Microsoft recently gave the source code for Windows 7 to the Russian Federal Secret Service. For non-techies it's like handing over the blueprints to the world's bank vaults.

Apparently it just extends a deal they already had where they handed over the source code for XP, 2000, and Server 2000. Anyone in the security community knows that Windows is rife with bugs and flaws that cause huge security risks. Things like keyloggers, viruses, and other malware are routinely downloaded without the user knowing, and often without them even doing anything due to these bugs and Microsoft's blasé approach to patching them. Often waiting years to patch a known vulnerability that's actively being exploited in the wild.

While Windows 7 is far more secure in general terms than previous versions, it - like most software - still suffers from new vulnerabilities being discovered and in the tens of millions of lines of code that's not unreasonable. Exploits are bound to be found and most vendors patch them as soon as possible after discovery.

What is completely unreasonable is to consider such publicly viewable, proprietarily authored code at all secure. Microsoft is known for creating highly exploitable products, and now also for not protecting their source code at all. The Russian Secret Service is only one of a large enough list of governments and agencies that have the source code.

Why did Microsoft do it? To increase sales of Windows and Office products. Why do the government agencies want it? Because sending spies to another country is dangerous, public, and bad for PR. It's also impractical when you can just spy on other governments and millions of citizens anywhere around the world who use Windows and Office products.

If you use Windows and connect it to the internet, you're asking to be spied on and monitored regardless of the anti-malware software you run because the underlying OS is completely insecure. You should have an encrypted thumb drive with some flavour of Linux which you boot up to do your banking, emailing, or anything else important. Or just don't use Windows at all.

I wanted to try a series that simplifies the news - cuts through big articles with boring facts and interviews and shit and just tells you what the story is about. Simple.

Supreme court of Canada says journalists shouldn't be able to fully protect anonymous sources. Saying it's not in the constitution.

The United Kingdom (ie: England, Scotland, Wales, and Northern ireland) had a general election. It resulted in a minority government. Now they're fiff-faffing.

iPad available in Canada starting May 28. During Google's IO event May 19-20 Adobe will demonstrate a Google phone running Flash 10.1 and Adobe AIR. This will spur the completion of the bevy of competing tablets and mobile devices. Notion Ink's Adam tablet, and Hp's speculated WebOS tablet will be fierce competitors. Notion Ink plans to start shipping by the end of July.

They dug up some neanderthal bones from 30,000 - 40,000 years ago, and sequenced their DNA. It was difficult. They're saying based on similarities between their DNA and ours'(humans) there was a lot of interspecies fucking going on. Which technically means neanderthals and humans were not separate species - if they were able to produce offspring together.

Beyond Petroleum(BP) - the petroleum company - lowered a heavy metal box over their pressurized leaking oil hole in the Gulf of Mexico today. They hope it will work to stop the torrential leakage and not destroy the entire eastern coastline of North America. They're saying that if they knew oil - the thing gasoline and propane comes from - could catch on fire, they would have had a backup plan to prevent such a catastrophic disaster.

Germany decided to help the Greeks with their economy melt down with 110 billion euros. Other larger members of the European Union(EU) have helped, and other Countries are thinking about it too.

The United States and United Nations trying to coax peace in the Middle East asked Israel - the only known country there to have them - to disarm and disable some of their nuclear weapons. Israel doesn't want to do that until there's peace in the area.

One of the volcanoes in Iceland responsible for the huge ash cloud over Europe emitted more ash yesterday.

6 days ago Maoists in Nepal went on strike because they're unhappy with the government, this made everyone else angry so thousands of protesters gathered to demand an end to the strike and compromise between the Maoists and the government. After the protesters became violent, the government injured some people firing bullets in the air and tear gas at the crowd.

Political parties in Burma are having differences and splitting up. This is all much more difficult under their strict election laws. Some say participating in the election at all is undemocratic in the military run country.

Turkey may revise their constitution from being secular to Islamic based. The bill to do so has been approved but may still be blocked before coming into affect.

Microsoft's security patches secretly attempt to fix more than they tell people, which can cause problems and complete system failures.

Google Goggles - an app that let's you photograph something with your phone and find out more about that thing - has added translation. So aside from taking a picture of the Eiffel Tower and getting Wikipedia or whatever, you can photograph a chalk menu outside a bistro in Milan and have it translated into the language of your choice.

There's a new update for Google's web browser Chrome which makes it the fastest browser for looking at web sites. It's half a second faster than the latest Firefox, four hundreds of a second faster than the latest Opera and Safari. Internet Explorer is still painfully slow, so much that it's not even benchmarked anymore.

The first non-latin domain names are live now. You can now register website names using Arabic, Japanese, and other non-latin characters.

Yahoo tries ad campaign to compete with Google as a search/home page, speculatively wastes $85 million proving how incompetent they are.

I've talked a lot about their unpleasantly ghostly Privacy Policy and Myspace-esk TOS, you know the ones that sign away equal rights and entitlement to your identity indefinitely just by using their site. But I haven't talked about the intrinsic insecurity of a social network like Facebook.

Fact: A significant amount of computer users exhibit insecure behaviour online. They don't use strong passwords, they don't opt for https://, they don't work on virus/keylogger free computers, and they answer spam emails(shocking I know).

Fact: Facebook contains not just a list of all your friends, but all your friends' friends, and a record of your interactions with them. Your social network and scene.

Think about it like this: If someone gains access to your email account, they can see your contact list, and they can see how you talk to your contacts. If they have a lot of time on their hands they can read huge volumes of emails and piece together your relationships.

On Facebook, they can see your list of friends, family, your communication with them, but more importantly their communication with each other. A schematic of your social life heavy with descriptions of how you know each person. Assuming you've toggled your privacy settings back so only your friends can see your stuff, and did so before google indexed your profile and friends list. Every one of your Facebook friends is an attack vector for all the personal info you've posted and that your friends and family have posted that doesn't even relate to you. More clearly A is an attack vector for B, A<->B, C, and B<->C.

In addition 3rd party Facebook app developers also have access to your social circle and information. Your Buddy wants to try an app from some developer he doesn't know? Well they just grabbed your entire social network and know a LOT about you and all your friends.

On Facebook, you are not the only one responsible for keeping your information safe. Anyone you friend is. Would you trust your Facebook friends with your Facebook username and password?

It's given birth to a new breed of highly personalized spam. Imagine getting an email from someone you don't know offering you cheap Viagra and even using your first name. Sounds like a scam right? Sounds like if you clicked on the link you'd probably get a virus or some kind of malware installed on your system right? Right.

Now imagine getting an email from Sarah your old girlfriend, where she talks about something you did the other night at a party (which you posted a photo of on Facebook being careful to only let your friends see) and then telling you she wants you to see a funny youtube video. You click on the link and guess what? It wasn't Sarah at all! "What?!", you say? How's that possible?

The Spammer, we'll call him Spammer, gains access to Jim(your buddy)'s Facebook account because a) he accidentally typed in FaceBack.com without realizing it and tried to login. His credentials were phished and the Spammer was in his account within 30 seconds, or b) Jim(same Jim) adds an application where the 3rd party developer wrote a bunch of code that scrapes all of Jim's and your information and emails it to him(the Spammer) as a .zip file when it's done. The Spammer goes ahead and looks through Jim's friends list, then through yours. Looks through your photos and descriptions of each of your contacts. Looks at Sarah's profile and write's down her email address, attaches the photo to an email, the email spoofs Sarah's email address(this is astoundingly easy without her login credentials from any computer connected to the internet) and adds an html link that looks like this in code:

<a href="http://sitewithavirus/silentkeylogger"> http://youtube.com/v=harmlessvideo</a>

and to you looks like this:

http://youtube.com/v=harmlessvideo

Clicking on the link will obviously take you to the virus and not to youtube and if you use Internet Explorer, or the Spammer is using a zero-day exploit for one of the other browsers, you're fucked due to arbitrary code execution.

A site that gives anyone other than you access to a super detailed schematic of your social circle is inherently insecure. Facebook should not expose your real life social circle to anyone even other people in that circle. But they do and will because a large part of their user retention plays on social needs for acceptance/approval/jealousy/etc. which requires exposing that information to people you normally wouldn't and in a permanent public manner that you normally wouldn't.

After a year and a half of using a mac I can say for certain that it's a far more secure environment than windows. I can't imagine ever doing anything important on a windows machine ever again, back when I used windows for work re-installing the entire operating system was a monthly routine, about 90% of these incidents were virus related despite heavy use of system intensive anti-virus software, firewalls, anti-spyware software, and every other effort to prevent it.

While reading a debate on a tech-blog between the commenters of a provocative post polling whether or not you use anti-virus software and why, I ran across a link to an article written almost 2 years ago at InfoWorld [http://weblog.infoworld.com]. The point argument: which is the safer operating system--Windows or OS X, and the old claim that the reason there are no mac viruses* is due to Apple's small market share (of millions and millions of customers). The following is an excerpt from the article listing some of the technical holes that exist in Windows and not in OS X that would allow a virus to get into your system, and hide. Since it's writing Apple has released a Leopard which is even more secure than previous versions, while Microsoft has done the same, most of these flaws still exist in Vista where the most tangible security improvement being disabled by most users due to it's irritating nature.

...

• All Windows background processes/daemons are spawned from a single hyper-privileged process and referred to as services.

• By default, Windows launches all services with SYSTEM-level privileges.

• SYSTEM is a pseudo-user (LocalSystem) that trumps Administrator (like UNIX's root) in privileges. SYSTEM cannot be used to log in, but it also has no password, no login script, no shell and no environment, therefore

• The activity of SYSTEM is next to impossible to control or log.

• Most of the code running on any Windows system at a given time is related to services, most or all of which run with SYSTEM privileges, therefore

• Successful infection of running Windows software carries a good chance of access to SYSTEM privileges.

• Windows buries most privileged software, service executables and configuration files in a single, unstructured massive directory (SYSTEM32) that is frequently used by third parties. Windows will notify you on an attempt to overwrite one of its own system files stored here, but does not try to protect privileged software.

• Microsoft does not sign or document the name and purpose of the files it places in SYSTEM32.

• Windows has no equivalent to OS X's bill of materials, so it cannot validate permissions, dates and checksums of system and third-party software.

• Windows requires that users log in with administrative privileges to install software, which causes many to use privileged accounts for day-to-day usage.

• Windows requires extraordinary effort to extract the path to, and the files and TCP/UDP ports opened by, running services, and to certify that they are valid.

• Microsoft made it easy for commercial applications to refuse a debugger's attempt to attach to a process or thread. Attackers use this same mechanism to cloak malware. A privileged user must never be denied access to a debugger on any system. My right to track down malware on my computers trumps vendors' interests in preventing piracy or reverse-engineering. Maintaining that right is one of the reasons that open source commercial OS kernels are so vital.

• Access to the massive, arcane, nearly unstructured, non-human-readable Windows Registry, which was to be obsolete by now, remains the only resource a Windows attacker needs to analyze and control a Windows system.

• Another trick that attackers learned from Microsoft is that Registry entries can be made read-only even to the Administrator, so you can find an exploit and be blocked from disarming it.

• Malicious code or data can be concealed in NTFS files' secondary streams. These are similar to HFS forks, but so few would think to look at these.

• One of the strongest tools that Microsoft has to protect users from malware is Access Control Lists (ACLs), but standard tools make ACLs difficult to employ, so most opt for NTFS's inadequate standard access rights.

Why this can't happen under OS X:

• OS X has no user account with privileges exceeding root.

• Maximum privilege is extended only to descendants of process ID 1 (init or Darwin's launchd), a role that is rarely used and closely scrutinized.

• Unlike services.exe, launchd executes daemons and scheduled commands in a shell that's subject to login scripts, environment variables, resource limits, auditing and all security features of Darwin/OS X.

• Apple's daemons have man pages, and third parties are duty-bound to provide the same. Admins also expect to be able to run daemons, with verbose reporting, in a shell for testing.

• OS X Man pages document daemons' file dependencies, so administrators can easily rework file permissions to match daemons' reduced privileges.

• Launchd can tripwire directories so that if they're altered unexpectedly, launchd triggers a response.

• If an attacker takes over a local or remote console, any effort to install software or alter significant system settings cannot proceed without entering the administrator's user name and password, even if the console is already logged in as a privileged user. In other words, even having privileges doesn't ensure that even an inside hacker can arrange to keep them.

• OS X has a single console and a single system log, both in plain text.

• OS X's nearest equivalent to the Registry is Netinfo, but this requires authentication for modification. In later releases of OS X, it is fairly sparse.

• Applications have their own per-user and system-wide properties files, private Registries if you like, stored in human-readable files in standard locations.

• Every installed file is traceable to a bill of materials that can verify that the file is meant to exist, and that it and all of its dependencies match their original checksums. Mac users, back up and protect your Receipts folder!

• The directories used to hold OS X's privileged system executables are sacred. Anything new that pops up there is immediately suspect.

• OS X does not require that a user be logged in as an administrator to install software. The user or someone aiding the install needs to know the name and password of a local administrative user to complete the install. On a network, most software is installed using Remote Desktop, an inexpensive Systems Management Server-like console.

• The UNIX/POSIX API, standard command-line tools and open source tools leave malware unable to hide from a competent OS X administrator. It takes a new UNIX programmer longer to choose an editor than it does to write a console app that walks the process tree listing privileged processes. Finding the owners of open TCP/UDP ports or open files is similarly trivial. The "system" is not opaque.

• Basic OS X features can be put to use to make life miserable for malware. For example, Windows' hackable restore points are done better by OS X's ability to create encrypted, read-only disk images. They're simpler than archives, and you can mount them as volumes anywhere in your file hierarchy.

• Likewise, OS X Server will image any Mac client or server's local drives and maintain safe copies that can be used not only for restoration, but which can be booted from to guarantee that there's no trace of infection.

• When erase-and-reinstall is the only way to be sure, OS X Server automates it. It can safely capture the affected Mac's active drives before having that Mac boot from the fresh install image.

So, after all this, do I have enough to judge Windows inherently more vulnerable to severe malware than OS X? I do.

...

-- by Tom Jager at [http://weblog.infoworld.com/...s_inhe.html] - click to read the whole article.

* The term 'virus' used here relates to malicious software being installed on your system without your knowledge. There is some malicious software (that I am aware of) on macs, and there's no reason why anyone couldn't just write some malicious code, however the secure unix foundation of mac os x and all of it's security features prevent malicious code from being executed without your explicit consent in 99% of cases and if a virus does get running it can't do anything significant without knowing an admin username and password and even then without tipping off the numerous checks and balances that something is awry.