Maybe Microsoft can help with a simple change to all their browsers: before an add-on is engaged, have an "are you sure" window. Or add an always off management option for snap-ins with related management utilities. Even better, like drivers, maintain awareness of major add-ins and what is ok, then go to always off on any version with a known exploit. More impressive would be to simply be aware of the exploit. Simple: look for Java, or any other add-in, downloading something that either has an executable magic byte or a magic byte mismatch to file extension or a broken magic byte.

I was thinking more along the lines of writing integrity checking from scratch for NoSQL vs. using what a major relational database comes with and has been polished by Oracle or Microsoft

or is that more-than-useless... i'm still in a new-baby fog.

Thanks. I, too, am waiting for someone to chime in who knows the caveats of their horizontal data structure.

Thanks. I, too, am waiting for something less-than-useless to show up.

The government forgot iSCSI, Firewire, and eSATA? Really? And, unless they have locked down new hardware discovery, you could add these in with a PC Card or Express Card slot on any laptop. iSCSI only requires a source system and rights to set up the drive. Even easier: map a network share on an unmanaged asset that you brought along to take advantage of DHCP.

And you don't need any magic or special software to trap a drive connection event, just use WMI. It works for any drive type: just listen for a drive connection event... like ten lines of code, max. You could set up an agent or script to watch for these on any Windows computer with almost zero effort... you could even do it remotely with the proper rights.

Plenty of vendors have software to help, too. Off the top of my head, McAfee, Symantec, and Cisco all have something. The catalog of features they offer attempt to manage the DLP idea a little more completely any one USB drive solution... although I admit none of the vendors have it absolutely right yet.

I will ask a question I always ask about something like this: What's the goal? If it is Data Loss Prevention (DLP) then I believe they have failed. If it is to prevent virus installations then could start with disabling autorun.inf and supplementing that effort with a little drive connection detection using WMI.