Slashdot

will they take away your license?

since when do laws stop the bad guys?

Even here in the U.S., one of the most common Internet-related questions that I receive is also one of the most deeply disturbing: Why can't the U.S. require an Internet "driver's license" so that there would be no way (ostensibly) to do anything anonymously on the Net?

The road to ruin was paved with good intentions. However, that includes ludicrous ideas.

Considering that enforcing a license requirement just here in the US would be nigh on impossible without rethinking everything and that the odds of doing anything of the sort worldwide is less than zero I'm left wondering just what problem this idea is intended to solve?

Hint, it ain't any problem we users have and it ain't a problem the network operators are having. And since the practice of allowing Microsoft products to connect to the Internet is the bulk of the spam/zombie/malware problem I guess we would license every host as well as user. Any any license scheme that permitted Microsoft crap to operate would be considered toothless and any that banned them would get called 'draconian.' No win scenario. The only winning move is not to play.

Oh, wait...

Of course, it would be completely coincidental that Microsoft would offer training, software and certification to help get your Internet driver's license, right?

Craig Mundie, Microsoft's Chief Research and Strategy Officer, called for the creation of an 'Internet Driver's License' at the World Economic Forum in Davos, saying, 'If you want to drive a car you have to have a license to say that you are capable of driving a car, the car has to pass a test to say it is fit to drive and you have to have insurance.'

In other words, Windows doesn't suck - The users do.

The drivers license analogy is being used to shift some of the blame from the OS to its users.

Bruce Schneier had a pretty good takedown [schneier.com] of this kind of argument just the other day.

Accept that you'll never truly know where a packet came from. Work on the problems you can solve: software that's secure in the face of whatever packet it receives, identification systems that are secure enough in the face of the risks. We can do far better at these things than we're doing, and they'll do more to improve security than trying to fix insoluble problems.

So this is like a ham license for landlines which sort of *act* like public airwaves. It's actually not SUCH a bad idea -- it sure keeps the S/N ratio up in the ham bands. Even if the test is virtually unfailable, the overall sense of earned-privilege vs. god-given-right seems to add a few percent to the general level of maturity you get. It'll never happen though!

1. It would probably be illegal for the US government to require "drivers licenses" for general Internet use. The Internet is primarily a medium for the dissemination of speech, and the US government is prohibited from demanding that people obtain permission before speaking [wikipedia.org].

2. Even if done privately, requiring people to identify themselves for any and all uses of the internet is likely a bad idea [schneier.com].

The article linked in the article posted here provides some context [rawstory.com]. He seemed to have been talking about this as a way of preventing cyber attacks, you'd have your license revoked if your computer was compromised and could be used in an attack. MS seems to have been trying to cover their asses: "It's not our fault, if we would just put this intrusive system in place, which has no chance of working, but more importantly would never be funded and never built, then the problem will be solved." The next time a problem with MS products creates a serious problem, they'll say "We told you so! If you had just put up a billion dollars to make the drivers license system, it might not have completely failed, and this could have been avoided! Your fault!"

Perhaps the licences should be handed out to Operating Systems based on compliance with web standards... I wonder if MS Windows would be given one?

I'm NO fan of Microsoft (which I hold responsible for a lot of the malware problems on the 'Net), nor am I a big fan of PKI (I think the implementations are way to fragile), but I think there might be a worthy idea in here.

Drivers Licenses have two uses:
    1. Certification of driving skills
    2. A nationally recognized identity
Consider this for use #2...

So what if the government issued an "Internet ID Card", with PKI Certs, etc, that would be used to secure email, transactions, etc? This is by no means a panacea, but as a factor in 2-factor ID, it might well cut down on some forms of malware.

Yes, there -are- civil liberty implications. But we always have the tension between known identity and guaranteed privacy.

So as a form of tougher ID on the Internet, I think this deserves to be taken seriously, and the plusses and minuses (as established here...) should be debated.

I just had a packet collision!

I think it would be even better if we mandate a security licence for designing, implementing and deploying operating systems/web browsers/etc that access the network.

For example, if you tried that for a couple of decades and could not get it right, then maybe your licence should be revoked and reinstated only after proving you code correct and only in a limited market first. (For example, desktops only, no laptops, no wireless etc.)

I really hope this will get traction!

There you go.

Fuck you Criag Mundie. Fuck you in your tiny dick hole, you elitist, ruling class, piece of shit. Shall we require government licenses to use our toasters and our televisions so that we will never burn our toast, and will be capable of understanding that not all TV, including the news is real, or good for us?

What the fuck Criag. Die in a fire.