Wannacry About Business Models

Exactly. The article isn't excusing Microsoft. But it's also arguing for a subscription model that aligns incentives.

Anyone with an EA has been paying for SA For Windows for many many years.

The subscription is just a way to get rid of the perpetual right to use and effectively raise the rent. My marginal O365 user costs like 2x more because you cannot buy Office anymore in the EA that I have.

SMB predates the internet. It is designed for the LAN.

There was a time when Windows was not internet-compatible unlike another OS I recall using at the time: BSD UNIX.

Then Gates finally gave up trying to understand why anyone would want an internet connection and decided he would dominate the www so he took the TCP/IP stack from a UNIX OS and inserted it into the Windows kernel. Then came "Internet Explorer".

From that day forward, Windows has always been vulnerable. It has been continuously vulnerable.

Unlike Windows, UNIX has never needed NetBIOS, SMB, CIFS, or whatever Microsoft calls the additonal layers of complexity today. UNIX can directly handle TCP and UDP. UNIX lacks the attack surface that Windows SMB provides, by default.

Microsoft refuses to ackowledge this flaw and fix it. Windows has an an enormous user base. No need to win user over with sensible design. They are already locked in.

In any other industry a product with a track record like Windows would have never been used for internet purposes. But this is no ordinary product. 80% or more of Windows users do not select and purchase Windows. They get it by default with the purchase of a computer. There is no choice. There is no refund for a defective Windows. Because there was no purchase. Sorry users.

As an end user, I got better "customer service" from the volunteers behind a free open source UNIX-like OS that I ever did from Microsoft.

The best way to make Windows "safe" is to disconnect it from the internet. "Updates" are not going to solve the problem that Microsoft itself has created and perpetuated for over 20 years. Windows was never meant to be connected in the first place. That was not Gates' vision.

And we are still seeing that legacy today.

Rumors of the retirement of Windows, e.g., a Midori replacement, were apparently no more legitimate than a 1990's Microsoft vaporware announcement. Microsoft need not do anything. Monopoly is sweet.

There are other OS besides Windows, open source and available for free, which are better suited to be internet-facing computers. Microsoft alas will never admit this and will continue to encourage, perhaps even require, people to connect Windows computers to the internet.

Microsoft's latest move is to replicate the userland of one of those other OS into Windows. That way the user will get the "benefit" of SMB. (or whatever it is called now)

If the user were using a UNIX-like OS that has no SMB layer on their internet connected computer, then how would they experience the fun of EternalBlue?

Meanwhile a quick read about this latest worm is that it relies on common file extensions to select files for encryption. Does this mean that if the user renames the file extension on her important files from .docx, .xlsx, etc. to .wannalaugh then they will not bet encrypted? Maybe she could xcopy them to .wannalaugh in bulk.

I don't think SAAS aligns the incentives the way the author claims it does. The biggest effect is to incentivize lock-in to an even greater extent than today. After all, if you can't switch then the money is guaranteed to keep pouring in.

Under the old model, if you didn't like Vista then you could stick with XP or wait for 7. Microsoft had definite incentives to make sure they were making improvements that were valuable to people. Under SAAS, you don't like Vista? Sucks to be you, because it's already installed - and thanks for the cash!

Finally this model doesn't account for those that can't do updates for one reason or another. Many of the first systems hit were medical systems that can't even do critical upgrades without going through a full requalification. It's possible that Windows should never have been considered for those systems in the first place, but the pressures of the marketplace almost guarantee that it happens.

IBM stuff that survives from the 70s does so because those organizations planned their future hardware and software migrations. z/OS releases are supported for 3 years after release. You then have to update to the N+1 or N+2 version. Windows releases are supported for 11 years. You then have to pay for extended support or update. This has always been the case. This is well known. If you're running an internet connected XP machine and not paying for extended support you have nobody to blame but yourself. It is not Microsoft's responsibility to support all versions of their software indefinitely and for free.