Ed Bott's Windows Expertise

Mark Stephens, the PBS pundit who goes by the pseudonym Robert X. Cringely, is modestly famous for his bomb-throwing anti-Microsoft screeds. He’s also famous for being flat-out wrong, often, even when it comes to his own professional credentials. His latest column, A Whole New Ball Game, reaches new heights of misinformation. Here’s a snippet:

Last week, a Microsoft data security guru suggested at a conference that corporate and government users would be wise to come up with automated processes to wipe clean hard drives and reinstall operating systems and applications periodically as a way to deal with malware infestations. What Microsoft is talking about is a utility from SysInternals, a company that makes simply awesome tools.

This is pure horseshit. One surefire indicator that something is rotten in this particular pulpit is that Mark’s … oops, sorry … Bob’s column contains no links. In fact, his columns never link to any external sources of information. Isn’t it remarkable that someone who writes a weekly column for the Internet never links to anyone else? If you want to actually check the facts about something Mark/Bob has written, you have to go dig it out yourself.[*] In this case, the quote is from a presentation at the InfoSec World conference by Mike Danseglio, program manager in the Security Solutions group at Microsoft. The story was originally reported by Ryan Naraine of eWeek. (Read the whole thing here, and see some additional remarks of mine here.)

Did Danseglio really say that corporate and government users should “periodically” wipe and reimage systems? No, not at all. He said that’s the most effective way to deal with a system that has been compromised by a rootkit or an infestation of some advanced spyware programs. And he’s right. When you let someone else take over your operating system, it’s not your PC anymore. You could spend hours or days trying to find and remove all traces of the intruder, but you’d never know for sure whether you were successful.

So, wipe and reimage as a last resort. But the smart, safe strategy that Danseglio recommends is prevention. In fact, if you click to the second page of the eWeek story, you read this conclusion:

According to Danseglio, user education goes a long way to mitigating the threat from social engineering, but in companies where staff turnover is high, he said a company may never recoup that investment.

“The easy way to deal with this is to think about prevention. Preventing an infection is far easier than cleaning up,” he said, urging enterprise administrators to block known bad content using firewalls and proxy filtering and to ensure security software regularly scans for infections.

That’s good advice, and it’s consistent with the “defense in depth” strategy that the Microsoft Security Response Center has been advising for years. But you’d never know that if you read only Cringely, who preaches to an audience that’s eager to sop up anti-Microsoft propaganda, no matter how ill-founded or factually challenged.

And then there’s this:

The crying shame of this whole story is that Microsoft has given up on Windows security. They have no internal expertise to solve this problem among their 60,000-plus employees, and they apparently have no interest in looking outside for help. I know any number of experts who could give Microsoft some very good guidance on what is needed to fix and secure Windows. There are very good developers Microsoft could call upon to help them. But no, their answer is to rebuild your system every few days and start over. Will Vista be any better?

Given up on Windows security? Yeah, I guess Windows XP SP2, Windows Defender, Windows Live OneCare, Microsoft Client Protection, and the many security improvements built into Windows Vista don’t really exist. No internal expertise? That’s ludicrous, as anyone who’s spent even 10 minutes with the Windows team would know. No interest in looking outside for help? As Scoble points out, all you have to do is look at the attendee list of Microsoft’s BlueHat Security Briefings to know that conclusion is not supported by any facts.

Or you could just look at the by-line. If it says Cringely, you know it’s wrong.

Update: Dwight Silverman is skeptical about some unrelated parts of the same Cringely column.

[*] As some commenters point out, a separate page, unmentioned in the original column, includes a link to the eWeek article. I’m a little baffled at the idea that a columnist who writes a weekly column for the web hasn’t learned how to create hyperlinks. It is 2006, after all. But technically, he did provide a link to this article, if you know where to look.

38 Responses to “Robert X. Clueless”