Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I've seen an interview with Richard Stallman some time ago, and he was asked a question about security and Windows OS which he answered saying that there are some relatively bad design decisions that were made when creating the Windows OS. These design decisions (according to R. Stallman) were known at the time for creating security vulnerabilities later on.

Can anyone explain what he's talking about ?

The video with the interview can be found here http://rt.com/news/richard-stallman-free-software-875/ - it starts at 8:30.

share|improve this question

closed as not constructive by Jarrod Roberson, Yannis Rizos Feb 22 '12 at 16:55

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
What Stallman is saying is simply that when Windows were first created, some design decisions introduced known (at the time) security vulnerabilities. From the video alone there's no way to tell which exact decisions he's referring to. Stallman has been quite vocal against Windows and other proprietary software, and you can find several other interviews online where he is a bit more specific. –  Yannis Rizos Feb 22 '12 at 15:39
    
I remember having read in great detail about similar things in an article on Gibson Research's page. I couldn't find the original, but I found this more recent one (PDF document): grc.com/sn/sn-197.pdf –  Péter Török Feb 22 '12 at 15:46

2 Answers 2

I'm not Stallman, but here's my guesses:

  • Single-user, with no roles or permissions. Yes, this has changed, but only recently, and there's still a tradition of single-root-user.

  • Default opening files with exclusive read access. This leads to frequent rebooting to install new versions of DLLs and so forth. Frequent reboots are the only way that a boot sector virus would spread.

  • Default executable file attributes, with file extension determining what executes the file. How many phishing emails have succeeded because of something named "whatever.jpg.exe"?

  • Until Windows 2000, no address space protection. This allows one process to write into another process' address space and cause problems.

  • Not exactly an operating system issue, but allowing people to send emails that caused execution on the receiving machine was known to be insane. Sure it was cool and it let you do fun things, but it also let people create email worms like MELISSA and the LOVE BUG. When early versions of Outlook appeared, there was a lot of usenet commentary on how silly that was. I recall someone writing that until Outlook came out, if you'd written an email client that executed incoming emails, people would have looked at you like you had a hole in your head.

Who knows what Stallman meant? Those are only the ones that immediately pop into my mind.

share|improve this answer

IMO the biggest flaw is the frequent need for elevated privileges. Installing the most trivial application requires access to the Registry and system folders and everything else. This leads users to have administrator privileges enabled all the time, or else to routinely enable them whenever they are prompted to do so. Combine this with a generally naive user community, and a barrage of malware via E-mail spam and the web, and it's no surprise Windows systems are so often compromised. Other operating systems (e.g. Unix) were designed to protect the system from users, and protect users from each other. Most tasks, including software installation, can be installed without elevated privileges, so the effect of user-installed malware is somewhat limited. Malware can still do pretty bad things to the user's data, but it is much less likely to corrupt the operating system.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.