|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
ISSUE 19.04 • 2022-01-24 ON SECURITY By Susan Bradley Are we more secure now? It’s been 20 years since Bill Gates wrote the “trustworthy computing” me
[See the full post at: Twenty years of trustworthy computing]
Susan Bradley Patch Lady/Prudent patcher
Twenty years later, are we more secure? Do you feel more secure?
If the threat environment were the same now as 20 years ago, yes, I think we would be. However, the threat environment is not the same. It’s far more complex and pervasive than it was 20 years ago. Security is a moving target, so the question really is are we gaining or losing ground? Until and unless we get a handle on ransomware in all its permutations and variations, and data breaches in general, I think we are losing ground.
When I was a kid, the only real worry was whether the Russians were going to nuke us. That became far less likely when the Cold War (version 1?) ended. Now, it’s nut jobs and fanatics shooting up schools, houses of worship, store and shopping centers; diseases that can run rampant; (Many scares (SARS and Ebola, for example) but only COVID has lived up to the early concerns. On the other hand, the smart money says there were be more of these diseases.); climate change/global warming to name just three. And we just might be seeing the beginning of version 2 of the Cold War.
My point is threats are evolving and seem to be doing so far faster than defenses and counter-offenses can be developed and deployed. Also, the attack surface has grown exponentially as information technology has become more pervasive.
Lastly, with respect to Gates’ last bullet, the Facebooks, Googles and governments of the world have run roughshod over anything remotely close to what he wrote about.
I think it has been going on for some time now. If I’m right, then let’s hope that it stays cold.
So do the Ukrainians…
Bill Gates is a but if a hypocrite. I’m old enough to remember his “Open letter on piracy.” This from the man who was stealing computer time while still in high school. Now decades later, we purchase Windows (with no other viable choice) and he continues to charge us, to rob us. I love buying a $200 copy of Windows Pro from Microsoft. I am paying to have myself shopped, be bombarded by adware, malware and targeted ads – and now if you buy from the Microsoft store you are NOT given a software key to Windows but must “trust” Microsoft that if you have to reload the software they’ll recognize your machine and not have to buy the software a second time.
In my opinion Microsoft has created the pirates it initially complained about.
In recent months Windows has been flagging Macrium Reflect when I try to run backups. I have been able to get around it after some poking around with little confidence. It’s irritating that such a reputable package is flagged by Windows 10. Surprisingly, only the most recent time did it run without an intervention. Did MS fix the issue or did I get it set to pass by other means. ??
I also find it very irritating with the push to “finish the setup” after some system updates where MS trys to get me to log in to an account to boot my system. And, getting around it is not intuitive unless you have some history of MS workarounds.
Maybe “write your own Operating System” is not a very practical proposition, but yes, Macs and Linux PCs are also there, as practical options to running Windows. And with Linux on the same PCs as those running Windows, because one can even have both Windows and Linux in the same machine, installed in dual-boot. Not to put myself as a shining example, but I voted with my keyboard and mouse to begin to move to a Mac more than four years ago, and for the last two years have been a Mac user 100%. And since then, very rarely I have had to worry about what Apple is doing that might be bad for me. And in every case nothing terrible has ever happened.
The problem of security in computing, I think, ultimately is not that different if one chooses Windows, macOS, or Linux, because it is basically beyond what their developers can do to solve it for good, but with: (a) hackers that eventually either invent novel ways of compromising computers, or find a new variant of how to get around protective measures put in their way in the OS (something known as an “armaments race”), and (b) users that are not careful enough, or know how to be careful enough. This is not a judgement on the latter, by the way, but a mere statement of fact.
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV
It’s important to note that how secure you “feel” has little to do with how secure you “are”. Marketing has decidedly taken control of the “feel” and is using it to manipulate people into making decisions.
An OS could be FAR more secure in reality. All any of them would have to do would be to add managed and updated blacklists of “badware” web sites to keep computers from visiting, along with a working process to ensure mistakes get corrected. For the last 10+ years savvy geeks have achieved this kind of protection for free with things like various blacklists freely available online, browser add-ons like uBlock, etc.
Instead we’re continually led down the path of thinking “Malware will get into your system, let’s try to protect you from the inside”, which was, is, and will be always a losing battle. But it’s a battle that sells everyone on new hardware and changed expectations.
-Noel
not forgetting firewall rulesets, my preferred.
AFAIK, Smart Screen works with Microsoft Edge, but IDNK if it works with any other browsers. I used Firefox for a bit recently, and I did not see any security check on a file download, so I suspect that the answer is no.
Based on the Microsoft documentation I found at (Microsoft Defender SmartScreen Frequently Asked Questions), “Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge.”
I hope this answers your question,
Ernie
The downside with “throw everything at the problem” comes in when the computer’s performance goes down the tubes AND your usability tanks because you are sold this concept: “You just can’t have too much security.”
Computers from 40 years ago did useful things for us, quite often very quickly by comparison to the speeds our brains move at. Now they’re a million times faster and can store a billion times more data. Think about those numbers. Yet we still find things to wait for, sometimes for a long time. Why? Because they’re laden with inefficiency.
Something like 20 years ago I could copy a whole tree of thousands of files from one place to another on a spinning hard drive in Windows XP and the operation would complete interactively in an eyeblink, with the disk access light staying on a while after. How? RAM caching oriented to performance. Now copying or deleting ONE FILE on an SSD brings up a progress dialog for several seconds, even on hardware many times faster. Perhaps tens of thousand checks were made on that file to ensure it doesn’t contain malware. This is not real progress.
-Noel
he very unethically ripped off an acquaintance for it.
A matter of opinion, of course.
Tim Patterson was not coerced into selling the product. We may look at the transaction in hindsight and conclude it was not fair, but that fails to take into account the moment in time. I’ve met Patterson, and he did not seem bitter.
Besides his numerous contracts with Microsoft after the acquisition, Patterson worked for Microsoft for over ten years. I don’t know anything about his finances, but anyone working for the company during those periods would have done well.
However, this was before he had a contract with IBM and that $50 grand was pretty much a bet-the-company.
I think that is an apt description of the moment in time.
In some ways, yes, in other ways, no. Some of it, as noted elsewhere, is that security is a moving target, and it’s never as simple as a yes/no declaration, nor is it “set and forget”. We’re certainly more secure against the threats of 20 years ago, but there are plenty of new security threats that have arisen since then.
Security is always a matter of trade-offs of cost/benefit, and there will always be compromises that must be made among competing agendas. In Microsoft’s case, I don’t know that those agendas are well-defined (especially in what is communicated to the public), much less of having any sense of how the differing agendas are weighted in their processes.
If Microsoft was set to “default to security” as the first agenda point for any decision, they would never get anything out the door, and where they would spend all the time chasing their tails around arcane holes that have no realistic security risks. However, other agendas also have weight, and there are times when Marketing’s needs may take precedence over the needs of security.
To me, this is where Windows 11 falls over. Although Microsoft is promoting Win 11 as a security thing, and I don’t doubt that there are some good security features there, but I believe that Win 11 is more a product to satisfy Marketing’s needs to sell than customers need to buy.
A similar thing is the release cadence of updates, whether the monthly Patch Tuesday updates or the semi-annual updates. Marketing is what sets the calendar for those, and it’s very rare that something is significantly held up because internal processes reveal that the release is not ready. And it doesn’t help that Home users are involuntarily are used as testers (rather than more extensive internal testing). If testing was done correctly (including the ability to completely opt out of feature updates), then we would have far less need of the DEFCON system for evaluating patches.
On that point, I think that Microsoft fails miserably, in differentiating feature updates from security updates and bug fixes. Even at the best of times, we still have to reboot Windows too frequently. And if an update is disruptive, it *is* a security issue, because of the time spent diagnosing and finding fixes and work-arounds. And the state of January Patch Tuesday updates is especially bad, causing us to have to choose between an update that fixes known holes, but has high risk of causing problems.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
