not so much computer competence test (although useful) - more likely 'common sense' tests (although I suspect a lot of people would fail that.

I'd settle for the competence test though, some of the people I have to deal with shouldn't be let anywhere near a computer.

So when will we admit that it isn't a blow against the Electronic Freedom Foundation to say: "Unlicensed users can use secure browsers on restricted 'information appliances' for surfing. But anybody who wants to run a machine that can be compromised has to demonstrate a minimum competence"?

Such a "restricted information appliance" already exists: It's called a Mac. :) Problem is, it's too expensive...

I've often though that the solution is to simply release a few old school virii into the wild - ones that render infected machine inoperable, and require a re-install. Not only will this decimate botnets, it would also make the affected users think twice about securing their machine next time they re-install windows.

...in that I do not believe anyone has been killed and left in a blood-soaked heap when someone else clicked on a phishing email.

Guy's argument is basically that if we are protecting people in our society from others in cases of -direct- threats - being run over or run off the road - that it makes sense to protect them from -indirect- threats - having a slower connection or getting lots of spam.

It makes sense for the government to safeguard citizens from direct threats to life and limb.

Guy says that this means it makes sense for the government to safeguard citizens from third- or fourth-degree threats against some vague potential inconvenience that might possibly have a financial impact.

Perhaps one should have to take a license test before writing a column.

"Do they know how to find and eliminate malware? No!"

Very few computer users even know how to detect that their computer is running malware, let alone find the malware in question, let alone eliminate it. I think you've just banned well over 99% of the population from using a computer.

"Are they running up to date anti-virus software? No!"

AV software is security theatre. If you don't want to get infected, you need to change your behaviour, not soak your machine in disinfectant and keep your fingers (legs?) crossed.

"Could they actually detect a fault in their security package? No!"

Crikey! I suspect that only a few hundred people on the whole planet have reverse-engineered the major AV products in sufficient detail to detect faults in them, and they are probably the ones writing the malware in question.

I propose a simpler test: Anyone who normally runs their computer with an administrative account should be defenestrated.

Trojans will still have limited use because you can't get a user to stop it. You can stop hiding the extension, however (MS thinks this is too scary for people, though. I've always wondered why they say "FLI file" when they don't know what the feck runs an .fli file, but there we go) and this will reduce it. You won't get "britney_spears_muffshot.jpg.exe" being clicked on.

Stop macros being so powerful would help with opening word documents (though you shouldn't be opening them unless you know who they are from: showing all headers will show if it's been faked).

IE comes OUT of the OS. Use an HTML renderer and give a standard API for it. Some people can change the POS IE html for something that's a POS in a different way.

When you become admin, you can see anything that's going on. That includes DRM files that are hidden from ANY view unless you boot into linux! You can see then whether your disk is disappearing because your machine is storing KP. The computer should only get in your way when it's telling you something, not when you're trying to find something out. You don't have to be admin.

Some of the "help" MS did was to make computers less scary. But all they've done is let people who don't WANT to learn about how it works use it and, in the process, stop them

a) learning

b) finding out what's gone "wrong"

For those who don't want a complicated life, an OS that's reduced in functionality is fine. E.g. the only access to the internet is through a web browser and email. If that's not good enough for you, get something "scary" and learn how to use it.

Some serious views!

I agree that certain groups of the people do indeed need licensing to even approach a keyboard.

Unfortunately the society we live in allows anyone access the web nearly anywhere, anyhow.

Is this a bad thing? A large part of my income is generated by incompetent fools at the helm of an OS.

Think of the content that is provided to the world of IT literates at the amusement of others.

Did anyone think of BOFH!!

``Most important, can we design a sandbox PC, which does what most of us want (visiting Facebook, managing photographs and videos and music, searching the web for news and chat) but which can only run other software when recognised by the ISP which provides our web link?"

There is no need to `_design_ a sandbox [sic] PC.' The technology to achieve your goal already exists to some extent in the form of Trusted Computing. A Trusted Platform Module (TPM) can attest to the systems state. An ISP can then decide as to whether this state is suitable. The problem, of course, is too many states exist. If, however, an ISP subscription included a laptop (or PC) which it maintained remotely (as part of its service package) then the state would be known and this solution would be viable.

Interesting article but I fail to see the analogy between a home computer and a car working unless you plan to throw the desktop at someone each day.

I wonder what we are gaining by ever increasing nanny state. Maybe the terrorists are mostly in our heads.

I agree with you on asking questions, the more the better.

Wouldn't it be better / cheaper / easier to give these people a "Dumb Terminal" where everything they need is stored and controlled at the ISP?

...some of the people I have to deal with shouldn't be let anywhere near a computer.

Same here. It's frightening really what some people clearly don't understand. Even more frightening are those who have no understanding, but think they are experts. Those kind of people are truly dangerous.

It's hard to know where to begin with this.

PC's are mqarketed/sold/presented as consumer appliances. Ever watched a PC World advert ? And I suspect the selling of security applications are seen in the same way as the 'extended gurantee' scam.

The car analogy is poor. You are forgetting that in 99% of cases the user is the *victim* of a crime - not a perpatrator. You are entering the murky realm of 'contributory negligence' at best.

Sure - it would be nice to turn the net back to the time it was the province of a handful of geeks and university students but .... aren't you the same Guy Kewney who wrote a long ranty article about the time his PC broke and he forgot to save his document ? Or was that Guy Goma ?

Users need (and deserve) secure networks, secure operating systems and the real criminals need to be punished.

(The article then seems to randomly leap onto the unrelated subject of corporate security - as opposed to individuals)

In my university, anyone can walk in and plug their laptop (or even desktop) into the university network and, once the MAC has been registered, is free to do as they like. However, if your computer has one of a number of network spreading or botnet-zombie viruses detected on it, it's cut off until you prove it's infection free. They'll even help you reinstall it, if you want. Surely an ISP can do similar? I know that there'll be arguments of personal responsibility, and economics, but it hurts ISPs as much as the rest of us when a botnet strikes.

As for a secured browser, I've long thought that it might be worth having bank websites only respond to a certain type of secured browser, above and beyond the little padlock icon, in order to prevent phishing.

You cannot compare a driving test to a computer competence test. If you behave badly on the road, you may well kill someone. If you allow your PC to send out enlargement e-mails then you may annoy a few people.

Can you tell the difference?

isn't there a joke about making things idiot-proof, and they'll just invent a better idiot.

Competency tests, and exams are all very well, but people still jump red lights, don't indicate, drive too close etc etc.

In this case, I'm sure the MoD have rules about securing MoD property (irrespective of whether it's a PC or a box of paper-clips) when off-site.

Why does my office have signs on the fire extiguishers : "Do not use these fire extinguishers to hold the fire doors open" ?

As part of our SOks compliance all users in the company now have to do a "data protection" test.

Its simple stuff like avoiding phising etc.

Seems like a good idea to me

With the rate at which legislation progresses, a high-powered computer would currently be rated as one running above 500Mhz with over 100 Megabytes of RAM and a hard drive measured in Gigabytes.

I could get behind taxing ISPs of people who haven't taken an internet safety course, but this again risks the illusion of safety. Having a standard list of ways to tell if a link is phishing for instance would be begging a phisher to come up with a site which passes this test because even more sheep than usual would trust it.

Driving licenses require different tests for different vehicle classes. Do you propose a similar system based on some aspect of the equipment being used for net access? Would that be hardware? Operating system? Browser? Email client? Something else?

What if I build my own system or write my own software? Would the knowledge required to do this exempt me from any such testing or would everything I built and wrote have to go through some sort of 'networthiness' test? This all sounds like a bureaucrat's wet dream but I don't think the public or the ISPs would wear it.

Utterly bonkers.

Utterly unpolicable.

There's so much wrong with this idea, practically and ideologically it's difficult to know where to begin. If you want to have a free internet, suggesting that massive government oversight of all users is the way ahead suggests that you regard freedom and security to be in perfect correlation, with security as the driver.

Presumably licenses would be revoked for catching a virus (aargh ! One click and that's my software business ruined !), it's the spammers that the ISP would send the bill when your 1p per email limit is breached and it would all be run by a benign and completely competent goverment organisation.

Unplug em all I say ! Especially those teenage game players.

Computer competence tests are something I've advocated in one form or another for most of my professional career thus far, some 12 years.

How many companies would improve their performance and morale, leaving the IT crew to get on with the important stuff (working on improving things rather than firefighting) if their staff were all competent to one decent, professionally competent level.

A lot of people would fail a common sense test and of course there will be those who complain about human rights being infringed.

I could start on about how people should pass a test before being allowed to breed, as that would be a more useful step in improving society.

One might be missing the point that it isn't a perceived threat nor inconvenience to the user that the author is debating - rather the addition of the users computer to a botnet that can be used again more significant (read valuable) targets.

I'm sure no one here is suggesting that people should be licensed simply so they can prevent a small and usally completely insignificant inconvenience to themselves (as if they cared/noticed I'm sure they would take it upon themselves to do something about it if it were a significant enough problem) as this would obviously be down to them. However, their participation (willing or otherwise) in botnets, etc. is something that needs to be addressed or at least discussed as evidenced by the massively increasing frequency and organisation behind this style of attack (mallicious or otherwise).

"I've often though that the solution is to simply release a few old school virii into the wild - ones that render infected machine inoperable, and require a re-install. Not only will this decimate botnets, it would also make the affected users think twice about securing their machine next time they re-install windows."

I like it. In fact, I think I love it.

Job security!

Any PC on the ISP's network that is "doing bad things" should have their connection redirected into a sandbox. The user would then be required to submit the machine to an MOT style test - is it fit to be connected to a public open network (road worthy). This check is chargeable, and any "repairs" are also chargeable. If the machine was not "doing bad things", then the ISP must pay compensation.

All machines must have a annual MOT test (just like cars).

All People must have a proficiency test, could be an on-line or VOIP test, to ensure they understand how to "drive safely", "perform routine maintenance" and fix basic problems "change a wheel". This could be taught in schools, like cycling proficiency - teach them when they are young, before they get any bad habits.

What "doing bad things" means in reality is open to discussion - but would be acting as a bot, spamming, spreading malware, etc. It would not be using P2P apps, or playing games.

ISP's would need to be regulated by an organisation with teeth who are not afraid to punish.

There are lots of problems implementing such a scheme, and maintaining it, but just because something is hard to do does not mean we should not try.

everyone should be banned from using computers unless they can prove that they are capable of using them competently.

i have the unfortunate job of maning a helldesk and i want to cull my entire user base.

Sounds like a good idea in some people's cases (a mate of mine phoned me up a few months back after discovering his PC had 'suddenly' contracted over 350 viruses. Not long after, the hard drive practically vaporized itself, he's had something like 6 complete reinstalls over the last year).

Maybe it would be simpler to build a control into the OS rather than having a licence. After so many stupid occurrences a message could be displayed to the user, along the lines of:

"Your computer has experienced a serious problem - you. Please pack the machine and all related peripherals into the original packaging and return to the original store, where they will provide you with an appropriate replacement system (pencil, paper and an abacus)"

Why compare driving a car to owning a computer? Will someone die if you walk away when a program is running? That's then you might need training - something like an air traffic controller for example. Someone checkign emails? Who cares?

People who care will look after thier systems, people who don't will moan about how slow thier systems is and end up paying someone to sort it out.

Licence to run a computer,, geez. Next you'll be saying you need one to own a mp3 player to ensure you understand copyright issues...

In five years time users will connect through voice or portable devices. There will be even less awareness of security because of the originating metaphor of the telephone.

At the same time, if TelCos hold their control as they do nowadays, those mentioned restrictions could apply simply because they are already built-in by design and nobody complains about that.

I guess the problem is that, in IT, we always looked to translate one experience to another, how many times I heard:Internet <--> Freedom of Expression which does not fit very well, especially now that the Internet has become a commercial workplace.

As for users being held responsible: I do not agree. A car is simple to start and drive. The same should be for computers and their security tools. The fact is that we use mediocre technologies and the level of complexity of modern OSes is rarely understood by their creators themselves. Not that I would go back to the Speccy but... Well 48Kb seemed so much to me!!

G B

If clever people really want to do bad to dumb people, all you can do is slow them down e.g. signature based AntiVirus is often like shutting the stable door after the horse has bolted, you also need dynamic anti-intrusion software.

Damn right liberty matters, we need all the liberty we can get in this insiduous Socialist police state, with self-censored media

A very partisan and elitist opinion. There is much truth in what you say, but in pandering to your sites demographic, you have comprehensively failed to address the ramifications of your suggestions. A restriction on computer use would result in the stagnation of the technological development that has resulted from the proliferation of PCs across the World. Much fewer and more expensive Killer Apps' would be available, game and CGI development would never have been able to proceed to the levels that they have now due to more archaic technology and higher cost due to fewer sales. Think of the impact of cost and logistics on schools and universities. Also, bear in mind that many of the malware that untraps these less "non-IT industry" mere mortals was written by highly talented, if unscrupulous, software engineers who will just work harder to entrap the brave new breed of licenced users. What is needed in not legislation to stop less talented people from using information technology, but for a worldwide consortium that REALLY takes ownership of problems such as botnets, ID theft and viruses, while relentlessly persuing and prosecuting the perpetrators. Anything else is pure fantasy. If you don't like it, stay beardy, fire up that old 386, and log on to Usenet.

No one needed a license or tests when the first cars came along, either, but imagine if no one had to take any tests or get any education about cars these days...

Matt wrote "As part of our SOks compliance all users in the company now have to do a "data protection" test."

Same here - and they add the "if you're found to be willfully ignoring this advice then you're sacked/prosecuted" type notes too - just to ram the point home.

Here's a thought for SteveB/BillG etc - if we have to endure the "Take a tour of Windows XP", why not similarly force users of new installs to take a basic "this is how to operate safer" presentation, (please no flames about MS supplying such a presentation - I run Linux too). And for all those folks who have to reinstall their OSs (journo's etc) just add a small tick-box on the install process that says "Skip security presentation" (default=no). If you're smart enough to want to reinstall, then it's likely that you should be smart enough to know what's good operating procedure.

Or another approach - have your new system operate in a very restrictive mode from day one and then only open up as you show that you need more capability. After all, my ZoneAlarm firewall supposedly watches what I do and then figures out settings accordingly, so I'm just asking for the OS to follow this idea.

@Ken Hagan: I'd willingly give up Admin rights on my XP system if there was someway to "su" when I needed to. Yes, I know I could probably have a separate "Admin" account and use that for software installs, but unfortunately there's a lot of XP programs that just plain fall flat on their ass if you use a non-privileged account. I like Debian's approach in this.

Lastly, what worries me (slightly) is that with more stuff being net connected that these bot nets might - at some point - be used as a vector for cyber terrorism. Hack a 777 and threaten to drive it into the ground, etc. In which case if we all operate with a bit more savvy then, as Guy says, we'll all benefit from a better environment.

"Why does my office have signs on the fire extiguishers : "Do not use these fire extinguishers to hold the fire doors open" ?"

It's because some idiot decided that, because fire doors should always be closed after use, they should not have any way to latch them open during use.

Then, when normal use turns out to involve leaving them open for a few minutes to load or unload heavy stuff by hand, people use the nearest heavy weight that's to hand. Which turns out to be the fire extinguisher.

In other words, it's a consequence of proscription without proper thought towards need. You see it every day in any sufficiently large organization.

Then to "fix" the problem they put stickers on the fire extinguishers but again fail to provide a solution to the *actual* problem of the doors not having latches or wedges provided.

It's at this stage that it all seems not so much a lack of foresight but a lack of any kind of sight at all.

This is why employees sometimes buy their own door wedges.

I think Guy's idea of a charge for sending e-mail is a good one. If ISPs were legally required to charge a user, say, 1p for every e-mail sent from their machine the effects would only be beneficial:

- the average used would still be sending their mail at a minimal cost of a few pence per day.

- businesses would also be minimally affected and could treat it as a business expense anyway.

- deliberate spammers would finally have to pay for the irritation they cause but that is their choice: nobody is forcing them to be spammers

- people with unprotected and infested machines would get to pay for their carelessness. Serve them right too, and maybe teach them to get a clue and secure their systems.

- the threat of class actions might even force those selling chronically insecure operating systems or easily infectable mail clients to rewrite them.

The ISPs are the obvious place to apply the charge: several already monitor data volumes and so already have the technology to bill the correct user despite the use of dynamic IPs. Doing the same for outbound e-mails should be easy enough to implement and difficult for miscreants to dodge: simply count outbound e-mails and add the total cost to the monthly bill.

...live in a house. You have to be able to fix basic problems like faulty plumbing or electrics.

....drive a car. you have to be able to fix basic problems like failure to start due to loose wiring to ECU.

....use a camera. You have to be able to pass a test of all the basic features like use of Program mode.

...use a cooker. You have to pass a basic cookery course.

...use a mobile phone. You have to pass a test in the the current SMS jargon and know how to setup MMS and data features.

Yeah right.

I have always had a good idea for a common sense test...

You take somebody in to a canteen and get them to choose a hot meal of their choice. The person serving them puts the plate on to their tray and says, "Be careful, the plate is hot." If the first they do is touch the plate then they fail. Simple!

Amen to that!!!

I've long held the opinion that people should have to pass the following basics of being able to use a computer before they are allowed to purchase one:

1. Be able to set up an email account from scratch

2. Be able to install and uninstall a program from a PC

3. Know what a web browser is

4. Know how to add and remove a printer

5. Know the difference between POP3 and IMAP accounts

6. Understand what an SMTP or outgoing server is

I've heard the horrendous howls of the left wing "do-gooders" chanting that this is an elitist view; how many of these people have honestly had to walk people who have no clue beyond how to turn on the computer through the 10 or so minutes to set up an email account which if they had the above skills they would be able to do it inside 2 minutes?

Every day I deal with this and let's not even begin to pretend to understand the amount of people who want to register a domain and have a web site but don't even have basic skills or understand what FTP is or how to write a web site and it's just getting worse. The next person who calls asking me for assistance to upload a site using MS Publisher should be publicly flogged and have the wounds scrubbed with peroxide and steel wool.

Yes, I agree that licensing would take away a large segment of the economy supporting these 'idiots' and their ineptitude to do the basics but I have other things to do over the course of the work day asides from "hand holding and nappy changing". Some of these things that I would be freed up to do would be, chasing users who regularly breach disk quotas, follow up on outstanding accounts and developing documentation.

Irrespective of what your opinion is on this subject; the matter is a problem and one that I believe that must be addressed. It's not an easy subject but one that needs to be tackled all the same.

And you seemed like such a reasonable gentleman when you were on the telly discussing Ipods and such.

Now you're just a mean man who wants to stop anyone who isn't like him from accessing the internet.

Of course - similar requirements for a blogger ... sorry journalist would be useful. The ability to construct a rational and logical argument rather than pandering to an elite group's inflated sense of their own expertise/importance would be a start.

I agree with Mark on this; any restriction on internet use would simply drive the majority of people off the Net, reducing its value as an advertising and marketing platform (thats its main function now), this would drive up the cost of internet access for those still using it.

The problem with this idea, nice as it would be, is that creating, administrating and enforcing a "computer licence", particularly a multi-layered one akin to vehicle licences, would need a huge amount of government bureaucracy. This would be, by its very nature, so incompetent, corrupt and oppressive that the problems it would create would dwarf the problems it would attempt to solve, which it would probably fail to solve anyway. See also: eugenics (or "birth licences").

"Excuse me sir, Intertube Licence Enforcement Division. No sir, we don't need a warrant, we're like the RSPCA in that regard, and if you don't open this door within five seconds any fines we levy against you in the near future will be doubled."

"Do you have a computer sir? Good, may I see your licence? Good, email licence, internet licence, commenting on El Reg licence... hmm, you don't seem to be licenced for Team Fortress 2, sir. No, that's a Class B1 licence sir, that only permits you to play as the Soldier, Heavy or Pyro, and your Steam account clearly shows 3 hours of playtime as the Spy. I'm going to have to ask you to come with us down to the station, sir. Anything you say will be used against you, and anything you don't say, i.e. encryption keys, will also be used against you. Evening all."

There is an easy way to test users: develop malware the sole purpose of which is to report the numpties who infected themselves with it. Then go to the ISP and explain to them that these people are too stupid to be allowed on the net.

Well, first up, attack the idea, not the analogies he uses to explain it.

Secondly, this all sounds very similar to the NetPC idea I heard being batted around at the turn of the century. I believe it had limited local storage, and the applications and data were stored remotely and downloaded before running.

Java was in there somewhere too.

It seems to me this would be the "secure information appliance" you're looking for as all the user's activities could be monitored and controlled remotely.

I agree.

I do think however that there should be some punitive action possible for infected machines/users of.

Maybe a desructive payload that locks the drive completely and requires a small fine to unlock.

There should be some increased negative consequence to the user from allowing their machine to adversly affect the machines of others.

It would make botnets in participating countries largely untenable, at least until the owners of the botnets can find a way around the drivelock.

I'm surprised no one has suggested that the problem should be eliminated at source.

Ban windows and only allow unix-bases OS to access the net.

This would prevent default root access, and therefore bot takeovers. Even if the hackers turned their guns on the mac and linux boxes, they are inherently much more secure.

William

Most people are actually victims of their computers, it's just they don't know it.

Many laws are framed with a criterion of reasonableness - such as "would a reasonable person expect to know if their computer was being used to help crack the launch codes of ICBMs" Of course the answer is yes - get these morons off the net.

You appear to be saying that spam is the result of people sending too many CCs from their email accounts.

"Surely, if ISPs limited CC emails to 20 a day and charged 1p per email CC thereafter, most spam would dry up?"

Surely because most spam is sent by large botnets, then it just means that lots of different people in different locations would be hit by the equivalent of a phone-scam charge, which inevitably would have to be absorbed by the ISPs. Meanwhile the botnet owners continue to do their thing.

Or, do you mean that because the ISPs would charge per email, then they will be obliged to shoulder more responsibility for it travelling along their pipes, and hence put more effort into making it legitimate and secure???

I'm confused. Hopefully not as much as you appear to be, but quite possibly.

Mines the one with the sketch of mohamed on the back.

What about a licence to use, let's say, a fork? It's immediate danger is a lot worse than the one stemming from using a computer...

MC

> Indignation is the immediate response if you suggest to any computer user that they should be given a licence to use their PC only if they pass a test. Why is this?

Because it's a stupid idea Guy. As stupid as your delusions about your own ability and competence are. As stupid as your prejudices about other drivers and computer users are. As stupid as the over inflated estimates of the number of machines compromised and part of the so-called "armies of bots" there are. As stupid as sitting pouring over pointless firewall logs bemoaning the "attacks" your computer is fending off are. As stupid as your belief that somehow "online idiots" are disruptive to your life at all, let alone comparable to getting hit by a lorry or crash landing in a plane. As stupid as your belief that you could derive a "competence test" and that it would make any sense or make any difference given that the only thing you could find to compare using a computer too already has a test, several for the 30 ton truck, and is the biggest killer of kids worldwide.

My 8 year old, special to his parents but just an ordinary child, uses a computer, without any AV software installed, and, with nothing more than simple advice. He's never installed a virus, clicked a link that took him to some mythical ha><0r page, clicked a link that asked him for his details which he then has given away. He's never "accidentally" viewed hardcore porn nor has he been subject to any grooming attempts by, you'd imagine, one of the millions of paedophiles that Carol Vordermann thinks is lurking in every online game and website.

He's been using a computer for over 5 years - linux and windows, without any major scene or incident. He can't drive. Think about that. He doesn't own a car. Do the f**king math. Yes, there are 2 reasons why he is allowed to use our computer and doesn't have the keys to the Ferrari. The first reason is obvious to any idiot. Or at least I'd have thought it obvious before reading your article and realising they've come up with a better class of idiot. The 2nd reason is because we don't own a Ferrari.

The number one proof of IT incompetence is using a car analogy. Viz the following from the "Operational Medicine 2001 United States Naval Flight Surgeon Handbook 2nd Edition 1998" - "a person, when talking about IT, computers or the internet, who makes an analogy to driving or cars is de facto clueless about both and yet, ironically, usually believes the opposite. Keep the patient talking, remove sharp implements, call for backup. On no account allow the person near any vehicles or computers you may have on the premises. If all else fails, leave him sitting in reception waiting and deftly take someone else sitting nearby by 'mistake' "

The truth is, any 8 yo kid can use a modern computer safely. It's easy. It's easy precisely because people like you, Guy, have been writing about how difficult it is for decades. You, the computer IT press, are the idiots that MS and others have strived to make the computer usable for. You might have kidded yourself that you were writing on behalf of some other mythical idiots and that you still are now. We're not fooled. We know who you are writing about. Now, the IT industry may not have made a computer or network simple enough for you to use yet, but their years of effort does mean folk of average or above intelligence have no problems now - and haven't for years. Even school kids can manage it now.

The BBC proved beyond any doubt that any buffoon dragged out of BBC reception could answer questions as well as you. If you're lucky enough that they want someone called "Guy Kewney" and you qualify for that I'd keep stum about competence.

Somewhere in that article was a good idea. Hidden amidst the bureautopian plan for living-by-numbers, Guy mentioned the long prophecied "internet appliance" (well, he actually called it an "information appliance" -- very techno-utopia 2.0).

The fact is that now is the time for the web appliance. A truly stable version of Firefox will do 80% of what users need. Stick it on a screwed-shut Linux box with stable versions of OpenOffice.org and Thunderbird, and a decent media player and 99% of the world would be happy with it.

That assumes a stable version of Firefox OOo and Thunderbird, but those are possible, if the OSS community really wants to do it. Or we could use Opera instead -- that's pretty stable.

"Stable", you say? Doesn't that limit future growth? Yes, but a £200 fire-and-forget internet appliance could, if pushed properly, increase the internet user-base by 10-20% and steal 10% of the upgrade market. That big a slice of the market would force major websites to cater for non-IE browsers. It would stabilise the entire internet (if people can't just "click here to download plug-in X", the proliferation of plugins and mutually incompatible websites would cease) and would provide serious reasons for the computer giants to start adding value with new releases, rather than adding pointless bells and whistles and imposing artificial obsolesence on perfectly serviceable systems.

But it's not going to happen, because no-one has the will for it -- which kill the goose that lays the golden egg?

If public service bodies were forced to justify using general-purpose computers rather than "internet appliances", we could guarantee a good initial uptake. After all, the PC in your public library is probably only ever used to browse the net and occassionally to word-process letters or school reports. Save money on computers and spend it on books. Similarly, approximately half of school computers will only be used for the same thing. Save the computer budget for the computing department and the techy design department, please.

A public-sector drive for efficient use of computing resources should instantly force vendors to produce more sensible machines -- who'd want to miss out on a market that big? Then they'd be mad not to sell to the public -- economy of scale and all that.

It's possible -- it's so near that I can smell it -- but I think that we're again going to pass up on the chance to make a positive change....

Even if all the questions asked could be answered, I think there are a couple of major flaws being overlooked when controlling access to sites/services online:

1. It would cripple innovation. How can the next facebook* be successful if 'limited' users can't access it without first being authorised by their ISP/security software?

2. People would want to 'unlock' their experience. And this would feed the market for cracked software/machines/ISP accounts. And in those circumstances, those users would then be more at risk of hackers than they are at the moment.

* I use facebook as an example based on it's rise in popularity, not on what I personally think about the site ;)

Originally my thought was yes, users should have to get a license to use a computer, after dealing with hundreds of people who clearly should not be allowed to use a computer.

Then I started thinking ...... Is it actually the users fault that their computer is infected with malware and currently being used as part of a botnet attack on a large business to extort money from it?

Common sense keeps keeps you infection free, like not clicking on the Free Viagra emails or clicking ok on dialog boxes that say things like "Press OK to close this dialog box" (how many times do I have to tell my users to always use the damn upper right hand cross to close anything that looks fishy) Some people (alot) don't have common sense, and there is not really much we can do about that.

Why do we have operating systems (Microsoft *cough* *cough*) that automatically run anything, allow processes to hide themselves and have "allow all" as a default security rule? Why do we have e-mail clients (Outlook Express *cough* *cough*) That automatically download files, run hidden scripts and generally execute things that should not be able to execute? Why do we have any web browsers (Internet Explorer *cough* *cough*) that allow ANYTHING executable on a web page to be secretly downloaded onto a computer and executed?

Why don't we just get ISP's to issue fines for every spam e-mail relayed from a computer, for every flood packet sent out and any malware that is distributed. That would stop user ignorance to the problems their computers are dishing out. If they have to pay then they will learn about security quick enough

Me no like this way of thinking.

Testing would cost someone money. Me in fact. And you. If it were introduced it would be run by somebody with fairly close links to No. 10, so you can expect your taxes to spent either implementing it, or at least running "focus groups".

Yes there is a problem, and yes it will cost money to fix it. I personally would prefer the root of the cause gets charged tho. I use Windows at work, I use it at home, but damn it has its issues. If it weren't designed by ppl whose metric of decency is "how pretty is it?" then it could be a decent OS, but no. It asks, nay begs, to be compromised and abused. The problem(s) lie firmly at the door of a company that happily sold a product that isn't fit to be networked.

Multi user OSes have existed for what? 40-50 years now? And MS still can't make a simple one that doesn't require n layers of 3rd party protection to even *hope* you can check your mail without needing a reinstall.

The basic fact is that ppl are stupid. That's why we have ABS, seat belts, crumple zones, air bags etc in cars - we *know* someone will make a mistake and so we try to mitigate that by making the safest cars we can. Why isn't our most popular (or should that be common?) OS the same?

So give everyone a licence, then endorse them for various offences. Such as three points for being stupid enough to being tricked into joining a botnet.

Reach nine points and your licence is suspended for three months.Or two months if you agree to take s computer aptitude test.

Licence the OS, not the user.

Car manufacturers must prove that any new design complies with extensive safety regulations before they can market it.

Manufacturers of operating systems, be they open source or proprietary, should be forced to prove that each new revision complies with certain basic security standards - not requiring every user to have read/write access to the system directories for example - before the OS can be distributed. Easy. We'll never be able to control billions of users, but we can influence the OS developers.

1. Be able to set up an email account from scratch

2. Be able to install and uninstall a program from a PC

3. Know what a web browser is

4. Know how to add and remove a printer

5. Know the difference between POP3 and IMAP accounts

6. Understand what an SMTP or outgoing server is

Brilliant. Exactly none of these will help make the machine secure. Go you.

Of course it would be nicer if users learnt to use their machines - but with support calls at 50p a minute it's not going to happen any time soon.

Can desktop support guys stop posting please. Not only do you have a clear conflict of interest. But you are also the bottom feeders of the IT world. (only kidding - but see what elitism sounds like?)

Can I submit that virgin media support staff be put through a _basic_ IT course (I'd prefer an advanced course, but lets take baby steps!). This may help relieve my frustration when dealing with them :).

I've always been an advocate of "security through education", rather than the current mindset of security through FUD. For experienced users - or even those with a basic level of common sense - anti-malware packages serve no more function than to slow a system down and cause unnecessary problems. Most people working in a tech field have sufficient level of intelligence to avoid any potential problems and deal with the occasional less-than-ideal sitution themselves. In a perfect world, every user with access to a computer would be forced to obtain a similar level of knowledge in order to better protect themselves and those around them.

I had someone ask me yesterday how "they set it up so that people can look through all their folders over the internet", and when realising that they wanted to create a root tree FTP server, I nearly had a heart attack. Here was a user with absolutely no awareness of the potential security risks involved with such an action; one who would undoubtedly have allowed anonymous read/write access to C:\, thus essentially giving anyone with their IP address carte blanche access to do whatever they wanted with the system.

When I explained the amount of data at risk (passwords, billing information, conversation logs, etc), they realised their mistake and dropped the idea instantly. However, it really makes you wonder whether or not these people are even able to understand that once you connect your system to the internet, the potential exists for anyone to access the contents of it; and what determines whether or not this happens in 99% of situations is is THEIR actions, not the actions of Microsoft or Intel or Dell or any of the companies involved in producing the machine and software installed on it.

Users fail to think about the consequences - or make any attempt to learn about the risks - because it's always easy to shirk the blame and try to pin it on the people that produced the device. Using the car analogy from the article, it's like a 13 year old kid who buys a car from a scrapyard and plows it into a primary school playground; upon being dragged out of the car, the first reponse is generally "the brakes didn't work." When in reality it was most likely an error in judgement and their own recklessness which caused the accident.

I see where you're going with this idea, but licensing wouldn't be even slightly practical (especially with multi-user machines - family computers for example).

What is really needed is more an education on the availability of cut-down capability machines at the point of sale (with the assumption of said availability of course). The problem you're essentially highlighting is that of someone going into B&Q, asking a sales rep for something to cut up cardboard for arts and crafts (a stanley knife) and being sold a circular saw. This keeps happening partly due to the consumer not entirely understanding what is available to them (not as obvious when purchasing a PC as with a stanley knife vs saw), the sales rep wanting a larger commission and the sales rep being about as clueless as the customer and thinking that by selling them something with big numbers they must be improving their lives. Yes PC World monkeys, I'm talking to you.

"In exchange, perhaps we could insist that who we send emails to, and what they contain, is entirely confidential without some evidence of criminality?"

Which would mean that this is not any kind of right but is a specially awarded privilege which can be withdrawn at any time. And of course would be the next time they plant a tabloid scare story.

More and more businesses and government offices etc. are cutting costs by dumping everything on the web. If you forbid someone to use certain functions, how to do guarantee that they have some other way to work with those organisations? Especially when it's a very rapidly moving target.

What happens when someone isn't licensed to use the web but can't find a mobile phone that doesn't have a web browser built in? Or wants to borrow someone else's phone when their battery has died?

The idea's grounded in good intent but how the hell do you propose to enforce a test and a license? What kind of benchmark can possibly exist for any person running any application on any hardware on any kind of connection? So the driving analogy breaks down completely - road users operate within well-defined imits, and they can be tested within them for their intended usage.

For example I am clued up, but I've just entered my username and password into an unencrypted web form to post this comment. Is that bad? Maybe - what's the risk, what are the consequences? That depends on where I am, who I am, how El Reg's page has been compromised, and so on. In otherwords, no-one can say for sure whether entering that info amounts to a 'test fail'. Only I can make an informed judgement - but that begs the question.

The current situation can't go on forever because it presents too much risk and cost all over the place. Eventually we will find more and more new legislation coming in to try and tackle it. Increased education of users is a good thing, but you cannot enforce it, and the unpopular fact is that some people are simply thick and will never get it.

So I predict that we will ultimately end up with a sevice model for consumers. There will be ISPs who are certified to have access to the 'raw' Internet, and they in turn will provision all manner of services to users - sorry, customers, who will not have access beyond the managed modules they have paid for. Ironic really, as Compuserve and AOL drove this model for so long in the early years.

"to let someone load the office database onto their personal laptop and leave it in their car outside Tesco"

But it only seems to be government/MOD employees who do that, so perhaps they should get their house in order first?

Kudos to Michael for remembering the BBC interview debacle. I'd forgotten it was GK they meant to have!

Bear in mind there's no longer a dog license in the UK - iffy PC practices vs half-starved, maltreated Rottweiler... doesn't really stack up.

However, this issue of incompetent users is what has given rise to the Vista nag-screen. Seamlessly escalating privileges only as and when required is actually not a bad idea - the problem is that it relies on people knowing what they _should_ do when presented with a pop-up that says "program xxx.pr0n.wmv.exe requires administrator privilieges; would you like to grant them?".

What's required is free, accessible PC training. UKOnline offers this to some extent but they tend to be "want to learn how to use the internet for shopping, email and online banking?". Which is fine, but before you can progress to that you should have completed something on basic computer security.

Besides, the biggest problem with a license is that the people who would be implementing the license are among those least qualified to do so, the government. I've lost track of how many government IT disasters there have been (most of which have never been satisfactorily resolved).

----

What about games? Is it really a blow against human rights to suggest that if you can afford a machine with a kilowatt power supply and a dual-core video card, you can also afford to register the thing and its IP address as a danger to the web?

----

Won't work - non-static IP addresses for starters, plus gamers are among those people most likely to alter their hardware configuration (chuck in extra memory, gfx cards etc) invalidating any kind of hardware fingerprint. The only people that can halfway accurately identify any "person" connected to the web is their ISP - assuming they've not given their login details to a "trusted technical friend". Besides, it's not like there aren't readily available anonymisers (proxies) out there to mask your IP even if it is static.

The point you were trying to make is that it is the users that require a license, not the software they're running. There are some very technical gamers who may have home networks proxied through FreeBSD with hardware firewalls; who actually know what programs and services should be running on their Windows gaming PCs and what level of internet access those programs require (client/server at least). Of course there are numpties who just play WoW as well ;)

----

Anyone who normally runs their computer with an administrative account should be defenestrated.

----

OK, but only after we've defenestrated all the sloppy "software engineers" who seem to think that their apps always need to run in admin mode. Even MS seem to have gotten their act together there somewhat - their software actually seems to work fine on limited privileges accounts now.

Just an aside - Thatcher did not say Society did not exist per se, she was saying, basically, that the word is merely a desciption of the end product of all us lot and how we behave, what we do, etc. As such it is not a body, an organisation, association or other but is actually lots of individuals. It was in response to specific question and so needs to be seen in context:

In answer to a question about what has caused a deterioration in the nation's moral standards, she answered:

"I think we've been through a period where too many people have been given to understand that if they have a problem, it's the government's job to cope with it. 'I have a problem, I'll get a grant.' 'I'm homeless, the government must house me.' They're casting their problem on society. And you know, there is no such thing as society. There are individual men and women, and there are families. And no government can do anything except through people, and people must look to themselves first. It's our duty to look after ourselves and then, also, to look after our neighbour. People have got the entitlements too much in mind, without the obligations. There's no such thing as entitlement, unless someone has first met an obligation."

humans will remain humans. There will always be ethical and unethical people and the unethical will always find a way around "the law". To say that OS's should be made with limited functionality may be fine and dandy but what about open source Linux, where you can modify and rewrite it any way you choose? Does that mean open source should be banned or creativity chopped off at the knees? What about the hardware - Should it be hard coded to restrict "dangerous" activity? OOPS there goes my FTP to my website. OH yeah, i can get a third party FTP client to bridge a connection. As a matter of fact I can get just about any third party program to do what Windows makes hard for the average user to do.

Do we allow the ISP's to scrutinize every connection we make? Make encryption or proxies illegal? There goes my privacy.

The problem as I see it is that OS's such as Windows has enabled much of what's going on by turning things on by default and having hardware that is "stupid" to what's happening and even measures such as DEP can be circumvented.

So here comes Vista with all it's annoying security dialogs and quirks, making what used to be tolerable.... intolerable and no more secure than previous versions.

So to me it would seem it's the end user who is unfortunately stuck with security since we all want our privacy and freedom. Sandboxing is all fine and well too but what does the average joe deny or allow to write to the disk? Joe needs to be smart enough to decide that unless you want to totally sandbox everything and not allow anything to write to disk.

The virtual world is much like the real world in terms of keeping your privacy and allowing you to do your own thing, as long as it's legal. Then there's things that may be illegal here but legal somewhere else. So I go somewhere else and we all know there are a lot of "somewhere else's".

There certainly isn't any concrete answer to keeping the net alive and well, without the "accidents" or deliberate unwanted actions. Well, there may be one way but do you really care to be completely regulated and controlled?

As in real life, we are all walking or surfing targets and always will be. The best we can do is educate and train people. So maybe a license is the way to go but there will always be some who break the speed laws or drink while they surf or fall asleep behind the wheel.

Besides all that, what will happen to poor M$ if they didn't have anything to do by way of "upgrades" if everyone who surfed with a license had the ability to stave off all the nasties out there?

IT's a cruel world.

I think too many people are concentrating on the 'compulsary' nature of Guy's suggestions, but what about non-compulsary training or licencing.

A voluntary government sponsored Internet/Security awareness course akin to the ECDL could be a useful qualification for people to have for job applications etc, and might encourage people to learn these things for themselves.

Also, at the moment Microsoft Windows (or in fact any of the other OS's) don't really include any advice on IT security, and this would be a very useful tutorial to give new PC users when they first switch the machine on.

Jonathan

Javastation running from (flash?)rom+ smartcard slot for storing your bookmarks. People not licensed to properly mantain a regular computer should stick to online mail and office solutions. We require licensing for weapons. And quite frankly: Some of the users connected to the internet today are capable of weapons-grade stupidity. Given the economic cost of these drone-infested bot-farmers, for the infrastructure itself, we can quite clearly place blame for people loosing jobs on those (their behaviour creates expenses, those expenses cause companies to have to downsize to cut expenses, downsizing creates unemplyment, thus those bot-farmers are responsible for parts of the unemployment).

The only real problem with this, is that MP/RI/MAFI-AA have most of those four still buying their music, among the online population that would be forced to turn off their system, and make a nice, profit of their computer illiteracy, since these aren't capable of using a torrent client, nor are they capable of critical thinking, nor capable of seeing how paying an immoral business (who uses extortion as their weapon of choice) is just as immoral as purchasing goods manufactured using child-labour, or contributing to smuggling.

As long as the media corporations have most of their paying sheep^w^wcustomers among the illiterate, this interest group will use every method (notice: Not every legal method. Every method.) to make sure this group stays online, including keeping their buddies in the "nice-and-shiny-interface-claiming-to-be-antivirus-software"-business well-fed, and keep up the hysteria to get people looking away from the real malware like copyprotection-rootkits, DRM, watermarking, blackmail contracts for the real artists, etc.

So where are we?

The 25% of those on the internet, that would have passed a license test (and 25% is an optimistic number!) agree that the internet would be a better place if we could find a way to disconnect the remaining 75%, preferrably by disconnecting them at the wrists. This is because we are getting fed up calming them down from media-induced hysteria, and cleaning up their computer from their bad habits. The hysteria is about having the shiniest Neat-InSecurity package around, instead of handling the real problem like "clicking randomly at everything on the horizon". This 75% includes most people wearing a suit to work. This 75% usually includes "Your Boss"(TM), and here we again hit a snag. How do you explain to your boss that YOU are allowed to have a computer, because you know the difference between left and right clicking, while he is an incompetent git that has enough difficulties getting a license for humanity, let alone a license to use a computer.

So now we have two major obstacles: Media corporations and most of the suit-wearing workforce. Notice how these two groups are also known as "your company

s owners", and "your boss". Now how was this license thing going to fly again?

Ahh, the solution is simple. Issue real sysadmins the license to kill, not only to use the shell-command...

I know. Coat-time.

//Svein

... thre is a "European Computer Driving License". Now I have no ide how good or bad this is, but in my last company (selling software to estate agents, who pay peanuts), it wasn't uncommon to have to explain to users how to send an email - it wasn't *our* job, but they couldn't send us a screenshot without it (and don't even start me about talking them through getting a screenshot).

I suggested that we should insist that we would only support users who had gained an ECDL ... an idea which was laughed out of the boredroom. Fast forward, two years, and I had to go on a course for one of the products I develop in, as the vendors will not support anyone who hasn't been on a course ! With some sense, as 95% of the issues I would have raised with their support desk were addressed by the training ....

Instead of farting around with teaching youngsters how to be PC, maybe we should work to ensure our schools equip kids to *use* a PC.

1) Those people are operating machines which cause economic damage to their surroundings by spreading spam, phishing email messages and malware.

2) Everyone, them included have to pay for that damage.

3) Non-damaging people are therefore subsidising those who damage

4) I'm f**king paying for your f**king internet f**king access you fat f**king dimbulb. Since I am, I get to say what you can do with it. Get over it.

QED.

Another elegant demonstration of logic. Hurrah.

Everyone seems to be forgetting that we are dealing with a (perceived) issue that crosses every border on this planet (and what with laptops in space... etc.). It has thus far not even been possible to standardise the road traffic laws across a few borders, so how does anyone think we can get agreements about something like computer networking.

Is the American inclination to think that the internet stops at the border now making its way into the UK?

I see no end point to this nonsense.

We all are experts on a very few things, duffers on a lot more, and completely incompetent on huge tracts of action. And everything - from cars and planes down to computers and fire extinguishers - is capable of causing problems.

If I have to be competent before I can do anything, you've closed off the vast majority of human activity to me. And yourself. The details may differ from one person to the next -- the effect is universal.

Just take the safety labels off everything and let the problem solve itself. For a lot of people, idiocy extends far beyond the realm of the PC.

Testing the average Joe seems fairly pointless. What is important is testing those who are in charge of sensitive data about many people. For example, secretaries who deal with patient data, or the IT staff who set up computers in libraries. These people could easily be provided with extra training in how to prevent machines being infected and how to encrypt data. Truecrypt is free, FFS.

One very simple thing that most Japanese internet cafes do to prevent viruses infecting their machines is to install a £5 card which prevents permanent alteration of the PCs HDD. Users can run applications and save to the HDD normally, but as soon as the PC is rebooted all changes are discarded and it returns to it's prior state. Even if the system becomes riddled with viruses, one reboot later and they are gone.

Testing users or certifying their computers and software is both unrealistic and undesirable. Sorry, we got used to our reckless freedom and we EMPHATICALLY don't like anybody telling us which OS (apples, anybody?) and programs (OOomydocumentsmustbestandardized) are good or bad for us.

Starting with the assumption that falling for a 419 turns you computer into a bot sort of sets the tone I think. A lot of ranting backed by either little knowledge or major misunderstandings.

Just because you sent someone $2000 in up front fees does not mean you allowed them to access your computer. Yes, you're an idiot if you did, but you're only a danger to yourself.

As already mentioned by someone else, very few people could detect a fault in their "security package". I suspect by the use of the words "security package", Guy is running something like mcafee or norton all in one jobbies, and wouldn't stand much of a chance detecting a flaw either. Sensible people actually pick the right tools for each job rather than leaving everything to a single package or application. A firewall written specifically as a firewall is probably going to do a better job then a firewall written as part of an antivirus.

"anybody who wants to run a machine that can be compromised". And which machines is it that can't be compromised? Perhaps he's fallen for the myth of "you can't make a virus on linux or mac". Maybe regular users are supposed to invest in millitary grade hardware and software (isn't that windows these days?)

On the whole issue of charge per email, how exactly will that fight spam? Spammers tend to make a lot of money from what they do, while the rest of us make no money from sending an email. All this achieves is discrimination against the poor. And it's not like spam couldn't be reduced massively if SPF was actually used on both ends. Judging from the amount of emails I get claiming I sent someone some spam from a server in china, it isn't.

There are a lot of legitimate uses for mass email, from mailing lists to updating dnsbl lists. Do away with such things as open proxy monitors and you've just shot yourself in the foot if your aim is to reduce the damage of bots.

As for privacy being reduced in emails because of spam, did he miss everything since september 2001?

How on earth do you equate someone not willing to register their gaming rig on some international register with not caring about gaming? Not only do you have to give up privacy, but apparently in Mr Kewneys world you'd pay for the privilege. You already have complete anonymity when posting anyway. Unless you are required these days to provide proof of name/address etc when signing up to a forum, nobody knows who you are unless you tell them.

Guy may want facebook, news, and chat, but I prefer to spend my days avoiding mindless crap. Perhaps we can invent a different network for those who think the internet is a giant T.V and phone, and nothing more.

His final remark about leaving a database on a laptop outside Tesco has nothing whatsoever to do with his proposals. He wants to block people accessing the internet unless they pass some test, but this kind of stupidity does not require access to the net.

the core of the argument is that instead of educating users, we should penalise them for their ignorance. you also revealed a surprising lack of IT savvy with your suggestions, beginning with dodgy car metephores and a lack of understanding of how bot nets function and ending with the naive presumption that a locked down internet appliance would be 100% secure. As long as you have software requiring updates, you will require administrative rights in some shape or form. castrating the less educated is not the solution.

the only solution is government sponsored re-education coupled with responsible media behaviour. how many windows users are even aware that they can create a non-admin account for day-to-day use, let alone what that means or that it is advisable? please replace the FUD with knowledge. and for the love of god, if you are going to play the role of an elitist prat, then at least approach the subject from a sound knowledge base.

How about we defenestrate those companies (starting with their entire senior executive, then working our way down their major shareholders) that deliberately and with malice aforethought derail or hold back standards and practices that would make computing more secure?

Instead of blaming the users of the crap that's being made available, how about blaming the companies that have put profit before security? If a car manufacturer did that... oh, wait, Ford did and they profited from it. Never mind. resuming...

Companies that have put crappy, poorly written, easily compromised operating systems up for sale while marketing them as "secure" to a general public that can't know better? Or perhaps blaming the governments have have repeatedly refused to take these software companies to court for lying and cheating the consumer with their practices?

As for "direct damage", talk to the pensioner who just got scammed for most of their savings, or the person who gets jailed because a computer in their classroom is a virus infested pile of unsecure crap. THEN talk about whether there is any real damage or not to allowing these practices to continue.

... claims that the Government (Capital G) never should have let the public have personal computers. He has his points but overall I think he's wrong - never stops him from asking me to look something up on the net. Cracks me up.

About the "bottom feeders of IT", the tech support types - I was one once upon a time and used to fantasize about black helicopters landing and removing every piece of electronics (even down to the time blinking vcr's), breaking the consumer's little fingers, and never, ever, be able to access the net ever again.

Fun stuff to think about while on the phone with a total idiot bitching about why nobody ever TOLD him about using AV software and why it doesn't "do it automagically".... what ever "it" is that it does... sigh.

People ask why I don't do residential call outs instead of just business clients - I simply don't have time for folks who believe that if they pay you once, it should come with unlimited lifetime support for their machine...

Paris icon because endusers and Paris have something in common - both have no sense and something infecting their "workstations"

...they have to pass a basic spelling test!

Here is a car analogy that is reasonably true.

Scene - The Midlands Car Show Room.

Customer: My friend says that I should buy a car - I want to visit my sister in Brighton.

Salesperson: We have really good cars here. Brighton is a long way, so you will need a comfortable car with a big engine - Like our WinCar. Do you have a family?

C: Yes - I have a partner and 2 children.

S: Oh, our WinCar SuperPlus is ideal for you, it has special shiney stuff to keep the children entertained.

C: Is that it? It looks complicated.

S: No, not really, everyone with children should have one of these. It is very shiney, and will be really comfortable for you all when you go to Brighton.

C: I have not driven before - Is that all right?

S: Yes, it is very easy - everyone else does it. I can teach you the basics here. This button here starts WinCar. See the lever on the floor - push that to "D" when you want to go forwards - If you want to go backwards you push it to "R". Now when you want to go around a corner turn the steering wheel. There are a couple of other things that would be useful - You can make the wipers go if it is raining - All of this stuff is in the really simple manual.

C: Are you sure? It still looks a bit complicated...

S: Oh everyone can do this - You did say you have a friend who knows about cars? They will help you.

C: Yes, but he is a bit busy - He works with cars, and can't always find the time to help.

S: Oh, you will need this book then "WinCar SuperPlus for Prats", it is very good, and will soon see you right.

C: OK - I'll take one.

S: Thank you (trousering customer's dosh), You will really like it.

S: (Sits Customer in WinCar). Oh by the way, when you leave the salesroom, remember to drive on the left...

Tim (The Car Expert) - Hat, Coat, Exit, pursued by a lemming.

If you want to compare surfing to driving, then computers are no where near the standards of a car. A car has to be fit to drive on the roads. Cars are equipped with all sorts of safety devices. You don't have to pay a monthly subscription to make sure your car doors are locked. Your car won't crash for no reason. You don't need to update your car to run on newer roads. If you buy a new car it won't have a completely different layout. Being the 'administrator' of your car is not a security risk.

Or am I completely mental? I was under the impression that Register readers were IT professionals. At least 50% (source: my hat) of IT Professionals rely on clueless users to make a living (and I'm not just talking about helpdesk folk here). Isn't that the point of development - taking something difficult and making it easy? What we really need to fear is the day that users aren't screwing up because we'll all be out of a job.

all this nonsense.....

i have never read such utter drivel in all my life......

the bigest issue i have with my home computer network is the kids pc, but even that took one hard lesson... opening a file someone sent her, a so called friend. The pc became so screwed up, it would not even start in safe mode.... so a format and re-install it was....

I know i could have saved all her photos, emails, homework bookmarks and other assorted stuff... but i decided to make the lesson even harder....

now, she takes the advice, close any popups via the X.... dont open anything any one sends you, unless you virus scan it... and ask first what it is. and 9 times in 10 she will ask me first..... from the hardware firewall, she only has one open port to the WAN... port 80... she only has web access up to 9-30 at night... and all msn chat logs are saved in a location that we can check them over when ever we feel like.... plus a long list of other rules regarding net access....

the upshot of it all, is a 12 year old child that will grow up with the understanding of computer security.... lol, she even reminds me about the antivirus updates, and is aware of 'update tuesday'

the answer is in education, and hard lessons, but there is no need for any new licences... bloody hell, how many licences are you going to need in this country....

so far, the number of licences i have had to obtain is 8... and that is just to run a small B & B.... the total anual cost of these licences is over 1000 quid... one of them is so i can play 'original recordings' on a CD player in a dining room... another is so i can serve hot food after 11 pm

When I got a 28k8 modem & a Demon account waaaay back in '95 I knew very little about the internet but I learnt quite quickly that it's basically a mirror, a mirror of humans and their achievments, accomplishments, failures etc.

The net was still farily much in it's infancy back then so generally the people who were online were those who knew how to operate computers becuase there was no cushy interface like Windows 98 & onwards to get email, browse the web etc.

But then slowly the unwashed masses appeared bit by bit and then in droves and now we're flooded with the fuckwits, mainly started out with people (mainly kids) getting modems for christmas and then the Eternal September decreased the average IQ of all internet users: http://en.wikipedia.org/wiki/Eternal_September

I don't know what can be done about educating users not to click on bad links, how to avoid becomming a bot zombie etc. but something does need to be done by someone with the ability (not Microsoft, they've caused enough problems already)

BTW, I still use the same email address since joining Demon, my spam levels aren't great but I'm not flooded by them, partly because of the Brightmail filter Demon use.

Q: What's the difference between intelligence and stupidity?

A: There's a limit to intelligence.

Ken:

"Very few computer users even know how to detect that their computer is running malware, let alone find the malware in question, let alone eliminate it."

My point is that MS have MADE it impossible. It hides extensions, Win98 hid files if you installed WMP (you cannot see them unless you boot clean into DOS, but not if you open a cmd.exe in windows nor if you drop to dos from win98). The system is hiding things from you.

All a virus writer needs to do is work out how to hide their malware in the same way and the OS will prevent cleaning up.

And it's only gotten worse.

As to the TPM, that is giving the computer to the manufacturer or ISP and them letting you use it. It only works if YOU THE OWNER are in control of TPM. But that doesn't help MS and it doesn't give ISP's power, so it's not going to happen.

I call BULLS--T!

It's been a while since I last read so much bulls--t.

So yes, BULLS--T has been declared.

Prove me wrong.

C'mon Guy. Some people ought to have a "Competence test" before they're allowed to procreate.

I don't agree at all, but I also think we should eliminate speed limits and seat belt laws. If the road is empty why can't I drive 120MPH?

Aside from SPAM that I've had moderate success at filtering, none of these people has caused me an issue. Haven't had a virus since 1988 (damn floppy disks.) SPAM is a specific problem that needs a specific solution.

Better: get the ISP to pay the penny.

If the customer pays, the ISP doesn't care. If the ISP pays, they'll inform the user, block them or sandbox them. It will also shut down spammer-friendly ISP's that don't care if someone is paying a lot of money to them to host their site that spams people, hell, they're getting paid.

> I'm surprised no one has suggested that the problem should be eliminated at source.

...and so was I, until I read your post and just a couple of others which spotted where the *real* problem lies.

It's very unfair to expect users take steps to guard against faults in the OS but since Microsoft is uninterested (or incapable) of properly dealing with them, the user gets it in the neck as usual.

"Surely, if ISPs limited CC emails to 20 a day and charged 1p per email CC thereafter, most spam would dry up?"

Who uses CC these days except cardigan-knitting office women? Not to mention, a large number of people use Gmail and such for their email, not their ISP's service.

Surely the author wouldn't pass this computer competence test he himself suggests.

"It's because some idiot decided that, because fire doors should always be closed after use, they should not have any way to latch them open during use."

Ahem the door are closed to prevent the spread of fire. that idiot would be the fire Marshall. Oh and there is no latches to to prevent people from leaving it open.

But hey if you know some thing I dont know I'd like to hear it.

"Every time some kid clicks on a phishing link ..."

I am in two minds about this really - it is not just young goats clicking the phising link :)

I don't know how you would train people to avoid that,

I think the test should involve installation of the operating system.

The word processor only being unlocked when the person has written the equivalent of War and Peace in a text editor.

The person should have learned and demonstrated to accompany any requests for IT support with various <strike>bribes</strike> offerings.

Any use of Visual Basic to be accompanied with an electric shot, each time the hand reaches for the mouse.

If they won't use unix, they have to use DOS for the period of one year and pay the princely sum of 1000 GBP for it.

But hey if you really want to stop cracking then really all you have to do is recognise the little technical geniuses as they mature, get them some decent jobs doing some decent work for, and

importantly, decent pay and reap a profit margin. Every country should nurture and grow their technical future, not offshore it, bring it back, outsource it, offshore and bring it back again.

What happens is people in IT in various countries keep getting the boot, then have to start the merry go round again. A lot just think, hey it is easier to make a buck on the other side of the tracks.

But, if you want to put a test in to give IT control over the sector then sure, but the test should be lead by the IT sector, not the legal sector, not the government sector, not for the love of all things digital the academic sector, but the IT sector looking after ITself.<--- see what I did there.

... before the terrorists that govern the country bring in some utterly repugnant piece of stupid, moronic, misconcieved legistlation to control the "terrorists/peodophiles/criminals".

We should start by mandating that all PCs should start life in a locked-down state.

If the user lacks the competence with a PC to open it up to de-neuter it, they aren't savvy enough to be allowed to use it in an open manner.

Email White Lists - Only permit users to send emails to those people that they know

Digital Signatures on email should be mandatory.

PGP would be nice, too.

ISPs to be made directly responisble for BotNets on their systems. Make it hit their pocket, then they'll control their users. £1000 per incident per connected node - That will definitely get their attention.

URL Whitelists that will limit the users access to any dodgy domains.

-

And before any bleeding heart liberal starts bleating; most of the neutered won't even notice anything anyway - except that they won't be able to get anymore cheap V14gr4 anymore!

First off, I've taught the ECDL. It's eminently basic - how to open Word, how to format bold and italic, how to check for and send an email. We need something broader - into security apps and the theory of viruses, perhaps.

As for "OMG HELPZ0RZ tehre's no SU on XP and I have to runz0rz as ADMINZ or not at all!!11!!1!!!", that's what the context menu is for. If you need to run an executable with admin priveleges under a limited user account, simply right-click on said executable and select the option "Run as...". Then you get to input your admin login and password to run said executable. Just the same as, *gasp*, Linux. I'm constantly surprised at how often this is thrown up as a defence against Windows/for Linux. Education before speech, my friend. Grow up.

"As to the TPM, that is giving the computer to the manufacturer or ISP and them letting you use it. It only works if YOU THE OWNER are in control of TPM. But that doesn't help MS and it doesn't give ISP's power, so it's not going to happen."

Sorry, can you explain your point?

Driving tests, along with any other competence test required to do something (ie. MOTs, dog owning, medical, legal and engineering licenses) are about preventing actual bodily harm to others - this keeps society running smoothly as idiots aren't depriving society of anyone but themselves if they mess up.

However, there is little net gain to society from enforcing basic computing licenses - a slightly faster Internet connection and a few less clicks to filter spam. Especially when compared with the massive infrastructure and privacy invasions required to maintain the licensing scheme (just look at TV licensing) - the costs far, far outweigh the benefits.

The issue of certification isn't entirely moot, however - the lack of respectable and enforced certification programs for IT workers (outside of certain niches) means that it's possible for anyone to walk into a business, talk up a storm to get hired and destroy a business very quickly through incompetence.

It also means that wages are kept artificially low for high-skilled workers as high-school kids and people in the third world can ply the trade for peanuts to end-users who can't tell the difference between good implementation and bad until their business is almost dead due to bad IT implementation.

IT systems are some of the most complex ever devised by mankind (50 million lines of code/working parts in Windows Vista, compared to a few dozen in an internal combustion engine) yet you need less qualification to ply the trade than a McDonalds burger flipper with a basic hygine cert.

Alas , I always remember a certain tale of a French Industrialist in post war France running a certain large European Car Company whose unfortunate founder was beaten to death as a collaborator by an enraged misinformed mob of twerps and the idiot doctor who refused to treat him at the time for the very same reason leaving him to die in agony , nice doctor indeed(I hope he died ashamed of his stupidity when the truth about the company in question during the troubled times eventually emerged) !

Anyway to cut a long story short one night whilst driving home in the companies car with his heavy case he carried with himself everywhere was put on the back rear parcel shelf ! To avoid some obstacle or drunk lying on the road he swerved and then ran off the road and came to rather sudden stop with very minor front vehicle damage and the unfortunately for him the unrestrained case flew forward like a lethal missile to strike him on the back of the neck and head killing him instantly !

A good hint never to place any object on the rear parcel shelf or carry it unrestrained on the back seat either any car at any time , for speed does not kill but the sudden heavy deceleration forces do the deed !

I am self taught in almost all of what I know of computers and software, had I had to apply for a test when I was a young'en then I would have failed, then.. well you see why this is a Bad Thing :)

Competence test for using the internet.. that's a different matter.

Just doesn't work. It never has, and never will, which I guess is most fortunate at times. While we here in the USA attempt to do this all the time (low flush toilets, etc.) it never works. Having a license to "operate" a computer isn't going to make the user more competent. There are companies that attempt to do this by conjuring up certificates that imply some sort of competence (MSCE, or some such). All this does is build up a budding industry of selling books and test helpers (MSCE made easy, MSCE in n days, etc).

The best suggestion I saw was to eliminate all the warnings and let the Darwin awards take over. Unfortunately in our (USA's) litigious society it won't work too well. Witness the number of stickers that are on a step ladder next time you use one (or pass by one in the hardware store). Ladders have been around for thousands of years, but with all the warnings you think they were invented yesterday. Oh, well.

Common sense can't be legislated, and it is useless to try. Lord knows the French system of laws makes an attempt.

First you should license the people who sell the computers, then the people who support the computers, then you can get to the end users. With tech support being outsourced to unskilled workers in whichever country is cheaper this time, with ISPs specifically refusing to employ IT skilled helpdesk staff because they might deviate from the official line, it's way too soon to start blaming the users.

A short list of people whose stupidity and ignorance either directly or indirectly causes avoidable human and suffering deaths:

People who don't recycle.

People who voted for Tony Blair.

Daily Mail readers.

Owners of diesel cars (particulates from dirty diesel engines cause hundreds of deaths in the UK every year).

Anyone who has ever bought anything made in China.

There are more, but I think that pretty much covers the entirety of the rich part of the global community.

Clicking the wrong link costs us money, but it doesn't cost lives in the way that the above activities do.

Why are we not able to develop idiot-proof technology ? Why does every grandmother need to learn about anti-virus license renewal, software updates, spam, etc ? Why is so much software buggy and/or insecure, offering crooks and other criminals an entry path ? Isn't this article an attempt to deflect the responsibility of the computer industry onto hapless lambda users ?

On the basis of a feeble analogy is Guy insinuating that computers are now such a threat to our "security" that a Government must step in with drastic controlling measures? That 2nd (or 4th) core is just dying for a background process which continuously reports to Central Server the URLs, files, data we are looking at so it can proactively shut down the process and save us from IT, isn't that right Guy? And after all, the letters t e r o i and s are in cyber-terrorist, so let's have a War on IT.

When you get off the boolean and onto the metaphorical logic, all sorts of non sequiturs become possible. Whether Guy has turned into an old lady, or is simply nostalgic, some things will never change. One of those is finding him barking vociferously up yet another wrong tree.

Well, I only fall foul of one of those (after all, who can honestly say that some item they've never bought wasn't made in China - it's damn near unavoidable), so am I still condemned to death?

It would be nice to make sure people can reason before they are allowed to run a computer, but there would be a lot of complaining from religious groups..

Lack of competence in other peoples cases (with regard to computers) keeps me in beer and pork scratchings, so while I might roll my eyes in disbelief from time to time, at the end of the day it pays my household bills.

Was slogging my way through the usual "I'm all for freedom but..." and "People are such idiots!" twaddle when I came to "To milk a poor analogy" and "The dog with the universal remit-to-bite" and stopped reading (with a great sense of relief).

Thank-you AC and Dr. Ellen. Nice to know that there are still people out there capable of seeing beyond the end of their own noses.

Now, if only this intelligence could be passed on to some of the other writers.

-Ima

...and nobody would listen. Are we starting to come around finally?

Where to an extent, and idiot and his money SHOULD be parted (natural selection and all), and idiots on the internet do cost themselves money if they don't smarten up quick, but identity theft leads to credit problems, which in turn effect the credit card and mortgage industries, company bottom lines, and the world economy at large. This is aside from the direct attacks on company systems, internet trash, and the general slowdown of productivity as we swim ever slower through the muck on our networks and inboxes.

It's a simple solution: unless you have special license to do do otherwise (issued simply by passing any of a dozen or so basic PC, OS, and security tests), you should only be allowed to use common accepted OS on the net. that OS must be open to be checked by your ISP for patch revision, AV, and other security settings. Should the ISP see you out of date, they only allow you to connect to the update site, and nowhere else, until patched. If your AV is out of date, missing, or in some other form non-sufficient, the ISP won't let you on the net, period. If they detect an infection (mass mailing, spam, DDoS, etc) you get cut off instantly. When you call for support, they'll tell you plain and simple to get clean, or stay off the net.

It's a simple system. You don't have to have a license to surf, you only have to have licensed software and an up-to-date PC to surf, and agree to let your ISP look at your security model and validate it before letting you on the net, and also to actively track your activity for likely virus infection (DDoS, lots of CC'd messages, etc). If you HAVE a license to do otherwise, then your ISP is off the hook as are you, but you become legally liable for any infections your PC causes.

Give people 1 year notice that as of their nect contract renewal, they either have to comply, find an ISP who doesn't enforce this, or get certified (and potentially insured) to not have to comply.

It starts by requiring BY LAW, today, that every PC sold, with or without an OS, must have an accompanying license for security software (free or otherwise I don't care). If you already have a license that's portable to your new PC (business class, VL, etc) then you'll need to fax proof to the company selling you the PC. That software should be tested and certified by some national organization in order to be accepted.

Microsoft has that integrated security center in Windows that can tell if you have or don't have proper security software, and how out of date it is. How tough would it be for MSFT to simply disable your NIC interface until you pass the test. Sure, its easy enough to get around that by installing some non-msft OS, but if you can get linux installed and running by yourself, then you by default should know enough to get licensed... pre-installed linux boxes, like those being sold by Dell, Walmart, etc, should be bound to include security software same as windows is, Macs too.

To all of you who think licensing is a good idea......you're nuts. You're the same kind of person who probably feels that a woman who dresses provocatively and gets raped deserved it. Why should the end user be punished because there are criminals and scumbags out there that find ways to compromise someone's PC. Isn't it the criminal that has done wrong? Shouldn't they be the one that is being pursued and punished? To equate driving a car to using a PC is also nuts. You are comparing apples to oranges. They are not in the same category. To me this idea is just another example of the rights we have lost in the US because it is beneficial to the fight against terrorism, ya right. None of the crooks, terrorists or scumbags are affected by the kind of rules, laws, etc that have been put in place. In fact all it does show is that they have won. When you punish the everyday person for the actions of the crooked, you have lost site of what is needed to solve the real problem.

I am not just an end user, after all we are all endusers, I have been in the computer field for 20+ years doing support work for endusers, OS's, hardware and middleware products. I would never advocate that the normal everyday user should be expected to do what I do. For one it would put me out of a job. For another it would be like asking me to be able to identify personal medical problems and being able to take the proper steps to treat or prevent the problem without consulting a doctor.

While I agree it would be great for all users to be as knowledgeable as myself, to expect it is asking way to much of an environment that has become the playground of the con artists, thieves and crooks. What they do is not the users fault under any circumstances no matter how much you would like to blame the dumb user.

I've spent my entire working life developing, managing and promoting IT certification programmes, both in the private sector and the public. I've sat round tables with the British Computer Society, the big exam boards, Microsoft, the BBC and various departments of education, skills, learning, innovation, employment and so on and I can tell you that not one of them has the first clue what they're doing, and none of their tests, exams and pseudo-driving licence certifications does a damn thing to solve the problems of new users and their stupidly powerful and insecure PCs.

ECDL doesn't cover security in any detail - phishing isn't even mentioned. It is as shiny and showroom as the PC itself - a good sell to a clueless newbie but of no effective use in helping them drive the thing. The skills it teaches are mechanistic and quickly forgotten, and the assessment is largely of theory rather than competence. IT Security was recently added to the government-backed 'ITQ', a competence-based qualification equivalent to 5 (count them) good GCSEs, but take-up has been poor and it takes too long for these qualifications to be updated to reflect trends. Too many of them still mention floppy drives, Zip disks, etc. Microsoft have free courseware online (their Digital Literacy Curriculum) which covers security, but it attempts to brainwash you in the process, presumably via a rootkit...

Like most things the media like to rave about, the threat is real, but small, and can be easily countered with simple, targeted training focusing on mitigating the risk, just like all the COI campaigns about crossing the road and not spreading the disease du jour. Licensing is an absurd idea - might as well let Captain Cyborg chip the lot of us and electro-shock us each time we dare to click on an email link.

The iPhone has shown that devices will be jailbroken, but if it was made just secure enough, then we already have part of the blueprint for a sand-boxed internet appliance. The Apple TV could become the home equivalent.

Michael - please, shush. You're spouting more rubbish than Guy Kewney! First of all define this "PC" that "BY LAW" needs a license for security software. I like the way you don't care whether it's free or not - someone else's problem, presumably? Not a great plan so far.

Does my web-enabled, email-enabled, java-enabled, media-enabled, wifi-enabled, bluetooth-enabled mobile phone fall under your new LAW? Well I imagine that's someone else's problem too? You need to start thinking a bit more before coming out with this stuff.

As for Security Center? Are you mental? That service gets disabled straight away here because of its annoying, pointless, preaching nagging about things that I've already solved but which it cannot recognise as being solved. It adds to the problem here, not reduces it.

And as for Linux boxes - I've seen some real cockwits get into all kinds of bother with misconfigured daemons - screwing up a large private network in one case and sending out reams of email crap. You didn't think of that aspect really, did you?

In fact, like Guy, you're high on stereotypical rhetoric and smug ideology, and devoid of anything useful to add to the pot.

You have failed. Insert coin to play again.

Please inform all known computer users that, as of the day after the 31st March 2008 that any detected dumb-use or poor invoking of common sense when using computers that a set of endorsement points (level yet to be defined) will be placed on their ECDL (European Computer Driving Licence) - yes, it exists. Those without may find re-assigned TV detector staff visiting them at an entirely inappropriate time to inform them of newly assigned guilt.

In line with road licences, when collecting 9 points, the licence will be revoked. The aim of this is to reduce the level of repeat visits to help desks with the same problem and to make people realise there really is no universal right to operate a machine of immense complex operation without for engaging some form of intelligence and at least minimal learning.

....

sorry I was bored :)

Dave

At least, not in a democracy.

However, if Microsoft were to make Windows work like XBox and *require* all executables to be signed by an approved and audited supplier, then that would enhance security a great deal (not to mention general reliability - no more apps that decide to hog 100% CPU, for instance). I'd suspect that most users would opt for this over an "open" version.

Can you imagine the anti-trust suits that would fly? That's why it doesn't happen, even for drivers.

It's very simple. Just force MS to put some GOOD internet blocking software in place (installed through the back door in their update manager), and viola, people must pass a government issued test and be given a strong key that lets them connect to the internet. And not just random keys that can be cracked; each user is given a new key, and then that new key is inserted onto the online database and deleted once used.

Linux and Mac users do not need to take a competency test, because they should know better, and at the moment are in no threat.

Though I do agree with one of the earlier comments about releasing old viruses that kill the OS itself, and making sure AV software does nothing about them...

I already do this. Everyone who gets me to fix their computer, family, neighbors, friends; gets a nice installation of Slackware. I set it all up, put the newest Firefox, Thunderbird, OpenOffice, and such on and then don't give them the root password. I put them on my domain too, so they get an email address and a folder on the FTP server to stash stuff they might use elsewhere. Theoretically, I can log in and fix anything remotely too but that has yet to happen in three years.

So there you go, that's how I help to make the internet a better place. If someone has a way to stop them from posting stupid and inflammatory things on forums I'd be glad to listen as well.

I mean if you buy a car you expect it to be safe and roadworthy for a few years. Most contries do not have test for a new car the first 2-5 years.

maybe we can demand the same from the OS producing companies ? You buy a new OS and then you know that you are safe ?

blaming everything on the users is just too narrow minded. Why don't most techies get it into their heads that most people don't care about PC's. It is just a thing to do whatever it is they want to do. Just like a TV, car, phone.

Maybe if we somebody would push the responsability towards the OS makers we would see some improvements or shifts of OS usage ?

"It's a simple solution: unless you have special license to do do otherwise (issued simply by passing any of a dozen or so basic PC, OS, and security tests), you should only be allowed to use common accepted OS on the net. that OS must be open to be checked by your ISP for patch revision, AV, and other security settings. Should the ISP see you out of date, they only allow you to connect to the update site, and nowhere else, until patched. If your AV is out of date, missing, or in some other form non-sufficient, the ISP won't let you on the net, period. If they detect an infection (mass mailing, spam, DDoS, etc) you get cut off instantly. When you call for support, they'll tell you plain and simple to get clean, or stay off the net."

Shudder. Thank you for neutering all the users who ARE smart enough to know how to do these things, and choose not to. A few years back, there was a Windows patch I was specifically choosing not to get because they frakked up something with the firewire drivers so that firewire devices, including cameras, hard drives, etc, were no longer detected. Installing said patch would have completely messed up my firewire hard drive, which was something I used on a daily basis. Should I cripple an expensive piece of hardware I paid for to keep my OS up to date?

As for anti-virus, I refuse to run any. Period. Why? Because every single AV suite I've tried over the past few years, since 2003 onward, has done things that were at least as bad as viruses, if not worse in many cases. And for what it's worth, the only time I've ever been infected was, ironically, in 2003. I was away from my computer for days at a time when Blaster happened. I wasn't able to patch my system and got infected. I fixed it as soon as I got back in front of my computer. But the funny thing is, after that, Norton, which is what I used at the time, started causing my computer to BSOD several times a day for no reason. Symantec could provide me with no solution to fix it, and didn't understand why I left my computer on anyway, so I dumped them. I tried numerous other AV suites in the two years after that - Panda, McAfee, etc, etc. The only one I had ever work semi-decently was Pc-Cillin. Panda and McAfee both kept deleting files it deemed "malicious" that were actually legitimate exe's, causing me several wasted hours over the course of a few days trying to figure out what it was doing and why - even when I had purposefully turned off the auto-scanning and auto-delete options, which it persisted doing despite my repeatedly checking that they were, indeed, off. There's no legitimate reason for doing this, and such "features" have probably caused more harm to both experienced and inexperienced users who would be at an utter loss to explain why a piece of software they used every day suddenly stopped working (in my case, a legitimate piece of FTP server software). Now, PC-Cillin never did anything like that to me, but it had the unfortunate problem of bogging my system down - and it's not an ancient system, it was only a year old at the time - to the point where I couldn't play games. Once I removed it, the games ran fine. I choose to, instead of running AV software, not browse like a tardstick.

I pay my ISP. They don't pay me. They don't pay for my computer. I don't think they have any right to tell me to update my operating system or force me to run antivirus software 24/7. I've given legitimate reasons for not doing both right here, and I'm by no means the only person who has run into such situations. If I become a problem and start spewing crap, fine - sandbox me. And when I clean up my machine and figure out what the source was, that should be the end of it.

A friend of mine who lived on a college campus had to deal with AV and OS policies like this, and he ended up moving off campus partly because of those restrictions. He would lose internet randomly even when his software was up to date and oftentimes was unable to contact anyone in the IT department at those times, meaning he'd go for, sometimes, days without internet access in his dorm room. Would *you* like to try and contact your ISP at 3 a.m. when your internet suddenly stopped working? I wouldn't. I don't have time to do that at any time of day. And you know you'd start seeing massive outages when ISPs screwed up started killing connections to tons of people for no reason at all. That would be awesome.

It's ironic. The same people complaining about Microsoft's activation scheme are probably some of the same people proposing a system much more complicated and rife with the possibility for flaws and abuse if, god forbid, a malicious hacker got in and managed to screw around with the ISPs database.

As someone who considers themselves a competent computer user who can usually troubleshoot her own problems, and has never needed to call a helpdesk for something that's not beyond my control (i.e. ISP outage issues), I can sympathize with some of the sentiment of the whole issue of computer licensing. I'm on the receiving end of some of the stupidest hardware and software issues in computing history on a fairly regular basis too. But I'm certainly not elitist or arrogant enough to believe that computer licensing would solve this problem. Someone earlier said that the IT helpdesk people should quit posting here. I concur. They wouldn't have jobs if every person who operated a computer were an expert at doing so. I sympathize with them for not wanting to help users with stupid problems, but at the same time, at least they're getting paid to do so. And when they aren't helping people, plenty of them are getting paid to sit around and do nothing but play games and chat online and e-mail people from work.

I don't know how much more of this whole nanny state I can take. It's something new every day. I'd love to give all the "nanny state" proponents their own country and see how long that would last. I'm guessing not terribly long. And it would probably be a very boring place to live.

Give them their own country? I think they already have one, it's called Britain.

I wouldn't say boring though. Why, knowing that using the Underground, nodding off on the bus or carrying a chair leg could easily be a lethal experience, being afraid to defend yourself against home invaders and muggers because you'll end up in the dock if you give them so much as a concussion, watching your children fail in school before predeceasing you from obesity because they can't let off steam due to elf n safety - I find all this adds a frisson of excitement to life.

Speaking of the very good car metaphor, here's one that happens endlessly to me:

At a family event/in the pub/at a reception/in a train, chatting with someone I've never encountered before:

- him/her: So, you're in IT

- me: yeah (not elaborating, too risky)

- him/her: I've just recently changed my PC. It was full.

- me: What was full, hard disk or memory ?

- him/her (baffled to learn there is actually more in a PC than a box, a screen and a keyboard): Errrr, it was just saying it was full ... So I bought a new one.

- me: ...

Now, let's do the same, at the very end of a driving license test, when the examinator is asking basic questions, to be sure he's not giving it to a dangerous maniac:

- examinator: Say, let's suppose a light suddenly lit, when you're driving, saying the petrol tank is near empty. What do you do ?

- candidate: I change it.

- ex.: What, the petrol tank ?

- cand.: No, the car ! I buy a new one because it's empty.

He's not gonna have the license, is he ??? If he did, we'd have even more deaths on the road ...

So, it's a darn good idea to get some tests, really. I'm up for it.

The Fatal flaw in your logic is that, when unlicensed drivers get in accidents other people are affected. They may not get full coverage for thier property damages or they may get hurt or killed. The law is created to prevent others from injuring you. Not to protect the individual from himself

With computer incompetence this is not the cause. Sure thier infected pc may cause alittle mischeif on the internet, but anyone who would be able to pass your so called test should be able to secure their pc sufficently that this is not an issue. I myself have never gotten a virus,worm etc People think that they should be able to rely on the software and that will always be faulty logic, but if you combine software with some common sense you have a complete defense.

The type of law you are advocating takes away basic rights from the individual to do as they see fit in thier own lives, for their own protection. The government should not be our mother. People are so willing to give up alot thier rights in these days of fear and dread for a false sense of security. People who advocate this kind of law scare me, I fear where this country is headed.

This will get rid of 99% of *ALL* management !! I know one who had to get his secretary to update his PDA everyday because he hadn't a clue how to !! But he'll wave that damn thing around at meetings and dinner parties to show how "clued up about IT" he is !!

These are the same people that think chickens are produced, pre-packed and frozen, from the supermarkets and that fish do come in little rectangular blocks !!

PH because she's representative of that tribe !!

One thing that no one has pointed out, is that it's not the users' fault. If your car has an electrical error and suddenly your alarm goes off, or you drive into a ditch, this is not your problem. When your computer is infected with a bot, essentially the Operating System was faulty to begin with, to let this happen.

Having a test is not necessary, all people who go through the education system learn how to adequately use a computer nowadays. It's the previous two generations that are causing more of these problems, and I believe mainly because of XP. Vista has taken a few steps in this direction (with UAC, which just happens to be the name of the bad guys in doom), but it isn't yet enough for me to be sure that Windows is a safe operating system. The amount of systems that I've seen running XP when they just can't handle it is depressing, these are often the worst PCs to fix, because they still feel broken once there are no errors.

I really think you missed the point when you wrote this article. Education is the reason that bots appear on the 'net, people don't know how to stop them. You teach someone how to cook before they use a cooker, how to read before you give them The Simarillion, why not PCs? Just educate people and the problem will change and we'll have different things to complain about.

only enforcing the slave mentality that we need 'controlling'

If computers are such a danger - come up with a solution to protect them from such attacks.

Most people don't have any inkling regarding computer security because its all made so complicated - by 'experts' - that they need to study just to understand it.

Most people fork out their cash on the understanding that they're buying a complete system, that they can then get on with their REAL job and leave the computer to do what its supposed to.

Most people are then rudely surprised to find their expensive system is incompetent - by incompetent design.

Any good protection system will run automatically, by default, any handle any and all threats. Any modifications needed by a simple but clear gui, designed with them in mind.

So far I haven't seen any system that can do this. But then it wouldn't be in the interests of AV system designers to do this, would it?

I think you'll find we allready have provissions for this sort of incompitence, It's called the data protection act. The problem (as usual) is, is that it's not being enforced properly and the penalties are not strong enough.

>...live in a house. You have to be able to fix basic problems like faulty plumbing or electrics.

Nonsense. You *DO* however need to be able to spot plumbing or wiring problems and get someone in to fix it before it floods your basement/downstairs neighbour, or set the house on fire (as applicable).; if you can fix it yourself, more power to you. Those matters can inconvenience more people than just yourself unless you're living in a sufficiently remote freestanding house (computer equivalent: standalone, not connected to the Internet).

>....drive a car. you have to be able to fix basic problems like failure to start due to loose wiring to ECU.

Nonsense again. You *DO* however need a license to show you're able to control a hefty lump of metal weighing a couple of hundred jubs at speeds of up to 1000 brontosauruses/hour and not inconvenience others who're doing likewise too much.

>....use a camera. You have to be able to pass a test of all the basic features like use of Program mode.

Who exactly are you inconveniencing by not being able to do that?

>...use a cooker. You have to pass a basic cookery course.

Same.

>...use a mobile phone. You have to pass a test in the the current SMS jargon and know how to setup MMS and data features.

Same.

The licenses, you oaf, get to apply when there's interaction with a larger group of unspecified 'others'.

>My 8 year old, special to his parents but just an ordinary child, uses a computer,

>without any AV software installed, and, with nothing more than simple advice.

>He's never installed a virus, clicked a link that took him to some mythical ha><0r >page, clicked a link that asked him for his details which he then has given away.

And all of the legitimate, non-iffy pages he (or you) has visited, is visiting or will ever visit will never be compromised, surely?

Can I have your IP number, so that I can add it to my firewall blocklists?

Decent advice, but you're still an idiot.

> Why are we not able to develop idiot-proof technology ? Why does every grandmother need to learn about anti-virus license renewal

Already done mate. Just don't look to Microsoft to provide it.

Education is the simplest and more realistic solution.

If everyone had a huge incentive to use circular saws, would we then require everyone to be licensed for saw use, or would we just make sure that people were properly trained in school?

This mentality needs also to be applied to gun use in America. If it works for birth control why won't it work for guns?

The underlying issue is that everyone believes everyone else is stupid, yet few will recommend education. Ironic really.

>The underlying issue is that everyone believes everyone else is stupid, yet few will recommend education.

Waste of effort.

I do not believe everybody else is stupid. I *KNOW*, from my 20-years-in-IT experience, they are. Simple as that.

If people had to use circular saws, then they would also use them to clean their toenails. And in the US, they'd then sue the manufacturer for putting such a dangerous device on the market.

When you send your banking details to a phisher, your computer becomes part of a netbot, really?

Licences and registrations? yeah shure, me dear. The users can afford it after all. Or, given that most of them only use the interwub for e-mail and google maps, won't they bother?

And the baddies will never, ever find a way through. Or will they?

The more implied trust you put in, (i.e. by licences and registrations), the more dangerous bad guys are. Because even with whatever test, you're not going to change the way the vast majority of lusers behave. You'll find that 99% of them actually perfectly know the basic safety (I mean, VERY basic) rules, such as: use an up-to-date antimalware app, change your passwords on a regular basis and don't make them too weak, don't open e-mail attachments that you're not sure are 100% safe, and the like (not to mention "try and use apps that are more secure than M$ trashwhore). But they can't be bothered with following these guidelines. Adding a "net licence" won't change this behavior and it won't bother the baddies at all, on the contrary it will provide a central location where to get detailed info on who is running what, and where. Phishers and hackers will be super-happy with your idea.

Seems that you genius are willing to turn a somewhat unsecure jungle in a totalitarian mafia-controlled prison.

On the other hand, basic IT training courses for all employees being given a piece of kit by their boss sounds good, but that's (supposedly) already implemented and does definitely not prevent CD loss, or laptop theft...

... to make it short, I'm just saying that you'll trade liberties that YOU're not interested in for others that YOU value more - and that you will loose every single liberty and safety that you might have gained at the first security breach, which is likely to happen whithin the first 20 seconds following the deal.

> Can I have your IP number, so that I can add it to my firewall blocklists?

If your firewall doesn't already block it then it seems that by trying to be a smart alec you have just shown yourself to be clueless about security.

Maybe the results of our IT licence test can be linked to the National ID card database and we can swipe our cards to logon and logoff.

My firewall blocklists serve more than just that one purpose you tried to infer from their name, dear twat. And rather than have all sorts of config files here and there I put some effort in allowing me to be lazy.

I also reserve the right to deal with known threats differently than I would deal with the Internet at large.

Because the average user just wants to do stuff, not learn stuff.

Until the IT industry provides a simple+safe+secure computing environment we can hardly blame the users.

...have a voluntary course available to teach people the basics of computer security - how bad people attack you, what to look out for, etc etc.

If you pass the test (and pass by actually showing that you have learned, not just that you attended), then you get a licence for a specific period of time - 2 or 3 years, say, that will allow you to buy computer equipment without paying VAT - thus it doesn't cost the retailer anything, and the government bears the cost of people being security-minded.

If you don't want to do the test, then simple - you pay more for your computer equipment.

I realise that this is a utopian scheme - there will obviously be ways around it - I don't need to be flamed, as I acknowledge this.

I just come up with the ideas.

Case 1

When I set up my girlfriend with a new computer and Broadband connection I was flabbergasted when the ISPs broadband installation disk seemed to freeze halfway through and I noticed the network was maxed out. I killed the connection and ran some tools - 7 trojan's installed withing 30 seconds. I ended up going home getting an SP2 disk re-installing the OS adding AV & firewall and reconnecting.

Case 2

I have spent the last 5 years constantly having to re-install my parent's XP system. Usually within two weeks the thing is riddled with spyware & malware rendering it useless until my next visit. In November I decided to install Mandriva 2007 instead. They don't have root access obviously. I showed them how to do the things they used to do on windows. I have not had a single computer support call since apart from what printer cartridge to buy. Looks like a result.

Case 3

A friend has 4 boys aged between 8 - 15. Her Windows PC has never worked properly for more than a couple of days. I installed Mandriva 2007 last October, the kids loved it - especially the compiz fusion eye candy. The machine has been rock solid since.

I guess if everyone in the world switched to linux we would soon start getting many more viruses etc targetting the OS but the locked down paradigm of the OS makes it much harder for the spammers/ scammers to get a foothold - although people will always be prone to social engineering.

finally - I don't currently run a linux OS (although I have in the past & will in the future) - I am using XP pro. I work for a company who writes nothing but windows apps so I need all the dev stuff installed. Then again I won't touch IE (opera & FF) if I intend to do unfettered web surfing I use a VM.

Personally I think your article is totally idiotic but I defend your right to make yourself look a complete twat in public.

PS how would we tie these licences to the person? ID card anyone?

.....the internet is dying off anyway, so lets go for it.

Between goverments telling us what we can and can't do, what we can and can't see, can and can't hear online, the internet is going that way anyway.

Hell, with the music industry is starting censorship at isp level, by telling ISP's to filter out content that the music company raises an objection to. Just because they have money and power they expect for their content to be given special favour. Next, religious groups will tell isp, to include their content in such filters, next....political parties....next your local next door gangster will take it to the highest court in the land to prove that if these people can have filters on their info, he wants one to.

Meanwhile, the general public, will give up on this b/s, and move to a grey market, where, due to laws passed, anyone can set up an isp by renting backbone space of a filtered isp, and have the isp filters removed. Small startup companies start providing un filtered content, now called the free internet.

More people then ditch the old internet, in favour of the free internet. the old internet becomes a shambles, caught up in patent like lawsuits, where everyones rights must be accommodated,

And the cycle starts again........

As for the sandboxed pc....

Smiles. Well shucks why stop there.Why not have a yearly insurance, based on how risky your pc is to the net, based on your isp observations as compared to a goverment scale. Points can be added for poor performance or lame choice of software. Software that does not come with an RIAA seal, adds 5 point to your premium. Bad surfing habits, or visitng prohibited sites, as set down and established by the multinationals and goverment, can result in a new DMCA provision, resulting in the loss of your PC, and those of any possible friends you may know.

Microsoft and intel, merge to form and manufacture, safe to browse pc's. PC's and macs, that conform to goverment standards, on internet use. Goverment standards being driven by multinationals.

Is this far off in the future. Maybe not. Think, of isp filters already blocking P2P connections, and inbuilt hardware to cripple a pc based solely on new DVD's, all with goverment and court approved backing. Think of current USA and UK ideas on ID cards, and their displeasure of something that is free and open for everyone. Given the money that multinationals place in the coffers of goverment, for political reasons, the link that is forming is uncanny.

The internet used to be place for freedom, the one place you could actually get to do and say what you wanted. Where, for that one instance, in that small period of time, that true freedom was free to all. Current laws catch up quick, and benchmarks in privacy are being quickly established and pushed beyond what current internet users expect. These new benchmarks have allowed government and multinational to push inside to the very core of your pc and browser habits. Once an outrageous benchmark on a persons privacy becomes established, the door is wide open to impose another. Pretty soon people forget that they had rights, and much worse, forget that they pay for this, and have the right to say no.

Spamer/malware/spyware: Does not care who you are, where you are, what you do, just wants to own you and make a fast profit. Will try to continue it's relationship with you.

Multinational/RIAA: Cares about who you are, wants to target you and your demographic range, wants to own you for the life of it's DRM, and make a fast profit. Will ditch you as soon as it sees you as a revenue failure.

Goverment: It needs to know you, it really realy wants to know to you, as long as it knows what your doing and when and with whom, it's happy. Does not care about your wants and needs, you must obey it!!! Wil never ditch you, will never leave you, you are a constant revenue stream. Inventor of benchmarks, and sandboxed PC's.

I have been reading Guy's articles for about 30 years, and I think he has a reasonable, balanced view of what has happened in the computing world in that time.

I think that you all ought to re-read the article (not just other peoples comments), because it is documenting a crisis of viewpoint (his), which I believe that many people who have been around long enough share.

He admits that what he is presenting is against his previously held views. When the 'net was new, it was largly (although not exclusivly) people who had an interest in the computers themselves who used it, and could thus protect themselves from the neo-vulnerabillities that were around at the time.

Time moves on, and the threats are now much more 'dangerous', the systems more complex, and the users more naieve. And the 'net is a more important part of our lives than ever before. Something needs to be done to prevent it being owned by malicious people, and he was presenting a possibe path as a talking point (and, boy, did it succeed).

But respect his experience. He knows a lot more than many of the journos out there. Don't call him names because he has raises an unpleasent option that neither he nor the rest of us really want. Try coming up with a workable solution yourselves that doesn't anger one of the parts of our community.

Power to you Guy, and I hope I will be reading what you write for a long time.

Hmm – I can imagine the adverts in the BA business lounge and Eurostar. “Come to Britain, leave your laptop and smartphone at home cos you don’t have a BritGov approved license to operate them here”.See how quickly Britain becomes the laughing stock of the business world. People already hate going to London because of Heathrow and airports in general due to “terrrrism”. Having a China-esque connection policy is going to drive businesses out in their thousands.

Has the uber-authoritarian Blairite streak gotten so entrenched in Blighty? Do so many of the commentors genuinely think “Big Government” can regulate every OS, device and connection in the country?

Oh, and I assume all the “pro” commentors assume they’ll be on the “white” list. Think how quickly you’ll squeal when your connection gets knobbled.

“Oh, sorry Mr Buttle – or is that Tuttle. Just get yourself down to the Dept of Connections with a valid 27b/6 form and we’ll get you a refund”.

The author may or may not have done some decent work in the past – but this suggestion has me scratching my head. Reality and this suggestion might have bumped into each other in a darkened corridor – but they didn’t make eye contact and most certainly won’t get to know each other intimately.

At home I have running boxes with Win2k,Xp,OSX,WinCE, a Blackberry, Wii with wifi dongle, and a PS/3 all connected to the interweb. I have net ready LiveCDs for Linux and WinPE as well, and obviously a POS home wireless/router with which I can malconfigure dyndns if I wanted. Not regularly on I have a bunch of VMs for Server2000, 2003, and Vista. There’s a tablet PC with Win98 kicking about. Oh, and my NSLU2 which is Linux of course. I’m *never* going to bother to pay to get or keep current some piddly little Govt backed “certificate” saying ..err…what exactly??

Case in point.The Win98 tablet is no longer supported by the OS vendor – would I not be allowed to use it any more given that I assume this certification would be linked to the life cycle of the OS? It would have to be linked when you think about it. I bought the tablet 6 years ago, it works fine for what I want it to do. Imagine the revenue incentive M$ would have if it could EOL Windows2000 and XP and force everyone onto Vista off the back of Govt enforced certification? “Mr Bloggs is running an unsupported OS, off with his broadband!”

Then there’s the application layer. Windows LiveUpdate *can* inject updates for 3rd party apps, but no company I’ve ever worked for is going to allow MS to f*ck with their apps – even if a hefty percentage of them are out of vendor support.

If this ever got to Govt level, I guarantee it will go the same was as key escrow – a fluffy bunny utopian idea that has as much chance of flying as a migratory bird with a coconut tied to its feet.

You've gone and fouled my Internet up. At this point, licensing all of you "end users" isn't going to help, so I've decided to shut the whole thing down...make your time....

I think that the major reason for the authors call for regulations similar to car use on motorways (the driving license, tests and so on) Is an old school perception of a computer and the Internet as some kind of device (a car) of limited use (transportation). A computer is much more universal tool. And in my opinion, the Internet is more like a city, (or better a world itself ) than the highway. As people were able to live with dangers of the world outside, they will learn it online. Although I agree that education is essentially needed in first place, but not going hand-in hand with licenses.

OK. So "this is bullshit but take it into account because the author has reportedly published serious things before"? I'd like to be able to fall for that. I'd probably be part of the "upper management" now. But for some reason, my brain doesn't allow that yet. No matter who wrote the stuff, bovine excrement it is, BS it will remain. The only excuse I can think of would involve Scottish breath freshener... and this wouldn't make the initial point stronger.

Ho, and -I almost forgot- please read the comments before advising people to re-read the article... you might learn a few things.

Anything to divert attention from the incompetencies of our political overlords...