Some nasty spyware popped up on my computer this morning. In the course of a minute a dozen pop-up ads appeared on my screen, despite the fact that I was visiting web sites that don’t do pop-ups. Ad-aware found more than a hundred evil files on my machine.
I think I’m relatively computer-savvy and rather paranoid about security. I download very few programs and think I have a pretty good idea of which programs are likely to have virii. Yet this is the second time this has happened to me.
This scares the crap out of me. Not so much because they did any great damage, but because it means that either (a) I’m not nearly as observant as I think I am, or (b) a stock Windows box has open security vulnerabilities that can install themselves on peoples’ machines without the user’s knowledge and consent. Either way, this is scary.
I’m undecided about whether all of this is Microsoft’s fault. On the one hand, Microsoft wrote my OS, my browser, and my email client, so any security vulnerabilities are their fault. And for my personal use, I’ve got a Mac, and Mac virii are almost unheard of. So certainly Microsoft deserves some of the blame.
Plus, now that I’ve used it for about a year, Microsoft’s software really sucks. A few quick examples: Outlook freezes up for about 30 second when I do a search in my email inbox. Apple mail client does roughly the same search on 2500 messages in realtime–the results are literally ready by the time I’m done typing. And even if it takes longer than that to do a search, the whole interface doesn’t freeze up, as it does under Outlook. When I paste a sentence into a paragraph in Word, it will randomly change the formatting of the whole paragraph in inconsistent ways, based on factors I haven’t been able to figure out. When I “select all” on a double-spaced document, the ruler disappears. I could cite lots of other examples.
This is the result, I think, of bureaucratic incompetence. Microsoft is an enormous company that’s been consistently profitable for more than 20 years. Old software like Windows, Word, and Outlook is likely to be encrusted with the software equivalent of barnacles. Since Microsoft’s most popular products have had no particular competitive pressures of late, they haven’t bothered to fix many of the problems. Microsoft software is like an old house that’s been remodeled a dozen times by incompetent amateurs. Each remodeling doesn’t quite fix the flaws introduced by the last, while introducing some of their own.
Now admittedly, most of the problems are annoying rather than show-stopping. But if they take the same lackadaisical attitude toward security, that’s a much more serious matter, and there’s no way mere mortals can tell the difference from everyday use. Even one security hole is enough to render the entire system vulnerable to compromise. Worse, if the fundamental design has flaws, it can be almost impossible to fix them without breaking compatibility with existing software. In that case, you’re stuck with the impossible choice of papering over the problems with the knowledge that sooner or later more exploits will be found, or fixing the problem and breaking most of the world’s software in the process.
On the other hand, I might be giving Microsoft too little credit. Because 90% of the market uses their product, every feature of Microsoft’s software is scrutinized intensively. It’s therefore not really a fair fight to compare them to competing operating systems on the basis of the number of break-ins, since the vast majority of virus and spyware authors are going to target the most popular system.
Still, like I said, this scares the crap out of me. It means that I really don’t know what software might be running on my computer, or who might have access. Right now, spyware usually announces its presence with a deluge of ads, and I run Ad-aware to fix it. But there’s no reason the same tactic couldn’t be used to install more subtle and sinister software: keyboard sniffers, backdoors that allow remote users to log into the machine, software that scans hard drives for interesting information and phones it home to the mother ship.
As a practical matter, this isn’t likely to happen on a large scale, because there are ways to detect these sorts of software and catch those who deploy them. Security types can and do scan the network traffic coming out of a machine looking for quirky behavior, and so if a machine was phoning home to a mother ship, someone would notice, and the organization on the receiving end would be shut down, if not thrown in jail. If the government did it, there’d be a firestorm of controversy.
But it’s still a problem people ought to be worried about, and as far as I can tell, most people aren’t aware of the implications or don’t care. The integrity of one’s desktop or laptop computer is extremely important to the security of the Internet as a whole. Having a computer with unpatched security holes is a like a blind man leaving his front door wide open. Most of the time no one will take advantage, but you can never be completely sure, and the consequences are potentially severe.
So whether it’s Microsoft’s fault or not, I think this is a compelling argument for running something other than Windows, because so far at least, only Windows has this problem. Not only would this give Microsoft a chance to clean up their act, but a bit more diversity would slow the spread of virii and make the work of spyware writers more difficult.