AM

And maybe it will be the consumer PC that will not have a local copy of MS Office installed, but use a web based office suite. Maybe all those Web 2.0 companies already got it and are just waiting for the locked down devices to appear. Who knows?

doc_atomicMay 5, 2006 1:29 AM

Pete wrote:

"However, I still have fears that in 10 years time, hardware manufacturers will be in the pockets of the media companies, and I will no longer be able to buy components that permit me to run "untrusted" operating systems."

I have similar fears too. And not only about "trusted computing" - the so-called "Fritz chip" - but even to things such as ACPI, which has recently been mentioned as yet another good opportunity for hackers to exploit, in order to gain control of a system.

It is for these reasons that I am hoarding computers. I have salvaged dozens of old, "obsolete" AT-formfactor computers and components - nearly all in excellent condition and working order, and none bearing any TCP or fully-implemented ACPI whatsoever.

These "obsolete" computers serve my needs quite adequately. The fastest of them - the Slot 1 'BX'-chipset AT types, such as the Asus P2B-B - will run at up to 1.5 GHz, with UltraSCSI 2 and a 256MB AGP video card; that is fast enough for moderate gaming, and video recording or editing. And they all run Linux just fine - even the really old 386 ones.

People and corporations are literally throwing these machines away *right now*... better grab your 'freebies' fast - and your _freedom_ as well - before it's all gone.

Forever.

PaulMay 5, 2006 2:15 AM

@ Alun Jones

No, I don't *have* to trust OSS, or it's authors. I can, if I choose, find a completely independent expert (and I know a few) who can vet the source code for me. Moreover, the open source community do this routinely, further reducing the likelihood that I will need to.

Closed source software, on the other hand gives me two options: Trust it, or don't trust it, period. There is no opportunity to get a second opinion from someone I already trust.

The fact that I don't *have* to trust it, makes it far more likely that I won't get burnt if I choose to trust it.

Do you really believe Sony would have tried it on if they knew the full source would be readable by anyone, anywhere? I doubt it somehow. They did it because they didn't think they'd get caught, and the root kit is all the evidence you need to prove it. They attempted to hide their software because the knew damn well it was wrong!

Personally, I'll take my software from the folks with nothing to hide.

Drake WilsonMay 5, 2006 4:10 AM

@RSaunders:

The problem with the analogy of 7) is that various corporations currently have an incentive to use political and/or economic leverage to push it out of reach. If they have their way, it may well become illegal and/or impossibly expensive to build and operate one's own computing equipment.

Jens MeiertMay 5, 2006 5:04 AM

Conflicts of interests are obviously a great thing. Your advice of fighting back is legitimate and necessary, above all since only a few actually do fight back. And nothing will change otherwise.

JungsonnMay 5, 2006 8:42 AM

Eventually yes, a secure webserver is one that is offline. regardless of OS. But my view was of the fact that it is simply untrue to suggest that linux is safer then a MS OS. This depends how you define security. When i state that more hackers have more knowledge of linux then of MS, then a linux webserver is more liable to be attacked then a MS one. And that implies a greater security risk. And also linux is open source, so any flaws in it are easely spotted, but on the other hand those flaws are quickly restored by that dedicated community. This is only to point out that it is not simply a case for everyone to just "switch to linux and everything will be solved" that's a fallacy to me.

As for who owns your pc, i think the user will be responsible for every practise on his computer. And thereby owns his own choice of being "owned". That companies, or hackers "owning" others is because the "owned" let them to be "owned".

Pat CahalanMay 5, 2006 12:44 PM

@ doc_atomic

Don't bother piling up old computers. If the dark and sinister "Them" manage to cram borg chips into every new computer manufactured in the United States in 10 years, you'll still be able to buy machines made elsewhere without the borg chips, or you'll be able to do a quick search and find 1,000 different web pages with quick and easy instructions on how to bypass, disable, deactivate, or otherwise render said borg chip useless. Every copy protection scheme released fails within 24 hours of publication, I don't imagine this trend is going to cease. Sure, you may not be able to play the latest Desperate Housewives on your computer, but given your use case I don't imagine this is going to bother you much.

@ Paul

> Closed source software, on the other hand gives me two options: Trust it, or
> don't trust it, period.

Disclaimer -> I prefer open source software as well, but for many different reasons. End disclaimer.

I see this argument for open source quite often, but what it boils down to is this only makes a difference if *you're* actually testing the open source code. Forget about "trust", you're proxying it either way.

If you're getting someone else to do your testing, you're still accepting a proxy. For the closed source software, you have two proxies -> your vendor (and presumably the many high priced software developers who work for the vendor), and those people who will test the code even without having the source. There are a LOT of people who do this, which is why Microsoft vulnerabilities get posted in the first place. Not all those researchers have access to the source code.

For open source software, you have two proxies as well -> your vendor (who is presumably working on the project for various reasons) and those people who will test the code with or without the source. Sure, you can hire someone you trust to do this on a particular case, but again you're proxying your trust -> you're assuming that the hire is good enough to find the problems :)

The argument of open source vs closed source in a security context is more complex than "I can look at the code". To just say, "I like open source software because I can look at the code" is like saying "I like closed source software because I think their security QA people are the best in the business"... it's holds pretty much as much weight as an unsubstantiated opinion.

There are lots of reasons to pick one software package over another, but in a security context, blindly or blanketly choosing open source always over closed source is putting blind faith in a production environment concept, instead of in security processes.

Secure software (in today's market) is a mythical goal... there isn't any. Examine your use case, your vulnerabilities, your liabilities, the guarantees of your vendor (if any), etc.

If you're looking for an anti-virus product, one of the more important factors is "release of virus" to "publication of definition". If a closed source vendor has an average of 2-12 hours vs an open source vendor with an average of 24-48 hours, you'd be an idiot to choose the open source vendor... unless you have a fairly careful user population. Even the Sony rookit story isn't *necessarily* a good reason to overturn your closed source vendor for anti-virus, *depending upon your environment.*

Security is a trade-off. If you need to trade-off your own personal comfort level for the good of your user/corporate environment, you're obligated to do that. Of course, Bruce is correct in that, in the long run, choosing vendors who put their customer's agenda over their own agendas will result in better products. So by all means, in instances where all things are equal, throw extra weight on the "less agenda laden" product.

Don't forget to examine your own personal agendas when making security decisions :)

taMay 6, 2006 4:25 AM

This is exactly the problem the Capability-based OSes (linux is not the one) are targeted to solve.

There are several active reseach projects in this area:
http://www.coyotos.org/
http://capros.sourceforge.net/
http://erights.org/


Also the site http://cap-lore.com/ has a lot of information about capability systems.

Linux is a bit more resistant than Windows with respect to malicious software. But the fundamental architectual defect is shared with Windows.

I advise those who cares taking ownership of own computer back at least in the future to invest time (or even money) in those projects.

JungsonnMay 6, 2006 7:03 AM

I find this such an interesting subject, about who owns you. and mainly i have ideas about open-source or so-called GNU licensed software. I know many of you follow bugtraq then you also know that when it comes to open source software, quickly bugs are found. Then a bout 10.000 webadministrators have downloaded for instance: a piece of opensource forum software. It happened with mambo, phpbb, and many other boards. When a leak is being found it puts all the systems which are running on the web into danger. Well, i find that that is not a good development. My opinion is to _ALWAYS_ build your own software or let it build from scratch, then no one knows how your system works, and the chances of an attack decrease also. Every script i make is build from scratch, i never use out of the box sollutions. I agree, open-source is a very good thing and too which i also contributed in the past, sharing ideas also, but i do not believe in blindly trusting open or closed source.

StilgherrianMay 6, 2006 7:56 PM

While "trusted computing" may mean users lose "ownership" of their computers, the battle is already lost. "Trusted computing" will win:

1. Normal consumers -- in the home or in business -- choose their computers and software on the basis of advertising, not what infosec cognoscenti write in blogs. TV and magazine ads depicting happy families protected from the pedophile-riddled Internet trump concerned technical articles about privacy every time.

2. While Bruce Schneier writes coherently, there are plenty of infosec and privacy advocates who come across as little more than anti-social crazies, thanks to aggressive language or poorly-chosen examples. You don't need to counter Bruce's cogent arguments, you just need to point to the crazies and say the only people worried about these issues are lunatics who want to protect criminals.

For a magnificent example of how this is done, see the recent debate in New South Wales, Australia, where the state government ignored its own privacy laws when trialling online health records. Health Minister John Hatzistergos used a triple-whammy to write off critics, saying "the rest of the community's right to access better health care should not be allowed to be hijacked by a handful of privacy zealots". Criticism of the trial is "hijacking" (a violent term) of health care in general, not just of the trial, and the "handful" of critics" are "zealots". http://www.parliament.nsw.gov.au/prod/parlment/hansart.nsf/V3Key/LC20060329033

3. The proponents of "trusted computing" have already chosen the best term to frame the debate. What they're proposing is "trusted" -- anyone proposing anything else is automatically "untrustworthy".


Michael GiagnocavoMay 7, 2006 12:05 PM

Anyone saying that Microsoft is going to turn off a firewall so that it can get around it isn't thinking. Microsoft "owns" the entire OS. So, if they really had some nefarious plan and wanted to secretly spy on you to make their advertising revenue grow (yea, MSN is certainly the cash cow), they could easily just add their programs to the exclusion list by default.

As far as outbound filtering... well, think how many applications need ports apart from 80 and 443... For instance, all the IM software. Microsoft then would have to get into the nasty decision of which software to allow by default. Now they are excercising even more control (say, they'll allow Yahoo, MSN and AIM, but not Jabber -- people will claim unfairness). Isn't there enough stuff MS is actually doing wrong so that you don't need to go making up conspiracies?

Christoph ZurniedenMay 7, 2006 1:05 PM

@Jungsonn
>When a leak is being found it puts all the systems which are running on the web into danger.

That observation is true and can be easily generalized to "When a leak is being found it puts all the systems which are running and can be accessed by anybody (including itself) into danger".
Even the idea behind your proposed solution is not bad but your implementation is.

> My opinion is to _ALWAYS_ build your own software or let it build from scratch, then no one knows how your system works, and the chances of an attack decrease also. Every script i make is build from scratch, i never use out of the box sollutions.

That would mean that you are a perfect programer, one who does not write buggy software. Are you?
It's also "security through obscurity" of course and even the insecure PC-architecture might play a small role here.

But, as mentioned above, it is by itself a good idea to mark executables as your own. It's easy with binaries: add a block (this part has been done before, but as you might have guessed if you know me: I lost the bookmark) with a cryptographic checksum (must be encrypted e.g. with a password given directly before execution or at boot time or sth.) and the kernel has a(n encrypted) list which one to execute, when and where. Security may rely on a working NX-implementation, but I haven't studied it, this scheme is just a rough sketch.
A bit more difficult are the scripts, you would have to rewrite all interpreters to support this scheme.
But how to solve the problem with the commandline? No CLI for the poor and hapless users? No fast&dirty(TM) shell scripts anymore?
Mmh...OK...two of three is not bad at all and you can build a good capabilities based access controll out of it which doesn't depend on trust but on well implemented cryptography: just encrypt the complete executable instead of only encrypting the "owners mark".
You could even get rid of root completly weren't it needed for installations especially installations of patches. You would have to install many excemptions to get it to work which would than kill all of the elegance and ease of the scheme.

Nuh, it's not that simple as it seems to be but it could be worse, so: calm down and relax because it will get worse :-)


CZ

madkadMay 7, 2006 2:20 PM

I would like to start by saying nice article there and very well written and intresting

I currently use all my own software, just a shame that i use windows as my os but maybe one day that will change.

Thomas SprinkmeierMay 7, 2006 7:01 PM

@Pat

Very interesting point about proxies and trust.

I'd just like to point out that in Open Source, the vendor has no control over the proxies.

In closed source the vendor can disuade proxies either actiely (google for DMCA abuses) or passively (see "What if Your Vendor Won't Sell You a Security Upgrade?" earlier on this blog).

I agree that OSS is not a panacea (the recent slew of FireFox problems proved that!). Security is a tradeoff, and the degree of trust you have in the software (and the vendor) is only one of the things that affects the decisions you make.

Ben LiddicottMay 8, 2006 8:32 AM

Outbound filtering is for people who are already 0wn3d.

It has some marginal use as an additional hurdle between the bot and the IRC network.

It's utterly pointless if it is Windows firewall or another market leader. All that will happen is common trojans will add allow rules before doing any network activity.

AartMay 8, 2006 9:23 AM

Excellent article and so true.

Even the article itself was owned (the Wired edition) by a huge advertisement of a major IT-vendor right over the text, which could only be removed by clicking on it.

JimMay 8, 2006 12:22 PM

I noticed this happening about four years ago, and made the move to Linux back then. I'm quite secure in my computing, running a Slackware-based distro called Zenwalk Linux. From behind a hardware firewall, a software firewall, and a normal Linux user account, my computer is probably as secure as i can get (aside from unplugging it from the network and powering it down). Oh, I have to use another machine from time to time, when someone I know wants something I haven't worked out yet in Linux, but I have no email access on that machine other than a Yahoo account i can use from anywhere. I've never paid the first penny for Linux, other than helping support others, and I've never had the first virus or instance of spyware yet (on a broadband connection averaging around 360kps).

I'd like to see others take the initiative and simplify their lives through open-source, but you know what? I don't really care if they do. I'm secure right where i am, so i can afford to laugh at the newest panic circulating among Windoze users.

Pat CahalanMay 8, 2006 12:23 PM

@ Thomas

> I'd just like to point out that in Open Source, the vendor has no control over the proxies.

Implicit in this statement is that Closed Source vendors have control over the proxies, which isn't entirely true (although they certainly have more control than open source vendors).

I agree that when it comes to auditing software, having access to the source code makes it possible for you to have a much more thorough and complete audit. Absolutely true.

JackMay 9, 2006 10:57 PM

I'm reminded of fight club and a statement in it, "In the future, it'll be the corporations running things, the microsoft galaxy, planet starbucks."
Well it all boils down to money. The more you have the more you can "buy". We can't seem to get around this one. You find a group of people (maybe you open source guys.) that cannot and will not be bought and that will code, then maybe you'll have something.
I'll point this out, RPC, Remote (scary) Procedure, Call...As it's name implys calling on a procedure remotely. What procedures? What port number? You can't seem to shut this service down, is this like Internut Exploder being part of the OS and you can't uninstall it? Hmm, makes you wonder about some of the other services you don't have the ability to stop. The next push will be by some conglamerate to push for govt regs on all of this. Great, now corps can lobby for their agenda to be pushed.

elegieMay 13, 2006 9:40 PM

In addition to free (as in "freedom") software and open-source software, it is also important to have open data formats and protocols. Imagine receiving an unsolicited e-mail attachment that is in a proprietary format. It may be worthwhile to politely tell the sender about better alternatives. See the page "MS-Word is {not} a document exchange format" (http://www.goldmark.org/netrants/no-word/attach.html) The same applies to Web sites where content is only available in a proprietary format.

Outside parties may sometimes expect or even require users to use certain proprietary software. Consider a Web site that requires users to use a certain proprietary Web browser. Users should encourage Web sites to not require specific brands of browsers.

Paul MMay 16, 2006 12:31 PM

When I signed up for SBC/Yahoo DSL, it was clear that they felt they owned my computer. During the installation, they disabled my Google Toolbar, installed and enabled the Yahoo Toolbar, changed my Home Page, and probably much more. All I wanted was high-speed internet, but I also got a Yahoo takeover of my computer.

With regard to DRM, it seems like media companies would like to make general purpose computers illegal. In other words, they'd like personal computers to be more like glorified Xboxes ("boob tubes"). The idea is that you would be allowed to do only a very limited number of things on your computer. It would be nearly impossible to use illegal copies of software, videos, music, etc.

firMay 21, 2006 9:51 AM

Thanks to your message, i just finished installing a 100% free operationg system.

Bryan@adminfooMay 31, 2006 5:16 PM

Outbound filtering is for people who are already 0wn3d.

I wanted to re-quote Ben Liddicott's statement for great truth.

Guys, you're totally missing the point if you think an outbound firewall does you any good. There are two things you should think about:

1) So I have an outbound firewall (hopefully) keeping the malware on my system from trashing anyone else's system. BFD: it has already infected me, and can trash my system at will. How stupid is that?

2) As Jesper so succinctly put it: Security belongs to the asset you are securing - not the *compromised* asset!(http://blogs.technet.com/jesper_johansson/archive/2006/05/01/426921)

Outbound firewall for security reasons = too little, too late. If you want an outbound firewall, please realize that you want it for privacy reasons (eg: prevent software from 'phoning home'), NOT as a way of preventing malware damage to your system.

Pat CahalanMay 31, 2006 5:43 PM

@ Bryan

> Outbound firewall for security reasons = too little, too late.

Not necessarily. You're over-generalizing.

Example: web server hacked by bot. Rootkit installed. However, rootkit unable to call home due to outbound firewall. Advantages: web server, although hacked, never becomes part of the botnet, local account information is not distributed, no additional information regarding the cluster or administrative processes is passed back to the hacker. Hacker could, theoretically, retailor his rootkit and bot, but in all likelihood you have time to respond before the machine is turned against you (or anyone else), or information that would enable successful attacks against other machines in the cluster is disseminated.

Outbound firewalls *do* provide defense in depth. Having the outbound firewall be outside the OS is even better.

John DavidsonJuly 25, 2006 11:30 AM

Investigation has shown me that Automatic Update facility is at the root of the problem, especially the manner in which it is supported within Microsoft through the use of ActiveX functionality. This facility allows downloaded content to switch content from the Internet Zone to the MyComputer Zone. This means that the extra overhead of these zones is absolutely useless.

Automatic Update allows companies to change the behaviour of their programs at will without the user knowing exactly what is going on. This is where a computer is really "owned", and is identical to the activity that a hacker employs when controlling a bot.

Automatic Updates appear to be a necessary evil. Witness the discussion about creation of white worms that go out and patch all unpatched systems when a black worm begins circulating. Insecurity of other computers on the Internet can only affect me through a 0-day attack, through a DOS, or by sending SPAM. ISPs should be required to quarantine computers within their network boundaries participating in a DOS. There are any number of reasonably effective ways of reducing SPAM below a nuisance threshold. Leaving only the 0-day attack, which by definition has no Automatic Update to apply. The percieved necessary evil only exists because the model used for Internet security is designed to make corporations money rather than to provide security. Only when those 'providers' of security services become legally liable will change occur.

WAP3July 25, 2006 7:31 PM

From all I have read to this point:
1) do VMware with CentOS host [Johnny, lead developer, lives where I do and I know him], and then do a *nix for web [non-safe] and 'Dohze if you have a few apps like I do [developer] that require it.

2) Welcome to the U.C.C.A - if you have been living under a rock for the last few years you need to understand that the U.S.A. is no more.
It has been replaced by the United Corperations and Churches of America.
The real product is the "stock" and the true customer is the "stock holder" -- get over it.
And for the "churches", just look at what the CongressCritters passed today Tue 25 Jul 2006, it all has its roots in the "religious right" for the purpose of salvaging the November Elections.

So, for the purpose of this forum -- vote with your dollars and ditch ALL the trash.

cynicalJuly 26, 2006 1:55 AM

There are many good thoughts and comments here. But many seem to me to miss the point.
The nature of hardware and software has changed. So has the nature of the users and their reasons for buying hardware and software.

In the early days of computing, companies made money by selling hardware and software to geeks. The geek market was - and still is - small. Today, hardware and software companies sell commodity products to a mass market. The goals and values of companies today are very different from those that sold to geeks.

If you are a geek, then you are bound to be disappointed buying from today's mass market oriented companies. They do not share your goals and values. They do see your computer as a powerful means to accomplish their business objectives. In an ever increasing number of cases, modern computer companies see your computer as a means to deliver product (i.e. motivated buyers) to their customers (i.e. advertisers). (Please see comment above). So they will use your computer for their purposes. Because it is legal and it makes them money.

The real problem, as I see it, is that GNU/Linux seems to have lost sight of the goals and values that got them started. Evidently, the goal has changed from having free and open software that can be understood and built upon by its users to *winning*. So we get ever more bloated, pritty but complex codes. Stuff that appeals to the mass market, stuff that trades reliability and security for features. Features that are rarely, if ever used.

It is hard for me to accept that the future of GNU/Linux is a platform indistinguishable from the current mass commodity market junk. Those are not my values and I don't want to go there. In absolute truth, I would willing give up the vast number of features that I never use to be able to hack the codes once again. Where is the fun or joy in reinstalling because the complexity makes fixes impossibly difficult?

Mass market producers' and consumers' values are not those of most geeks (or so I believe). A mass commodity market trusted computing base is not something a geek would willing buy or use. If GNU/Linux mimics the mass commodity market TCB then it will lose its geek base. If they are locked out by patents or whatever, this is a good thing.

Somewhere, perhaps China or India, some company will make a processor that doesn't include US sponsored trusted computing hardware. And has an ugly port of GNU/Linux. But ugly worked for me for years. It can again. After all, it was my ugly, and I loved it.

DrakazzJuly 29, 2006 1:57 PM

Hi,
seems like DRM is being planned all over the world by different organisations.

Just one thing I didn't understand - Internet services - I didn't receive any emails so far from them ;)

But you're right - on most things - you don't have a choice how to live :(

Elena NicemanFebruary 6, 2007 10:21 AM

Tagging, hacking, defacing, and virtually all vandalism is effortless to inflict, yet very costly to correct.

This makes the vandal feel powerfull and in control of an otherwise bewildering world they face.

Yet destruction is the most pathetic and weak form of communication they could have chosen.

Even a little self esteem can take someone that is a vandal like this, and make them a contributor. Or even an artist.

When you believe in yourself, anything is possible.

BrightStarApril 27, 2007 5:42 PM

If you hire or rent an employee in your home to do some work for you, and you find that s/he is releasing & deleting & blocking your works or part of it to & for her/his employer or somebody else, then that will be legal ? i dont think so, in fact, NO.
When Vista does something like that in my own computer inside my own home, then that will be legal ? NO.
Why our government is allowing such an illegal spyware to be sold in the market and allow people to fall in these traps ? The answer is , its not our govt, that is, its not protecting our rights, choice, but protecting corporations and groups, who are trying to abuse and take advantage of people.

BrightStarApril 27, 2007 5:54 PM

I've seen few modified (no-drm) vista release in p2p network, where the creator has removed all the DRM / TC spyware stuff out, but they need further improvements.
Anyone else knows of a tool software, that can take out all the DRM/TC spyware stuff/component out of the vista, 2k3, longhorn, etc and install alternative free stuff for those disabled/removed features ? ?
Or any other tool/software that allows to use the drm/tc or modifies it, to protect our own stuff ? instead of only theirs ?
thanks

jostJune 9, 2007 4:39 PM

"Just because computers were a liberating force in the past doesn't mean they will be in the future. There is enormous political and economic power behind the idea that you shouldn't truly own your computer or your software, despite having paid for it."

I think that's a brilliant comment that truly sums up the entire issue, not just with DRM or copyright law or any one issue. Of course it's true not even with computer in general, but what's happened to America. Greedy, immoral people want to own you and control your life, people who view you as an asset to generate cash, and will do whatever it takes to get as much money as possible. In the trauma of 9/11, domination of the media, and with the Republican rise to power, now they're finally able to.

It reminded me I recently read somewhere when television first was becoming popular people envisioned it as something being used to "englighten" and educate people, such as people could listen at a conference or university but at home. It would be used in some sense for democracy or to benefit society. Now we have american idol, Fox "news," stupid talk shows, and of course only a few corporations control all TV news and media. Perhaps when a new technology comes out, don't judge its probable influence by its most noble or democratic use. Rather how it will be used by people who want to make as much money as possible from it.

What ties things like net neutrality,the DMCA, and the like together is that it's all the clash of two opposing interests. One group doesn't want only a few people controlling everything, and would rather have digital technology used in a democratic and free maner. The other group that doesn't believe in ownership or fair use and thinks it's entitled to control of what you do and look at (since it's "their network" or you're not buying it, just licensing it) wants to turn the internet and computers in general into proprietary cable-type services where they can check up on you at will, restrict what you can do, and make sure you're not doing anything they consider inappropriate. The telecoms and government are probably already sorry they promoted the internet, and are now trying to turn it back and if not to find a way to make it another tool to consolidate wealth and power. Of course most tech enthusiasts don't tend to be drawn to this type of rhetoric, but maybe everyone who opposes this needs an NRA style "out of my cold dead hands" type slogan.

Fed upAugust 25, 2007 6:35 AM

"If left to grow, these external control systems will fundamentally change your relationship with your computer."
For me, they already have. Finding out that my new laptop has a (surreptitiously installed) tracking and control chip (yeh, dress it up however you like, I can tell spyware when it's slipped to me) I won't be accessing the internet from that machine. Combined with the "come crawling to us if your hard disk fails and we'll sell you another computer, we're not giving you reinstallation disks" attitude, the "don't worry about it, just let us install whatever we like on your computer, we'll be doing it without telling you and you'll have to spend hours trawling the internet trying to find out what's going on to stop it", the "let us pester you endlessly with popups and reminders to do things you have deliberately chosen not to do", the "we're not telling you anything about what we've installed on this machine and you can't have any instructions" and I'm not buying another computer, ever. Once the ones I've got die, that's it for me. oh, and I'm not a geek or a techie..... I am a fed-up consumer.

FeRHaDDecember 5, 2008 6:07 AM

So everybody should use Open Source. You can know what is inside your computer, but in any case you can't be sure who puts what in your computer.

ChrisJuly 8, 2009 10:55 PM

I wish I could post to the stuff on wikipedia (Which is how I got to your site!), but this is good. This "Tool", I mean that in the largest sense, is possibly a beta version on Windows XP. I HATE MICROSFT for this "Thing" they have created!!! I have lost thousands of dollars worth of material on my hard drive (Unless I can find some illegal hack, and get my stuff back.)

St CatOctober 14, 2009 8:24 PM

I wish I could post to the stuff on wikipedia (Which is how I got to your site!), but this is good. This "Tool", I mean that in the largest sense, is possibly a beta version on Windows XP. I HATE MICROSFT for this "Thing" they have created!!! I have lost thousands of dollars worth of material on my hard drive (Unless I can find some illegal hack, and get my stuff back.)

WhAT do you mean? Thers nothing that cant be extracted from a hdd...

DedektifOctober 29, 2009 3:03 PM

Even the article itself was owned (the Wired edition) by a huge advertisement of a major IT-vendor right over the text, which could only be removed by clicking on it.

şairMay 8, 2010 4:29 PM

Nice essay, i agree most things are known by many. But it's fun to read it, and it can set things in perspective for some.

Leave a comment

Allowed HTML: <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre>

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..