PC World Still Getting It Wrong

Google’s OS Security Claims Called ‘idiotic’ – PC World

Google said in a blog post that it was “going back to the basics and completely redesigning the underlying security architecture of the OS so that users don’t have to deal with viruses, malware and security updates.” An operating system should “just work,” the company said.

Bruce Schneier, the chief security technology officer at BT, scoffed at Google’s promise. “It’s an idiotic claim,” Schneier wrote in an e-mail. “It was mathematically proved decades ago that it is impossible — not an engineering impossibility, not technologically impossible, but the 2+2=3 kind of impossible — to create an operating system that is immune to viruses.”

Let’s think about this for a second. Yes, it is not possible to solve all security problems. However, it is possible to solve virus and malware problems in a computer that is constantly connected. SImply, put the OS in non-writable firmware. Or, at least put it in firmware that can only be updated from a bios mode. In the former case, if you ever get infected, reboot. In the later case, there is potential of distribution of viruses, but you don’t have the everyday threat issues that current PCs make. Again, as long as the firmware updates don’t introduce a virus, then a reboot fixes any potential problems.

Now, what if there is nothing stored locally? What if all of your documents and files live in the cloud? Then, what damage do viruses do? Simply, at this point security issues become issues of privacy concerns. These types of concerns can be engineered away. So, yes, in a traditional PC is it impossible to be completely secure. However, it is possible to invent a PC where security is irrelevant. I have a lot of respect for Bruce Schneier, but I think he is theoretically right, but practically wrong.