3 ms·

It's such a huge flaw that there's no need for hindsight, really. A good tester should be able to point out the problem with autorun with no prompt.

by nandemo 16y ago

jarek 16y ago
Autorun was introduced in Windows 95. The security world, especially on consumer OSes, and especially again on Windows 9x, was very, very different back then. CIH wouldn't come around for another three years. CD-R burners were pretty expensive and pretty rare, cheap USB drives were a twinkle in someone's eye that wouldn't materialize for another five years at least. We don't know that the problem wasn't noticed; maybe it just wasn't considered to be crucial. Consider the magic-like benefits it would have been weighed against: all you have to do is put the CD in! Edit: the USB specification and first USB consumer products weren't released until 1996. Further food for thought.
- nandemo 16y ago
  Well, I don't really understand how that contradicts what I'm saying. I still think a decent tester should have been able to point out the problem back then and mark it as "critical". For me it's so uncontroversial it could even be an interview question. Viruses and trojans already existed back in 1995, and I don't think anyone would claim then that CD-R burners would remain expensive for long.
  - jarek 16y ago
    Said tester would have been overruled by a PM.
  - ghshephard 16y ago
    Security versus Flexibility - from 1995-1999 Microsoft, Flexibility frequently won out. It's better to have a monopoly on the world's operating systems, but be insecure, than to have the worlds most secure operating system, but have some other company be the market leader.
powertower 16y ago
Assuming that the average computer user in those days (and even today) was capable of navigating to the cd drive letter, entering it, and double-clicking "setup.exe", "install.exe", or "app.exe" - via some type of an understanding of what to do after inserting a cd.. would be an even bigger flaw. Autorun did exactly what it was designed to do and solved the problem both for Microsoft and the software shops with users not being able to install products -- the worst of the worst of issues.
- ericd 16y ago
  This. Lambasting autorun as an obvious design flaw is really betraying a lack of perspective on what's actually important in a computer's design. Yes, security is important, but making it easy for normal people to use the computer was much, much more important, and hiding people from the crap at the core of windows (like needing to hunt down blah.exe) was a very important part of that.

It's such a huge flaw that there's no need for hindsight, really. A good tester should be able to point out the problem with autorun with no prompt.

by nandemo 16y ago

It's such a huge flaw that there's no need for hindsight, really. A good tester should be able to point out the problem with autorun with no prompt.

jarek 16y ago

Autorun was introduced in Windows 95. The security world, especially on consumer OSes, and especially again on Windows 9x, was very, very different back then. CIH wouldn't come around for another three years. CD-R burners were pretty expensive and pretty rare, cheap USB drives were a twinkle in someone's eye that wouldn't materialize for another five years at least. We don't know that the problem wasn't noticed; maybe it just wasn't considered to be crucial. Consider the magic-like benefits it would have been weighed against: all you have to do is put the CD in! Edit: the USB specification and first USB consumer products weren't released until 1996. Further food for thought.

nandemo 16y ago
Well, I don't really understand how that contradicts what I'm saying. I still think a decent tester should have been able to point out the problem back then and mark it as "critical". For me it's so uncontroversial it could even be an interview question. Viruses and trojans already existed back in 1995, and I don't think anyone would claim then that CD-R burners would remain expensive for long.
- jarek 16y ago
  Said tester would have been overruled by a PM.
- ghshephard 16y ago
  Security versus Flexibility - from 1995-1999 Microsoft, Flexibility frequently won out. It's better to have a monopoly on the world's operating systems, but be insecure, than to have the worlds most secure operating system, but have some other company be the market leader.

powertower 16y ago

Assuming that the average computer user in those days (and even today) was capable of navigating to the cd drive letter, entering it, and double-clicking "setup.exe", "install.exe", or "app.exe" - via some type of an understanding of what to do after inserting a cd.. would be an even bigger flaw. Autorun did exactly what it was designed to do and solved the problem both for Microsoft and the software shops with users not being able to install products -- the worst of the worst of issues.

ericd 16y ago
This. Lambasting autorun as an obvious design flaw is really betraying a lack of perspective on what's actually important in a computer's design. Yes, security is important, but making it easy for normal people to use the computer was much, much more important, and hiding people from the crap at the core of windows (like needing to hunt down blah.exe) was a very important part of that.