|
Why hasn't Microsoft's security act been fixed?
#154339
04/15/23 07:57 PM
|
Joined: Aug 2008
Posts: 5,025
Az4x4
OP
Platinum Member
|
OP
Platinum Member
Joined: Aug 2008
Posts: 5,025 |
Microsoft Windows has been insecure since 1985. When 'Windows 1.0' was first rolled out it appeared as an extension or 'add-on', a simple GUI pasted on top of MS-DOS, not an actual OS in its own right.
So, why, we might ask, hasn't Microsoft been able to get its Windows security act together after all these years? It can't be that they don't know what it takes to make a system secure. Long before they cobbled 'Windows 1.0' together they were the leading vendor of Unix operating systems, up until the so-called 'Unix wars' and litigation that caused the loss of that market as a reliable income source for companies like Microsoft.
So what is it about Microsoft's Windows' and its 'cobbled together' development from 1985 to the present that has made it so irreparably insecure? ..The fundamental problem is that Windows, from its very beginning, was never meant to be used on a network. It still isn't today. It was intended to be a standalone PC operating system, one user, working on his or her own PC, doing things that didn't include networking.
We used Windows 3.11, 95 and 97 on our 'stand alone' work PCs with no networking in place, running them for years without problems. But once we set up networks and incorporated the new 'Internet' into what we were doing things changed, and not for the better.
Here we are, going on four decades later, and Windows keeps showing up with the same pre-internet problems that came 'built-into-it' back in the mid 80's, problems that still rear their ugly heads and cause havoc today.
Unix, the high water mark in secure operating systems, began with the premise that multiple users would have access to a system, so individual accounts above all needed to be secured. Linus Torvalds picked up on that premise when he proposed what would in time become 'Linux', beginning in the early '90s.
Microsoft itself was 'all in' on this Unix security first premise back in pre-Windows days. At that time they were 'top dog' in Unix system marketing. This basic Unix 'security first' principal has served Unix and later on Linux operating systems incredibly well, Unix in particular for a lot more years than Windows has ever been around.
Windows developers like to tell us they've rewritten Windows code from the bottom up to make it more secure. Actually, they haven't. In fact they can't. ..They claim for example to have patched zero-day remote code execution Windows Scripting Languages Vulnerability, CVE-2022-41128, a Windows JavaScript scripting language 'security hole' in Internet Explorer (IE) 11's JScript9 JavaScript engine, not too long ago.
This built-in vulnerability affects every version of currently supported Windows from Windows 8.1 (on the verge of its support being discontinued) to various Windows Servers and on to Windows 10 and 11, makes no difference whether IE is installed or not.
Once this built-in Windows vulnerability showed its ugly head, North Korean hackers immediately began exploiting it to flood South Korean and other users world wide with destructive malware. Google's 'Threat Analysis Group' (TAG), the group that uncovered this vulnerability some time back, had this to say about it:
"This technique has been widely used to distribute IE exploits via Office files since 2017. Delivering IE exploits via this vector has the advantage of not requiring the target to use Internet Explorer as its default browser."
Truth is, this vulnerability is a lot older than 2017. This same kind of problem was described in the now defunct magazine 'PC Sources' back in 1992, when it was found in 'Windows for Work Groups 3.1'. Then, same as now, Windows and its native programs treated document data as programming instructions. That's why, according to security experts, "Microsoft Office remains the most widely exploited software for malware delivery."
How bad is it, really? ..It's reported that 78.5% of all malware attacks come via Microsoft Office. However some will say, "Not my problem, I run Office 365." But that doesn't matter, they're both open to attacks.
The 'elephant in the room' is simply that Internet Explorer (IE) was retired in June 2022, supposedly replaced by Microsoft Edge. ..Why then are all current versions of Windows still vulnerable to these same sort of exploits in 2023? Isn't IE ancient history now? After all it was never part of Windows 11, was it? So how could it still be a problem there?
Even though Windows users are encouraged by Microsoft to think that way (for the sake of the corporation's 'bottom line), no matter what version of Windows they're using this flawed IE exploit remains so deeply embedded in Windows that to do anything about it other than apply band-aid like 'patches' whenever the wound starts bleeding simply isn't possible. The vulnerability is always there, ready to run JavaScript attacks on every Windows machine whenever conditions are right and users let their guard down, if even for a moment.
Windows' most fundamental security flaws have never been fixed, and they never will be. Backward compatibility for the sake of keeping users 'on-the-hook' is far more important to Microsoft these days than actual security, unlike the tune they were singing back in their Unix 'top dog' days. So today's Microsoft contents itself with playing its own version of whack-a-mole, something they call 'patch-a-hole' - with no end in sight.
If you see your PC's security as more important than Microsoft's flawed version of 'backward compatibility', running Linux is where you need to be. Despite what you may have heard others say, Linux isn't difficult to install, learn, and use - especially a modern desktop OS like Linux Mint.
For those who'd rather not go the extra bit it takes to download and install Linux Mint on their own PC, they can buy one of today's modern Chromebook laptops. Linux based Chrome OS is far more secure than any version of Windows ever will be, plus Chromebooks are incredibly capable and ready to go right out of the box.
I picked up a Google Pixel Chromebook at a local estate sale the other day, brand new, in the box, all the 'bells and whistles' that the best most modern Chromebooks come with. Felt kind of sorry that whoever bought it never got to use it. However the Price was more than right, and all I've gotta say is, "..Seriously, this is as impressive a PC as I've ever had available!" Straight forward, simple to use, does everything most users will ever need and so much more if you're willing to dig bit deeper, and does it flawlessly!..
Lots to learn about it just yet, but oh-my-gosh, this is a beast of a Linux based OS that Google has made into as slick a consumer PC as anyone markets these days. What I'm finding can be done with a top tier Chromebook like the Pixel is simply amazing!
Whatever you've settled on PC wise, Windows, Linux or otherwise, 'be safe out there on the net, whatever it takes'.
And of course, ride safely at all times, wherever you go!..
..FAILURE is not the opposite of SUCCESS, it's part of what makes SUCCESS..
|
|
|
Re: Why hasn't Microsoft's security act been fixed?
[Re: Az4x4]
#154340
04/16/23 03:43 PM
|
Joined: Jan 2004
Posts: 6,569
Muniac
Platinum Member
|
Platinum Member
Joined: Jan 2004
Posts: 6,569 |
Hi George - Thanks for the info and history. The market needs to solve the problems of quality, integrity and security. An educated consumer being the best customer. Many people have concerns about data mining, phishing and security. Especially when it comes to BIG tech. I can't comment on any PCs offered by Google as I've never owned one and probably won't. As for their products being ahead of Windows, I don't think that would be too difficult to achieve. I'd be interested in how updates are handled and applications are installed. As a Linux based O/S, I'm assuming all the freeware is available like GIMP, InkScape, Audacity, Kdenlive, KiCAD. FreeCAD, LibreCAD, Gparted, FileZilla, Blender, VLC, Timeshift, k3b, etc. Or are you funneled through Google's app store? Some programs that are very good like Media Monkey are Windows only. Is Virtual Box installable if you need a Windows O/S. I have two PLC applications (C-More & Pro-Suite) I need to run for a customer. These are Windows only which I've solved by using Virtual Box. Does Google require you to setup an account to use the PC? Do you have an HDMI port and USB 3.0? Also a camera and mic for ZOOM or other media recording. Just curious what's going on with newer hardware.
|
|
|
Re: Why hasn't Microsoft's security act been fixed?
[Re: Muniac]
#154343
04/16/23 10:31 PM
|
Joined: Aug 2008
Posts: 5,025
Az4x4
OP
Platinum Member
|
OP
Platinum Member
Joined: Aug 2008
Posts: 5,025 |
..Hi George - Thanks for the info and history. The market needs to solve the problems of quality, integrity and security. An educated consumer being the best customer. Many people have concerns about data mining, phishing and security. Especially when it comes to BIG tech. I can't comment on any PCs offered by Google as I've never owned one and probably won't. As for their products being ahead of Windows, I don't think that would be too difficult to achieve.. Certainly agree with your thoughts and comments, Scott. It isn't difficult to fault Windows insofar as 'quality, integrity and security' is concerned. What I've heard, but don't really know for sure, is that Microsoft has a project going that'll supposedly result in a full 'ground up' build of a complete new desktop OS. ..Of course these sorts of Microsoft rumors have floated to the surface every so often but have never born fruit, so I doubt anyone needs to 'hold their breath'.. ..I'd be interested in how updates are handled and applications are installed. As a Linux based O/S, I'm assuming all the freeware is available like GIMP, InkScape, Audacity, Kdenlive, KiCAD. FreeCAD, LibreCAD, Gparted, FileZilla, Blender, VLC, Timeshift, k3b, etc. Or are you funneled through Google's app store? Some programs that are very good like Media Monkey are Windows only. Is Virtual Box installable if you need a Windows O/S. I have two PLC applications (C-More & Pro-Suite) I need to run for a customer. These are Windows only which I've solved by using Virtual Box. Does Google require you to setup an account to use the PC? Do you have an HDMI port and USB 3.0? Also a camera and mic for ZOOM or other media recording. Just curious what's going on with newer hardware.. The Chromebook market is going great guns, but Google it turns out discontinued their super high end Pixelbook laptops in 2022. Google began pursuing other interests and reassigned their Pixelbook technicians to other projects. What I found once I dug a little deeper with this Pixelbook is that it's a 2019 model, an expertly refurbished unit the original owner purchased online, but unfortunately never got to use. With a fast i7 processor, 16GB of ram, a 512GB SSD and a FHD display I'm confidant it'll handle pretty much anything. Looked these refurbished late model Pixelbooks up online and found they're selling expertly setup and nicely packaged like this in the $450 range, exactly what I was told the buyer paid for it. I paid $150 for it and the lady was glad to sell it to me. Given its specs and the 'as new' condition it's in, it was a very good buy. It sold new for $1000, so whatever I end up doing with it well be $$ well spent. Exploring the many options available with Pixelbooks and new Chromebooks means there's lots to learn and a lot of different directions I can go with it. Should keep me busy for a long time to come! As of now it's online with my Google account and working great. I'll keep those who may be interested up to speed as time goes by and I learn more about these Pixelbook and newer Chromebook laptops..
..FAILURE is not the opposite of SUCCESS, it's part of what makes SUCCESS..
|
|
|
Re: Why hasn't Microsoft's security act been fixed?
[Re: Az4x4]
#154344
04/16/23 10:53 PM
|
Joined: Jan 2004
Posts: 6,569
Muniac
Platinum Member
|
Platinum Member
Joined: Jan 2004
Posts: 6,569 |
Hi George - OK, I'm gathering you're not far enough into the burn to answer my questions? If you're looking for basics like a browser session, just about any PC will handle that. As for a full on workstation, that's a different matter. As for high end mobile work stations, don't get too carried away with claimed processor power. I did a 10 second video animation in Blender which took 7 hours to render at 720p. That's on my Dell with similar HP to your Google machine. I have a second PC I use to crunch through these tasks. My beef with a Google PC is support, an account and available applications. Good luck with it.
|
|
|
Re: Why hasn't Microsoft's security act been fixed?
[Re: Muniac]
#154346
04/17/23 01:57 AM
|
Joined: Aug 2008
Posts: 5,025
Az4x4
OP
Platinum Member
|
OP
Platinum Member
Joined: Aug 2008
Posts: 5,025 |
..Hi George - OK, I'm gathering you're not far enough into the burn to answer my questions? If you're looking for basics like a browser session, just about any PC will handle that. As for a full on workstation, that's a different matter. As for high end mobile work stations, don't get too carried away with claimed processor power. I did a 10 second video animation in Blender which took 7 hours to render at 720p. That's on my Dell with similar HP to your Google machine. I have a second PC I use to crunch through these tasks. My beef with a Google PC is support, an account and available applications. Good luck with it.. It's a good looking well built laptop, which coming from Google shouldn't be a surprise. Apparently they priced themselves out of their own Chromebook market with these Pixelbooks. They were too expensive. Other Chromebook manufacturers started producing high quality machines at a lower cost, which left Pixelbooks still in their boxes on store shelves while other's Chromebook sales took off. Still, picking this Linux based Chrome OS powered Pixelbook at that give away price allows me to discover everything there is to know about these PCs, and that'll be interesting and fun! The reading I've done so far leads me to believe that setting it up to run Linux programs and apps isn't difficult. Once that's done if I can install Wine and run some Windows programs I'll be elated. Like I said, I'm just getting started and there's a whole lot to learn, so stay tuned. One thing's for sure already, this Pixelbook has a top notch 'look and feel' to it, equal in every way to my Linux Mint powered Asus, Lenovo and Dell laptops performance wise. So I'm anticipating the best as I learn to get the most out of it..
..FAILURE is not the opposite of SUCCESS, it's part of what makes SUCCESS..
|
|
|
Re: Why hasn't Microsoft's security act been fixed?
[Re: Az4x4]
#154347
04/17/23 02:56 PM
|
Joined: Jan 2004
Posts: 6,569
Muniac
Platinum Member
|
Platinum Member
Joined: Jan 2004
Posts: 6,569 |
Hi George - Good luck dealing with Google and Chrome O/S. It's a hobby so that takes time pressures away. My guess is the O/S interface has been made specific to Google apps. That Chrome is Linux based doesn't mean it's compatible with the freeware Linux environment we know like Mint. Something supported by a large tech company will undoubtedly be different from open source community support. You won't know how this plays out until you attempt installing something easily available from a Mint platform. I'd also guess Mint itself can't be installed on that PC. A bootable USB drive would answer that in a couple of minutes. Report back when you get deeper into this project.
|
|
|
Re: Why hasn't Microsoft's security act been fixed?
[Re: Muniac]
#154349
04/17/23 03:20 PM
|
Joined: Aug 2008
Posts: 5,025
Az4x4
OP
Platinum Member
|
OP
Platinum Member
Joined: Aug 2008
Posts: 5,025 |
Hi George - Good luck dealing with Google and Chrome O/S. It's a hobby so that takes time pressures away. My guess is the O/S interface has been made specific to Google apps. That Chrome is Linux based doesn't mean it's compatible with the freeware Linux environment we know like Mint..... Hobby machine for certain. No pressure to get it up and running the way I want anytime soon. That's good. Don't really 'need it' as a Linux work machine, and wouldn't want to experiment with it otherwise. Even if I end up turning loose of it sometime down the road I'm not worried about that either..
..FAILURE is not the opposite of SUCCESS, it's part of what makes SUCCESS..
|
|
|
|
Board Upgrade:
Board upgrade to V7.7.3 has been completed on Monday Feb 3rd 2020. Ride safely.
Enjoy the new software!
|
|
0 registered members (),
24
guests, and 2
spiders. |
Key:
Admin,
Global Mod,
Mod
|
|
Forums38
Topics16,761
Posts150,836
Members5,917
|
Most Online279 Dec 6th, 2019
|
|
S |
M |
T |
W |
T |
F |
S |
|
|
|
|
1
|
2
|
3
|
4
|
5
|
6
|
7
|
8
|
9
|
10
|
11
|
12
|
13
|
14
|
15
|
16
|
17
|
18
|
19
|
20
|
21
|
22
|
23
|
24
|
25
|
26
|
27
|
28
|
29
|
30
|
|
|
|