Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Windows 7 UAC compromised
From: Valdis.Kletnieks () vt edu
Date: Thu, 05 Feb 2009 14:38:40 -0500

On Thu, 05 Feb 2009 14:17:32 EST, Jimmy Astle said:
               It all comes back to windows biggest issue, joe the plumber
shouldn't not be running as a local admin on his box. UAC problem solved!  I
still dont see how redmond missed the concept.

It's *easy* to see how Redmond missed it - they *intentionally* missed it.

You have to keep in mind that as a corporation, Redmond doesn't *really* give a
flying f**k in a rolling donut about your computer's security - they care about
their profits.

We all (including the Redmond guys) know that we could drastically reduce the
number of infections by making people run as non-admin and making it damned
inconvenient to install possibly untrusted software.  But if you care about
your profits, you ignore the 4,986 geeks who won't run it because it's a total
security mess, and sell it to the 193,472,415 Joe Sixpacks out there, and sell
it in a config that lets Joe install any damned thing, because Joe wants his
dancing hamster screensaver.

In other words, they'll fix the security problems *only* when they get so bad
that even Joe Sixpack (and his corporate counterpart Joe "ya want fries with
that" McSE) start insisting that Something Be Done.  And even then, they'll only
do as much as it takes to maximize the profits (you tighten it too much, and
you get double-whammied - tightening more costs more *and* loses you sales).

Attachment: _bin

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]