Warp <war### [at] tagpovrayorg> wrote:
>   The DOS/Windows design always took basically the exact opposite approach:
> Whatever the user wants to run or do, the OS allows. It's not the system's
> task to stop the user doing what he wants. Unfortunately it took over 20
> years for Microsoft to rid itself of this mentality

  I think the quintessential example of this are email viruses.

  If in the mid and early 90's you had talked about "email viruses",
especially to unix people, they would have laughed. Well, the very
concept *should* be equally laughable even today. The very concept should
be as ludicrous today as it was in the early 90's. Advise like "never
open attachments from emails sent by unknown people" should not have to
exist.

  However, then came Microsoft. Some people today might not realize this,
but the first email viruses didn't actually exploit any bugs at all. They
just abused Microsoft's software design. Back then Microsoft's ideology
was still the antiquated "whatever the user wants to do, do". This included
"if the user wants to open an email attachment and watch it in the way as
watching those files has been configured in the system, do so". And yes,
if the attachment was an executable, it would be executed by simply opening
the attachment. This was *by design*. It was not a programming error (at
most one could argue it was a design oversight).

  As said, Microsoft is, for some reason, quite slow at learning certain
things, and it seems that they still hadn't developed the "what if"
instinct. (In this particular, a basic question a developer could have
asked would have been "hey, what if someone sends someone else a program
as attachment, and the program deletes everything from the hard drive?"
Even if someone at Microsoft did ask such questions, they were obviously
ignored.)

  Of course when Microsoft later put a few barricades to their email program
to slow down this, the email viruses started exploiting bugs in the software.
Naturally bugs are something we have to live with, but this *still* shows
the fundamentally wrong mentality in OS design: Even if the email software
is buggy, it should *still* be impossible for a virus to spread by abusing
this bug. The OS should be designed in such way that it's just not possible.

  Virus scanners are fighting the symptoms, not the fundamental problem.

-- 
                                                          - Warp

Post a reply to this message