Computer built under slave-like working conditions in China?

Looks like it's darn near slave labor, according to BoingBoing

I have a new appreciation for the Dell keyboards as shown in the photo...

Explaining Input Lag

Bit-Tech.net has an excellent explainer on input lag on a modern LCD monitor. A good monitor will techncially have some input lag, but at a tiny delay imperceptible to anyone. Poor-qualitiy displays are a diffrent beast entirely. Probably the best part of the article is explaining a methodology for detecting input lag. They're able to illustrate the problems clearly in video and pictures.

Windows Vulnerabilities - 92% mitigated by not being administrator

I'm going to step aside from my normal patching discussions and talk about what happens when you do get attacked with malware that exploits a vulnerability. When a nasty program exploits an unpatched vulnerability, there are always mitigating factors that can help limit the impact. One of the big ones is that the exploit usually runs in the security context of the account which it attacks/is run against. Security vendor BeyondTrust looked at the 154 Microsoft vulnerabilities published in 2008. They found that 92% of all vulnerabilities had their impact mitigated or were rendered completely harmless when the user was running with no elevated privilege (normal user rights). Obviously this is a report from a security vendor selling software that helps manage user rights... but the breakdown for 2008 is striking, indicating that running as non-administrator at least mitigates:

• 94% of Microsoft Office vulnerabilities reported in 2008
• 89% of Internet Explorer vulnerabilities reported in 2008
• 53% of Microsoft Windows vulnerabilities reported in 2008

That makes sense when you realize that the first two categories are just applications. They're very specialized, widespread and extensible applications, hence the risk. Ultimately, however, they're running at the user's privilege level. Even though the OS itself is somewhat less protected-- many of the juicier exploits will run at the System context or elevate privileges-- 53% mitigation is still pretty good.

Here's my beef with Microsoft in this regard. We all know that running in the least level of privilege is the safest and these numbers add good ammunition to that argument. While Microsoft has made great strides in allowing the user to elevate their privilege on some actions in the "XP era" and later, getting the ability to universally change security context on the fly eludes them. *nix with sudo and the standard GUI security elevation method of OS X both have serious problems, but they're a lot closer to right. Windows 7 will certainly continue the slow progress in this area, but at some point Microsoft ought to do better.

Windows 7 Update: Editions and Release Candidates

Windows 7 is moving along swimmingly (that's a betta splendens joke, son.) The good news that that the beta version that we have out currently is the only real beta we're going to get. RC1 be the next release. A mid-2009 release looks increasingly do-able with a late Q2 timeframe not out of the question.

The bad news is that Windows 7 will be coming in 6... editions that is. Things to note:
- Home Starter is a gimped edition allowing only 3 concurrent applications, similar to XP starter edition. This time, however, it'll be a worldwide OEM only release. Expect this version to ship on Netbooks, possibly including in developed countries.
- Home Basic is now for emerging markets only, but will look a lot like Vista Home Basic -- unlimited concurrent aplications but no Aero Glass, no "advanced multimedia" features and limited local area networking support.
- Home Premium is largely similar to Vista Home Premium in feature content with the main limitations being ones relating to remote access, joining a domain, EFS etc. This version will be available worldwide.
- Professional is the "intro" business class OS, with the ability to join a domain, use EFS, etc.
- Ultimate is again the ultimate home/business solution, and the best license that you can buy individually. Ultimate adds BitLocker, AppLocker, etc.
- Enterprise is available only as a volume license, and includes most of the same features that Ultimate does, plus deployment and management-centric tools.

At least it's no worse than Vista, but whomever thought limiting an OS to three concurrent apps should be shot repeatedly at close range. I'll be a sad panda if this version really starts infecting computers I have to touch.