The Artima Developer Community
Sponsored Link

Agile Buzz Forum
Why WGA is a bad idea

0 replies on 1 page.

Welcome Guest
  Sign In

Go back to the topic listing  Back to Topic List Click to reply to this topic  Reply to this Topic Click to search messages in this forum  Search Forum Click for a threaded view of the topic  Threaded View   
Previous Topic   Next Topic
Flat View: This topic has 0 replies on 1 page
James Robertson

Posts: 29924
Nickname: jarober61
Registered: Jun, 2003

David Buck, Smalltalker at large
Why WGA is a bad idea Posted: Nov 20, 2006 12:03 PM
Reply to this message Reply

This post originated from an RSS feed registered with Agile Buzz by James Robertson.
Original Post: Why WGA is a bad idea
Feed Title: Cincom Smalltalk Blog - Smalltalk with Rants
Feed URL: http://www.cincomsmalltalk.com/rssBlog/rssBlogView.xml
Feed Description: James Robertson comments on Cincom Smalltalk, the Smalltalk development community, and IT trends and issues in general.
Latest Agile Buzz Posts
Latest Agile Buzz Posts by James Robertson
Latest Posts From Cincom Smalltalk Blog - Smalltalk with Rants

Advertisement

Tim Bray gives more than a few examples of what kind of havoc is likely to erupt from the new kill switch piece of WGA in Windows Vista:

Let’s see, suppose I’m a black-hat profiteer sitting beyond the reach of Western law but with control over a few botnets . If I can get my hands on your Kill Switch, I’ll have a nice little extortion business, as in “Pay up or all your desktops will decide they’re unlicensed and turn off.” It’d work best in a sales-centric business near end-of-quarter. Another potential victim would be any government (or company even) that has a lot of enemies; they don’t want your money, they just want to take you down. So, without thinking too hard, here are some attack vectors I’d consider: If I can subvert your network routing, gotcha! If I can subvert the registry on your desktop machines, gotcha! If I can subvert the NTP protocol (how most computers learn what time it is), gotcha! I’m sure that an actual seasoned network engineer could think up a half-dozen more attack scenarios over a cup of coffee. Finally, never ascribe to malice that which can be explained by incompetence; WGA is software and software has bugs and if one of those bugs flipped the Kill Switch on your sales infrastructure offline during the Christmas rush, well, there wouldn’t be any malice involved, but it’d sure be a pity. What prudent businessperson, I wonder, is going to install critical infrastructure that can be turned off remotely, trusting the claims that only the good guys will be able to find the key to the “off” switch?

That last part is instructive - do you want to be manning the help desk at a critical part of the year after Windows decides that it's not genuine?

Technorati Tags: ,

Read: Why WGA is a bad idea

Topic: Smalltalk Daily: 11/17/06 Previous Topic   Next Topic Topic: It worked so well for SCO

Sponsored Links



Google
  Web Artima.com   

Copyright © 1996-2019 Artima, Inc. All Rights Reserved. - Privacy Policy - Terms of Use