Okay, figure this out:

Since Update 10, Oracle's Java SE 6.0 comes with a tool called "Java 
Quick Starter" (JQS). Its purpose? To speed up starting Java software, 
by loading the most commonly used stuff ahead of time.

And loading ahead of time it does.

It does this not only once though, but - for whatever sake - every 
bloody hour. Over and over again. The same bloody files. Which on my 
system (maybe due to a sinister conspiration with the Anti-Virus 
software I use) takes about 1 or 2 /minutes/ each time. Oh, and did I 
mention that all this time it starves every other piece of software 
running from hard disk I/O?

Heck, maybe it /does/ speed up startup of Java software, but seriously:

*I DON'T GIVE A BLOODY DAMN!*


Did I mention that the official procedure how to turn off this bullshit 
mysteriously doesn't work on my machine? >_<

(Fortunately I stayed resolute and resourceful in an atmosphere of utter 
pessimism...)

Post a reply to this message

On 06/03/2011 05:30 PM, clipka wrote:
> Okay, figure this out:
>
> Since Update 10, Oracle's Java SE 6.0 comes with a tool called "Java
> Quick Starter" (JQS). Its purpose? To speed up starting Java software,
> by loading the most commonly used stuff ahead of time.
>
> And loading ahead of time it does.
>
> It does this not only once though, but - for whatever sake - every
> bloody hour. Over and over again. The same bloody files. Which on my
> system (maybe due to a sinister conspiration with the Anti-Virus
> software I use) takes about 1 or 2 /minutes/ each time. Oh, and did I
> mention that all this time it starves every other piece of software
> running from hard disk I/O?
>
> Heck, maybe it /does/ speed up startup of Java software, but seriously:
>
> *I DON'T GIVE A BLOODY DAMN!*
>
>
> Did I mention that the official procedure how to turn off this bullshit
> mysteriously doesn't work on my machine? >_<

and I bet it's documentation sux too ;-)

>
> (Fortunately I stayed resolute and resourceful in an atmosphere of utter
> pessimism...)

lol then ... I admire your half full glass (rather than empty) outlook 
on things!

Post a reply to this message

Am 03.06.2011 23:40, schrieb Jim Holsenback:
>> Did I mention that the official procedure how to turn off this bullshit
>> mysteriously doesn't work on my machine? >_<
>
> and I bet it's documentation sux too ;-)

Documentation?? *What* documentation??

>> (Fortunately I stayed resolute and resourceful in an atmosphere of utter
>> pessimism...)
>
> lol then ... I admire your half full glass (rather than empty) outlook
> on things!

Yeah; those 1-2 minutes an hour have been pestering me for months now, 
until today I finally managed to identify the culprit... and nail it down.

*WIN!*

Post a reply to this message

clipka <ano### [at] anonymousorg> wrote:
> (Fortunately I stayed resolute and resourceful in an atmosphere of utter 
> pessimism...)

  Someone has been playing too much... :P

-- 
                                                          - Warp

Post a reply to this message

On 03/06/2011 09:30 PM, clipka wrote:

> Since Update 10, Oracle's Java SE 6.0 comes with a tool called "Java
> Quick Starter" (JQS). Its purpose? To speed up starting Java software,
> by loading the most commonly used stuff ahead of time.
>
> And loading ahead of time it does.

I'm pretty sure JQS has been there for years. Lots of software does this 
(e.g., Acrobat Reader). The idea, presumably, is to load stuff into 
memory ahead of time.

Except that isn't this the entire point of the Windows prefetch cache? 
Also, won't the unused data simply get swapped back out to disk after a 
while? (Thus utterly defeating the entire purpose of it.) Unless you 
lock the pages in memory - in which case you're taking resources away 
from applications that *definitely* need to run in order to benefit an 
application which *might* need to run at some unspecified future point.

Personally, I dislike quick-starter services. They're a waste of resources.

> It does this not only once though, but - for whatever sake - every
> bloody hour. Over and over again. The same bloody files. Which on my
> system (maybe due to a sinister conspiration with the Anti-Virus
> software I use) takes about 1 or 2 /minutes/ each time. Oh, and did I
> mention that all this time it starves every other piece of software
> running from hard disk I/O?

OK, that's pretty screwed up. It shouldn't take anywhere near that long. 
(Unless your AV product is decompressing all the JAR files to check 
there's no viruses inside them...)

> Did I mention that the official procedure how to turn off this bullshit
> mysteriously doesn't work on my machine? >_<

It's news to me that there's even an official procedure to turn it off...

> (Fortunately I stayed resolute and resourceful in an atmosphere of utter
> pessimism...)

Outstanding! You <subject name here> must be the pride of <subject 
hometown here>.

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On 04/06/2011 07:31 AM, Warp wrote:
> clipka<ano### [at] anonymousorg>  wrote:
>> (Fortunately I stayed resolute and resourceful in an atmosphere of utter
>> pessimism...)
>
>    Someone has been playing too much... :P

What is this "too much" concept of which you speak? ;-)

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On 04/06/2011 07:31 AM, Warp wrote:

>    Someone has been playing too much... :P

http://www.thinkgeek.com/homeoffice/mugs/c7cc/action/215f43a/?cpg=160SS

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Le 2011/06/05 07:24, Orchid XP v8 a écrit :
> On 03/06/2011 09:30 PM, clipka wrote:
>
>> Since Update 10, Oracle's Java SE 6.0 comes with a tool called "Java
>> Quick Starter" (JQS). Its purpose? To speed up starting Java software,
>> by loading the most commonly used stuff ahead of time.
>>
>> And loading ahead of time it does.
>
> I'm pretty sure JQS has been there for years. Lots of software does this
> (e.g., Acrobat Reader). The idea, presumably, is to load stuff into
> memory ahead of time.
I don't know how long, but I think that it was there with Java SE 5.x.

>
> Except that isn't this the entire point of the Windows prefetch cache?
> Also, won't the unused data simply get swapped back out to disk after a
> while? (Thus utterly defeating the entire purpose of it.) Unless you
> lock the pages in memory
OR you reload the stuff periodicaly to reinitiate the countdown...

- in which case you're taking resources away
> from applications that *definitely* need to run in order to benefit an
> application which *might* need to run at some unspecified future point.
>
> Personally, I dislike quick-starter services. They're a waste of resources.
I share your opinion on those. I hunt them down, and kill them, as much 
as I can.

>
>> It does this not only once though, but - for whatever sake - every
>> bloody hour. Over and over again. The same bloody files. Which on my
>> system (maybe due to a sinister conspiration with the Anti-Virus
>> software I use) takes about 1 or 2 /minutes/ each time. Oh, and did I
>> mention that all this time it starves every other piece of software
>> running from hard disk I/O?
>
> OK, that's pretty screwed up. It shouldn't take anywhere near that long.
> (Unless your AV product is decompressing all the JAR files to check
> there's no viruses inside them...)
1 - It reloads the files to prevent them been pushed on the page file.
2 - The AV is to agressive. Scanned files should be remembered, and, 
unless they have been changed, skipped on the next scan.
3 - Yes, the AV need to uncompress and extract files from any archive if 
it wants to scan it's content. JARs are compressed archives.

>
>> Did I mention that the official procedure how to turn off this bullshit
>> mysteriously doesn't work on my machine? >_<
>
> It's news to me that there's even an official procedure to turn it off...
>
>> (Fortunately I stayed resolute and resourceful in an atmosphere of utter
>> pessimism...)
>
> Outstanding! You <subject name here> must be the pride of <subject
> hometown here>.
>

If it's impossible to turn JQS off, then you kill the process, then you 
delete JQS.exe.

Post a reply to this message

>> Personally, I dislike quick-starter services. They're a waste of
>> resources.
> I share your opinion on those. I hunt them down, and kill them, as much
> as I can.

If it works as intended, it's making one application faster by making 
every other application in the system slower. How selfish is that?

> 2 - The AV is to agressive. Scanned files should be remembered, and,
> unless they have been changed, skipped on the next scan.

Don't you just love the way most AV product insist on down periodic 
manual scans?

1. If a file is never opened, it doesn't *matter* how's inside it. It 
can't possibly run.

2. If a file is opened, the on-demand scanner will scan it anyway. 
There's no need to do a manual scan as well.

3. I've yet to see any AV product which "remembers" which files it's 
scanned and stops rescanning them unless they changed. (Presumably 
because that would make it too easy for a virus to slip past; just tweak 
the file timestamp...)

For that matter, I've yet to see an AV product that's any good at 
*removing* malware. Most of them will *detect* an infection, but they do 
an utterly crap job of *removing* it.

> 3 - Yes, the AV need to uncompress and extract files from any archive if
> it wants to scan it's content. JARs are compressed archives.

A Jar file is just a Zip file. (Actually, a surprising number of files 
are just orginary Zip files...) But yes, if it's loading a lot of Jar 
files, that would explain it. I don't know what JQS is loading. Maybe 
just [uncompressed] executable files, IDK.

> If it's impossible to turn JQS off, then you kill the process, then you
> delete JQS.exe.

That's probably not an especially good idea; the product repair routine 
will probably restore it for you.

Actually, I just checked my system. JQS is a normal Windows service. 
Just configure it to not run at startup. Done.

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Le 2011/06/05 17:38, Orchid XP v8 a écrit :
>>> Personally, I dislike quick-starter services. They're a waste of
>>> resources.
>> I share your opinion on those. I hunt them down, and kill them, as much
>> as I can.
>
> If it works as intended, it's making one application faster by making
> every other application in the system slower. How selfish is that?
>
>> 2 - The AV is to agressive. Scanned files should be remembered, and,
>> unless they have been changed, skipped on the next scan.
>
> Don't you just love the way most AV product insist on down periodic
> manual scans?
>
> 1. If a file is never opened, it doesn't *matter* how's inside it. It
> can't possibly run.
>
> 2. If a file is opened, the on-demand scanner will scan it anyway.
> There's no need to do a manual scan as well.
>
> 3. I've yet to see any AV product which "remembers" which files it's
> scanned and stops rescanning them unless they changed. (Presumably
> because that would make it too easy for a virus to slip past; just tweak
> the file timestamp...)
Avast does it. It have a local database of files scanned and found sane. 
They are excluded from autoscans for a set, and configurable, duration. 
They are NOT excluded from scheduled and manual scans.

>
> For that matter, I've yet to see an AV product that's any good at
> *removing* malware. Most of them will *detect* an infection, but they do
> an utterly crap job of *removing* it.
>
>> 3 - Yes, the AV need to uncompress and extract files from any archive if
>> it wants to scan it's content. JARs are compressed archives.
>
> A Jar file is just a Zip file. (Actually, a surprising number of files
> are just orginary Zip files...) But yes, if it's loading a lot of Jar
> files, that would explain it. I don't know what JQS is loading. Maybe
> just [uncompressed] executable files, IDK.
>
>> If it's impossible to turn JQS off, then you kill the process, then you
>> delete JQS.exe.
>
> That's probably not an especially good idea; the product repair routine
> will probably restore it for you.
>
> Actually, I just checked my system. JQS is a normal Windows service.
> Just configure it to not run at startup. Done.
>

Post a reply to this message

Am 05.06.2011 23:38, schrieb Orchid XP v8:

> Actually, I just checked my system. JQS is a normal Windows service.
> Just configure it to not run at startup. Done.

X-actly.

Official procedure though is to go to the control panel, "Java" settings 
dialog, "Advanced" tab, "Miscellaneous", deselect "Java Quick Starter", 
and restart the system.

While this seems to be intended simply as an alternative way to both end 
the process and set the service's start mode to disabled, on my system 
it plainly doesn't. Checkbox toggles, but that's all it does. Next time 
firing up the "Java" control panel, checkbox is back again.

Post a reply to this message

On 05/06/2011 11:06 PM, clipka wrote:

> Official procedure though is to go to the control panel, "Java" settings
> dialog, "Advanced" tab, "Miscellaneous", deselect "Java Quick Starter",
> and restart the system.
>
> While this seems to be intended simply as an alternative way to both end
> the process and set the service's start mode to disabled, on my system
> it plainly doesn't. Checkbox toggles, but that's all it does. Next time
> firing up the "Java" control panel, checkbox is back again.

I had something similar with MSN Messenger yesterday. I opened up the 
settings pane and unchecked "run at startup". Reboot, and it still runs 
at startup. Unselected the checkbox again, and this time it appears to 
have taken effect. GO FIGURE.

I prefer the old days of the Amiga, where software almost always did 
what it was supposed to. (Or else failed to work completely.) None of 
this "sometimes it works, sometimes it doesn't" nonsense. (Or "if works 
if you press the buttons in this order, but no other order".)

This kind of thing seems to be endemic to Windows (and now Linux). For 
example, when I was setting up our old file server, I discovered that 
the only way to make the tape drive work was some long, complex routine 
(which I eventually wrote down) where you uninstall and reinstall the 
hardware drivers multiple times, rebooting in between, in just the exact 
right sequence, and then it works perfectly. If you don't do this, the 
device just refuses to function. WTF?

Post a reply to this message

> I'm pretty sure JQS has been there for years. Lots of software does this
> (e.g., Acrobat Reader). The idea, presumably, is to load stuff into
> memory ahead of time.
>
> Except that isn't this the entire point of the Windows prefetch cache?
> Also, won't the unused data simply get swapped back out to disk after a
> while? (Thus utterly defeating the entire purpose of it.)

http://en.wikipedia.org/wiki/Quick_start
http://en.wikipedia.org/wiki/Prefetcher

In the process, I also came across this:

http://msdn.microsoft.com/en-us/windows/hardware/gg463004.aspx

Post a reply to this message

I had something similarly strange happen:
My PC would wake up at night for no apparent reason. Each and every night.
I'm running it as a PVR and it usually goes to hibernate after recordings and
wakes itself for a new one. So it should have been off in the morning.

I finally foud out that it was a leftover from Windows Mediacenter, which I had
installed for the purpose of checking something with my new satelite tuner card.
It seems that uninstalling Mediacenter does not remove the daily EPGupdater task
which is set to wake the computer at 3:30am.
And since my PC doesn't have a timeout to go back into hibernation and the
EPGupdater was no longer available, it would just stay on. I suppose the EPG
updater would normally put the PC to sleep after it finishes.

Regards
Aydan

Post a reply to this message

On 6/5/2011 14:38, Orchid XP v8 wrote:
> Don't you just love the way most AV product insist on down periodic manual
> scans?

Security in depth. Try Microsoft Security Essentials. It's really good.

> 1. If a file is never opened, it doesn't *matter* how's inside it. It can't
> possibly run.

But you still might propagate it to someone else, even if you don't run it.

> 2. If a file is opened, the on-demand scanner will scan it anyway. There's
> no need to do a manual scan as well.

"I have an idea! Let's make the system seem more responsive by doing a scan 
of a file the very instant the person starts waiting for it to run! That'll 
have the double-good effect of loading every single page of the executable 
into RAM, bypassing that pesky demand-paging stuff."

> 3. I've yet to see any AV product which "remembers" which files it's scanned
> and stops rescanning them unless they changed.

Microsoft security essentials.

> (Presumably because that
> would make it too easy for a virus to slip past; just tweak the file
> timestamp...)

Don't use the timestamp. Use the USN journal. That's what it's for. Indeed, 
you can just do a lazy background scan of anything that might be an 
executable after whoever is writing to it finishes writing to it.

> For that matter, I've yet to see an AV product that's any good at *removing*
> malware. Most of them will *detect* an infection, but they do an utterly
> crap job of *removing* it.

It depends on the malware. It's hard to "remove" an infection that has 
replaced valid code with virus code.

-- 
Darren New, San Diego CA, USA (PST)
   "Coding without comments is like
    driving without turn signals."

Post a reply to this message

On 6/6/2011 1:28, Invisible wrote:
> I prefer the old days of the Amiga, where software almost always did what it
> was supposed to.

That particular one sounds like a permissions problem to me. :-)

-- 
Darren New, San Diego CA, USA (PST)
   "Coding without comments is like
    driving without turn signals."

Post a reply to this message

On 06/06/2011 05:44 PM, Darren New wrote:
> On 6/5/2011 14:38, Orchid XP v8 wrote:
>> Don't you just love the way most AV product insist on down periodic
>> manual scans?
>
> Security in depth.

Seems to me more like "useless busy-work to reassure the customer that 
we really are doing something".

I notice that Symantec AntiVirus Corporate Edition doesn't do scheduled 
scans at all by default. (Unless you explicitly ask it to.) Neither did 
Trend Micro, until our IT department turned it on. (Why?)

> Try Microsoft Security Essentials. It's really good.

It has "Microsoft" in the name. Why would it be good?

>> 1. If a file is never opened, it doesn't *matter* how's inside it. It
>> can't possibly run.
>
> But you still might propagate it to someone else, even if you don't run it.

That's a valid argument for a file server. But even in that case, you 
(or somebody else) still has to *access* the file.

While we're on the subject, almost all AV product claim to be able to 
detect "virus-like behaviour" even if they don't have signatures for it. 
But I've yet to see this actually work in practise...

> "I have an idea! Let's make the system seem more responsive by doing a
> scan of a file the very instant the person starts waiting for it to run!
> That'll have the double-good effect of loading every single page of the
> executable into RAM, bypassing that pesky demand-paging stuff."

It's an optimisation in that it only scans files which could actually 
harm the system, without wasting time scanning files which are never 
used. On the other hand, it also scans them at the worst possible time...

>> (Presumably because that
>> would make it too easy for a virus to slip past; just tweak the file
>> timestamp...)
>
> Don't use the timestamp. Use the USN journal. That's what it's for.

And how many 3rd parties know this exists? (Also, it only works for 
NTFS. Which should be a non-issue, because *nobody* should be using FAT 
by now...)

> Indeed, you can just do a lazy background scan of anything that might be
> an executable after whoever is writing to it finishes writing to it.

You might argue that you could also do lazy on-access scans by logging 
who's accessing stuff, and then checking after. Still, difficult to 
block access to a file after it's been accessed...

>> For that matter, I've yet to see an AV product that's any good at
>> *removing*
>> malware. Most of them will *detect* an infection, but they do an utterly
>> crap job of *removing* it.
>
> It depends on the malware. It's hard to "remove" an infection that has
> replaced valid code with virus code.

For example, when my laptop was infected by MS Blaster, McAfee correctly 
detected the virus file on disk, but was utterly unable to delete it. It 
kept complaining about "access denied", because the virus was still 
running. When *I* manually killed it in Task Manager and then deleted 
the file myself, it worked just fine. Now why the **** couldn't McAfee 
have done that for itself? Isn't that what we paid exorbitant sums of 
money for? So that people who aren't the IT System Administrator can 
clean malware off their systems?

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On 6/6/2011 10:29, Orchid XP v8 wrote:
> Seems to me more like "useless busy-work to reassure the customer that we
> really are doing something".

Or maybe "check that you haven't installed something while the scanner was 
turned off"?

> I notice that Symantec AntiVirus Corporate Edition doesn't do scheduled
> scans at all by default. (Unless you explicitly ask it to.) Neither did
> Trend Micro, until our IT department turned it on. (Why?)

See above.

>> Try Microsoft Security Essentials. It's really good.
> It has "Microsoft" in the name. Why would it be good?

Because it's written by the same people whose OS you're trying to protect is?

> That's a valid argument for a file server. But even in that case, you (or
> somebody else) still has to *access* the file.

But the other person might not have a virus scanner.

> While we're on the subject, almost all AV product claim to be able to detect
> "virus-like behaviour" even if they don't have signatures for it. But I've
> yet to see this actually work in practise...

I have.

> It's an optimisation in that it only scans files which could actually harm
> the system, without wasting time scanning files which are never used. On the
> other hand, it also scans them at the worst possible time...

Right. That's why using the USN journal is such a good idea.

>> Don't use the timestamp. Use the USN journal. That's what it's for.
>
> And how many 3rd parties know this exists? (Also, it only works for NTFS.
> Which should be a non-issue, because *nobody* should be using FAT by now...)

If you don't have the USN turned on, fall back to on-demand scanning. Lots 
of third parties know it exists. It's well documented and has been around 
for years. Heck, *I* know it exists and I don't even try to write 
non-portable Windows code.

Too many people try to do cool stuff and just skip all the tools that 
Windows gives you to make it work well. Not knowing the USN journal exists 
when you're writing file scanning software for Windows is like not knowing 
the Apple UI guidelines exist when trying to write interactive code.

>> Indeed, you can just do a lazy background scan of anything that might be
>> an executable after whoever is writing to it finishes writing to it.
>
> You might argue that you could also do lazy on-access scans by logging who's
> accessing stuff, and then checking after. Still, difficult to block access
> to a file after it's been accessed...

Right. But this way, you're scanning the executable as soon as it gets 
potentially-infected, not when the person is waiting for it to run. You get 
notified as soon as you visit the web page that gives you the virus, not a 
week later after you have no idea why the program you only use once a week 
is suddenly different.

> Now why the **** couldn't McAfee have done that for itself?

Dunno. Privilege problems?

-- 
Darren New, San Diego CA, USA (PST)
   "Coding without comments is like
    driving without turn signals."

Post a reply to this message

On 06/06/2011 06:55 PM, Darren New wrote:
> On 6/6/2011 10:29, Orchid XP v8 wrote:
>> Seems to me more like "useless busy-work to reassure the customer that we
>> really are doing something".
>
> Or maybe "check that you haven't installed something while the scanner
> was turned off"?

...which the on-demand scanner is *still* going to detect...

>>> Try Microsoft Security Essentials. It's really good.
>> It has "Microsoft" in the name. Why would it be good?
>
> Because it's written by the same people whose OS you're trying to
> protect is?

Heheh. These are the people who thought "hey, let's make it so that 
every home user has full admin rights by default". Yes, I'm sure they 
know a thing or two about security. ;-)

>> That's a valid argument for a file server. But even in that case, you (or
>> somebody else) still has to *access* the file.
>
> But the other person might not have a virus scanner.

If the file is on a file server, then each time you try to access it, 
the AV product on the server will perform an on-demand scan.

> Too many people try to do cool stuff and just skip all the tools that
> Windows gives you to make it work well.

Now /that/ I can agree with.

>> Now why the **** couldn't McAfee have done that for itself?
>
> Dunno. Privilege problems?

What, this scenario didn't show up in testing? "We want to clean a virus 
that's currently running" seems like more or less test #2 or #3 in any 
sane test suite...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Am 06.06.2011 20:22, schrieb Orchid XP v8:

>>>> Try Microsoft Security Essentials. It's really good.
>>> It has "Microsoft" in the name. Why would it be good?
>>
>> Because it's written by the same people whose OS you're trying to
>> protect is?
>
> Heheh. These are the people who thought "hey, let's make it so that
> every home user has full admin rights by default". Yes, I'm sure they
> know a thing or two about security. ;-)

Um...

Wrong perspective. Development was actually from CP/M's "access control? 
just lock the f*** room door" concept to there.

Oh, and didn't they go for "hey, let's make it so that every home user 
does /not/ have full admin rights by default" when they introduced 
Vista? Might be wrong here, but didn't both software and users kinda go 
amok back then?

Post a reply to this message

>> Heheh. These are the people who thought "hey, let's make it so that
>> every home user has full admin rights by default". Yes, I'm sure they
>> know a thing or two about security. ;-)
>
> Um...
>
> Wrong perspective. Development was actually from CP/M's "access control?
> just lock the f*** room door" concept to there.

Yes. And it has taken them a spectacularly long time to figure out that 
this model is ineffective today.

(Apparently this is the company that thought that networks were just a 
"fad" that would go away after a while...)

> Oh, and didn't they go for "hey, let's make it so that every home user
> does /not/ have full admin rights by default" when they introduced
> Vista?

Yes.

They didn't do it in Windows 2000, they didn't do it in Windows XP, only 
in Windows Vista did they *finally* get it right.

Granted, backwards compatibility didn't help them at all. But I'm pretty 
sure there are better solutions than what they actually came up with. 
The company's goals seem to be to promote a /sense/ of security rather 
than actually /being/ secure.

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Am 06.06.2011 21:02, schrieb Orchid XP v8:
>>> Heheh. These are the people who thought "hey, let's make it so that
>>> every home user has full admin rights by default". Yes, I'm sure they
>>> know a thing or two about security. ;-)
>>
>> Um...
>>
>> Wrong perspective. Development was actually from CP/M's "access control?
>> just lock the f*** room door" concept to there.
>
> Yes. And it has taken them a spectacularly long time to figure out that
> this model is ineffective today.

Not really. It has been around in NT since when? Ever since the first 
version, I guess.

> (Apparently this is the company that thought that networks were just a
> "fad" that would go away after a while...)

If that's what they had thought, they surely wouldn't have attempted to 
roll their own network.

But they possibly didn't expect a single network to win over all the others.

I think none of the network operators did back then. And definitely they 
didn't expect a (then) /non-commercial/ network to make the race.

>> Oh, and didn't they go for "hey, let's make it so that every home user
>> does /not/ have full admin rights by default" when they introduced
>> Vista?
>
> Yes.
>
> They didn't do it in Windows 2000, they didn't do it in Windows XP, only
> in Windows Vista did they *finally* get it right.
>
> Granted, backwards compatibility didn't help them at all. But I'm pretty
> sure there are better solutions than what they actually came up with.
> The company's goals seem to be to promote a /sense/ of security rather
> than actually /being/ secure.

Yes. I guess customers would go rampant if they gave them a somewhat 
secure system - because people would (a) complain that they have to 
invest time in security housekeeping (you can't just "buy" security), or 
(b) complain that the system still isn't /totally/ secure (ignoring the 
fact that such a thing as a totally secure system exists only beyond the 
event horizon of a black hole).

Typical end users want to just "buy" their security (or, better yet, get 
it for free), and not invest any of their own time into it. So Microsoft 
serves this market segment with the best security you can buy for money 
alone: The mere illusion of it.

Post a reply to this message

Am 06.06.2011 10:28, schrieb Invisible:

> I prefer the old days of the Amiga, where software almost always did
> what it was supposed to. (Or else failed to work completely.) None of
> this "sometimes it works, sometimes it doesn't" nonsense. (Or "if works
> if you press the buttons in this order, but no other order".)
>
> This kind of thing seems to be endemic to Windows (and now Linux). For
> example, when I was setting up our old file server, I discovered that
> the only way to make the tape drive work was some long, complex routine
> (which I eventually wrote down) where you uninstall and reinstall the
> hardware drivers multiple times, rebooting in between, in just the exact
> right sequence, and then it works perfectly. If you don't do this, the
> device just refuses to function. WTF?

Increase in system complexity, anyone?

Post a reply to this message

On 6/6/2011 11:22, Orchid XP v8 wrote:
> ...which the on-demand scanner is *still* going to detect...

Again, the on-demand scanner is the worst possible way, efficiency-wise, to 
detect such things.  Where "efficient" means "minimal impact to actual 
users." It should be a last resort, not a primary mechanism.

>>>> Try Microsoft Security Essentials. It's really good.
>>> It has "Microsoft" in the name. Why would it be good?
>>
>> Because it's written by the same people whose OS you're trying to
>> protect is?
>
> Heheh. These are the people who thought "hey, let's make it so that every
> home user has full admin rights by default". Yes, I'm sure they know a thing
> or two about security. ;-)

I'm sure they do. And I'm sure every programmer in Microsoft *wanted* to not 
make that the default. That business cases mean you lessen security doesn't 
mean the security team doesn't know how to do security.

>>> That's a valid argument for a file server. But even in that case, you (or
>>> somebody else) still has to *access* the file.
>>
>> But the other person might not have a virus scanner.
>
> If the file is on a file server, then each time you try to access it, the AV
> product on the server will perform an on-demand scan.

Sorry? What file server?  I'm pretty sure Linux doesn't have a virus scanner 
that will detect Windows viruses, for example.

> What, this scenario didn't show up in testing? "We want to clean a virus
> that's currently running" seems like more or less test #2 or #3 in any sane
> test suite...

As I said, "dunno."

-- 
Darren New, San Diego CA, USA (PST)
   "Coding without comments is like
    driving without turn signals."

Post a reply to this message

On 6/6/2011 11:52, clipka wrote:
> Wrong perspective. Development was actually from CP/M's "access control?
> just lock the f*** room door" concept to there.

I still remember being amused at the Burroughs mainframe we were looking at 
buying back then. We asked about multi-user features, and they said "code a 
password request into your programs."  We asked something else along those 
lines, and they said "that's why each terminal has a keyhole."

> Oh, and didn't they go for "hey, let's make it so that every home user does
> /not/ have full admin rights by default" when they introduced Vista? Might
> be wrong here, but didn't both software and users kinda go amok back then?

Exactly. It wasn't that they didn't understand what needed to be done, but 
that different demands were made. The president would be safer if he never 
appeared in public, also.

-- 
Darren New, San Diego CA, USA (PST)
   "Coding without comments is like
    driving without turn signals."

Post a reply to this message

On 6/6/2011 12:02, Orchid XP v8 wrote:
> Yes. And it has taken them a spectacularly long time to figure out that this
> model is ineffective today.

Not really. They figured if you had a system where it was single-user, 
adding access control wouldn't help unless you were smart enough to not get 
infected to start with. If you had a system that was multi-user, you 
probably already know how to create accounts that aren't super-user.

> (Apparently this is the company that thought that networks were just a "fad"
> that would go away after a while...)

Microsoft had networking before TCP/IP was popular enough to need DNS.

> They didn't do it in Windows 2000, they didn't do it in Windows XP, only in
> Windows Vista did they *finally* get it right.

If you had multiple users, you could create privileged users or 
non-privileged users. If you had a multi-user networked machine, chances are 
you were running AD or some such and didn't have an admin account.

> Granted, backwards compatibility didn't help them at all. But I'm pretty
> sure there are better solutions than what they actually came up with.

Remember that when you're talking about security, the result is to break 
things. Security in this sense means "preventing things from working as 
programmed." Hence, you can't increase security effectively without breaking 
backward compatibility. It's a careful balancing act you have to do.

-- 
Darren New, San Diego CA, USA (PST)
   "Coding without comments is like
    driving without turn signals."

Post a reply to this message

Am 06.06.2011 22:02, schrieb Darren New:

> Sorry? What file server? I'm pretty sure Linux doesn't have a virus
> scanner that will detect Windows viruses, for example.

It very bloody likely does.

Post a reply to this message

Am 06.06.2011 22:02, schrieb Darren New:

> Again, the on-demand scanner is the worst possible way, efficiency-wise,
> to detect such things. Where "efficient" means "minimal impact to actual
> users." It should be a last resort, not a primary mechanism.

You need an on-demand scanner though, lest a program opens a file that 
wasn't there when you last had a chance to check it.

Plug in a USB stick full of data, and open something from it right away: 
In that scenario, on-demand is the /only/ efficient mechanism. You don't 
want to tell the user, "sorry pal, that file you're trying to open 
happens not to have been scanned yet - and there's still 4236 other 
files scheduled to be scanned before it."

Likewise, you don't want to clog up the system for minutes just because 
someone inserted a USB stick he only reads one file from.


So in the sense of "total computing & I/O time spent for virus 
scanning", on-demand may be the worst - but "felt" system speed is not 
measured in such ways.


Also note that even if a file has been scanned and hasn't changed, the 
virus database may have; so if you don't want to dig through all files 
on the system every time the virus database changes, on-demand scanning 
provides an advantage there as well. (Ideally of course in that case the 
file would only be checked against virus signatures that were installed 
after the file was last checked.)

Post a reply to this message

On 6/6/2011 15:30, clipka wrote:
> You need an on-demand scanner though, lest a program opens a file that
> wasn't there when you last had a chance to check it.

Or you have a USN journal. :-)

But yes, if you want to be sure, an on-demand scanner is necessary. It's 
just not a good idea to have it as the first and/or only option.

> So in the sense of "total computing & I/O time spent for virus scanning",
> on-demand may be the worst - but "felt" system speed is not measured in such
> ways.

Yep. In those specific scenarios, where you suddenly add a bunch of files to 
the file system *without* them passing through RAM as you do so, on-demand 
works well.

> Also note that even if a file has been scanned and hasn't changed, the virus
> database may have;

Also a good point. As I said, on-demand should be the last resort, not the 
first. Background-scanning while the screen saver is on of all executables 
when the database changes or when they're written is far more efficient than 
actually blocking a person's access while you scan an entire file. Managing 
to do the scan as part of the VM paging would be even better, but that I 
imagine would be hard to do.

-- 
Darren New, San Diego CA, USA (PST)
   "Coding without comments is like
    driving without turn signals."

Post a reply to this message

On 06/06/2011 05:45 PM, Darren New wrote:
> On 6/6/2011 1:28, Invisible wrote:
>> I prefer the old days of the Amiga, where software almost always did
>> what it was supposed to.
>
> That particular one sounds like a permissions problem to me. :-)

I content that it was more a philosophical thing. Like, if you tried to 
use something and it didn't quite work right, you threw it away and used 
something else that /did/ work perfectly 100% of the time. If your 
computer randomly malfunctioned from time to time, you would damned well 
go find out /why/. Because, you know, this kind of thing /isn't normal/.

Today the populous has somehow been convinced that it /is/ perfectly 
normal and /acceptable/ for computers to not work right. Given such an 
attitude, what incentive is there for software writers to bother fixing 
their stuff?

Post a reply to this message

>>> Wrong perspective. Development was actually from CP/M's "access control?
>>> just lock the f*** room door" concept to there.
>>
>> Yes. And it has taken them a spectacularly long time to figure out that
>> this model is ineffective today.
>
> Not really. It has been around in NT since when? Ever since the first
> version, I guess.

It still puzzles me that NT was designed as "business only". It's a 
pity, really. It was quite a good OS...

That being the case, Windows Vista is still the first OS aimed at the 
casual user base which actually has half-decent security.

>> The company's goals seem to be to promote a /sense/ of security rather
>> than actually /being/ secure.
>
> Typical end users want to just "buy" their security (or, better yet, get
> it for free), and not invest any of their own time into it. So Microsoft
> serves this market segment with the best security you can buy for money
> alone: The mere illusion of it.

Yes, perhaps that's the real problem here...

(I would say "so why don't they make a business version with *real* 
security?" And then I realise that most PHBs /also/ think that 
"security" is a product that you can just buy.)

Post a reply to this message

>> Granted, backwards compatibility didn't help them at all. But I'm pretty
>> sure there are better solutions than what they actually came up with.
>
> Remember that when you're talking about security, the result is to break
> things. Security in this sense means "preventing things from working as
> programmed." Hence, you can't increase security effectively without
> breaking backward compatibility. It's a careful balancing act you have
> to do.

...which completely explains how Vista and 7 managed to be more secure 
while not breaking everything in sight.

Oh, wait. No it doesn't.

It also doesn't explain why Windows couldn't have done this 10 years ago.

Post a reply to this message

On 06/06/2011 09:02 PM, Darren New wrote:
> On 6/6/2011 11:22, Orchid XP v8 wrote:
>> ...which the on-demand scanner is *still* going to detect...
>
> Again, the on-demand scanner is the worst possible way, efficiency-wise,
> to detect such things. Where "efficient" means "minimal impact to actual
> users." It should be a last resort, not a primary mechanism.

You have a point. Scanning a file after each time it's modified would 
seem the best approach, but I'm not aware of any product that does this yet.

>> Heheh. These are the people who thought "hey, let's make it so that every
>> home user has full admin rights by default". Yes, I'm sure they know a
>> thing
>> or two about security. ;-)
>
> I'm sure they do. And I'm sure every programmer in Microsoft *wanted* to
> not make that the default. That business cases mean you lessen security
> doesn't mean the security team doesn't know how to do security.

OK, how about this:

This is the company that produced a web server where you can completely 
defeat all access controls and fetch files you don't have permission to 
fetch just by using backslashes in the URL rather than forward slashes.

This works because:

1. The server neglects to check for invalid characters in the URL (such 
as backslashes).

2. The server uses a list to determine file access rather than 
properties of the files themselves (e.g., FS-level file security).

3. The server blacklists files that you can't access rather than 
whitelists files that you can access, causing it to fail-open rather 
than fail-closed.

4. Because the restricted URLs have forward slashes and the user typed 
an equivalent path with backslashes, a textual match routine returns no 
matches, and the URL is allowed. (This also means that any /other/ way 
to generate a semantically equivalent but textually distinct URL would 
/also/ bypass all security.)

Yes, /clearly/ MS knows how to design systems that are fundamentally secure.

>>>> That's a valid argument for a file server. But even in that case,
>>>> you (or
>>>> somebody else) still has to *access* the file.
>>>
>>> But the other person might not have a virus scanner.
>>
>> If the file is on a file server, then each time you try to access it,
>> the AV
>> product on the server will perform an on-demand scan.
>
> Sorry? What file server?

If the file exists on another PC and that PC has an on-demand virus 
scanner, than whatever way you access that file, it's going to trigger 
that PC to perform an on-demand scan. So I'm not seeing how a file on a 
PC with an AV product can pose a threat to other systems.

Post a reply to this message

On 6/7/2011 1:12, Invisible wrote:
> That being the case, Windows Vista is still the first OS aimed at the casual
> user base which actually has half-decent security.

XP had half-decent security. Pretty much the same security as Vista, except 
that Vista runs admin programs in a different screen space to avoid shatter 
attacks. You're still logged in as an administrator by default. If you mean 
the UAC, most people don't pay any attention to whether that makes sense to 
be popping up or not.

> (I would say "so why don't they make a business version with *real*
> security?"

They do. You just have to actually use the one you have.  XP had real 
security. About as good as UNIX (and better in some ways) as long as you 
didn't log in as administrator by default. No amount of technical security 
is going to force people to use it.

-- 
Darren New, San Diego CA, USA (PST)
   "Coding without comments is like
    driving without turn signals."

Post a reply to this message

On 6/7/2011 1:15, Invisible wrote:
> ...which completely explains how Vista and 7 managed to be more secure while
> not breaking everything in sight.

In what way are they more secure?  Remember everyone bitching that they had 
to buy all new hardware like new scanners and printers and stuff for Vista? 
Why do you think that happened?

> Oh, wait. No it doesn't.

How many Win3 programs broke when you tried to run them under Win2000?

(Answer: Lots and lots.)

> It also doesn't explain why Windows couldn't have done this 10 years ago.

See above. By now, nobody really complains when a Win3 or Win98 program breaks.

-- 
Darren New, San Diego CA, USA (PST)
   "Coding without comments is like
    driving without turn signals."

Post a reply to this message

On 07/06/2011 02:29 PM, Darren New wrote:
> On 6/7/2011 1:12, Invisible wrote:
>> That being the case, Windows Vista is still the first OS aimed at the
>> casual user base which actually has half-decent security.
>
> XP had half-decent security. Pretty much the same security as Vista,
> except that Vista runs admin programs in a different screen space to
> avoid shatter attacks. You're still logged in as an administrator by
> default.

Really? I thought they finally changed that in Vista.

Post a reply to this message

On 6/7/2011 1:23, Invisible wrote:
> You have a point. Scanning a file after each time it's modified would seem
> the best approach, but I'm not aware of any product that does this yet.

Yes you are. You just ad hominem'ed them out of your memory.

> So I'm not seeing how a file on a PC with an AV
> product can pose a threat to other systems.

I write a program that writes out an executable file that has a virus in it. 
(Like, say, the copy command.) I write that file to a USB stick, and I give 
it to you.

Or, as has actually happened in the past, you install a program off a 
commercial CD that has been created on a machine that is infected, and which 
therefore includes a virus.

-- 
Darren New, San Diego CA, USA (PST)
   "Coding without comments is like
    driving without turn signals."

Post a reply to this message

On 6/7/2011 6:32, Invisible wrote:
> Really? I thought they finally changed that in Vista.

Really. The first account you create is an administrator account. (I may be 
misremembering, but I'm pretty sure that's the case, since you have to frob 
with privileged things in order to log in as administrator without being in 
safe mode.)

-- 
Darren New, San Diego CA, USA (PST)
   "Coding without comments is like
    driving without turn signals."

Post a reply to this message