Roy Schestowitz wrote:
> Security watchers lambast Vista
>
> ,----[ Quote ]
> | Windows Vista has only just left the starting blocks but security
> | watchers have wasted no time in challenging claims that it provides
> | improved security defences.
> |
> | Virus Bulletin, the independent security certification body, has
> | revealed that Microsoft's own anti-virus product, Live OneCare, is
> | among four anti-virus testing products that failed to reach the
> | standard required for approval. McAfee's VirusScan anti-virus
> | software also failed the tough VB100 certification process. Eleven
> | of the 15 products submitted passed the tests.
> |
> | [...]
> |
> | While Vista contains a number of security improvements, notably
> | better anti-spyware defences, additional protection is required.
> | "Although many improvements have been made, Vista cannot fend off
> | today's malware without help from security products," Hawes added.
> `----
>
> http://www.theregister.co.uk/2007/02/05/vista_security_criticisms/
>
That is bad news.
The machine I mentioned earlier today, my brother in law's XPVista, it comes
with Symantec security. Symantec seem to have lost some of their bloat, but
of cause some aspects of security have been taken up by MS so the third
parties should be able to concentrate more on other areas. But I did feel
better about that side simply because Symantec were on there, I trust
Symantec, not with my wallet nor with my real address and phone number on
the registration page, but I trust them to secure my users PCs.
You do get a lot of pop ups from the system as you go along saying
'something is trying to get communicate with the web', or 'something wants
to load an ActiveX'. The problem isn't so much the messages, but the fact
that home users do not know which of these they should allow and which they
shouldn't, I was tempted to say 'no' to a few of those to see what would
happen, but it wasn't my computer. But really there wasn't enough
information on the screen to make a decision. 'MSM is trying to
communicate...', well MSM IS a communicator so of cause users will say
'yes', then will get bored with always clicking 'yes' and look for a way to
automate it. 'This web page is trying to loads ActiveX-something', well is
it a good thing or not? How do I know if this web page can be trusted?
The control of these things I think has to come from elsewhere. I know MS
want everyone to register every control, and maybe there is merrit in that,
but these controls on Saturday were MS's, specially in the first hour or so
when he was setting up his MSM and the first launch of main applications.
Would it not be possible for MS and others to pass the signitures and CRC
of their controls to the security vendors so that if your pattern files are
up to date then the security software itself can decide which controls are
safe and which are not? I don't think that would be so difficult to
implement.
Of cause they would be moans from those who want to allow on-the-fly
controls. They can do that, all they have to do is disable the security
while it comes onboard, it's they choice as to whether they take that risk.
I think that many more users would prefer a trusted partner to control that
risk for them.
|
|
