Monday, January 10, 2005
Why is Windows Not Secure?
A rant today by a person on the Universal Thread prompted me to search back through my blog archives to find something that I wrote on why Windows is not secure....at least I thought I had. I couldn't find it. So, here goes...
Windows security has nothing to do with some great consipiracy between Bill and his "cronies" as the UT ranter put it it. It has nothing to do with Microsoft and the US government to give the FBI and other security agencies access to your computer under the Patriot Act. It has nothing to do with Microsoft trying to push products out the door to improve the company financially. It has everything to do with the history of Windows and its prominance in the market place.
Windows is built on technology that was designed in the early 90s, when security threats consisted of people in your office gaining access to your computer. The Internet as we know it didn't exist. Microsoft pushed the concept of interoperability between application through the use of DDE, OLE and later COM and ActiveX. In order for these applications to interoperate, the OS had to provide an easy way for these applications to communicate. There wasn't concern about malicious applications. We weren't all interconnected like we are now. Applications started using these communications APIs to work with each other and as the applications grew more robust, continued to rely on these APIs. These same APIs still exist today. Why? Because applications still rely on them. Microsoft closed some of these APIs with Windows XP, Service Pack 2 and people complained when applications stopped working. It was not something Microsoft took lightly. The company struggled with the idea that these programs wouldn't work and knew they would get the blame. However, they were already blamed for security holes. To close more APIs would cause more applications to stop working. Damned if you do and damned if you don't.
So, what about Internet Explorer? Didn't I just say that these APIs were around before IE? Well, it turns out that IE 1.0 was introduced as an addon to Windows 95. Not many people used it, preferring to use Opera, Mosaic, or Lynx. But still, not many people used the Internet in 1995. It still wasn't what we know today. Then, in later versions of IE, Microsoft pushed for things like Active Documents to make the Internet more usable and allow web-based applications to use some of the same communications APIs that desktop apps had been using. This proved to be a big mistake as it opened security holes. (For a history of IE, go here.)
So, why can't Microsoft get things secure? Well, they are doing better, but have more to do.
I've personally heard from Microsoft executives including Bill Gates, Steve Ballmer, Jim Allchin, and others that security is a concern and top priority at Microsoft. And they aren't just giving it lip service. I've talked to people on down the line at MS and they tell me the same thing. Microsoft never said that Windows XP, SP 2 would fix everything. They never said that SP2 wouldn't have problems of its own. They only said that it would make you more secure...and it has. When a new vulnerability is discovered, it takes time to test things as the fix could close another API call and render that new $300 accounting package or your new game unusable. That's why it takes so long to get a fix out the door.
But, now we hear a new cry in the woods, "If FireFox can be secure, why can't IE?" Simple...FireFox doesn't carry all the historical baggage of IE. It's all new code. Can't Microsoft just write a new browser that will take care of things? No, not yet...we need some of the new technologies coming in Longhorn, the next version of Windows. The biggest thing there that will help is Indigo...a new way for applications to have communication between each other...and from what I hear, will be secure. Even better...you won't need Longhorn to use it. Inidigo will work on Windows XP and Server 2003.
I know you want a solution now...not 2-3 years down the road when Longhorn and Indigo are ready. I'd like a solution now too. In the mean time, use the browser of your choice, be aware of things that can increase your chances of getting malware, use anti-spyware and anti-virus software, and keep your system patched and up to date.
Windows security has nothing to do with some great consipiracy between Bill and his "cronies" as the UT ranter put it it. It has nothing to do with Microsoft and the US government to give the FBI and other security agencies access to your computer under the Patriot Act. It has nothing to do with Microsoft trying to push products out the door to improve the company financially. It has everything to do with the history of Windows and its prominance in the market place.
Windows is built on technology that was designed in the early 90s, when security threats consisted of people in your office gaining access to your computer. The Internet as we know it didn't exist. Microsoft pushed the concept of interoperability between application through the use of DDE, OLE and later COM and ActiveX. In order for these applications to interoperate, the OS had to provide an easy way for these applications to communicate. There wasn't concern about malicious applications. We weren't all interconnected like we are now. Applications started using these communications APIs to work with each other and as the applications grew more robust, continued to rely on these APIs. These same APIs still exist today. Why? Because applications still rely on them. Microsoft closed some of these APIs with Windows XP, Service Pack 2 and people complained when applications stopped working. It was not something Microsoft took lightly. The company struggled with the idea that these programs wouldn't work and knew they would get the blame. However, they were already blamed for security holes. To close more APIs would cause more applications to stop working. Damned if you do and damned if you don't.
So, what about Internet Explorer? Didn't I just say that these APIs were around before IE? Well, it turns out that IE 1.0 was introduced as an addon to Windows 95. Not many people used it, preferring to use Opera, Mosaic, or Lynx. But still, not many people used the Internet in 1995. It still wasn't what we know today. Then, in later versions of IE, Microsoft pushed for things like Active Documents to make the Internet more usable and allow web-based applications to use some of the same communications APIs that desktop apps had been using. This proved to be a big mistake as it opened security holes. (For a history of IE, go here.)
So, why can't Microsoft get things secure? Well, they are doing better, but have more to do.
I've personally heard from Microsoft executives including Bill Gates, Steve Ballmer, Jim Allchin, and others that security is a concern and top priority at Microsoft. And they aren't just giving it lip service. I've talked to people on down the line at MS and they tell me the same thing. Microsoft never said that Windows XP, SP 2 would fix everything. They never said that SP2 wouldn't have problems of its own. They only said that it would make you more secure...and it has. When a new vulnerability is discovered, it takes time to test things as the fix could close another API call and render that new $300 accounting package or your new game unusable. That's why it takes so long to get a fix out the door.
But, now we hear a new cry in the woods, "If FireFox can be secure, why can't IE?" Simple...FireFox doesn't carry all the historical baggage of IE. It's all new code. Can't Microsoft just write a new browser that will take care of things? No, not yet...we need some of the new technologies coming in Longhorn, the next version of Windows. The biggest thing there that will help is Indigo...a new way for applications to have communication between each other...and from what I hear, will be secure. Even better...you won't need Longhorn to use it. Inidigo will work on Windows XP and Server 2003.
I know you want a solution now...not 2-3 years down the road when Longhorn and Indigo are ready. I'd like a solution now too. In the mean time, use the browser of your choice, be aware of things that can increase your chances of getting malware, use anti-spyware and anti-virus software, and keep your system patched and up to date.
// posted by Craig Berntson @ 1:33:00 PM 
Subscribe to Posts [Atom]