Slashdot Mirror

Only 31 known, unfixed IE vulnerabilities...

It's hard to say for sure, but I suspect Linux might have an edge on MS for security.

I've tried a few CMS and read about many. Obviously some are more suitable than others for certain situations. Drupal has been perfect for running my two sites. One has a book and news stories while the other is purely a blog. Drupal's online documentation is very good and the community is very very helpful with users. I highly recommend it.

What you're saying renders Microsoft's actions with regard to the discussion of open source in developing countries especially egregious.

The Windows help system was exploitable for about 7 years. From the time of Windows NT 4.0's release (1996?) until June, 2003, an attacker could exploit the help system to run their own code. And that's just the help system!

As of September, 2003, there were 31 known unpatched vulnerabilities in Microsoft Internet Explorer. Some of the most critical have not been fixed in well over a year. The original page listing them was removed at Microsoft's request, but I cached it.

Microsoft was notified of significant issues with their implementation of the Java Virtual Machine (JVM) on September 2, 2002, and on April 9th, 2003, Microsoft issued an update to fix the problem. That took more than seven months.

Shameless plug: more examples are available at my site.

The Windows help system was exploitable for about 7 years. From the time of Windows NT 4.0's release (1996?) until June, 2003, an attacker could exploit the help system to run their own code. And that's just the help system!

As of September, 2003, there were 31 known unpatched vulnerabilities in Microsoft Internet Explorer. Some of the most critical have not been fixed in well over a year. The original page listing them was removed at Microsoft's request, but I cached it.

Microsoft was notified of significant issues with their implementation of the Java Virtual Machine (JVM) on September 2, 2002, and on April 9th, 2003, Microsoft issued an update to fix the problem. That took more than seven months.

Shameless plug: more examples are available at my site.

Total of 65,000 bugs - estimated 28,000 are âoerealâ problems
> 21,000 âoepostponedâ at time of release (Feb 2000)
> 27,000 âoeunfinished workâ or âoelong-forgotten problemsâ

The original source was a ZDNet article quoting a Microsoft memo. The article is no longer online. I have more related information here.

Read this. Longhorn will not be backwards compatible. Windows Server 2003 is not compatible with Windows 2000, so what makes you think they wouldn't further break compatibility? As my employer has found out they are in the continual process of making customers re-write their applications to run on Windows. This continues their revenue stream. Why do customers put up with this? Past investment in Microsoft makes people reluctant to give up. Desktop monopoly is also a major factor.

Read this. Longhorn will not be backwards compatible. Windows Server 2003 is not compatible with Windows 2000, so what makes you think they wouldn't further break compatibility? As my employer has found out they are in the continual process of making customers re-write their applications to run on Windows. This continues their revenue stream. Why do customers put up with this? Past investment in Microsoft makes people reluctant to give up. Desktop monopoly is also a major factor.

So you want to have one of those arguments? Check the news about all of the countries whose governments are switching desktops to linux. Take a look at the largest country in the world having their government promote their own flavor of desktop linux. And how about yesterday's news of a country with more people than the US having a president recommending linux. Let's not forget IBM with over 250,000 employees switching. And then there's Merryl Lynch and Morgan Stanley. How about 640,000 TiVo users? See my list for a few more.

# Microsoft® Exchange 2000 will not run on Microsoft Windows(TM) Server 2003
# Internet Information Services 5.0 will not run on Windows Server 2003
# SQL Server 2000 will only run on Windows Server 2003 with Service Pack 3 installed

See this article for details.

Also consider that every MS server application comes with a GUI. Therefore if a new version of Windows breaks backwards compatibility for its GUI it breaks its server applications. See their plans for the future.

From an article I wrote on MS Versus:
Microsoft plans to release the next major upgrade to Windows in 2005. An anonymous source from a third-party vendor has informed journalists that Longhorn will not be backwards compatible... completely dropping compatibility with current software and requiring all software to migrate to .NET and the new Avalon GUI API.

The graphics system has changed at least slightly with each version of Windows, causing problems for front-end developers such as myself. Even if these changes are small, soon there will be zero backwards compatibility.

Why is there no command line only version?

We're looking longer term to see what can be done, looking at the layers and what's available at each layer and how do we make it much closer to the thing the Linux guys have -- having only the pieces you want running. That's something Linux has that's ahead of us, but we're looking at it. We will have a command line-only version, but whether it'll have all the features in is another matter... It's a very tangled subsystem.

Why is there no command line only version?

We're looking longer term to see what can be done, looking at the layers and what's available at each layer and how do we make it much closer to the thing the Linux guys have -- having only the pieces you want running. That's something Linux has that's ahead of us, but we're looking at it. We will have a command line-only version, but whether it'll have all the features in is another matter... It's a very tangled subsystem.

First, you really need to read this. The first half you're probably familiar with, but read the rest. Second, cross-language development is irrelevant when all of the languages are new. If a company is picking .NET, they're also picking just one language, because those who were using C++ will keep with C++ or switch to C#. Those using VB need to learn a whole new VB or learn C#. Either way, moving to .NET for now means picking one language. Instead of providing all the great new functionality in COM, MS chose to go with a whole new platform, not because anything is wrong with COM, but to generate revenue and continue vendor lock-in. Again, read "What's the need for .NET?".

First, you really need to read this. The first half you're probably familiar with, but read the rest. Second, cross-language development is irrelevant when all of the languages are new. If a company is picking .NET, they're also picking just one language, because those who were using C++ will keep with C++ or switch to C#. Those using VB need to learn a whole new VB or learn C#. Either way, moving to .NET for now means picking one language. Instead of providing all the great new functionality in COM, MS chose to go with a whole new platform, not because anything is wrong with COM, but to generate revenue and continue vendor lock-in. Again, read "What's the need for .NET?".

The .NET framework on Windows is entirely dependent on existing Win32 APIs and COM technology. Although Microsoft is encouring people to drop the use of COM and Win32 APIs, they themselves heavily depend on these technologies. As it is now, the .NET framework is just a wrapper around existing APIs (COM and Win32). The C# comipler has been implemented using COM, csc.exe being a wrapper around this COM C# compiler. The VS.NET IDE depends heavily on COM. The .NET framework is huge (more than 3000 classes) but only 15-20% of APIs have been covered by these classes. Apparantly, that is enough to write usual application.

<plug class="shameless" >

I have written an article called Whats the need for .NET where in I argue if there was a real need for MS to come up with .NET. The statements I made above have been backed up in the article by providing links to the comments that MS employees have made about this.

</plug >

Jalil Vaidya