Google makes promise it cannot keep

newsguy 0 839 Views

So Google reckons that it can provide in Chrome, even to the point where according to Google's Engineering Director, Linus Upson, it will herald the end of malware. That's what he went on the record to say, promising that Google was "completely redesigning the underlying security architecture of the OS so that users don't have to deal with viruses, malware and security updates." Which could just end up being one of those 'why did I say that' moments that go down in software development folklore. Not least because as soon as you say something is 100 percent secure, is malware-proof then out of the woodwork crawl all the bad people just itching to prove you wrong.

One application vulnerability specialist, Richard Kirk of Fortify Software, told us "You can have the most bug-free operating system in the world – which is what energy companies have in the shape of the SCADA-compliant embedded firmware that drives their critical systems - but if the software has bugs in it, you're dead in the water."

Kirk continues "The plans of Linus Upson, Google's engineering director, outlined in the latest New Scientist magazine are laudable and, if they turn out to be correct, will make computing a lot safer for everyone, but the plethora of software that is available - and being developed all the time - makes the task of eradicating viruses impossible."

According to Kirk, this isn't to decry Google's plans for a secure operating system, although he also noted that the company's plans took a battering recently when two flaws were revealed in the Chrome browser application. The irony of Upson's plans is that embedded firmware versions of Windows are already in active use on SCADA-compliant systems in critical government and utility grids the world over, he explained. The downside of using an embedded operating system is that it cannot be easily updated, but that is a small price to pay for a more secure computing environment, the Fortify director went on to say.

Dani AI

Generated

Marketing promises aside, the useful takeaway from this thread is not whether any vendor can stamp out malware forever but which engineering controls actually reduce real-world risk. is right to be skeptical of absolute claims, and is right that no broadly used OS stays immune once it gains features and market share. raises the complementary concern: a web-centric platform can concentrate both convenience and sensitive data, so privacy and control matter as much as bugs.

There are a few timeless technical reasons a single OS can never be 100 percent immune: complexity (tiny bugs in large codebases), third-party apps and plugins, privileged services that must talk to networks and hardware, human error and social engineering, and supply-chain or hardware-level issues. Because of those, the realistic goal is containment and rapid recovery, not perfection.

Practical architectural choices that materially lower risk include:

  • process- and site-level sandboxing to limit what a compromised component can touch
  • least-privilege user and service accounts so apps run unprivileged by default
  • cryptographically signed system images and verified-boot to detect tampering
  • automatic, atomic updates with rollback to remove exploited code quickly
  • minimal default services and exploit mitigations (ASLR, DEP, etc.)
  • strong isolation for web content and packaged/signed apps
  • easy data-export, encryption, and user controls to counter centralization of private data

For readers looking to act now: keep systems and browsers patched, run day-to-day accounts without admin rights, use separate profiles or guest sessions for untrusted sites, enable disk encryption and regular backups, vet extensions and apps, and prefer platforms that let you export or locally control your data. Treat any OS as one layer in a defense-in-depth strategy rather than a silver bullet.

Member Avatar for happygeek
happygeek 2,411 Most Valuable Poster

I note that Apple makes a similar claim with "Mac OS X is designed with security in mind. Its built-in defenses help keep you safe from viruses and malware without the hassle of constant alerts and sweeps" although further down the same security puff page it does have a disclaimer which states "The Mac is designed with built-in technologies that provide protection against malicious software and security threats right out of the box. However, since no system can be 100 percent immune from every threat, antivirus software may offer additional protection."

I don't think any OS can be bulletproof, certainly not for long. Give it market share of any kind, give it additional functionality of any kind, and the bugs creep in, the holes appear and the secure smokescreen is shattered.

Member Avatar for von_Wanderlust
von_Wanderlust 0 Newbie Poster

Problem is that {Chrome|Android|iPhone|TakeYourPic} will become the new malware. Why?

Google tried hard not to let you delete your mail (data). Same with Facebook accounts, wouldn't want to make it easy to delete your info (data) and account details (data) would we? They do not see this as your private information, it's potentially profit creating data, and it's theirs goddammit!

Facebook can see where and how you interact with others and what you are looking at. Now that Google has Chrome OS, they will be able to as well. Excellent. And in the meantime we have Phorm which is getting ready to jump out from behind the bushes at any time so that it can watch your data and online habits as it flows through your ISP.

Apple locks it's iPhone platform down so that you can only use XYZ telco, and only approved apps can run on it - basically it already has built-in malware that is in control of the product rather than the actual owners.

And I am sure there are another 100 startups just waiting to come and get as close to you as an immediate family member and improve your quality of life by selling your data in exchange for free services. It doesn't matter which one it is, or whether you swat one away (hopefully Phorm is gone now), but there WILL be a Goliath Corporation whether you like it or not.

All I want to know is, will there be a real life Thursday Next to save me??

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview