Hi Paul, Am Di, den 20.01.2004 schrieb Schmehl, Paul L um 17:01: > But the *real* problem isn't the OS, it's the users.
Actually, that's wrong. Users are never the problem. It's always the software. When a user doesn't understand something, then there's a problem with the software, not the user. When a user doesn't operate the software in the way the developers intended to, then there's a problem with the software. Customer is king. Always. Why should every single user on earth have to worry about virus updates, personal firewalls and so on? They want to USE a PC not secure it. Any attempt to deliver software in a state as secure as possible without cutting too many features must be welcomed. Any practise where software is delivered "with open doors" should be considered a fatal flaw. When a user has to act in order to deactivate features he doesn't use that are potentially dangerous then this is wrong. There shouldn't be any "opt-in" into security. If individual users discover they need an additional feature of their software that adds to overall risks then let those individual users find out how to do that. That's education. Not the other way around. If they have to do something on their behalf to use risky features that the majority doesn't use, then they actually educate themselves in the process. If you want to have a webserver running on your box, then it's better there isn't one by default and the user has to find out how to enable it and how to enable it SAFE. The majority of users who don't, won't have to care about this. Users should always have to "opt-out" from the more secure setting into the risky setting. The "anti MS" drive IMHO results from the fact that MS has practised "opt-in" into security far too long. One of the most striking examples giving evidence to this is the fact that _AOL_ had to shut down the Windows Messaging Service on its clients PCs because clients were complaining about receiving unwanted ad messages that way. I find it very striking that this feature seems to be activated by default in an OS that is aimed at the end user, a single connected machine connected to the Internet by mostly a modem or some other form of dial-up connection without something in between. Delivering an OS with such a feature enabled leaves millions of users to disable that feature while only a minority actually makes good use of the feature. This is just one example of many. The Blaster worm is yet another example how "opt-in" into security fails. Why do private, single connected machines to the Internet use an open RPC port by default?! Obviously there hasn't been a real use to it for most end consumers because the recommended Personal Firewall just shuts it down. Why has it been enabled for millions of end users by default? Just because this is a feature that may be used in a certain scenario inside LANs? Again millions of end users who don't know about "RPC what?!" had to act to "opt-in" into security. This stinks. THIS is why MS is drawing so much bad attention here. It's not because people don't like the colours of Windows XP around here or because of the idea that Windows is not a good OS. It's about "opt-in" into security. And the blame goes on MS for this. Nobody else. cheers, Tobias W. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html