Lol. I think I was a part of this story. In the early 2000s, I was one of those faceless, nameless government people who were complaining to MSFT that their s

Lol. I think I was a part of this story. In the early 2000s, I was one of those faceless, nameless government people who were complaining to MSFT that their software was insecure compared to Solaris or even ConvexOS. I KNOW I am not the only one to have done this, but we gave them a copy of the rainbow books at a meeting and asked them to read them. MAC (Mandatory Access Control) isn't the be-all/end-all of computer security in general, but it IS a good model for government computers in the 1990s. Plenty of people understood the Bell-Lapadula model, all our machines were self-managed behind locked doors and we could afford a small army of sysadmins and infosec people. I've talked about interviewing as the Office Security Architect in 2003, but the job that got me talking to MSFT was one in what was going to become NGSCB, bits of which were eventually rolled into Windows Vista. My interview for that team was scuttled when I talked with their senior tech person who asked me... "Oh. I see you have experience in Crypto(graphy), then you clearly know how to tractably factor a 2000 bit number." I admitted that I was still under the impression that it was a difficult problem, but he assured me that all you had to do was print it out in binary and apply a particular regular expression to it. When I pointed out that primality testing and factoring are different things the interview went south. I later found out this was some sort of MIT shibboleth and I was supposed to respond with some comment about the compilers class. In any event... It always seemed odd to me that NGSCB tried to make MAC a mainstream feature, but I wasn't really thinking about DRM. Like I said, if you're a big organization and can properly manage the classification problem, and have info security peeps who are cleared and trusted, MAC (as embodied in any of the C2 Unices from the 90s, NGSCB or SE Linux) can be useful. But yeah, the only reason you would want this on a consumer machine is to prevent the "owner" from doing something with downloaded media the person who produced the media doesn't want you to do (aka DRM.)