"Joseph M. Newcomer" <newcomer@flounder.com> wrote in message
But if the VM can access drives outside its world, then the VM can
damage
the state of my
system. So this doesn't solve the problem.
Asking permission to run something doesn't allow me to control or
determine what it is
modifying or looking at. So that isn't a solution.
It isn't paranoia when they ARE out to get you, and the second time a
network attack took
me down for a week, I decided that the Internet was not safe enough to
be
trusted. I have
to weigh the advantages of access to the risks, and right now, avoiding
the risks is still
winning.
Think about it: if FedEx or UPS told you they would not deliver to your
home unless you
left the front door unlocked, would you deal with them? "Don't worry,
all
our drivers are
bonded and background-checked, and they won't steal from you!" Right.
So
then someone
would say "But your missing out on fast deliveries by not leaving your
front door
unlocked!" Explain, please, why I should trust ANY piece of code that
comes over the
Internet, MOST ESPECIALLY on a Web page! Note that JavaVirus does not
come with digital
certificates.
joe
On Mon, 28 Jan 2008 16:06:17 GMT, "David Ching"
<dc@remove-this.dcsoft.com> wrote:
"Joseph M. Newcomer" <newcomer@flounder.com> wrote in message
news:gqsrp35vvnetdul4764vot3qsohdui590q@4ax.com...
And what do I run in the virtual machine? I can't run email, because
if
I
reset the VM,
I'd lose all my email. I can't run the browser, because if I reset
the
VM, I'd lose the
ability to log in to all kinds of sites that keep cookies. A VM works
only if you are
willing to lose all the work that has been done in the VM. The
*CORRECT*
solution is to
make sure that I can control the security of ANY client-side script,
and
a
VM is not
flexible enough to guarantee correctness without potentail of massive
loss.
You could keep your e-mail store on a network drive, outside of the VM.
So what if you lose your cookies? Just retype your username/password
every
time.
Have you looked through the Security tab in Internet Options? Set the
High
security and even Custom security, and you can disable or set to prompt
before running everything.
You could also use Pocket Firefox or some other browser mounted on a USB
drive that keeps everything on the USB drive.
Or if you are so paranoid that even these options don't work for you,
get
a
second Internet connection into your home-office and hook 1 isolated PC
onto
it. You really are missing a lot on MSDN and the MVP specific sites due
to
your paranoia.
-- David
Joseph M. Newcomer [MVP]
email: newcomer@flounder.com
Web: http://www.flounder.com
MVP Tips: http://www.flounder.com/mvp_tips.htm