Vendor at fault? Well, yes, in a way. However, the vendor you mention, Microsoft, is not alone. I would hazard a guess that any general-purpose OS has similar problems.

The problem lies in programming methodology, in computer architecture and, as the article mentions, in the users.

There is no simple answer, but the fact is that vendors (of hardware, software and communication services) provide what I would like to call "heavy machinery" to untrained people. The heavy machinery is unsafe to operate if you do not know what you are doing, but professionals can leverage its power and really accomplish fantastic feats.

Is it possible to reduce the danger of using equipment you don't understand? Can the behaviour of a general-purpoase computational device be made sufficiently deterministic to make unwanted actions nearly impossible? Can this be done while still providing the power and flexibility we have come to expect?

If the current state of affairs persists I believe it might be worth looking at somewhat regulating computer use, ie you have to have received some training before being allowed to even buy a computer. Yes I think it's that serious! It's obvious that the large majority of people just don't get it and in some instances just can't get it (thus they should not be allowed to use computers).

On the other hand, the fact that clueless people connect to the Internet without rudimentary safeguards (and they allow their even more clueless and immature kids to use it as well!) will likely force vendors to place safeguards in software, hardware and communications services to reduce the effects of clueless actions. It will be interesting to see whether the result is more secure operating systems and software (using better programming techniques) or if it will result in locking down what all users are allowed to do...

Will engines be throttled or will people start to drive responsibly?

(Admittedly this car and machinery metaphor is a bit silly as PCs are most of the time more complex to operate, but it will do...)

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/236/26059#26059