The assumption here is that an attacker choosing the easiest way has no other route. It would be safer to say that the route used by the worm would have been unavailable if basic preventative steps had been taken.

It's like the old joke. "Ever wonder why whatever you're looking for is always in the last place you look?" "Well, sure, once you've found it, why keep looking?"

Microsoft seems to think the authors would have stopped looking without finding an exploit route. Instead, they found one, and stopped looking.

I am shocked that the number of nmap users who are also download.com users would be significant.

Eh, I kinda agree with him. I hate it when my phone is a computer too.

I do appreciate that Apple has spent some time making things snappy. I understand this isn't always the case (iOS 4 on iPhone 3G for example).

It sounds like he's complaining about being told that he has to update this, scan that, defrag something, and turn on his firewall for crissakes. My netbook is far more interested in telling me that whatever programs I run at boot have a new version out than just opening whatever program I need to use badly enough to have turned the thing on.

And that's the deal here - firing up a desktop operating system in the first place requires a certain amount of work and carries with it a certain cost that makes using a desktop operating system for short periods inefficient.

If you want to, for example, check the weather, for many, it's going to take five minutes of computer stuff to support a minute of the actual task.

Now, someone is going to come in and tell me that Ubintows 7X Meerkat boots faster than an iPad on a triskadecacore i8 with SSD, but I say that's not everyone's experience.

Further, the iPad doesn't expose the finer points of computer configuration, use, and management. The Slashdot crowd has a lot of people whose work exists in that stuff. I'm one, and time with an iPad or CR-48 makes me feel like I can't get work done, but that's often because my work is "computery." For people whose work is word processing, it doesn't matter so much.

So, Slashdot, if your work is working on the tool, it's easy to see a tool that doesn't need your kind of work as a tool that prevents you from doing work.

How would an equidistant supercharger (thus, one that is 200 miles from each of two points, themselves 400 miles apart) fail to help drivers with cars that have a 230 mile range?

Agreed on DansGuardian. You'd want all ports closed for all users in the organization, including 80 and 443, then you'd want to create an exception for the Dansguardian box.

Also, even if it's on older hardware, consider setting up a second box to serve as backup. Look into proxy autoconfiguration files. You can return two proxy addresses in an autoconfig file, and if your main proxy is down, your clients will silently fail over to the other box. The config files also allow your internal traffic to skip the proxy for things like your intranet site.

Also, consider putting /var/log on it's own partition, if you aren't already. You don't want to let forgetting about your logging directory free space to be able to kick your whole organization off the web.

On squid (DansGuardian is often used with squid) look at your http_safe_ports (I might have that variable a little munged, as I'm not in the config right now) to make sure it's right for your org, and that it matches what your firewall is allowing out.

No, that's QBASIC Gorilla tactics 101.