A Christmas Computer Bug, and the Future of Files

A Christmas Computer Bug, and the Future of Files


Let me tell you a Christmas story. Or, rather a Christma story, because this
is from the days when computer file names were limited to eight characters. It’s December 1987. Ronald Reagan was US President; Margaret Thatcher
was British Prime Minister. And home computers were sort of a thing, just, although for the few people that had them
they weren’t really connected up to any other machines. We were still two years away from the World
Wide Web even being invented. And in a small university in Germany, a student was writing one of the first major
computer worms. It was called “CHRISTMA”. Simple program, it only ran on one type of
old, text- well, now-old, text-based computer. Back then, it was state of the art. It just displayed a little text art of a Christmas
tree. But while the user was looking at that, it ran through the 1987 equivalent of their
computer’s address book and emailed itself to everyone in it. “Let this exec run,” it said — exec being
executable file, a program you start — “and enjoy yourself”. Well, by modern standards of ransomware and
identity theft, that is a pretty innocent virus, although it replicated so well and convinced
so many people to open it that it took down one of IBM’s networks for
a couple of days — and that was back when IBM was still a
force to be reckoned with. Actually, it took it down twice, it resurfaced three years later when, presumably, someone forgot what it was while they were
rooting through their files and opened — “ah, there’s that lovely little Christmas
card again”. Which brings us to a question. That kind of attack is still sort of possible
now, on modern hardware. Not the same program, but that’s how a lot
of malware still spreads: you convince the user to download something
and run it, and it gets access to everything on the user’s
PC — internet access, webcam, personal documents,
everything. Email isn’t not a good vector for spreading
stuff like that any more, but web sites offering pirated stuff do the
job just as well. And yes, there are other routes, there are zero-day attacks on Flash — actually, a lot of zero-day attacks on Flash, actually, it’s pretty much all zero-day attacks on Flash
right now. Zero-day meaning there is no warning given, zero days from the exploit going out and infecting
people, and Adobe trying to patch Flash, again — anyway, there are other routes. But ultimately, if you tell a user, hey, free music, free pirated software, free Christmas wallpaper for your PC, whatever
you want, you get them to download something and run
it — and it is game over. And there are some mitigations these days. Windows has User Account Control and built-in
antivirus, and Mac and Linux have administrator accounts
and permission management, but if the malware is trying to do something
to the important parts of the system, it’ll get stopped, as long as the user doesn’t
just click the OK box or type in their password, and let’s be honest, that happens more often than it should. But even without getting that permission, even if the virus that you’ve downloaded is
just able to use your user account and your files: it can still do a lot of damage, it can still encrypt all the files in your
personal directory, all your photos and your business invoices, and lock them away until you send Bitcoin
to some anonymous person far away. To the computer that’s naively running a program, there is no difference between a virus doing
damage, and the user deliberately running something
to take those same actions. You can’t create a filter for malicious behaviour
like that without having a near-perfect model of what
the user’s thinking and what they might actually want to do. There are times when, genuinely, you want to delete everything on your computer. There is another option, though. And we use it all the time. On an iPhone, for example, each app has its
own separate area for storing documents. There’s not one central space that all apps
can access at the same time. Imagine if desktop computers were built that
way: all the reports or homework that you’ve written
in Microsoft Word are only accessible under Microsoft Word,
locked down. And if you want to email a report to someone, or convert it to a different program, you don’t go — if you want to attach the
file to an email program, you don’t go to the email program, click “Attach” and run through your central
Documents store — you open Word, and you tell it to push that one file to the
email program. All your music would be accessible only in
the player you downloaded it in, until you pushed it to somewhere else. And right now, all the techie people watching
this, all of you, you’re out there and you’re going, “oh that’d be terrible, that’s an awful thing, it’d mean we wouldn’t be free to use our computers
the way we want, how am I supposed to chain these three different
programs together to do this obscure thing that I need to do?” And I get that. I really do. I enthusiastically endorse that kind of bodging. And for anyone who’s delving deep into their
system, who knows their way around, that kind of advanced mode is necessary. But why didn’t we build those systems, the ones for non-techies, differently? Because we never had the chance. The desktop computers that we have today are
descendants of those old systems from 1987. There wasn’t the storage space or processing
time back then to try and give every application its own little silo and manage it separately
— besides, in a lot of cases the programs were just writing
ones and zeros. Computers were for academic use, for professionals, so it was Proper Expensive Equipment that
had to be treated with care. But for today’s regular user, for the people
who get hit by ransomware and who do lose all their family photos: I’m
not sure that system works. Do regular computer users really need to see
the “C drive” or “Macintosh HD”? Should they need to worry about folders and
files and backups? We’ve got that design because of backwards
compatibility, because for desktop computers we’ve never
been able to have a clean break. Even Apple, who said that their users move
with the times, they give a couple of years of grace to stay
updated — and, hell, Windows will still happily most programs from
literally twenty years ago. There’s never been the option to start fresh. If they ever stopped using that metaphor of
folders and files all in one central location — and it’s been promised, from time to time
— all those old programs will stop working. But for all-new devices that we’ve only had
for the last few years? For tablets, and phones, and Chromebooks, with their locked-down operating systems?
Behind the scenes, sure, they still use that folders and files system, but it’s not visible to the end user. As those devices become more and more popular, and the PC’s market share starts to decline,
at least for home use: perhaps we will finally be able to leave that
old system behind, and computer security will get a little bit
better. Except. One of the reasons that Britain has such a
strong tech industry now is the home computer boom of the 1980s, when the BBC Micro and the ZX Spectrum made
a generation who could code. We’re seeing governments push and push to
make sure that kids are computer literate, that they know that they can write the future
as well as read it. And as much as locking down computers and
systems might makes the world more secure: you can’t write iPhone apps on an iPhone. And someone has to write the iPhone apps. So whether you’re hoping for a new laptop
with its files and folders, or a new phone with its separate data silos, or maybe something a little less technological
under your tree: merry Christmas to you. And whether it’s digital or physical, whether you’re writing code, or painting art, or just building a snowman: here’s to whatever you’re making next, and I’ll see you in 2016. [Translating these subtitles? Add your name here!]

100 thoughts on “A Christmas Computer Bug, and the Future of Files

  1. What we are doing is not working for most user. That is why most homes have a laptop that is never on and phones that are never off.

  2. The modern equivalent would be that ANIMATED CHRISTMAS TREE FOR DESKTOP thing joel downloaded once.

  3. As far as desktop goes, Windows 10 introduced UWP, which does store app data in it's own sandboxed area, but they still have access to the main file system (even though it is limited).

  4. i would say you should make a video about cryptography cryptology i learned a lot from your computer and technology or binary videos

  5. the major switch for windows was from DOS and 3.1 to windows 95/98/xp/2000/me
    however even many DOS programs, games for instance(as they have an avid following) are possible to run with things like DOSBox on windows 10

  6. I wonder is there something between deny and grant. Hmm.. Only if we had invented questions popups, like Hey, Gmail try to read files from Word. Hey ChristmasWallpaper tries to read files from NetBank app. And Allow, Deny button and Always checkbox. Hm…

  7. Or just make Websites more secure.
    for those people who got the viruses because of "free stuff websites" they deserved it and should learn form their mistakes.

  8. …and Every document you ever wrote in Word is now owned by Microsoft , and the next update can stop you accessing all your documents, you are creating ransomware … not stopping it

  9. The issue is not that an app does not own it's files .. it's that a user can and will download and run an app … Linux and Mac and phones have app stores and package managers that teach people: this is where you install software, and nowhere else …

  10. I really like Android's implementation of this system, where apps are locked down but you're still given a traditional file explorer in case you know what you're doing, and you could root your phone if you really know what you're doing.

  11. What about a default mode which is locked down with a function to unlock everything for those who want to do more with it?

  12. While in theory it's great to have a fancy front end, another issue with having a large portion of people using it, will be an extremely limited support group for the advanced mode, as companies will no longer have hordes complaining if something goes wrong.

  13. I'd go with a slightly different approach with file directories – apps get their own folders, but they can't lock down OS access to their own files, e g Apple File Explorer. Programs may of course encrypt their files to disallow access and tampering, but that shouldn't be the default.

    For backwards compatibility, just run stuff inside a sandboxed OS emulator. You could probably use a sandbox mode for development too, which doesn't touch the system.

    The real problem is coders are lazy and not expected to make efficient code, but let better hardware pick up the slack rather than save millions of other people's hours by optimizing code.

  14. its still considered 2 years after this video came out, so i find it funny that you say about 2 years before, so you made this video before i watched this video

  15. yeah, android does that. but what it also does is that every app maages its folder the way it wants, deletes files (or doesnt) the way it wants to, and when you have used and installed/uninstalled a handful of apps the file system begins to be clotted with hundreds of files you don't actually need, uninstalled apps still have their files left in there and you use so much space. i don't think the average app developer will bother to handle this stuff and actually save you any space. it's not a perfect solution.

  16. Many of today's so-called 'advanced' users began by messing around on their cheap, consumer hardware and learning more and more how the system worked.

    To 'lockdown' a machine fully would rob the next generation that potential for tinkering and therefore, maybe, stumbling into being advanced users themselves over time.

    Being protected and being imprisoned are very similar situations.

  17. This segmented file system makes it very hard to manage storage space. My iPhone has very small storage space, but I can never tell where the files are to see which ones are actually taking up the space. I have to go through various apps that say the amount of data they are each using, but I can’t just delete the files. Often the best I can do is to delete an app and re-install it and then I lose my settings and there is no way to choose which files I actually delete. This is a serious problem that Apple isn’t about to fix because they want to sell me additional cloud storage which. This isn’t as good because I still can’t really manage my file storage. I just pay for more space to dump an ever increasing pile of data most of which is superfluous mixed with the few files I want to keep, but worse I have limited accessibility to those files depending on the strength of my cellular signal and in addition to paying extra for that additional storage space, I have to pay a third party for the data transfer to access my files.

    While they old system may be more vulnerable to viruses and ransomware, the new system is virtually ransomware for which you are constantly paying the manufacturer for access to your data. I prefer freedom with vulnerability to safety with restriction.

  18. something happened to me like this,
    i downloaded the sims 4 with the dlc's from a website. (i wasnt gonna pay £500 for it)
    then i litterally couldnt cmd or task manager…

  19. If we go to the "Everything is in a container" approach, then, we can say goodbye to the UNIX philosophy. Or put more simply…
    #! /bin/bashIf programs != container; then
         echo "UNIX philosophy GONE"
    else
        echo  "UNIX philosophy intact"

  20. I thought about a hybrid kind of system where I as user have the right and can grant this right to any app to all my data, but the apps are locked into their jail

  21. I really like your videos!! What if the computer was set to detect if the command was from the keyboard or mouse and demands a admin password if it is not something it have to do by your commands?
    If you execute a program via the mouse, it detect that and lock everything else, if you then decide to delete a file, it looks if you dit the command.

  22. mery christmas bro. Heres the solve to your idea, Microsoft make a simple OS called 'pussy OS' that comes with word and some other simple things.

  23. You know, some people out there, mostly crusty old codgers, don't need "computers" at all. They need a microcontroller at best. That's why dumb phones still exist. To me, the utility of FireOS is "It's a youtube, Netflix and Audible machine." My PC, that I need root access to.

  24. Been using Macs for the past 15 years and I still haven’t had a single piece of malware, spyware or ransomware or any hardware failure now I think of it. But that’s just because of the low market share.

  25. Also the techies will find a way to make there computer more accessible even I did it with my phone

  26. If we actually had a fine-grained concept of what programs need to talk to or even see what files, things would be a lot better. This wouldn't even be incompatible with the customizable PC, although it would probably break most of the Unix abstractions.

  27. I somewhat disagree, I think that phones are almost unusable as "general purpose computers" because of sandboxing, and the lack of an administrator account. I would maybe accept the move to mobile if I could run something like Raspbian or LM or Ubuntu on my phone (never windows it's terrible linux is better).

  28. I don't want the world to be safer, I want it to be better.
    Hunter-killer drones that take out those who make viruses and try other types of e-fraud would be enough for me.

  29. I don't like "easy" operating systems. This statement might not make sense but if you ask me, having full control over a computer keeps you smart. Sometimes having to delete a virus without a dedicated app for example is something people should know how to do. How to properly back-up files etc. Just learn it. I seriously think that by making our lives easier we only get dumber.

  30. I think when the video came out thoose things have been in development, but meanwhile more and more technologies are becoming more popular using this approach: Docker on servers, Snap and Flatpak on Linux, UWP Apps on Windows.

  31. Also why would microsoft want to share data with Thunderbird? Or Gmail? F them, let the user just use Outlook, nobody needs alternatives. And this will extend, why would anyone want democracy? Voting? For what, so that others menace our monopoly, let it there be only Dictatorships, we decide what is good for people, since we are so much smarter and bright, for example, no one needs gays, feminists, independant scientists or artists let us just execute them and burn their bodies to ashes.
    No one would agree with that, because the human is condemned to choose and take that risks associated with that, it is inherited to the human condition.

  32. separation of programs is not a solution to prevent malicious operations. there is no guarantee for a user that some application will never do something wrong. i think there should be protection other than file protection. it should be protection of information treatment. applications should be like source of algorithms, not like objects to whom user trust his data or device.

  33. the best way to avoid viruses is to not run files unless you trust them
    its scarily easy to write viruses (for windows) that even virus total cant identify as dangerous

  34. I really think Chromebooks will be the future of computing soon. They're already being used by some school districts. Android and Chrome app support gives you the nice idiot proof permission system, while the Linux VM support gives you the development flexibility. If you really, really need full access to the hardware you can developer unlock the system and modify everything, even run another OS on top of ChromeOS' kernel, or if that's still not enough boot into Linux off a USB.

    The reason I bought mine is because I wanted the flexibility of Linux (and Android), but I wanted a system that was designed to work well with the hardware I was using. I've lost too much of my life trying to figure out how to get Linux to work, or finding the "Linux" way of doing things, which is often obscure and/or not well supported. With this computer I can keep most everything running under the Android part of things (except the browser), using the mostly open source apps I already use on my phone, and when I need to do something more advanced I just drop into Linux apps, which are conveniently linked into the Chrome apps menu. There's also a terminal, but I wouldn't expect an ordinary user to get that involved with it.

  35. On an unrelated note, you should make an episode on ring-0 DRM software pieces that were used as entry point exploits. That's always a fun PR story! 😀 (bonus points if you install that DRM stealthily, and double bonus points if it actually breaks some functionality of the system it's installed on; triple if you don't remove it once the user is done with your crap)

  36. I'll take the legacy way of handling filesystem over that locked-in iOS-like poopcrappe anyday, anytime, since i want to be able to have as much control over my machine as possible. It's people who need to learn how to handle computers with proper care, be it learning on their mistakes or not.

  37. German student: you know what, I'm gonna spread Christmas joy by making a program that shares itself to others, which will show holiday greetings and this cool tree!

    the program: (takes down IBM twice)

    German student: (surprised pikachu)

  38. I enjoy how you touch on both sides of an argument and let people come to their own conclusions based on that information, that's what makes your channel so great.

Leave a Reply

Your email address will not be published. Required fields are marked *

Releated

Trent University’s 50th Anniversary

(music playing) Dr. Leo Groarke: I wanted to be President at a University where I could be “close to the action”. (music playing) Announcer: Fifty years ago our community’s dream for a university became a reality. And for half a century, with a forty-year partnership in Oshawa, Trent University has been challenging the way we […]