2009/2/6 Yudi Rosen <yr42.lists () gmail com>:
But Joe the Plumber doesn't want to have to click on endless
dialogs every time he tries to use the computer. Simply having
him run as a
non-admin user only fixes half the problem.
No, it doesn't fix anywhere *near* half of the problem; it doesn't
address that we have millions of people that use their computers
without knowing anything about them.
"But not every car driver needs to be a mechanic!" Yes, I know
but every driver needs to know that there are laws and rules
concerning how they drive and what happens when a 1200 kilogramme
hits a 100 kilogramme pedestrian at 70 kilometres/hour. Every
needs to know they need to have their tyres rotated and their oil
changed. There are things you must know beyond, "accelerator,
decelerator and steering wheel".
"But a computer isn't going to kill anyone if someone gets
a virus or trojan!" Yes, I know this, too, but if you're mixing
questionable software and surfing habits with online banking and
shopping, it's a recipe for destruction. Welcome to identity theft
empty bank accounts.
We can either continue to pretend like it's *only* really crappy
software or we can realise that it's a combination of easily
exploitable software, user ignorance and user apathy. You can give
them an operating system that has been vetted and been through
multiple code reviews by people that really do know secure OS
but they wouldn't be able to accomplish anything at all. So what
do? We give them operating systems that are less secure, hope they
don't shoot their feet off and turn them loose with it - but we
shoulder the burden of training them. Some of us do but we, as a
collective, do not. Until we can properly educate our users, all
are doing is trying to mitigate risk in the best ways we can while
still providing them a service. I maintain that by not educating
users we are failing in that goal.
Far better is it to dare mighty things, to win glorious triumphs,
if chequered by failure, than to take rank with those poor spirits
neither enjoy much nor suffer much, because they live in the grey
twilight that knows not victory or defeat.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/