Slashdot Mirror
TCP/MS, We'll Cure What Ails You
Cringely can string some words together from time to time, and this week's installment is a pretty good one. He's been reading a little too much Gibson (raw sockets have nothing to do with the spread of MSTD [?] 's), but overall, he's probably right. When the time is ripe, I think we'll see a move exactly like this.
But it sounds to me like he wants MS to make a secure email product that would never, ever do something without the user's permission.
I kinda found that funny, given MS's history.
Besides, I severly doubt that the DOJ will look favorably upon this move, or even if ms will have the fortitude and the gonads to even propose such a thing.
Yes, it would be cool, but I honestly think the folks in redmond don't have the ability to carry out something like this, on such a large scale and have it work properly from day one.
I'm actually not sure who could design the protocol - perhaps a think tank of the best programmers around the world hired by several governments for actually good money?
And yes, I read the last paragraph, and I still think XP's only redeeming feature is allowing us to write our own IP headers.
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
It doesn't matter that the network is insecure, only your computer needs to be secure and the keyserver.
PGP or GPG is great for e-mail, but not for the socket exploits the article discusses. So when your computer or a keyserver is rendered insecure because of TCP/IP socket insecurities on an XP machine (client or keyserver), then what do you have? Properly written, a virus could enter thru an app that allows insecure raw socket access, and could send nicely authenticated e-mails that begin with "Hello, my friend..." You get the drift.
While they have the ability, unfortunatly it's almost impossible to use them properly, at least using NT and Office 97. In order to run Office 97 on NT, your NT system directory must be world writable. Once you allow this, then any user can replace any DLL, and get any privlage they want.
While I can't help with 2-4, I wrote 2 things that help with #1. My web site offers to ability to Test Your E-mail Defenses by e-mailing you a harmless VBScript file. (It reads your registry, but doesn't change anything or send any info out.)
I also wrote Script Sentry which traps those VBS scripts (as well as DOC, XLS, SHS, SHB, REG, HTA, and more), shows you details as to what it would do if run, and lets you decide whether or not you really want to run it. So if a user opens up that new Love Letter they just got in the mail and sees a "This will change your registry" message, hopefully they will be scared/wise enough to cancel the action.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
What ever happened to the good old days when virii were a thing to be admired, were hand crafted in assembler to use the fewest instructions, and took talent? It seems nowadays everything requires the user to click an attachment in their outlook program. Theres nothing creative about that!
Very well written and accurate portrayal of Microsoft and their vision of computing. While Cringly's idea of TCP/MS may seem far-fetched, you are right on the money regarding their desire for such a protocol. If Microsoft could embrace and extend the internet, it would in a heartbeat. If that ever did happen, it would be the end of the free internet as we know it.
Unfortunately, only the free-thinkers would see it that way. The mindless herd of end users that follows Microsoft would know no different. They would continue to surf and enjoy their digital playground and carry with them the same illusion of freedom they have about the rest of America. These same people never knowing about the DMCA, Sklyarov, DeCSS, or fair-use, (because the media practices awareness control over the public) would just assume that's the way it's always been. The movie, "The Matrix," at least metaphorically speaking, is not far from the truth. In the future, I see a day when people are too "attached" to a system to let go. In this future, I see people who can't define their own reality or even define freedom because of the constraints that are placed upon them since birth. In other words, they will have lost the ability to step outside the box and question the facade they call "reality".
Maybe I've read "Brave New World" one too many times, but the parent post and Cringly's article make for a great introduction to a new 1984esque type of novel. Ok, so I got a little carried away there. LOL.. Anyhow, what I meant convey was that the average user would probably not care since they use windows anyway. They would see all the neat new services that passport provides and consider it a "feature." As scary as this may sound to you, the average joe user knows no better. However, with IPv6 right around the corner, I don't see Microsoft embracing TCP/IP. But have no doubt, if Microsoft could change the very protocol of the internet in yet another attempt capture even more marketshare, I have no doubt that they would at least try. That is what scares me about this company - the complete and total disregard for the open standards that allowed them to become so big in the first place.
As posted to microsoft.public.win2000.general:
Come on, Bill.
I know you've got this great vision for a wonderful Internet and a computer on every desktop and all that stuff. I've met you in person on two occasions, and found you to be friendly, personable, brilliantly intelligent, and I know you believe very strongly that your vision of the computer industry isn't flawed. I even grudginly like you for your passion, courage, vision, strength and business acumen. Most damningly towards wanting to hate you, I also believe you and Melinda are true philanthropists.
But I'll still bet money that I had an e-mail address before you did. And you and I both know that this has to stop. At this point, I tell my consulting customers that running IIS is as irresponsible as drinking and driving. My procmail filter automatically sends all e-mails from Outlook mail clients to /dev/null. Like drinking and driving affects all road users,
the many blatant security flaws in Windows and related programs affect all
Internet users.
Please make it stop.
Copied and pasted from my (Apache on UNIX) webserver log:
(D'oh! Slashdot Lameness filter sees all the capital Ns of the Code Red worm buffer overflow and won't let me paste, so you'll have to see it here.)
Fire and Meat. Yummy.
Why, in my day, we only had ONE character which had to be multiplexed by switching 104 times per second, and machines were networked with string and dixie cups - and we were GRATEFUL for it!!
It's 10 PM. Do you know if you're un-American?
Raw sockets are an application programming interface (API) whereby the application is able to control the contents of IP packet headers directly. This means that an application, for instance, can transmit a packet with a forged source IP address - thus disguising its origin. This is often used to conceal the source of a DoS attack.
Linux provides raw sockets, but only the root user is able to utilise them (and rightly so). Cringely's article doesn't make it clear as to whether or not there's any kind of user-based protection under XP, or whether anything and everything can access raw sockets under XP.
Strags
Slow down your shoveling boy... you might hurt yourself.
So exactly how can Microsoft's IPv6 stack be proprietary, when they don't own the routers, switches, et al? You see, if they change the format of the packets, then the router needs to accept the new format. Since CISCO should be setting up their IPv6 stuff to the agreed standard, that leaves Microsoft little choice.
Microsoft's network protocol implementations have always been fairly standard and able to interact with the world at large. I don't see that changing in the future.
As for IPv6, I don't see that really rolling out until XP covers much of the marketplace. XP (and the Server 2002 editions) should have native IPv6 support.
Stop spewing FUD. It isn't any more endearing than when Microsoft does it.
Natural != (nontoxic || beneficial)
1)Um, are you under the misapprehension that Linux et al are secure OSs on the basis that there haven't been any viruses targeted at it to speak of?
I believe linux...and pretty much any Unix i've dealt with (Solaris,OSF, Ultrix...) are much more secure OS's, becuase it's much harder to write an exploit for a unix box than for a windows box. Writing a buffer flow exploit to compromise a server process is order of magnitudes more work than sitting down and writing and emailing a Word document that takes advantage of the VBscripting to erase you harddrive.
There are "talented" crackers out there that do target unix machines. You can do a lot of real damage if you can compromise a large corporate Unix system....but you have to expend real effort to discover a new exploit on a unix system. With windows on the other hand....the same "feature" is being exploiting repeatedly to cause damage....how many differently named viruses have to circulate before MS removes this exploitable "feature."
Point out a "feature" of linux, or unix that gets repeated used for malicious activity...but people refuse to fix. Bind and sendmail, mainstays of unixland have had a history of exploits but the software makers make it a point to fix the problems asap. Software will be buggy, and bugs can turn into exploits, and then they get fixed. But a FEATURE like VBscripting is not a bug. VBscripting is a very powerful and woefully insecure FEATURE, but MS refuses to strip out the VBscripting features or add a layer of security to their use. MS viruses...don't use bugs in the code...they use perfectly acceptable scripting commands...to do bad things, and MS refuses to do anything about this FEATURE!
2) On the general subject of quality, Linux still hasn't got anything to compare with the Office suite.
No i think there are some candidates for comparision. Take Staroffice...is as slow as MSOffice, and for me staroffice does crash on occasion just like MSOffice...the big difference I've seen is that staroffice doesn't take down the entire OS with a BSOD when it desides to stop working.
You need to upgrade your gnome. I'm living in Ximian gnome on my PC and I haven't had the GNOME Desktop crash yet. But I'll be damned to figure out why my windows PC won't get past the logon box without causing a GPF.
3) I used to buy into this idea that OSS necessarily produced better quality software, but it just isn't true. Large products are flawed for many reasons: release deadlines, unforseen design errors, resource constraints, but mostly because people in general just aren't smart enough
I still believe OSS development makes far better products, but my reasons have nothing to do with being able to make product deadlines or whatever. I do not believe that OSS makes products more quickly. I don't care about release deadlines...the OSS products will get done when they get done....as long as products are making steady progress, that's what matters. How long did it take MS to make a stable OS worth actually paying for? From MS-DOS upto win200...how many manyears or should i say mancenturies of development time went into that development cycle. If want to believe in the pay for every yearly broken release, and call it a full product fine...I'm sick of it. Just don't bring your timeline baggade to the OSS community. Products get done when they get done. I believe that OSS development makes better products, for the simple fact that the source code is available. I believe OSS makes better products becuase in the long run those OSS products are far more adaptible and allow for more innovation. -jef
-- ;-)
Kuro5hin.org: where the good times never end.
Look, raw sockets in windows are not the end of the world: they're available already, open source (http://netgroup-serv.polito.it/winpcap/), and you can run them as a non-privaleged user. In as much as MS have a concept of privaleged users.
Even if they weren't, there are SO MANY possible security exploits you can run using a small army of 0wn3d windows boxes. Including (but not limited to) just packeting the crap out of Steve "Bloody" Gibson's webserver. For instance, has anyone considered using something to script the IE network libraries (COM objects, I would imagine) in the background and launch a 'many millions of perfectly valid requests, complete with cookies and everything' attack?
How would you defend against that?
This whole raw socket thing has been blown out of all proportion. Can we please stop fretting and find a way of PREVENTING these big attacks from being spread. Or possible. Or something.
Dave >:(
I write a blog now, you should be afraid.
Someone needs to write some viruses that do the following things:
1) educates -- infects your computer and gives you
a multimedia presentation on flaws within "Hi! I'm Victor Virus!
I'm an Outlook Virus. How did I get in your machine?"
2) secures -- "Would you like me to install a Zone Management
package?"
3) explains alternatives -- "Did you know there are other alternatives
to Microsoft?"
4) Highlights Microsoft abuses...
Libertarianism is rich wolves and poor sheep playing gambler's ruin for dinner.
There seems to be a lot of confusion about this.
Raw Sockets allow someone to send forged IP packets (spoofing) that appear to come from any IP address the sender chooses.
This makes filtering a DoS attack harder, because you can no longer filter the traffic by IP or domain.
So, right now the limited defense in the DDoS zombie attacks from Windoze is the fact that the IP packets have valid source addresses. These can be filtered at backbone or ISP provider routers.
If these attacks used spoofed IP packets, there would be no easy defense.
Once a virus is detected, software can be written to clean it and possibly prevent its further transmission. These days, the delay between first detection and anti-virus software is usually a few days.
The more time a virus spends lying dormant or slowly spreading, the more time there is for someone to find it and spread the word. There are a small number of highly secure systems run by highly paranoid sysadmins who do things like compare all files to known good copies on a regular basis and log all network traffic. Even a quiet virus will be detected if it attempts to spread to one of these systems. If the virus attempts to infect something like a Honeypot, it will be detected. And then, the game is up.
These virii are only effective against the uninformed. The slower it moves, the more time it gives information to spread.
This somewhat misses the point of traceable TCP. It doesn't matter whether we catch the bad guy, what matters is that we can stop the flow of traffic to our overloaded site. Untraceable traffic cannot be effectively firewalled against.
It's rare that you're presented with a knob whose only two positions are Make History and Flee Your Glorious Destiny.
If you're trusting the network without doing any proper checks, that's your problem. Somebody could plug in his own PC and start spoofing IP packets _today_. The release of WinXP doesn't change that.
What about the 'only root can use ports 1024' feature of Unixes, which Windows doesn't implement? Does that mean that Windows is a security threat? No. If you're being so stupid as to trust the originating port number, you deserve everything you get.
Egress and, er, ingress filtering around the edge of your network may be good enough most of the time; it doesn't protect you against PCs inside the network starting to spoof things, but you may feel you can trust your own employees (and don't let them run Outlook).
-- Ed Avis ed@membled.com
Speaking as someone who used CP/M back in the day (okay, dammit, it was 20 years ago), CP/M (at the time the IBM-PC came out) didn't have subdirectories, didn't use / for options, and used Control-D for an EOF marker. I'm not 100% sure about text file end of line control codes (this is a *long* time ago), but I don't think I had to do anything fancy between Apple ][ and C64 formats and CP/M, and certainly nothing fancy for big boxen formats (of course, at the time, transfer protocols like Kermit and Modem7 handled such things).
Now, this is the dim memory of someone posting at 2:30am (and too damn lazy to do a google search), but I accessed plenty of Unix boxes (and VMS) at the time, and didn't have file format problems, so I'm guessing that it was the same.
Anybody else remember Magic Window for the Apple ][? Or the original WordStar. Wow. I'm seeing amber all caps when I close my eyes...
--
Evan
"$30 for the One True Ring. $10 each additional ring!" -- JRR "Bob" Tolkien
Not that much more dangerous. Yes, smurf becomes a possibility (allowing DDOSing more than one site at once) but you filter it out the same way that you filter out any other attack-- at the upstream routers and secondarily at your firewall... Raw socket access is no big deal really.
LedgerSMB: Open source Accounting/ERP
Hey guys, this is somewhat unrelated to the stuff in this conversation, but it's about M$ vulnerabilities, so I'll ask anyway.
If we all set up out webservers to send a ping of death or some other blue-screen/reboot DoS attack automatically to anything that shows the signature request of the IIS worm, wouldn't that help to at least slow the spread of this thing?
The shell script to tail the log file and run a script would be pretty easy, but does anyone have anything tried and true for Linux/UNIX that will force a reboot of an affected Win NT/2000 server?
At this point, I see this as an eye for an eye, I'm kinda tired of all don't patch their systems despite big media attention. Besides, it'll definitely give me a sense of satisfaction to confirm a kill when the server doesn't respond to an automated regular ping a few seconds later.
Fire and Meat. Yummy.
In particular, to make program not do something that it shouldn't one doesn't need to rely on the protocol that is security-neutral anyway (the other end can be malicious even if you aren't) but should place restrictions on the processes on the host.
Capabilities system, that now can be used to manipulate processes' abilitites to use raw sockets without making them run as root at the same time, is one of the examples how it's done in the kernel. While I am sure, neither RXC, nor Microsoft engineers looked a it, Linux already implements it and even had a sendmail security bug related to improper implementation of that.
Contrary to the popular belief, there indeed is no God.
(a) The content industry will get right behind it, if it makes file transfers traceable and allows file sharers to be brought to "justice". That's AOL Time Warner and Sony on the bandwagon.
(b) It is likely that if a universal authentication solution appears, it would be eventually made a government-sanctioned standard, much as they're attempting to do with secure media formats, the government being beholden to the content industry and all that.
Netscape 4 requesting from IIS is markedly slower than you'd expect by looking at relative performance on Apache with NN and IE.
I'm not so sure about this. While experimenting with Squid's user agent logging facility to see who was running what browser on my network, I noticed that MS Internet Explorer actually claims to be "Mozilla 4.0" - go figure.
I can say for certain that Microsoft's support web site does not tolerate unknown browsers graciously at all - when confronted with Netscape 6.0 beta or a Squid anonymised user agent string, it got stuck on one page redirecting back to itself...
Almost right. CP/M ran on the Z-80 and 8086 (The version was called CP/M-86). MS-DOS was meant to run on the IBM PC which were 8088 machines. The 8088 was a scaled down version of the 8086.
The Economics of Website Security
We're running IPV6 already with other universities over i2 and I don't see this happening on a large scale for at least another 10 years (and personally, I doubt it will ever happen without some intervening step like a IPV4b or MS/IP...)
The wheel is turning, but the hamster is dead.
You know, I thought the same thing as she did in the past. I'd worked for large companies and I knew how incompatibilities cropped up and it was just from engineers being distanced from their customers.
..someone took it out) CR/LF instead of NL. ^Z as EOF. blah, blah. I wonder how many of these are deliberate?
Well, I was chatting with an ex-microsoft employee who had moved over to the white-side and he put things in perspective. Microsoft has strategic meetings where they sit around a table and say "how can we own this?"
That put a different light on all those subtle incompatibilities I had always had to deal with.
Backslash instead of slash in paths... / for options instead of - (remember switchchar?
"Cringely" and Dvorak keep saying, "No, seriously, shutdown the Internet and replace it with something secure."
They're missing the first law of complex systems. I can't remember the exact quote, but it goes something like:
All complex systems that work began as simple systems that worked.
You can't replace today's Internet, the result of decades of evolution, with something purpose-built from scratch to do as much. The attempt will suffer from the second-system effect, and just plain won't work.
It's easy for a columnist to ask for something drastic. Too easy. But it sells papers (or click-thrus, or whatever we're selling today).
Stupid job ads, weird spam, occasional insight at
I don't know about you guys (and gals), but last time I was at this tiny web site for a tiny computer manufacturer, I had the choice of Win98 SE, WinME, Win2K or Win2K with an upgrade to WinXP. That doesn't sound like manufacturers are limiting my choice of viable Microsoft operating systems to me.
People wouldn't be forced to participate, but if they remain anonymous, I might choose to block them. I certainly wouldn't accept file attachments from them. I know you hate this idea, but I think the Internet needs a fingerprint.
Hmm... And who would control this "fingerprint"? Our beloved government, who is trustworthy? A large computer corporation like, say, Microsoft? And how would something like this work internationally? Who is forcing you to accept attachments now? I run Win98, WinME, Win2K and WinXP all on different machines. Over the last week, I've been sent about 10 emails with both SirCam and Badtrans, and none of my machines are infected. Why? First off, I didn't open the attachments right away. Second, I tested the attachments by saving them and then scanning them first. This is not a difficult concept! If someone puts a big package in your mailbox at home, and it's ticking, do you just open it up if the return address says it's from someone you trust?
You can choose not to have a fingerprint, but then your ability to communicate with others may be limited -- a price many people may choose to pay.
This is endorsed by the same crowd that bitches about MS Passports?
If kids want to install an Internet game, the game's IP port would be registered and permitted to operate, hopefully by the parent.
Why can I not see this happening in the general population? The average users I know bitch about having to confirm Internet activity when Zone Alarm or other personal firewalls pop up and ask.
Programmers who ought to be familiar with Microsoft's plans have suggested that the real motive for raw socket support is for Microsoft to use Windows XP to exploit a bad situation, to deliberately make things worse.
Jesus, what a conspiracy theory. This guy gets paid for this?
Move along, Cringley. Common sense tells us that you're just spreading FUD. Meanwhile, I'll get modded down for criticizing you, I'm sure.
--SC
You read fiction? I write it! Lemme know what you th
You can already do this. You can trace email. You can block email from those you don't know. And this system won't work to block email worms because usually they come from people who you know.
Caller ID, like rdns mapping of incomming ip addresses (cumbersome) etc. You can do this sort of strategy on so many levels... Of course someone who says that Linux is safer than Windows on one hand and that raw sockets are dangerous evidently is simply paroting what he has read and not actually studied the matter. Has he heard of any sort of authentication service or tactic? That is what these are about and of course many people do block people without the proper credentials from access to their networks ;)
Raw sockets exist in Windows 2000, and I assume that it has a bit to do with the FreeBSD code in the TCP/IP stack... This code has helped to make Win 2k far more stable on a network than its predicessor, IMO. If they are such of a problem, why not acuse Linux or FreeBSD of the same problem...
He also states:
And what's with those file attachments, anyway? Replace mail clients and APIs with secure models. The new model will not run attachments as they do today. E-mail attachments should not have access to the e-mail client, APIs, etc. Attachments should not have access to the operating system by default. The user should approve the use of some APIs, like having to give permission before device drivers are updated.
This guy is out to lunch. It is simply sufficient to limit user privilages and require them to export the attatchments before they can be run.
The only e-mail activity on my PC should be initiated by me, personally. Nothing else should access my address book or send out messages without my express permission. Microsoft will of course reject the idea, mostly because it will fail the "increase market share litmus test." My answer is, "Microsoft, if you do not take responsibility for locking down your APIs, it will become obvious to the public and become a detriment to your market share."
Which Office XP does quite nicely. Of course SirCam bypasses these controls and sets up its own smtp server... YOu cannot get around it totally. I am no more a Microsoft fan than the next guy, but this buy is a bit over the top...
LedgerSMB: Open source Accounting/ERP
???!
So says gibson. Why does that make things easier? Have you ever set up a screening router? You can filter out whatever you want...
LedgerSMB: Open source Accounting/ERP
Gibson constantly plugs Zone Alarm, so it's not suprising that people who don't read carefully would think that Zone Alarm is a GRC product, not a Zone Labs product.
If Gibson wrote Zone Alarm, it'd look as ugly as hell, have lots of BIG and alternating fonts, but be less than 300k in size, written in ASM, and fast as hell.
And people who hack other machines to do spoofing usually get to root if they get any normal user account.
.scr .bat .doc .vbs or any of the other alphabet soup of scripting engines on Windows will have full rights to do anything! Couple this with the known history concerning the security of products such as Outlook and IE, and you're putting together the formula for a disaster.
Ahh, now that is a good point. On a Unix box you must hack into the root account before gaining access to the raw sockets. On Windows, there's no need to do anything of the sort. Heck, today it'd take you about 15 minutes to work up a hack in MS Word that can write any darn thing it likes into your system registry, no restrictions.
What is scary here is not access to raw sockets. The issue here is unrestricted, no protections, any
Heck, Microsoft has already commented on this very issue. They are already blaming those nasty virus authors for the coming up screw ups. (my apologies for not having a link, read this one a couple of months back.) Even they know it's going to be bad, but yet they are still moving forward with this.
Lastly, keep in mind that we're not talking about NT or 2000 here. Both of those OS's have the ability to run as either an admin or a regular user with limited abilities. We're talking about a version of 2000 that has had it's securities stripped so as to be compatible with ME (aka, Win 95 Version 5).
The line must be drawn here. This far. No further.
Actually, I've heard that IPv6 is not popular because none of the current backbone equipment will switch it and no one wants to be responsible for conversion from v6 to legacy IP...
If MS's implementation is buggy/not compatible, then it probably won't work through any switches or routers, and they will have to change it. IPv6 does have some provisions for vendor specific fields, ala Kerberos, but that'll go over about as well as MS's TNF email format (read 'not at all'), esp. in such a wide open environment as the 'net.
After all, it's not called the INTERnet for nothing. However, I don't doubt that they will be able to push their proprietary extensions into corporate environments, but they really already have done that (SMB & MAPI).
The reality is that TCP/IP is really too low level for MS to worry about. There is no added value to controlling packets, only the payload, which is why they are pushing
Chris.
-- I don't have a cool sig.
Cringely makes a very astute observation: How did MS manage to avoid having all those VBS viruses tagged as MS Windows viruses or MS Outlook viruses instead of "email" viruses?
Laws affecting technology will always be bad until enough techies become lawyers.
You're probably a gamer.
It does suck for games.
All I can say is that it's gotten better - way better over the past year. Grab the latest RedHat or Mandrake or Debiam and screw around with it.
A *lot* of people got a bad taste using crappy early versions. Bad first impressions are hard to shake...
My own Windows install died (again) a couple of months ago and I really don't care at this point.
Be sure to grab the latest Mozilla - It seriously does work as well as IE. If you're using the Netscape 4.7 that comes with all the distros, the web will be painfully ugly.
Pretty much if you have your heart set on using Windows, go with it - I can't change your mind.
-- My Weblog.
All right, consarnit, I've had just about enough. I've been listening to you geeks fight with each other about this Intranet for a while now, and I'm just about fed up. Some of my boys have been telling me to just let you guys fight it out, but I really don't see any progress. It's inferurating! I didn't stand for this kind of crap at my former job, and I'm sure not gonna stand for it now.
So here's what we're gonna do. We're gonna split the Intranet right down the middle. That's right, the whole dang Intranet, from Wahoo to The Amazon's, right straight down the middle. And don't you be like some of my guys around here, telling me that it's "impractical" or "impossible", or that "I have no clue how the Intranet works", cause I don't really want to hear it. I've had enough, and it's time to take action.
So like I said, straight down the middle. One half goes to that Billy Gates guy up there in Seattle, the other goes to you Linucks guys. Now, I understand that there's not one guy in charge of Linucks, so I'd suggest you form a committee to handle it. If you need some help with that, well, drop me a line, and come on up for some help: if there's one thing I know about, it's committee's.
So anyway, one half to Billy, one half to Linucks. Both parties will be able to run the Intranet however they want, and we'll let the American People decide. The American People deserve the best, most great Intranet they deserve, and it's high time we let The American People decide the future of the Intranet. It's simple economics people, like you learned in college, the Law of Diminishing Returns! Adam Schiff himself would be proud!
Signed, George W. Bush
AOL/TW own vast content holdings, which are at risk from file sharing. Now it's MP3s, but as broadband spreads, DivX files of movies will become a massive problem. It would be in AOLTW's interest if the anarchic design of the Internet was replaced by one which enforces accountability and traceability. And if the content industry push it hard enough, we may see laws mandating traceability in TCP/IP, preceded by a campaign in the AOLTW/Murdoch/Vivendi/Bertelsmann media about how child pornographers are using the Net with impunity and nobody can stop them.
Hasn't microsoft already brok^H^H^H^H embraced-and-extended TCP/IP lots of times before?
There was a time when Sun servers responded "slowly" to windows HTTP requests because microsoft changed the behavior of TCP slowstart, etc...
I'm sure there are other examples.
I used to respect this person but now I have to wonder what kind of technical background he has and if that background is backed up by ay sound reasoning ability. I remember watching conspiracy theory in the theaters (You know with Mel Gipson). That had some pretty crazy ideas but this is just nuts. At one point in this article he suggests that everyone loose his or her anonymity. Then at another point in the article he criticizes Microsoft for their supposed protocol, which will remove anonymity. This article seems more like a rant by a frustrated Windows user than an actual intelligent discussion on the security problems of Windows.
The two main points of this article are based on flawed assumptions.
1. Raw sockets in windoze is not the end of the world. *nix systems have them, even vxworks. A number of ISP's filter forged packets. If this type of spoofing is such a harm, it is trivial for ISPs to implement this. Cripling stack interfaces in OS'es is rediculous.
2. Passport will not authenticate every connection made on the net. Sorry, this is a pipe dream M$ sold you on somehow. And second, priority net traffic based on M$ passport is even more impossible.
Although most end-users are running a MS-based operating system, there is simply too much non-MS underlying internet infrastructure for such a radical change in protocol. TCP/IP is going to be around for a very long time.
Furthermore, how is it exactly that TCP/MS would prevent things like Code Red from happening? An application is vulnerable to stack overflow exploits because of the application code itself, not because of the protocol through which it receives data. Registering the ports that an application listens on won't help if the app contains a vulnerability.
Cringely goes on to suggest that all connections be traceable - well, that's fine, except that it doesn't solve the problem of people launching viruses from public terminals, or obtaining free trial dialup accounts using fictitious information. Digitally signing specific applicaitons with an Active-X control style GUID, and only granting access to validly signed applications might help, but I can't see developers embracing that idea. Even if they did, it only takes one compromised certificate to release any number of malicious programs.
And did Gibson actually write Zone Alarm? Cringely seems to think so, but it's marketed by Zone Labs, not GRC.COM. Anyone know for sure?
Strags
I want some of whatever Cringely is smoking. He seems to having some really wild hallucinations.
SOCK_RAW access permits applications to spoof source IP addresses, thus disguising the source of a DoS attack.
thank you. like he said, people attack windows because windows is always the same, they all have the same setup (more or less), they all run the EXACT same programs, i.e. it's much easyer to get your buffer overflow to work with winnt/iis then it is with linux/apache because the binary or IIS and NT are going to be the same.
in linux and apache the kernal and apache executables are configured differently before they are compiled, so it's much more diffecult to have a overflow work against all instances.. of course for a standard distro like redhat and apache binary rpms this isn't true.
Windows is also more common, so your expliot will be more used.
Windows is also owned my Microsoft, a "evil" company, all the better to attack then.
-Jon
this is my sig.
Seeing as how Zone Alarm is the only darn free/software firewall that appears to work, then why run anything else? I'd like to see Microsoft's crack team of security "experts" come up with something comparable.
Oh wait, they did.
Hahahahah
Yeah, right.
It makes things easier on the target machine. Filters themselves require a fair amount of bandwidth and CPU to process incoming packets.
If you are running web services on a limited bandwidth connection (T1/etc) a filter at your ISP (i.e. before your gateway router and you) prevents all the bogus traffic from reaching your machine and wasting bandwidth (and CPU).
But it would appear to be a fact
'There is a Light that never goes out.'
That, and we normal folk already knew them anyway.... well, for odd values of "normal", anyway.
--
# Canmephians for a better Linux Kernel
$Stalag99{"URL"}="http://stalag99.net";
We could implement a secure user identity system precisely like telephone Caller ID. It would be essentially an Internet ID. All Internet transactions could be based on it. Anyone who sends me e-mail can be identified. Anything I send can be traced to me. People wouldn't be forced to participate, but if they remain anonymous, I might choose to block them. I certainly wouldn't accept file attachments from them.
You can already do this. You can trace email. You can block email from those you don't know. And this system won't work to block email worms because usually they come from people who you know.
Get with it, man!
Dancin Santa
--News Flash Y2K was a hoax.
--News Flash The internet is not going to be "shut down" by any stupid virus.
--Any half decent FW comes with its own proprietary TCP/IP stack... Yeah MS might think about changing over to something else.
--It is time for "technologists" to cut it out and stop trying to scare the Hell out of everyone with this MS is evil and the internet is falling shit.
--Bottom line if MS was as bad as WE all think it is it WOULD disappear. Truth is it isn't that horrible. For 90 minutes at a time it's a great gaming platform.
This
I think cringely needs to quit posting while stoned.
After reading his rant, which admittedly does bring up a couple of interesting points (although the idea of M$ trying an Embrace and Extinguish on TCP/IP strikes me as one which, if attempted, would be laughable in its arrogance and stupidity), I think overall Cringely contradicts himself. First he talks like setting a GUID for everyone on the internet is a Good Idea, and then later on in the article, he attributes the same idea to the Evil Software branch of Microsoft. So, which is it?
On one point I totally agree, however. The current rash of email worms are entirely due to a business decision on the part of Microsoft, and they are culpable. The best, simplest, and most obvious way to fix a good part of this would indeed be to prevent email software promiscuous access to attachments embedded in email messages. No amount of restating the obvious, it seems, is able to either convince institutions to quit sending these (which are often, most unneccessarily and foolishly, in Word format), or to convince mom and pop users to not open them, or at least scan them for viruses before opening. And I'm sorry, but if you open a file sent from someone you've never heard of promising to display a naked celebrity, you get what's coming.
political_news.c: warning: comparison is always true due to limited range of data type
The deal is that w/out raw sockets, in order to send large ammounts of data, you have to send UDP packets with the data. When creating a datagram socket (i.e. for sending UDP packets), you don't have to get a succesful return from connect() prior to sending data. Thus you can just start sending huge packets.
But with stream socket (i.e. for sending TCP packets), you have to get a successful return from connect() before you can start sending data. Which means that before you can send any data to a server, you have to send a SYN packet, get a SYN-ACK packet back, and then send an ACK packet. Only then will connect() return with a success, and then you can start bombing away at the server with huge packets. But even then if you don't send them in a form that is recognizable by the application, the server will just issue a RST and close down the connection. For example, if your stream doesn't include HELO foobar, when you connect to an email server, the server will just disconnect.
Non-raw sockets make it easier to filter out attacks at the upstream provider because they are usually UDP packets which your web application does *not* need. So you just filter them and then you're done with it.
With raw sockets, it becomes *much* harder to filter upstream. WIth a raw socket, you can create a SYN packet from a random IP address to a web server on PORT 80. That SYN packet can be 9k long if you want it to be. And it will be to a port that you can't easily filter out . Basically, it makes the DDoS attack much easier and harder to prevent. The attack could come from any IP address , and it will be destined for your web server, which (presumably) you want to keep running. How do you filter out a packet destined to port 80 from possibly anywhere without also filtering out the legitimate connections?
Of course, even without raw sockets, you can still initiate a DDoS attack against a TCP port. If there were fewer script kiddies and more programers, it would not be that difficult to write a simple program that uses a stream socket, and DDoS's with a well formed HTTP POST that posts 18MB of data. If the DDoS kiddies were able to program, then that's what they'd do, and they wouldn't need raw sockets to accomplish it.
So while I agree that the addition of raw sockets really isn't that big of a deal, it seems to me that it's a little bit more complex than what I've seen so far.
$.02
Key to financial independence: Spend less than you earn. Save and invest the difference. Do it for a long time.
The local news programs that dispense opinions to the average folks have a tendency to simplify technological reports WAY past the point of inaccuracy. These news shows are aimed at the kind of user who doesn't know that there IS anything beyond what they do, and they don't really have a clue exactly what it is they're doing, anyway. They just do it, and most of the time, it works well enough for them.
Back to my point, the majority of reports are not going to point out that these email virii only work through MS Outlook - because the news perceives that web-based mail and Outlook make up the totality of their target audience's concept of 'email'. And why should they take the time to be accurate? They might piss off Microsoft, they might alienate some viewers from their "friendly" news service, and it's close enough anyway.
Reality is indistinguishable from any sufficiently advanced fantasy.
But would it use raw sockets?
Got friends?
funny. although i don't think there is much value in controlling the underlying packet layer--it would be like Micro-Channel Architecture all over again. i think microsoft would be more concerned with content and .net.
Got friends?
Mike, apologies for the title of the post. What I meant to convey was that all of the posts I'd seen indicated that people were missing the forest for the trees. You're right, though - it was an inflammatory subject line.
Read the EFF's Fair Use FAQ
..but if someone doesn't have 300,000 machines at their disposal, raw sockets make all the difference.
I/O Error G-17: Aborting Installation
This seems like a nice idea, but I'm not for it, and I'm not sure if it even feasible. An IP address is already like caller ID.
Lets say you were assigned this new unique ID. Who's responsible for ensuring the identity of the payload remains unaltered? The software maker? That sounds familiar! Today, when you send mail, your message might sit at several relays. Is it up to the mail server to implement tracking of this ID? Could you not simply make a mail server that ignored this precedent and spoofed whatever it wanted? This seems the same as someone getting a shell on a box and running some kind of custom relay meant for delivering spam mail anonymously.
I also can't imagine a business deciding to ignore mail based on the lack of this identification. If you have to favor security over a new customer, you have other problems.
The funny thing about this article is that a PC implementing his ideas for security could easily exist now, but the fact is Microsoft isnt going to do that. If they can't follow measures to implement good security now, why would they under this new system?
Personally, I hope the answer to all this DOS'ing does not involve me losing what anonymity I do have (which doesnt seem like much at this point anyway).
Imagine that! No longer will cookies be used to track user activity. These won't be necessary, since the Internet ID would be much more effective at tracking user activity.
There are better ways to promote security than to adopt such measures. I prefer his less intrusive suggestions, such as improving the way the OS handles potentially insecure software.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
This is true, I have NO IDEA what Cringley is saying when he says that raw sockets allow for more viruses and such to be introduced to your system.
For the uninitiated...
Generally, when programming, you define a great many things when defining a socket, the layer of abstraction to tcp/ip defining a single connection.
SOCK_RAW is a bit less abstract, you define more of the data that is being used by hand rather than allowing for the socket code to do it for you. Generally the you use SOCK_STREAM of SOCK_DGRAM, which define TCP and UDP sockets, respectively. SOCK_RAW writes directly to IP, so you must encode many of the headers manually rather than automatically, as the other 2 would do, and then write them to this socket.
In other words, it has NOTHING to do with getting viruses! SOCK_RAW is just another socket, but you are writing to the IP protocol, rather than TCP or UDP (which sit on top of IP). It also has nothing to do with being DoS attacked. I have NO CLUE where he got that from.
Micro$oft (NASDAQ: M$FT) today realized that their new TCP/MS protocol will not function over the Internet's (mostly-non-M$) infrastructure. The TCP/MS protocol is designed to address some of the security issues involved with the industry-standard TCP/IP protocol. It allows for authentication and tracing, to allow large corporations to know who does what, when, where, and how.
Micro$oft is not held back by this issue, however. They are currently working on developing a solution called "MS-over-IP" which will allow TCP/MS packets to travel over non-M$-compliant IP networks. This will be available as a patch to the upcoming Windows XP, for approximately $300. Micro$oft also notes that if your ISP refuses to conform to the new TCP/MS standard, and you do not wish to spend $300, you may switch to their M$N Internet $ervice, which will support native TCP/MS connections.
Micro$oft did not return any calls to our reporters on this issue, and simply sent us an E-Mail saying: "All your packets are belong to us."
Then the folks at Readmond step forward and say, "When you're right, you're right. As you have no doubt heard, we are offering services like Passport as part of our Hailstorm initiative. These services are pretty much exactly what you have described. See, we truly are the leaders of innovation!" And (hopefully) everyone is sold on Hailstorm ;)
LedgerSMB: Open source Accounting/ERP
Anyway, I have to go log on to AOL so I can view _Inside the Making Of Survivor Pop Stars on Temptation Island_ hosted by The Rock.
It's 10 PM. Do you know if you're un-American?
One of the reasons that IPv6 is not very popular is because the MS version is proprietary as hell. MS is waiting for the big switch to IPv6 so incompatabilities between Unix and NT/winME could show up. At the time when the first MS-IPv6 stack was written, ms arrogantly assumed NT would own %80 of the server market by the time IPv6 became standard.
With almost everything running on NT, MS could then easily convince IT managers to only run NT on all servers for full network compatibility. The good news is that Microsoft's server dream never came quite true. Unix is still king on the Internet and is surprising gaining marketshare. At only %35 of the server market, I believe the MS IPv6 will not be very standard even if the whole Internet switches to the standard IPv6. But due to the MS-IPv6 problem, IPv4 will never quite go away.
http://saveie6.com/
IPv6 will take a long time to happen, and complete stacks are hard to implement - however, most system and router vendors are quite a way down this track, and not all devices/hosts need support all features. The biggest issue is router support, and Cisco is finally committed to an IPv6 roadmap ending in late 2002.
Something like a billion mobile phones will require IP addresses quite soon, and NAT will be enough of a pain that the European 3G standards have mandated IPv6 in UMTS release 5. In other words, without IPv6 you won't be getting IP multimedia on your mobile phone any time soon - this is what will push IPv6 adoption, first in mobile operators, then wireless application hosting networks (W-ASPs), then enterprises, then finally in core networks.
We already have a replacement for IP that does many of these things. It's already supported under Linux, and probably a couple of other OSs I don't know about.
It's called IPv6, and it has QOS, guarenteed delivery, traceablity, and a whole host of other goodies. C'mon, do you really thing Cisco would let MS take away their bread and butter? IPv6 has been in the works for years and was designed specifically to solve all of the issues he mentions. I guess he thinks that only MS is smart enough to develop a new protocol...
This whole article is a red herring, and Cringley's about a technically literate as a door knob.
-- I don't have a cool sig.
But Cringely's real point is that Microsoft is a very powerful company with a long history of turning its own technical shortcomings into market strengths. Microsoft's PR machine is incredibly effective - witness the FUD that kicks into high gear any time MS announces anything.
It's also instructional to remember a few Microsoft projects that didn't go off as planned. Ever wonder why journalists never bring up those failed efforts, or points to the millions of wasted dollars MS has spent over the years on vaporware?
Remember how Microsoft Bob was going to "personalize" the computing experience? Well, it failed not once, but twice!. Remember how Chrome was going to "revolutionize the industry," according to the drooling press?
Because Microsoft is the 800-lb. gorilla of the software world, even when they fail, they get the benefit of the doubt. It comes with the territory. Also, because the Microsoft culture is fantatical about continuous improvement, they have a long history of sucking hard at v1, sucking at v2, becoming fairly usable at v3, and taking over the market by v4 and beyond.
Microsoft has been doing this long enough to realize an opportunity when they see one. Cringely is reminding us that unlike all of you Slashdot readers out there, Microsoft is driven not by desire to build cool, useful technology, but by the desire to control marketshare. That's the be-all, end-all of their existence.
So whether Cringely is correct about raw sockets or the demise of TCP/IP doesn't really matter. Almost every company that has gone toe-to-toe against Microsoft in a market segment has failed because they continually underestimate and miscalculate Microsoft's strengths (IBM, Novell, Apple, WordPerfect, Lotus).
Microsoft has an overarching vision of the computer marketplace that is far more evolved than any of their competitors, with the possible exception of Sun.
Microsoft remains unconcerned with business ethics, is unafraid of censure by the government, and wouldn't hesitate to use the ubiquitous of their own flawed products as an excuse to move the foundation of the Internet to a proprietary framework.
Microsoft doesn't give a shit about the history of the Internet and the spirit in which it was created. They don't give a shit about letting everyone in.
If Microsoft believes they can make the Internet a proprietary environment that they can control, they will work relentlessly toward that end.
Read the EFF's Fair Use FAQ
I can see the part about TCP/MS as being a remote possibility, but the real problem with the theory is the part about Microsoft introducing something like raw sockets specifically to encourage abuses that they hope will subsequently be blamed only on hackers, UNIX, and TCP/IP itself.
This would seem to be an extremely risky strategy due to the high potential that it could backfire from a public perception point of view. My experience is that despite the fact that some people are apologetic toward Microsoft as Cringley points out, there is a steadily growing public perception of the weakness of Microsoft products.
Many Windows users that I know use it because they feel they have to, either for the applications they need, because their workplace demands it, or because they feel they are too non-technical to use an alternative like Linux (and believe me, many of them are). They are well aware of the instabilities and the susceptability to virii, and in fact many of the Windows users I know joke about it all the time even though they use Windows for various practical reasons.
I think at this point in time, if Windows XP doesn't live up to the MS hype about it being a more stable and robust platform, and ends up in fact being less robust, they run a significant risk of damaging their public perception; probably not fatally, but noticably none the less. Given the fact that a wholesale migration to TCP/MS, while possible, is far from a sure thing, this would seem to be a rather risky strategy.
No he's not saying viruses spread over raw sockets. He's saying that many viruses/worms like Code Red have the end effect of creating a denial of service attack; denial of service attacks are very difficult to block when the addresses of the packets are spoofed. He's saying that in the future, when 90%+ of the world is running Windows XP (and Windows 95/98/ME/2000 has been discontinued by Microsoft- ever try to get Windows 3.1 anymore?), and 90% of those people haven't used third party tools to secure their computers, there will be a continuous series of distributed denial of service attacks, and viruses like Code Red which will effectivly bring the Internet to a halt. (Most servers aren't running Microsoft OSes, but most of the clients are- the fact that Apache is the most used server is completly unimportant in this matter. Code Red isn't as bad as predicted because most people don't run Windows 2000, but XP unifies the server and consumer OSes so it'll be running on a very large number of computers, making these future problems several orders of magnitute worse.) The end result (as predicted by Cringly) is that Microsoft will extend and embrace TCP to get the Internet (which will be rendered useless by script kiddies and/or attacking foreign governments) working again.
Once implemented, if your web server doesn't speak MS/TCP then no one with Windows will be able to see your site. (And the only servers that will have bug free implementations of MS/TCP will be running a Microsoft OS.) Think that little ploy is hardly enough to overturn the Internet? Then why am I using IE right now? Their ploys have undone greater marketshares.
Someone said that Cisco is working on a way to prevent spoofed IPs at the router, if this is true, then this speculation is for naught. However, the fact that this is plausible should be a wake up call. Microsoft owns all of us. This is the straw that broke the camel's back, I'll resign before I install Windows XP. Microsoft's abuse of their monopoly is an affront to freedom. Live free, or die.
Most PC users don't get a choice. SPARC users don't get a choice. Don't know about IBM systems, nor HP. But anyone who installs BSD or Linux has made a choice, and can make another one if it doesn't work out.
Infuriate left and right
Quoted from Cringely:
If it were not for Microsoft's carefully worded user license agreement, which holds the company blameless for absolutely anything, they would probably have been awash in class action lawsuits by now.But can't sysadmins sue Microsloth for the gross negligence that consumes our bandwidth?
I know the license agreement that I made when I opened my Windows 2000 CD only affected my Windows 2000 desktop. It has *nothing* to do with the bandwidth - which I pay for - that this stupid [expletive deleted - Ed.] worm has consumed.
I'm not normally litigious, but Microsoft needs to clean up their act.
Anyone know a good class-action lawyer?
Fire and Meat. Yummy.
I'm using Outlook XP at home on a Win2k box.
If I try to send an email to someone from the Outlook Express news agent, there is a message box that pops up and states "This program is trying to use Outlook to send email, do you wish to allow this?"
This isn't quite as complicated as his proposal to authenticate and tie applications down to the socket, but it is very effective. Further this type of tie down is a fundamental design change for the TCP/IP network stack and would probably end up breaking an awful lot of current applications. Of course then when only Outlook Express worked, everybody would accuse Microsoft of purposefully breaking apps to promote their stuff.
So it's basically a no-win situation for Microsoft(or any other vendor), and they just have to do their best to solve a problem and not get in the way of the consumer.
Honestly, I don't know what else people expect Microsoft to do. This functionality to lock down Outlook was introduced as a patch to Outlook 2000 last year. It's built into Outlook XP by default.
Sadly most people don't use the patch.
If someone suggested this on Unix, people would just laugh - 'lose the ability to script my whole system using my favourite glue language; no way'. Why it seems any more appealing on Windows, I have no idea.
I didn't know Steve Gibson wrote Zone Alarm. When did this happen? What happened to Zone Labs?!
Yeah, right.
The bee in Gibson's bonnet (and therefore Cringely's, cuz we know where he gets his material) is IP source address spoofing. He thinks that Windows XP will somehow make this much easier.
He's right.
But it doesn't matter.
There are already several easy technical fixes to prevent source spoofing, and if Gibson and Cringely's phantasy comes true, they will all be deployed in various Internet routers in a matter of weeks. Some of them already are implemented in Cisco routers, but are not enabled by default. Long before things can come to sufficient head to justify Microsoft's appearance as an off-white knight to ostensibly save the day.
See also this article from Network Magazine.
Raw sockets are a just a slightly easier way to spoof IP addresses. But if someone has 300,000 machines at their command why would they need to spoof the IP addresses at all? Knowing the IPs will not really be of much help against a distributed attack of this scale.
Stop worrying about the risks of nuclear power and start worrying about the risks of not using nuclear power.
IPv6 does not have any more support for QoS than IPv4 (except for the flow label, only useful with RSVP, which is very rarely deployed). I work for a software company that enables people to deliver QoS today on IPv4, and quite a few are happily doing so.
IPv6 does not have 'traceability' - there is an IETF RFC detailing how to have slowly changing IEEE identifiers (MAC addresses) so that your IPv6 address will not include a static ethernet card MAC address. No more traceable than IPv4, and better in some ways.
IPv6 has no more guaranteed delivery than IPv4 - both of them can use TCP to ensure delivery of packets, but IPv6 has no special features in this area.
IPv6 is all about larger address space, easier router/host configuration and auto-configuration, easier re-addressing, better mobile IP, reduced routing table sizes, simplified options processing, and simplified headers. Please read up on IPv6 at http://www.ipv6forum.com before making these misleading statements.
If these attacks used spoofed IP packets, there would be no easy defense.
Except for if every damn net admin would WAKE UP and SMELL THE COFFEE and IMPLEMENT EGRESS FILTERING or SOURCE ROUTE VERIFICATION or whatever your router calls it.
If you have a router built within the last 5 years, I can pretty much guarantee you it supports it. So turn it on already!
If every border router on the internet used it, we could stamp out IP address spoofing overnight. No magic about it. All the border router has to do is check that the source address of the packet is within the range of addresses that it 'owns'. If it isn't, drop it, and log the MAC address so that it can be traced.
Easy huh? Any router worth its salt can do it, so...
Please!?!? What does it take to convince you?
When *I* was a youngin, IBM could do no wrong with many decision makers. I swore I'd never have my head in my ass when I got into decision making positions.
Now I'm 42 and one step away from making the decisions. I can INFLUENCE them now, and due to that, we run Apache for our web servers, I've stopped any thought of IIS from being implemented, and run Linux where possible and NT reluctuntly in some applications....
So don't forget this stuff. Microsoft may gain that market share, but one day hopefully pointy-haired bosses will be a bit better educated and make better decisions and not get sucked in by marketing hype.
Oh, I can dream, I can dream...
If you're not using Linux now, you should be.
Don't like what MS does? Make sure that they don't get a single nickle of your money.
Linux is getting to the point where it is just about as easy to use *on the desktop* and once you know the desktop, you are halfway to knowing the server.
You *do* have a choice, you know...
Get Linux, install it, learn it. Burn a copy for a friend. Help them install it and learn it.
Lather, rinse, repeat.
Cheers,
Jim in Tokyo
-- My Weblog.
I dreamed once, likely from having a fever, that I went back in time and told the developers of IPv4, "Add two more octets to the address space. Yes, I know it seems like overkill right now, but it will solve so many problems in the future!"
Bob-
The Ludwig von Mises Institute. The reasoning individuals economics
...they can use this wonderfull "Micronet", with all those pay-per-use video-on-demand, content protection, secure audio path, flashy pages and can give the good old "broken" tcp/ip internet, without all that wonderfull stuff back to those who don't mind using text terminals, and "legacy" stuff. Perhaps then we will be able to use IRC, USENET, even telnet, back again.
Give them (tcp/ip) 10% of the bandwidth. It will be more then enough.
> they don't really have a clue exactly
> what it is they're doing, anyway. They
> just do it, and most of the time, it
> works well enough for them.
Good point. This goes along my theory/view that technology is created with knowledge, but generally used in ignorance.
Let's review how we get technology:
1. Scientist acquires knowledge by pure research.
2. Engineer applies scientist's shared knowledge to solve problems. This often includes designing technology.
3. Technologist uses devices and methods (technology) made by engineer, with the special point that the user can be ignorant on how the thing works.
Of course there is lots of interconnection, as scientists and engineers use technology, but whenever you use something that you don't know how it works or how to make it yourself, you are a "technologist". 99% of computer users are technologists, to a certain degree myself. Heck, there is a whole industry based on ignorance of how computers work called "Information Technology" where people just "troubleshoot" and never really know what the problems are. (I worked in that for a short while as an intern.) Software programmers fall somewhat under the "engineer" category if they have been trained correctly.
Anyway, society will always have "technologists" (perhaps "lamers") because:
1. People are generally not technically capable of learning how technology really works or how it is made.
2. There isn't enough time for everyone to learn everything. See mortality.
Sorry for the rant, but its important that people understand this situation.
Welcome to the future!
Before going into my opinion on why people see M$ in this way, I should explain a few things first.
so, all that aside. People love Microsoft because their products are incredibly useful.
As programmers, we know that Microsoft products are buggy, poorly written, and often just plain stupid.
However, you try writing a book with a pen and paper. Now open, even, Word 6 running on Win 3.1 and compare. It's not hard: the M$ product wins out every time.
Or try doing some serious accounting work on a paper ledger, then open M$ Money. Damn, but, you know...
The problem, fundamentally, is that computers are too good. Computers in general are such fantastically useful tools that people love them, even when they're seriously non-optimal.
As far as I can tell, the only really strong link in the whole M$ apps network is Word. Word has so many features, I find it quite incredible. (It does have security failings and other failings, of course. But given the size of its codebase, it's actually pretty reliable, I think. Unlike, for example, IIS, which is just a little program.)
Which is why people shell out all that cash for Office, because Word is amazing, and the features it has are stuff they understand. People understand writing. They don't understand email. They like email, they just don't know how it's supposed to happen. So most of them use Outlook because it comes with their Word, and they assume that because Word is amazing, Outlook is too.
So anyway: that's my point. Computers have radically changed people's lives and made possible things that they found hard to imagine before. Even when they're running M$ operating systems, they're still fantastically useful, so nobody thinks to ask if there's something better around.
my old sig used to be funny, but then slashcode ate it and now it's not funny anymore
Naaaah...
TCP/IP over 802.11 - community freenets!
I was looking at the Seattle Wireless/Freenet site yesterday - marveling over a directional antenna members had built for 802.11 communications that got 3db of gain - and was essentially constructed out of PVC pipe, threaded steel rod, and washers, with a reflector made from a candy tin!
They had an omni that was constructed in a similar "use-whatever-parts-you-can-buy-cheaply" manner.
I think we would see these things springing up rapidly, and to hell with the FCC. That, or wireless lasercomm solutions. Perhaps individual community nets would be tunneled across the new MSnet - at least until long distance interconnects could be built and put in place. Or perhaps connected in a FIDOnet type fashion over multiple long distance modem-to-modem connects.
Never thought I would see the day I would go back to BBSing...
Reason is the Path to God - Anon
Unlike other nations which can trace their heritage back many hundreds or thousands of years, America is an "invented" country, whose identity resides pretty much in the day to day consciousness of the people (ask somebody what being "American" means).
What you say is true today - but America does have a culture, and a history - one of the most colorful ones in the history of the world, as well as one of the most bloody.
But it isn't taught - and when and where it is taught, rarely is it in a way to excite people.
I remember my senses and thoughts almost dulled to the point of exhaustion by American History. But today, as an adult - I have begun to see that how we were taught had a lot to do with my boredom of the subject. One thing I mean to do, and soon, is to study up on the history and people of the "Old West" - what I have learned so far, living in Arizona and visting surrounding "Old West" towns (as well as about Phoenix itself) has taught me about the hard and dangerous life that the expansion of the west was really about. Similarly, I am interested in the colonial and revolutionary periods. Even the Civil War era holds my interest. I have always been excited about the days I consider between the Civil War and oh, say Kitty Hawk (1903) - and the technical advances in steam transportation, electricity (and the whole Tesla vs. Edison debate), computing (Hollerith), and flight (Langly vs the Wrights) - all of which happened here in America (and yes, I know that much of steam and electricty were invented and developed in Europe, but many great advances in uses of electricity and distribution, as well as locomotive transportation, happened here). It is so colorful, so amazing - the things that have happened and transpired here in our country. As much as I would like to someday tour Europe and see the history and ideas of that continent firsthand, I dare say that it is more important to me as a citizen of this country, the United States of America, that I learn about it first.
Unfortunately, I wish other people of this country would realize this as well. I only touched upon the color that makes up this country - there is so much more - and what makes it amazing, is that the majority of it has happened in only the last 200 odd years...
Reason is the Path to God - Anon
When i worked at a Air Force base - and we had perfectly good Sun Sparc20's running as our servers (mail, dns, SQL, etc)...
.NET.. why should we think that they will stop there?
my boss told me that because we were upgrading to Windows 95.. that it was time to ditch all those servers and get Windows servers with Exchange, et al...
i asked him why should we get rid of our perfectly running servers which had given us no trouble at all just to move to Microsoft? "Because, we're getting in contractors now, and they only know Windows Nt 4.0."
Later on, it was then decided that instead of bases having their own servers and their own email systems, that now that we'd all moved to Exchange, that we'd all put our GALs together (Global Address List - the list that Outlook/Exchange VBScripts use as their distro lists to replicate themselves), then we'd really kick ass.. no more joe.blow@otherairforcebase.af.mil...
my reply was - um... LDAP servers? open Source? Hello? Anyone?
well, skip ahead to today - the US Air Force (and soon all of DoD) is going to be moving from its now Air Force-wide GAL (why we just pull the plug now during virus scares and why we were down for weeks during Melisa) to Active Directory.
back when i shut down all my Sun boxes.. i told my boss that this was just stupid.. why should we give up on what works just to buy what Microsoft is giving us? Their goal was not to give us good products, but to get us to buy their products... and things like Exchange, with its GAL, are just the first protocols that they are trying to hijack and take back on the internet... eventually, all the open ones would be overthrown by the new default MS proprietary ones that would ship someday with newer versions of Windows.
I thought it might end with email.. but i see that i'm wrong.. i agree with Cringley... its going to go all the way.. and we have no way to stop it..
MS will take over the internet.. they are already took over filesharing with SMB, they are taking over email with Exchange, they have taken over HTM L with Explorer, they are trying to take over java with
sigh.. oh well..
guns kill people like spoons make Rosie O'Donnell fat.
Unless, of course, you believe that everything they say in the way of empty reassurances is entirely trustworthy, sincere, and not an outright, intentional, manipulative lie. But then, Microsoft does not lie ;) right?
The one thing Cringeley DOES have exactly right is Microsoft's intent. This really should enter into the ongoing antitrust investigation. Who says that release of Windows XP is REALLY the Big Issue at stake? I would say that was a relatively minor issue compared with the more longrange plans in process, and although Cringeley is painting worst-case scenarios regarding the _ease_ of MS doing this, he is dead-on regarding the general idea of it.
At this point, and it could happen, Joe Average freaks out. Thing is, Joe doesn't have any really constructive solutions- what he'll want then is roughly equivalent to nationalizing Microsoft and switching off all those forms of taxes and 'piracy protections' that are abusing him. He has no clue of the significance of things- he will just want to destroy Microsoft at that point.
It's a pseudonym for a team of (quite knowledgeable, quite talented) writers. The guy who presents the TV show is just an actor. The story about Apple is completely false. (Jobs doesn't mind, of course --- it adds to the mythology.)
There was a front-page story in the WSJ a few years ago, about how InfoWorld, PBS and various freelance writers were locked in legal battles over who had rights to the name.
It wasn't THAT backwards. IT was written as an expression:
A> pip b:=a:*.*
That copied all the files on drive A to drive B.
Just like good old BASIC's LET A=B set variable A to be equal to B. FWIW, it is true that many of the lamest things in MS OSes date back to CP/M. Drive letters instead of mount points, ^Z for EOF, CR/LF instead of newline, and so on. Even the infamous DOS PSP (program segment prefix) is practically a byte-for-byte clone of the CP/M base page (did you know you could make DOS calls from a small-model DOS program by doing a CALL 0x0005 instead of an INT 0x21? That's how you called CP/M.) For all I know, the old "FCB-style" file system calls still work in NT's command-line window! (The FCB stands for File Control Block. CP/M didn't use file handles. Instead the OS filled in a structure in the application's memory with all the data neede to access an open file. The real downside of FCBs was they were never made able to work with heirarchical directories).
All of these "klunky" designs of CP/M make a lot of sense when you realize that CP/M had to be able to run on a machine with only 16k of memory and still had to leave room for an application program that could do something useful.
MS-DOS has little excuse (with its ability to address 1M - barring IBM's goofy BIOS placement that limited it to 640k), and Windows 32-bit has no excuse whatsoever.