"Over-Draconian" browser security??

Microsoft?
Ship something that can even be secured?/
It'll never happen.
They love their exploit codebase to much to lock something down.

One of the long term Microsoft goals is the process that they have, in the past, called Palladium and Trusted Computing. This is a security concept whereby the computer, the network, and the Internet will NOT allow any connection with a computer that is not certified as being correct via the control mechanisms in place. Part of that control being a double check of the software being legally licenced and current. It is NOT beyond the realms of expectation that MS would incorporate a process in their browser that would limit its ability to view sites to those that are registered with it somehow.

I do not know what is in IE7 as I gave up using it years ago. First I went to Avant Browser which sits over the IE engine as a new interface and security screen. Now I use Firefox as I find it easier to set up and use. Also it is harder for things to hijack than IE is.

I think they PROGRAM in the "bugs", AND have the "fix" written at the same time. They then just follow a schedule of releasing these preprogrammed "fixes" to make it appear that they are constantly working to make their products better for us!

Think about it.

A Unix admin does not get the same attention that a Windows admin does because witht he Unix box you put it in place and forget about it until it is time to update the software or hardware.

With the Windows box though, you get to constantly remain in the minds of your (l)user because you have to come save the day on a regular basis and "fix" (reboot) something. Your a hero!

Windows is making you this hero, and you should learn to be more respectful and show some graditude! Bow before the alter of Bill, and he accepts visa AND mastercard......

:D

IE7 on Vista protects people against the most dangerous aspect of computing; humans. If you accidentally do something you shouldn?t be doing, it will at least warn you now. You can still choose to infect yourself, but at least you?ve been giving two warnings that you can choose to ignore. Under most circumstances, you shouldn?t be seeing any warning boxes. If you are seeing a lot of warning boxes, you?re probably doing a lot of things you shouldn?t be doing.

In the case of a flaw in IE7 under Vista, it will prevent a hijacked IE7 from accessing your system files or more importantly your user files. After all, your kid?s photos are more important than your Windows system directory because you can always reinstall Windows, you can?t retake pictures. In a recent Apple Mac OS X flaw, the hijacked browser session is prevented from accessing your system files which is better than Windows XP, but it let?s the exploit get wide open access to all of your user files. IE7 on Vista will move Microsoft Windows XP and IE6 from least secure to the most secure Desktop operating system. Is it going to be perfect, certainly not but it does make the best effort of any modern Desktop OS and Browser.

My default settings for any web browser:
NO FLash player.
No shockwave player.
No media player plugin
No PDF support
No Java support
No Javascript support
Delete ALL Certificate Authorities from the trusted list.
Delete all included certificates.
[ if running windows, expect this to crash the os..permanently ]
Cookies, from originating site only.
images, from originating SITE only.
popups, block them, completely, don't indicate that there was one blocked.

since I only use linux, I don't have to worry about activex, I don't install the open source package that supports it.

This is exactly what every browser I use is set to. Since mozilla's Seamonkey has pdf support built into it, I actually have to get into really detailed settings dialogue to disable it.

I installed Beta IE 7 for XP (slightly off topic) and several of my addins failed to work, also Nero caused problems and the tabs I saved did not load correctly. I have reported these things to my software suppliers and have had to run system restore so all is now ok, but this goes with running betas I suppose has anyone had any problems with this?

I agree with you 100% but just making the observation that where the theory meets the pavement your arguments fall apart.

It wouldn't be difficult to create the most secure OS/browser in the world or take an OS or browser and properly secure it.

But it would have such limited functionality and features that few would be interested in it.

You may disagree with most, but most people prefer eye candy, features, functionality, etc. Few enjoy surfing the web in text only. That isn't realistic.

As an IT professional, it's our jobs to give them what they want and then find a way to secure it. Not the other way around.

We don't secure everything and then tell them what they can and cannot do.

add user, add group, assign user to group.
in my case, user = jaqui
group = jaqui
the only thing I cannot access by default now is system admin tools, all applications required for normal use are available.

there is sudo for gui access as jaqui to system admin tools
su on cli to access them
or just use a second tty to login as the admin and perform needed tasks.
I actually prefer to work with the latter, that way I have to check what needs to be done before gaining the access level that can damage the system, so my time as the admin on a login session is minimal.

Convert them all overnight to Linux because he has some magical powers that you and I don't possess.

While I'd agree with many of the points our Linux brothers bring up time and time again, they just don't live in the real world.

Their theories might apply to their PC network at home in their basement, but getting some businesses to convert to anything other than Microsoft is damn near mission impossible.

These conversations are fun and interesting, but CEO's, CIO's, and CFO's don't care. They'll gladly go along with the status quo.

Sorry, I only work with Professional quality software, Microsoft's insistance on including video gaming technology and major security risk technology means that their products do not fit the definition of Professional Quality.

*@msn.com
*@microsoft.com
*@hotmail.com

I literally blacklist the entire domain.

then add in those ignorant enough to send html formatted email...

*@sun.com

Every time we go down this road, you start out with something reasonable, and immediately spin off into the FUD:

1. "There are too many distros!"
2. "[Linux is] not an OS for the casual user!"

1. That's asinine. Too many for what? It's called "competition", and having your desktop market sewn up by a single vendor is in no way a positive state of affairs.

2. It is. That's part of the beauty of it: depending on which distribution you choose and how it's configured, it can be just about any kind of OS you want it to be, [b]including an OS for the casual user[/b].

You say: "[i]Jesus, we've been down this road before.[/i]"
I say: While I'm flattered by the comparison, I am not Him.

"[i]First of all, I didn't mention Desktop Linux. I'm counting Windows and Mac.[/i]"
Funny -- that's not what you said in your previous comment. You just referred to "desktop" OSes in general. If you meant that Windows is the "most secure" of MacOS and Windows, you should have said so.

"[i]Linux runs great as a Server operating system, but it's arguable if it is mature enough to serve as a desktop OS.[/i]"
I'd argue that Windows lacks some maturity as a desktop OS. It still doesn't employ strict privilege separation in the core architecture, for instance. In fact, that is relevant to your commentary about IE7 running under a separate user ID: as long as strict privilege separation is not fully implemented, the threat of privilege escalation renders that security configuration a half-measure at best.

Perhaps Linux is not the perfect desktop OS in general terms. Neither is Windows, so this argument against Linux is spurious at best.

"[i]If you were using Desktop Linux, I believe you would have to manually set up something to run the browser under different user permissions as the user.[/i]"
It's true that this is not default behavior. Thanks to other factors in platform security, however, it's not really a problem -- and at least it's possible to configure it that way, whereas implementing strict privilege separation (and other security advantages that are standard on Linux systems) on a Windows install is not currently possible.

Windows has the edge on things like widespread familiarity and user-obsequious "wizards". It falls short on security and stability. C'est la vie.

MS Office is fully capable of using file formats that are not limited to the usual lineup of MS-only formats. For instance, word processor documents can be made more portable (and smaller, and safer to open) by saving them as RTFs instead of DOCs.

I have been trying out various versions of Linux in recent months and have found several that have a default installation very suitable for end user desktop usage. In every case the default installation has included a browser, sometimes Fire Fox sometimes something else, that works perfectly for every basic user.

I don't love silicon just because it uses electricity. I'm not a computer enthusiast, eager to know everything that can be done with a bit or computing logic. Linux is easy enough, for anybody courageous enough to ignore FUD and insert a different disc into the CD-ROM drive. The fact that writing one's own programs is common is an added opportunity, not a requirement.

Mr.Sarin (now there's a suspect name!) makes a valid point regarding the use of "over-Draconian", since "Draconian" implies the utmost penaly imposition: the slaughter of a multituse of innocents to make an example of them. Can there BE anything worse that that?
I would suggest the utilization of "Uber-Draconian". This re-unites the Roman-Germanic synthesis (concetenation?) of overlordship (ala Microsoft), stays within cultural boundaries and gives the French an additional reason to be pissed at Microsoft.

It was from a podcast on Vista:
http://blogs.techrepublic.com.com/rootcast/?p=8

There have been several other blog posts and discussions of IE7 lately so I think that's why Stephen posed the original question. There are links to some of the other IE7 content in this blog post:
https://www.techrepublic.com.com/5254-6257-0.html?forumID=99&threadID=174062&messageID=2002199&id=3053951

since I don't want multimedia content that's the only thing I never see. And don't miss at all.

When I hit a site that requires functionality in the browser I don't support, I leave the site.
making note of domain name and looking up the company through whois.
CEO's just love getting phone calls from people hearing that their flash / shockwave /javascript / activex powered website has cost them more money in lost business than they have made, that you are only calling to congradulate them on choosing to drive customers away from their website by implementing it, and I'll be taking my business elsewhere.