Security and your mother's Linux box

Page 2 of 2:

Page 2

LXF: Because nobody's going to block the whole of Hotmail, or whatever it is?

RA: Hotmail isn't that bad, but you could think of one or two of the big British ISPs, that I won't name for libel reasons. If you send mail to abuse@ one of these companies dot com, nobody will read it. You might as well complain to the spammer himself, for all the good it will do.

So the proposal that we have [Anderson recently completed a report for the European Network and Information Security Agency], is that if you complain to abuse@ somebody or other dot com, and more than three hours after that, you get more phish or spam from the same infected machine, then you should have a legal right to claim €10 from them. No need to prove malice, no need to prove actual damage, just "here's the bill". A similar scheme has largely sorted out late flights, cancellations and overbookings among cheap airlines in Europe, because now you get €250 EasyJet or Ryanair bump you off the flight to Barcelona. You don't have to produce a whole bundle of hotel bills and car rental vouchers and argue the toss, you just send them the bill. If they don't pay, you go to the county court, and if they still don't pay, you get the bailiffs to go and collect – believe me, I've done it!

RA: The poor boys at Redmond are doing what they can, but they've got an enormous mountain of legacy codebase to deal with. Although they are beginning to do some semi-sensible things with Vista, in terms of not having users run as root all the time any more, this breaks so many applications that it's hard to get much traction. You end up with this learned helplessness phenomenon, whereby people are trained to keep clicking away these annoying dialog boxes that say: "Do you really want to override this? Do you really want to dismantle your security? Do you really want to run as root?" blah, blah, blah. They have to, to get their work done. That's a fundamental problem of the whole [software] architecture.

From the point of view of a user who's only going to use the PC for web browsing, word processing and one or two other simple tasks like that, the best solution is to move to an alternative platform. The big opportunity, which some Linux distributions are now obviously seizing, is to produce Linux PCs and Linux laptops that just work, which don't need anyone to know what a Tar file is, let alone how to compile stuff.

Current page: Page 2

Prev Page Page 1

TOPICS