Bruce Schneier: Chrome OS's Security Claims "Idiotic"

"Guru" is probably the right word to use for Schneier at this point, and here's another great example of him inserting himself into a story he has no involvement in, making comments that betray a complete lack of awareness of the context of the story he's commenting on. Par, unfortunately, for the course.<p>It is doubtless the case that Schneier is fielding constant phone calls from trade reporters asking for his opinions on the security news of the day. Taking those calls, and writing the op-ed-style pieces that generate them, is probably the bulk of his job description. And so it's to be expected that he's going to be asked questions about things like Chrome's "virus-proofness", and having given no thought to Chrome or its architecture, be at a loss for pithy commentary. Hence, "2+2=3". Thanks, Bruce.<p>But before you feel too much sympathy for him, remember that he always has the ability to tell the reporter, "sorry, I don't know enough to comment intelligently on this story".

"It was mathematically proved decades ago that it is impossible -- not an engineering impossibility, not technologically impossible, but the 2+2=3 kind of impossible -- to create an operating system that is immune to viruses." Does anyone know what he's referring to? That would be an interesting read.

These sorts of arguments really make me facepalm.<p>Listen, Bruce, they don't <i>literally</i> mean that their OS will be completely and 100% totally impervious to any sort of malware or virus attack of any kind ever to exist ever in the future ever ever ever to infinity times infinity.<p>They mean that their OS will be considerably more resistant to any sort of reasonable malware attack in the foreseeable future, and they're 100% correct.<p>Windows, even just because of its target market, will be the low hanging fruit for as long as I think anybody can foresee. Simply because of this, linux and bsd-kernel based operating systems that are using proper user isolation (meaning not running as the freaking root account by default) are going to be more secure than windows.

It would be good if we could look at his actual statement/blog post rather than an analysis. Given how so few of his words are mentioned in the "article", it makes me wonder if the 'press' is misinterpreting what he really said.

Not worth reading. Let me save you a few minutes of your life. How do I vote this down ?

I think making a claim like <i>users don't have to deal with viruses, malware, and security updates</i> is potentially more dangerous than having an OS with a less robust security model.<p>Even linux and BSD systems are vulnerable if malicious programs are given the necessary permissions to run. If a casual user hears something like, "This OS is immune to viruses", they're likely to be a lot less cautious about running programs that might auto load from websites. By now most Windows users know better than to click OK when a website wants to install something on your PC.

"Google, while announcing its new Chrome operating system late Tuesday, said users would no longer have to worry about viruses, malware and security updates"<p>Good marketing. Tough to live down when you're first discovered to be "human" (developed by software engineers) - as it will be when Apple's first takes a major hit [which news suggests the iPhone may be vulnerable to].

Perhaps a needed dose of sanity (even if hyped) to counter Google wishful thinking/marketing: "Google, while announcing its new Chrome operating system late Tuesday, said users would no longer have to worry about viruses, malware and security updates"<p>Good marketing. Tough to live down when you're first discovered to be "human" (developed by software engineers) - as it will be when Apple's first takes a major hit [which news suggests the iPhone may be vulnerable to].

Whatever they do, I just hope they release the code. That way even if their redesign fails, the FOSS community will have something to learn from it, and if it's the best thing ever, it can be ported over to other Linux distros.

I really don't think anyone should view this claim as anything more than marketing claims and statements, not actual technical claims or guarantees.

Just report, don't scoff experts. It makes you look stupid. Now what was the context? Ah, I see you were so busy trying to claim intellectual superiority (failed) that you forgot about that.