It all boils down to Microsoft just not giving a fuck. The shitty part is that their name carries enough weight to allow them to do so; much to the savvy consumer's dismay. :2 cents::dunno:
As much as I'm a huge, open source advocate, that's a simple, and incorrect, answer. Although their total misuse of "The Cloud" does show how the great majority of consumers don't care, I'll agree with you there. Marketing is king. Substance is not. There's no more proof in that than virtually major innovation being developed on UNIX and in open source, only for people to assume open source is "stealing" ideas "already on Windows" (ha ha ha!
Not!).
Yes, they took way too long to "give a fuck." It wasn't until SQL Slammer (2003) that they started to care. And the reason why they were forced to care is because their own, MCSE-wielding professionals started calling them out (because Microsoft was hanging them out to dry).
But understand by 2003, "Longhorn" (NT 6) was already developed architecturally and virtually hitting internal Alphas. They started to re-write some, even their own .NET team (.NET is based on licensed Java code, with similar security mechanisms as UNIX, especially latter versions) pushed for a change away from legacy Win32, and that wasn't going to happen. It would have pushed back everything, and Microsoft believed "Blackcomb" would sort out the mess.
But just as "Cario" in the '90s, what was "Longhorn" became everything, as Windows 7 is merely NT 6.1, neither NT 7 nor the "Blackcomb" planned. Eventually they caved into something like UAC, which basically notifies when a program is using a privilege service call. Unfortunately, it's incomplete. There are many libraries and mechanisms totally not understood by Microsoft, allowing all sorts of access that is not marked privileged. Plus they have outsourced most development outside the US for all NT releases, let alone Microsoft had the "brain drain" to Google and others, losing core architects.
The fact that Microsoft only tracks security issues at the base platform level if part of the problem. People like to point to "security counts" on other platforms -- namely Linux -- but they don't realize that includes the development tools, the office suite, several browsers, just about every desktop application anyone would want, and to a different standard too. MS Office would be considered a non-starter on Linux from a security standpoint.
UAC is
not a security fix, it is a
tool for software developers (one that Microsoft forced on users) so they get calls from users when they are
stupidly raising privilege without writing the software proper. Sadly, Microsoft's own application division is the biggest culprit, because the don't know how to write software proper. I was involved with some early WINELIB (a porting kit from Windows to Linux -- not to be confused with WINE, the emulator, WINELIB is actually a Win32/GDI to POSIX/X11 porting kit), and it's always a total eye opening experience for Windows developers on what not only Windows, not only the crap Visual Studio outputs, but what they don't even think of.
Like the simple, but overlooked issue, of a program being able to write to its own directory where it is installed. You hit Windows developers with the stupid bat for that and they look at you like you're hitting them for no reason. Yet even a simple MacOS X or Linux coder knows that, and wants to now beat the Windows developers with dumb stares down like fuck too.
There's also the issue of how digital signatures work and can be bypassed in Windows. Software can be forged and users will click through. At least Microsoft
finally made it default that you cannot install core libraries or drivers without a valid signature. But it's still horrendous how much software can be. That's why Windows seems easy for home users, but it's hell for corporations. It's funny because all the work corporations have to go through to "package" and "validate" Windows applications are already done on Linux systems natively, which users don't understand why they have to deal with.
MacOS X goes too far the other way. They just have images, which can be just as much of a trojan nightmare. Fortunately MacOS X does have some controls, but I wish they'd address them better and with more mandatory procedures.
Sigh ... I'm so going geek! And way off-topic!
