I’m not going to opine on the validity of this discovery, but I’ll throw in my two cents on the Slashdot commentary.

Some folks noted that when they receive their machines, they immediately reformatted the drives and reinstalled (or installed alternative) operating systems. When I was part of the Windows world (using Dells) I did the same, never quite trusting the factory install. And I always had a retail (or MSDN Universal Subscription) version handy to do it.

Do all Windows machines come with manufacturer images nowadays?

Brian Krebs notes after extensive individual study that Internet Explorer was unsafe for 3/4ths of the year during 2006.

While I applaud Brian’s efforts, I doubt that comes as much of a surprise to anyone. What is, however, a little shocking is the fact that for more than 3 months out of the year (not necessarily concurrent), Microsoft was withholding (or just didn’t have) solutions for flaws that identity thieves were actively using in criminal pursuits. Actually, that’s no surprise either, so I’ll move on - but kudos to Brian first for pointing it out to everyone else!

When you buy a car that is similarly screwed up, one of several things may happen:

• The dealer denies responsibility over and over while portending to fix things under the vehicle’s warranty. Then your ex-girlfriend marches into the showroom and calls you from her cell phone, screaming bloody murder into your ear (and everyone else’s in the showroom) until the general manager hands out a new car (and you have to find a dealer in another state to handle your service, since the present dealer now hates you so damn much). Yes, that happened to me (or an ex, that is), and even though we are no longer together I still think that was a pretty killer move on her part.;
• You hire a lawyer to assist you in enforcing some state lemon law, and after enormous time and expense you get a new car (and you have to find a dealer in another state to handle your service, since the present dealer now hates you so damn much);
• Your vehicle fails to perform, in a catastrophic way, when you least expect it. You crash. You get hurt really bad. You may very well hurt others really bad. Everyone hires a lawyer. After enormous time and expense, the court finds the big manufacturer at fault, and everyone gets compensation.

Now, to my point…

Regarding IE (and Windows in general) - unfortunately for it’s users, there is no lemon law. I believe the cute little EULA (which nobody reads), takes care of that. Instead, it has failed, catastrophically.

• How much damage has been done to innocent bystanders - those who don’t read the EULA because they’re simply running something else (I suspect the EULA covers passersby like corporate employees and friends borrowing the computer, but I’m not taking the time to install Windows just to find out)?
• How many people have had to hassle endlessly with spam, as a result of some friend’s desktop contact list being pilfered via virus infection?
• How many identities have been snatched as a result of the same?
• For that matter, how many servers running business critical application on alternative operating systems accessed by alternative browsers have been crashed by floods of spam and DDOS attacks originating from zombiefied home computers?
• How much time and money has been spent direct protecting one’s self against these indirect threats?
• How much time and money has been wasted correcting the mistakes of others?

Where the hell is a screaming girlfriend when you need one?

Microsoft issued a record 26 security patches yesterday for its operating system and ancillary softwares.

I’ve said it before, but I’ll say it again - it sucks sometimes to be a Windows user, but yesterday that was especially so. Not only did folks have to patch the hell out of their systems, but the update system itself was acting like it was in need of a patch.

The debate continues, even though many say the Mac is only less susceptible to malware because there are less Macs in the world. Tom Yager provides more “guts” on the matter.

No judgement here - I just want to hear those security through obscurity comments from Windows users again.

The Department of Homeland Security announced that you should patch your Windows systems right away.

Yes, the folks that fail miserably on their own cybersecurity are telling everyone else to get on the ball.

So, when you see that little “Updates” popup in the lower right hand corner of your screen (you know, the one that appears each and every time Microsoft issues patches), pay attention this time - a wise and wary group of governmental types say so.

Boy am I glad I read the news the morning, even if I am on a Mac.

***UPDATE***

A suggestion: If the government will pass a law stating that if an employee of an organization (including bureacracies) leaves a laptop in a parked car (or unattended in any other public place for that matter), and it gets stolen, the employee must be terminated immediately. In return, all citizens will then listen to government warnings about computer security threats.

Sophos just released their latest Security Threat Management Report, and the news is not good for all. Viruses are waning, but malicious malware designed to steal you blind (say financially-oriented trojans) is up dramatically. The Sobers and Netskys of the world still lead the charge, but the face of deliver is simply changing.

Then, in the wake of this news, Sophos (who I feel generally maintains an unbiased reporting approach in order to preserve their credibility), adds the following footnotes to their distribution charts:

For malware…

All of the above malware works on Windows; none is capable of infecting Mac OS X.

and their families…

Again, all of the above malware works on Microsoft Windows; none is capable of infecting the Apple Macintosh operating system.

They go on to say…

“It’s more vital than ever that all organisations use an integrated security solution to protect against intrusion, as well as blocking known and unknown malware. On top of this, hackers seem happy to primarily target Windows users and not spread their wings to other platforms. It seems likely that Macs will continue to be the safer place for computer users for some time to come - something that home users may wish to consider if they’re deliberating about the next computer they should purchase.”

This couldn’t be much more timely. I was recently accused of being a well-crafted shill (for OS X, despite the fact I generally promote Linux side-by-side), and a “clueless machead.” Well, let’s just set the story straight.

I was a Windows user since the days of 3.1, moving to 95, then migrating carefully along the NT-based set. I never got an infection (I spent a hoard of money on protective mechanisms), but since I put my machines through their paces, I saw the “blue screen of death” on numerous occasions. Then I stuffed Linux on my Dell laptop, and I was hooked. My “in-the-know” friends lent a helping hand, while my less inclined colleagues continued to struggle with Windows. I found freedom to do what I wanted with my desktop - but it took time. The ensuing months found me spending more and more of my work day on the Linux side of that tricky little dual-boot, dual-drive Dell, even though that work day was primarily financial in nature.

Then one day, I get handed a Powerbook - told to toy with it on a rainy weekend. I did, and what I found was the best of both worlds, so I bought one myself. I’ve stuff a fresh database server on it, used it to test web apps, compiled Gimp and Ethereal for it, and hoards of other half-fun, half-needed things. And I’ve even protected it with anti-virus software (mostly to prevent passing something on to others). It has never crashed to memory dump or been infected, and I can (surprise) still use it to send email, build financial projections, and write letters. And, Linux is still the platform of choice when bringing a server up.

I can’t help but be biased now, but I’ve put in the hours. I promote OS X because the shit works, and I hate seeing my friends struggle (and I hate reformatting their Windows machines, and reinstalling XP, too, although I do it anyway). I’ve gotten numerous people to switch to Linux (and if it had training wheels, they would have probably stayed). Only one migration to OS X as a result of my preaching (due mostly to cost), but it has stuck. Put in the time, or fork up the dough - both are fine by me.

I don’t own Microsoft or Apple or Red Hat stock either.

***UPDATE***

Regardless of what’s really the case, a battle ensued over at Slashdot, and the arguments were top notch.

It’s being touted as a “kind of safety switch” but it is about as lame an excuse as I have heard in a while. Windows Genuine Advantage, Microsoft’s program for controlling piracy, has your computer running an undisclosed daily check in.

Now you’d thing that once you validated/registered your software you would be home free. You’d run the auto-updates if you liked, and if you kept a tinfoil hat on you could shut those off too (although I hope you’d run them once in a while, if only on your schedule).

David Lazar, director of the program noted:

“We’re looking at ways to communicate that in a more forward manner”

…after being questioned about why it wasn’t disclosed in the EULA.

Now’s as good a time as any, Dave, since you have just been called out.

A proof of concept has been released for a virus that can affect both Windows and Linux machines.

As those systems are attached at the hip, with the majority of desktops running Windows and a slew of servers running Linux, this is not good news.

***UPDATE***

Word has it there isn’t much too this.

***UPDATE 2***

And Linus Torvalds creates a patch, at least for the Linux side of the threat.

I wonder what Michael Dell and Kevin Rollins are thinking right about now. I doubt Bill Gates is upset though.

Malware attacking Windows computers has become such a big issue that Microsoft itself is suggesting the only solution might be a complete hard drive wipe and OS re-install.

Usually I’d say move to another OS, but in this case I won’t. Anyone who knows their Windows machine well already realizes that a wipe/re-birthing every six months to a year is the only way to keep the machine from slowing to a crawl anyway.

The process which I once endured twice-yearly took roughly four to six hours, depending on apps and the availability of hard wired internet access. I suggest wiping clean by deleting partitions and reformatting. Then install operating system and service packs first, base applications like Office next, and then firewall/anti-virus/anti-spyware. Go after third-party apps to wind things up.

Brew some coffee before you start, and get some nice music or a movie playing. It is a pretty boring, often non-interactive process, so you’ll want some distractions.