<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" 
      xmlns:thr="http://purl.org/syndication/thread/1.0">
  <link rel="alternate" type="text/html" href="http://dashes.com/anil/2001/01/im-not-surprise.html" />
  <link rel="self" type="application/atom+xml" href="http://dashes.com/anil/atom.xml" />
  <id>tag:dashes.com,2009:/anil//1/tag:www.dashes.com,2001:/anil//1.559-</id>
  <updated></updated>
  <title>Comments for I&apos;m not surprised they say</title>
  <subtitle>A Blog About Making Culture</subtitle>
  <generator uri="http://www.sixapart.com/movabletype/">Movable Type 4.3-en</generator>
  <entry>
    <id>tag:www.dashes.com,2001:/anil//1.559</id>
    <link rel="alternate" type="text/html" href="http://dashes.com/anil/2001/01/im-not-surprise.html" />
    <link rel="service.edit" type="application/atom+xml" href="http://dashes.com/mt/mt-atom.cgi/weblog/blog_id=1/entry_id=559" title="I'm not surprised they say" />
    <published>2001-01-17T01:11:24Z</published>
    <updated>2005-08-12T06:49:29Z</updated>
    <title>I&apos;m not surprised they say</title>
    <summary>I&apos;m not surprised they say they&apos;ve found security holes in Windows Media Player skins. I did one of the first skins Microsoft commissioned for Player...</summary>
    <author>
      <name>Anil</name>
      <uri>http://anildash.com/</uri>
    </author>
    
    <content type="html" xml:lang="en" xml:base="http://dashes.com/anil/">
      <![CDATA[<p>I'm not surprised they say they've found <a href="http://news.cnet.com/news/0-1005-200-4499270.html?tag=st.ne.ron.lthd">security holes in Windows Media Player skins</a>. I did one of the first skins Microsoft commissioned for Player 7, and the potential for those things is remarkable. Basically, anything you can do with a local, scripted, web page is open to the developer.</p><p>That being said, the default settings on most people's browsers prevent these kinds of exploits. And I'm really tired of this George Guninski guy making a name for himself by &quot;discovering&quot; these &quot;vulnerabilities&quot;. Being able to run signed code was a design decision Microsoft made. I understand why people object to that decision, those opinions are legitimate and there are platforms that make other decisions in those regards.</p><p>But there are problems with the constant teeth-gnashing and hand-wringing over the handling of unsigned code on Windows/IE machines. First, people blindly click &quot;OK&quot; and &quot;Run&quot; on every goddamn thing they see. If they get a program from a stranger, set their security settings to let any random program run, (and they <em>do</em> have to set them, it's <strong>not</strong> the default) and then decide to run a program that screws up their machine, what should be the result? I say they <em>should</em> be fucked. A little judgemental and perhaps overly Darwinistic, but those are fundamental flaws of my character, and I'm happy with them.</p><p>I know, I know, I'm blaming the victim and what about people who don't know any better and blah, blah, blah. But <em>believe</em> me, there are so many warnings you have to click through, a user has to have made at <em>least</em> three separate decisions to exceed their level of knowledge and keep pushing towards their own destruction before anything bad will happen. I see it as a decision akin to smoking; If they want to kill themselves, go ahead as long as they don't affect me.</p><p>Which brings me to the second, bigger point. The George Guninskis of the world, with their sky-is-falling alarmist security announcements punish advanced users by pretending that these are big dangers for home users, and then I lose things like the ability to get to a goddamn program that someone emails me.</p><p>So the hell with you, George. I mean that in the nicest possible way.</p>]]>
      
    </content>
  </entry>

</feed>
