| I think you've missed the point on multiple fronts... > and you don't see Android phones being compromised remotely within fifteen minutes of being connected to a network. Again, why do you (and others) keep comparing today's Linux/Android/OS X OS with a 10-15 year old Windows OS. Windows security has been at its core since after XP, and by all knowledgeable accounts is just as good as Linux's ... as long as you know how to use it / deal with it. Today 95% of the problem is clueless Windows admins, and bad user decisions. As far as my own experience goes, I've ran Windows 3.1, 95, 98, 2000, XP, Vista, and all the rest never having been compromised. So it is possible at least. What you're doing is the same when people complain about IE 6 vs. the latest version of Chrome... IE6 came out in 2001, and at that time was the most standards-compliant and feature full of all the browsers on the market (well, except for IE 5.5 for MacOS). > They didn't have to have everyone running as root by default in all versions of Windows before Vista (AFAIK in XP Home you can't actually set up restricted users). They didn't have to have lots of open ports offering things like RPC to the world. They didn't have to have all files executable by default, based solely off the hidden part of the filename in AnnaKournikova.jpg.exe. Of course they had to do all that. The Windows users back then were generally not very savvy and anything that got in their way was a disaster waiting to happen. Also it was a different time. Even today most Windows home users don't even understand the file-system with it's drives, devices, directories, subs, and files. And you wanted them to understand user security and how it plays with applications that they ran? No. > but those opportunities wouldn't have been there if they hadn't ignored security for so long. I guess they should have gotten a time machine to the future to pull all that work and knowledge back to the past. Windows XP should have been based off Windows 7. My point is that what is possible today, was not possible 10, 15, or 20 years ago both from a tech and user point of view... Just because someone can do OS security good today, dosn't mean you can blame someone else for not doing it good decades ago. |
You argued that Windows was targeted solely because of its high market share. I'm drawing a comparison to another platform with high market share; there simply wasn't anything comparable ten years ago. And it is not obvious to me that it's not a valid comparison; Microsoft were a huge company who had been developing Windows for fifteen years at that point. Android is a lot younger, so you could just as well expect it to be less mature and therefore less secure.
And yes, I know it is possible to run it without being compromised. You obviously knew what you were doing; millions, even tens of millions of others didn't know and wound up with their computers zombified into botnets. That wasn't all because of their ignorance; there were times when a newly installed XP machine would be compromised less than fifteen minutes after being connected to the internet, which wasn't enough time to install the patches it needed. That can't be considered that user's fault, especially when they've just sat through half an hour of being told how they're installing The Most Secure Version Of Windows Yet!
> Of course they had to do all that. The Windows users back then were generally not very savvy...
Now you are missing my point. Microsoft didn't have to do anything. They could have built an operating system that was harder to use but more secure. I contend that it's even conceivable that they could have built an operating system that was roughly the same for ease of use, but still more secure; maybe they'd have been slower to market or had to compromise elsewhere. The point is that security was not a priority for them for years, they obviously just weren't that concerned. That may ultimately have been the right path for them, because they arguably didn't pay a high price really, but I don't personally consider it the technically best course.
> My point is that what is possible today, was not possible 10, 15, or 20 years ago both from a tech and user point of view... Just because someone can do OS security good today, dosn't mean you can blame someone else for not doing it good decades ago.
I think this is where we fundamentally disagree. I don't see why you think security is only something that can be achieved now and why it couldn't be ten or fifteen years ago. In the Unix world, people have known not to run as root for decades; Microsoft chose to ignore that for a long time and ultimately have been forced to shoehorn it back in for Vista. They could have done that in XP, if not long before; it certainly had the capability for it, they simply cut that out of XP Home and chose bad defaults for XP Pro.