Rick's b.log - entry 2010/11/07

Microsoft smells the coffee

I wrote a comment slamming the idea with respect to Microsoft, but this post either failed silently, or was deleted. Well well... Anyway...

After a good couple of opening paragraphs, with respect to "Cyber" security and "Cyber Threats" (I'm sorry, I can't take anybody seriously when they refer to "Cyber"-anything in a non-ironic sense), we start to see the dark vision appear:

This approach involves implementing a global collective defense of Internet health much like what we see in place today in the world of public health.

What exactly does this mean, "Internet health"? How does one define health on the internet? One person might define it as "no more porn", another as "no damn advertising", and Google might think all is healthy when their click-advertising is pulling in good revenue. To that matter, how does one call a computer "sick"? When it is misbehaving? Aside from actual hardware faults, computers only follow instructions. Sometimes even the major applications or the operating system itself can crash. Sometimes there is no reason or pattern. Is the computer sick? Or is this simply a quirk of the unimaginable amounts of code residing on the machine, crafted by tens of thousands of people, with more information than will pass through your mind in your lifetime whizzing around its digital circuitry every minute. It is a marvel of modern design, and sometimes a miracle it works at all. But those times when it doesn't, is it a quirk, an error, or sick?

Despite our best efforts, many consumer computers are host to malware or are part of a botnet.

Just as when an individual who is not vaccinated puts others’ health at risk, computers that are not protected or have been compromised with a bot put others at risk and pose a greater threat to society.

Greater threat to society? Wanting to fine people $$$$ for sharing a song, while saying that they cannot legally buy said song in their region, that crap like that flies is a threat to society. That we, in Europe, are restricted in what we are able to go as a result of American Software Patent law, is a threat to society; as are the patents awarded to ideas which can hardly be described as novel...

In the physical world, international, national, and local health organizations identify, track and control the spread of disease which can include, where necessary, quarantining people to avoid the infection of others.

Simply put, we need to improve and maintain the health of consumer devices connected to the Internet in order to avoid greater societal risk.

The risk that botnets present to Internet users and critical infrastructures must be addressed.

Collective defense can and should be used to help improve the security of consumer devices and protect against such cyber threats.

A public health model can empower consumers and improve Internet security.

Voluntary behavior and market forces are the preferred means to drive action but if those means fail, then governments should ensure these concepts are advanced.

Privacy concerns must be carefully considered in any effort to promote Internet security by focusing on device health. In that regard, examining health is not the same as examining content; communicating health is not the same as communicating identity; and consumers can be protected in privacy-centric ways that do not adversely impact freedom of expression and freedom of association.

For its part, Microsoft looks forward to continuing to provide and promote research and development that will make system scanning and cleanup more cost effective, along with looking to solve current technical barriers. We will also advocate for legislation and policies worldwide that help advance the model, but does so in a way that advances principles supporting user control and privacy.

I accept that things are improving with Windows 7, however XP is the most deployed at this time, and Microsoft missed a HUGE opportunity with the transition to XP.

Why?

XP was different enough to earlier builds that it pretty much required new drivers to be written. XP introduced security rings in order, pretty much, to protect the system from itself. Little concern was given to external security, so we had:

• An operating system that created a default user profile that had full admin access.
  This epic fail has led to a number of drivers/programs that, quite simply, will not work unless you are an admin (try installing Flash, for instance).
  You could, of course, say this is a fault of the people releasing the drivers, and that is true. But Microsoft missed an opportunity to enforce decent user access rights.
• The group admin policy stuff was considered a tool for the "professional" user, and as such how can you tweak what a user can and cannot do? For example, the "admin" is too permissive, while a "limited" user is too restricted. I would like, for instance, to be able to alter my system clock and set up various desktop-related options and rights, while blocking applications from messing around with \Windows or important parts of the system registry. Is this possible? Honestly, I do not know. I run as an admin and I take great care in what I let pass into my machine. It is not a good solution, but it is a solution that works better than being a limited user, for that is too restrictive. But, I am at risk of a rootkit being able to install itself, due largely to Microsoft's inability to understand what users actually need to do while remaining protected. And this, dear friends, is how botnets operate. A little bit of very clever software installs itself at a very low level and sits, in the background, virtually undetectable. And how does it get there? Microsoft's "admin-by-default" policy.
• The Windows firewall is yet more fail. Firstly, you can ping a Windows box. While this makes it simple for testing a LAN is hooked up correctly, it does show that the machine is present. A proper filewall will not respond to any communications (at all) unless it has been specifically permitted for exposure. The grc.com "Shields Up!" test for the common service ports should show all green - if it does not, there is a problem.
  But an even bigger problem is that the Windows firewall does not even attempt to block outgoing connections. I just reset my firewall to its defaults and loaded up my VeroDes, which attempts to connect to heyrick.co.uk to see if there is an update. Which it did, with no warning from the Firewall. The only time the XP firewall asks you anything is when a program wants to open a port for incoming connections. Which is, frankly, not a lot of use for those who have software wishing to "phone home" what it finds. Indeed, while a botnet typically opens a port and awaits instructions, it would be trivial to write a program to fire a "what should I do" request every hour, and this would completely bypass the default XP firewall.
  What we need to see is the following window pop up for every application that makes a socket connection, regardless of direction...
  
  
  And, to be brutally honest, until the Windows XP firewall is capable of even performing such a basic task, I'm afraid I just cannot take anything Microsoft says about security seriously.

This, however, is not taking into account alternative issues, such as:

• If you are banished from the Internet...
  ...how do you go to look for information on what is going on? Wait, hang on, you only have what - if anything - the organisation blocking you decides your are able to have. Furthermore, if one computer behind a router is "sick", will that IP address (and any other computers) be blocked as well? How do you prove your machine is "healthy"? What recourse if your OS is in any way unusual and the remedy you are deigned to access does not work, or is loaded with advertising and such and you don't want to install it, or it makes things worse? This will, I assume, also block your access to basic services (news, weather, emails/forums)? Do we not have a right to the communications channel?
   
  
• We are starting to see a potential class war
  For no doubt any of these provisions will not be free. One of the main reasons I have never gone to Windows 7 is that I just cannot justify the cost for what is, to me, a redesigned XP. Does Win7 bring orgasmic new features? No, not really. At least, nothing I can justify nearly a week's wage on buying. For only marginally more than the cost of a Windows 7 licence (and no, not the crappy "basic" version), I can buy a completely new eeePC (with XP...). I think I know which I would find more useful, as it comes down to "new OS or whole new computer". Gee, that's a hard one...
  Likewise, I cannot imagine any government or commercial enterprise around will manage "computer health" for free, so we will start to see a situation where people cannot afford to do that which is necessary to permit them to go on-line, while the affluent just rack it up as another thing to use as a tax deduction. All of this because the so-called professionals created a vulnerable system and now act shocked at the fact that it is attacked. Did anybody notice there were no figures in the original posting? Maybe Microsoft couldn't face the bleedin' obvious - but to me it is mindblowing that the company that is most directly responsible for the widespread deployment of malware now wants such machines kicked off of the Internet. This post surely belongs on April 1st?

There is a technical approach that could be implemented at the ISP level. Botnets need somewhere to call home to, and (depending on technology) they may use specific ports. Well, the ISP is your "portal" to The Wired and it is one of the few places in the entire Internet structure where your connection can be completely monitored.
Thus, a solution that could work is to block IP addresses of botnet controllers, and also block specific ports. An example of this in operation is that on my Orange network, it is simply impossible to connect to the SMTP port on any machine other than orange.fr. I don't know why they bother, since I sent myself an email from "god@hea.ven"... but I digress, it shouldn't be difficult to maintain a list of bad IPs and bad ports, and block them.
To be honest, since this can be used against BitTorrent clients (that suffer the weakness of needing to translate to a "tracker"), I'm surprised it hasn't been implemented already...

Virtual Woman

Seriously, the things I had to say to get her willing to strip (what, right in front of me? in public? are you kidding?) really would have enticed a real girl to slap me. Hard.

So I tried a new girl with a different approach:

Do you think I look fat?
Yes.
Seriously, you can be honest about how I look. Sometimes I think certain outfits make me look dumpy. Do I look like I need to lose some weight?
Yes.
Let's talk about something else.
No, you're fat.
Well, I don't obsess about my weight, but I do try to keep fit. I just don't get crazy about it like some girls do.
You should obsess, you are a giant balloon.
Why are you interested in whether or not I am a giant balloon?
You're fat, ugly, fake, and you have the lamest parser I've ever seen. A schoolchild could do better.
Teachers and I never seemed to get along.
You belong in an asylum.
Are you talking about me?
Yes, bitch, who the hell else is here?
I can tell where you get most of your dates.
I don't care what you think, in fact, **** you.
That's great. I think I see a cute guy over there I'm going to talk to.

The lesson here? It is harder to annoy a chick than to get her to show me her panties. Hardly realistic, huh?

Helicopter?

Getting the budgie in trim is not so easy, especially as it seems also to depend upon battery charge (the two rotors are driven by independent motors). Sadly this is something of an issue, offering 5-10 (not actually timed it yet) minutes of flying time on a charge. That's some battery abuse going on there!

I tried again at night with the outside lights and it was pretty fine. I was able to get it to a pretty steady hover, stable enough that I could reach up and have it settle down onto my hand. It still drifted, slowly, on account of the barely-perceptable breeze.
Here is the helicopter hovering at a height of about two metres:

The main problem, I feel, is that the tail rotor (forward/backward) is barely capable of pushing the helicopter around. In fact, it is more inclined to make it start to spin. I fixed an AA battery to the rubber skids to throw off the centre of gravity to make it inclined in the forwards direction, but amusingly this didn't appear to make much difference! It'll be nice to know if there's a bit of "play" in the centre of gravity, as this means I could be more flexible with any camera I hook up.
You need to go up about 30-40cm to clear the worst of the ground effect:

I might see if the field barn is enclosed enough I can fly it in a wind-free area, but I am wondering if, when I play with the camera, it isn't a case of going up and hoping for the best. The main thing, I guess, will be to trim out the tendency to spin, and then just point it in the direction of interest.

One of the really dodgy things is if the battery runs low, the motors will just cut out. And without the wind beneath, it has the attributes of a lead balloon. So you really only ought to take it high off a fresh charge. Because I was flying at a height of about two and a half metres (to clear the washing line, that I could not see (it was night, remember)) when it just gave up. And fell from the sky.
The most amazing thing? The little walnut tree poked a branch in the tail boom support and caught it (!wow!), with a branch in the landing gear just to be sure!

No doubt I'll play more. With or without piccies. ☺ That said, I think the last battery charge took around two hours. Ouch! It is 3.7V at 1000mAh. I wonder if I can find a cell with greater capacity? In theory a 2000mAh cell ought to offer around a quarter hour of flying time. Perhaps one of these?

Your comments:

Please note that while I check this page every so often, I am not able to control what users write; therefore I disclaim all liability for unpleasant and/or infringing and/or defamatory material. Undesired content will be removed as soon as it is noticed. By leaving a comment, you agree not to post material that is illegal or in bad taste, and you should be aware that the time and your IP address are both recorded, should it be necessary to find out who you are. Oh, and don't bother trying to inline HTML. I'm not that stupid! ☺ ADDING COMMENTS DOES NOT WORK IF READING TRANSLATED VERSIONS.
 
You can now follow comment additions with the comment RSS feed. This is distinct from the b.log RSS feed, so you can subscribe to one or both as you wish.

No comments yet...

Add a comment (v0.11) [help?] . . . try the comment feed!
		Your name
		Your email	(optional)
		Validation	Are you real? Please type 16898 backwards.
		Your comment