mike montagne
Member
A Software Developer's Advice For Avoiding Viruses In Windows
I've written millions of lines of Windows code with dozens of tools; and perhaps I should delineate the viral susceptibility issues of Windows, as, just for instance, I maintain a political website which receives hundreds of thousands of unique visits a month, and I respond to email received on a development system, onto which have landed millions of viruses over the course of the last few years. None have ever unleashed; and neither has anyone who has followed my advice suffered a viral infection.
The problem is really the underlying philosophy of Windows software; and if you understand this first, you can easily enough protect yourself without viral ware. That's right. I run no anti-viral ware, and so I will first explain that if you rely on viral ware (even supported by a good firewall) for protection, you will suffer viral infections.
Why/how?
It's simple. Viruses/Trojans/worms... or whatever... are recognized by *known* patterns. The trick of course then to designing an effective new self proliferating threat is to devise an unknown or undetectable pattern. Of course, detection continually becomes more sophisticated; but just the same, if any detection scheme were wholly foolproof, then we all might be using those wares, and no problem would exist.
This is not the case.
The truth is, the virus which escapes any kind of such *assumed* protection is the one to worry about; and the further truth is that your ISP is probably running anti-viral/spam filters on your email which already eliminate most *known* threats from landing in your mail.
The *unknown* threat defeats this partial umbrella; and all the great viral infestations of existence are a result of this fault: Pattern matching only provides limited protection (which you will not even need unless you introduce unwanted material to your system from sources other than mail [which should already be effectively filtered]).
The trick to *real* protection then is never *executing* potentially dangerous material.
Why; and what does this mean?
As I said, the real threat is the way Windows software works. Windows objects are designed to be able to interact with each other; and even while the processes by which they do so are highly inefficient, this ability for independent objects to execute processes distinguishes the whole vulnerability of the Windows software philosophy. Understanding the difference, you can protect yourself by exercising standards.
Collectively, the many objects and/or processes of this nature are often referred to as ActiveX. To protect yourself on Windows boxes, you have to wholly disable ActiveX (including scripted forms) wherever it is possible to do so; and you have to refrain from running any processes which will run unknown ActiveX.
This means that you must disable all ActiveX activity in Internet Explorer's custom security settings (which actually configure the operating system). Neither can you have a preview pane open in your mail program, because *previewing* any material containing a virus essentially runs the virus ostensibly to display ("preview") the material.
The thing is, a virus is always just a file or a part of a file. Laying dormant on your machine (whether that be on the Mac side or the Windows side), they actually pose no threat to you (except that you might inadvertently run them). *It is only when you run them that you unleash them.*
Many ActiveX controls are treated as attachments. Thus one obligatory protection (even if you run anti-viral ware) is to set up mail rules which divert incoming mail with attachments to a "Potential Virus" mailbox. From here, you open *the source code* to the mail to read the mail. Sure, I understand this is a huge impediment, but if you want to protect yourself against viruses that will get by filters, you absolutely have to do it; and if you do it, your anti-viral ware will be performing redundant operations for you, won't it?
Indeed that's so.
A further thing to understand is that AVware itself is often a substantial threat to the sanctity of your system. Being a software developer, I refuse to run it because it poses unnecessary threats to contending processes.
You *do* however need a firewall to protect your file system not only from internet threats, but from threats infiltrating your network (if any). ZoneAlarm is the best out there for Windows, because in its stealth mode, your IP isn't even visible to potential intruders. Not being able to find you even means they cannot target you.
So furthermore, this is the great general difference between UNIX/Linux software and Windows software for which you have gravitated to the Mac. It's also something for all of us to remember who develop or use software; because it prescribes two classes of software design -- one which is wholly vulnerable and is impractical to truly protect; and another which simply refrains from running potentially vulnerable entities.
We might say then that good software engineering philosophy is to purposely refrain from running *any* potential threat -- versus celebrating the adverse idea that interoperability of *any* potential process (which inherently includes potentially adverse processes).
What makes the prospect of the latter even more displeasing is that the alternate design philosophies are also far more efficient.
Pastle said:
I've written millions of lines of Windows code with dozens of tools; and perhaps I should delineate the viral susceptibility issues of Windows, as, just for instance, I maintain a political website which receives hundreds of thousands of unique visits a month, and I respond to email received on a development system, onto which have landed millions of viruses over the course of the last few years. None have ever unleashed; and neither has anyone who has followed my advice suffered a viral infection.
The problem is really the underlying philosophy of Windows software; and if you understand this first, you can easily enough protect yourself without viral ware. That's right. I run no anti-viral ware, and so I will first explain that if you rely on viral ware (even supported by a good firewall) for protection, you will suffer viral infections.
Why/how?
It's simple. Viruses/Trojans/worms... or whatever... are recognized by *known* patterns. The trick of course then to designing an effective new self proliferating threat is to devise an unknown or undetectable pattern. Of course, detection continually becomes more sophisticated; but just the same, if any detection scheme were wholly foolproof, then we all might be using those wares, and no problem would exist.
This is not the case.
The truth is, the virus which escapes any kind of such *assumed* protection is the one to worry about; and the further truth is that your ISP is probably running anti-viral/spam filters on your email which already eliminate most *known* threats from landing in your mail.
The *unknown* threat defeats this partial umbrella; and all the great viral infestations of existence are a result of this fault: Pattern matching only provides limited protection (which you will not even need unless you introduce unwanted material to your system from sources other than mail [which should already be effectively filtered]).
The trick to *real* protection then is never *executing* potentially dangerous material.
Why; and what does this mean?
As I said, the real threat is the way Windows software works. Windows objects are designed to be able to interact with each other; and even while the processes by which they do so are highly inefficient, this ability for independent objects to execute processes distinguishes the whole vulnerability of the Windows software philosophy. Understanding the difference, you can protect yourself by exercising standards.
Collectively, the many objects and/or processes of this nature are often referred to as ActiveX. To protect yourself on Windows boxes, you have to wholly disable ActiveX (including scripted forms) wherever it is possible to do so; and you have to refrain from running any processes which will run unknown ActiveX.
This means that you must disable all ActiveX activity in Internet Explorer's custom security settings (which actually configure the operating system). Neither can you have a preview pane open in your mail program, because *previewing* any material containing a virus essentially runs the virus ostensibly to display ("preview") the material.
The thing is, a virus is always just a file or a part of a file. Laying dormant on your machine (whether that be on the Mac side or the Windows side), they actually pose no threat to you (except that you might inadvertently run them). *It is only when you run them that you unleash them.*
Many ActiveX controls are treated as attachments. Thus one obligatory protection (even if you run anti-viral ware) is to set up mail rules which divert incoming mail with attachments to a "Potential Virus" mailbox. From here, you open *the source code* to the mail to read the mail. Sure, I understand this is a huge impediment, but if you want to protect yourself against viruses that will get by filters, you absolutely have to do it; and if you do it, your anti-viral ware will be performing redundant operations for you, won't it?
Indeed that's so.
A further thing to understand is that AVware itself is often a substantial threat to the sanctity of your system. Being a software developer, I refuse to run it because it poses unnecessary threats to contending processes.
You *do* however need a firewall to protect your file system not only from internet threats, but from threats infiltrating your network (if any). ZoneAlarm is the best out there for Windows, because in its stealth mode, your IP isn't even visible to potential intruders. Not being able to find you even means they cannot target you.
So furthermore, this is the great general difference between UNIX/Linux software and Windows software for which you have gravitated to the Mac. It's also something for all of us to remember who develop or use software; because it prescribes two classes of software design -- one which is wholly vulnerable and is impractical to truly protect; and another which simply refrains from running potentially vulnerable entities.
We might say then that good software engineering philosophy is to purposely refrain from running *any* potential threat -- versus celebrating the adverse idea that interoperability of *any* potential process (which inherently includes potentially adverse processes).
What makes the prospect of the latter even more displeasing is that the alternate design philosophies are also far more efficient.