Microsoft's Jim Allchin is talking mighty tough to hackers eager to crack Vista, BetaNews reports. The extent of his bravado? You can run Windows Vista without antivirus software, he boasts, thanks to a new trick that randomizes the location of PC system files. (Many viruses rely on system files being located in the same spot on every Windows PC. With Vista, that's no longer the case; those files will be stored in random locations that vary from PC to PC, thanks to something called Address Space Layout Randomization.)

While Microsoft is hyping Vista's new security features as a selling point - and Allchin's comments are part and parcel of that marketing campaign - Allchin is violating a fundamental tenet of security: Never wave a red flag in front of hackers' faces. You're just asking for trouble.

Hyping this particular feature is an especially bad idea: Security researchers have already found vulnerabilities in Vista's ASLR technology. Microsoft's Michael Howard counters that researchers haven't found a weakness at all: it's an intentional design feature. Allowing too much randomness, he says, would make the system unstable. But a commenter on Howard's blog points out that the security compromise could be easily defeated with a "brute-force" attack if hackers used thousands of infected PCs to check every possible location for files.