Point 1 above will never happen. Users don't WANT to be educated. They want things to work and since they pay hard-earned money for it, they expect it to. MSIE doesn't (at least not when presented with 'unexpected input' which is what to expect when you encounter the works of certain belligerent or recalcitrant fellows). This is why it carries malware by the wagonload into the homes and offices of end users.

As some other users already have pointed out, the reason MSIE is broken by design is that it is the designated application for handling both the local filesystem and internet access, which means remote execution of code will be possible as long as LOCAL execution of code (running programs) is.

I've never understood why people happily accept purchasing and installing (often expensive) anti-virus software and personal firewalls just because the OS and most of its components are broken by design.

I've been running Linux on the desktop for the past 8 years, most of them on a public IP without masquerading or anything. I've never had a firewall or antivirus software installed, and I've never had a malware-, virus- or otherwise "evil person"-related problem. Ofcourse, I've never had IE installed. Could the two be connected? *ironic*


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/249/26855#26855