Slashdot Mirror
Slashback: Snapshots, Amends, Bazaarity
Microsoft is just as secure as the competition, says Microsoft. Jon_E writes: "According to this article Microsoft is responding to the Gartner Report which recommends that enterprises drop IIS by claiming unfair targeting due to their popularity."
Whether because of better-trained or more vigilant administrators, or some other factors, the Apache servers running many web sites certainly haven't seen the devastating outages in the past month (Code Red, Nimda) as certain large IIS installations have.
If animated, this might make a really good Saturday cartoon. cconnell writes "Last September, slashdot published my critique of Eric Raymond's essay The Cathedral and the Bazaar. There was a lively (and sometimes scorching) discussion that followed. Here is Eric's reply to my critique, which Slashdot readers might enjoy. And here is my reply to Eric."
This was not faked in the same studio as the "lunar landings." mrsmalkav writes "Deep Space 1 has passed by Comet Borrelly within 1400 miles and took some very pretty pictures of the comet's core, all while collecting lots of data about said comet. NASA's press release discusses some of the details and findings of the flyby.
This is actually really impressive given that there was very little hope for this mission. From the Mission Logs on DS1's site, '[T]o be honest, DS1's visit with the comet simply is unlikely to work as well as we hope. Many mission logs have described the difficulty of keeping this aged and wounded bird aloft, and the encounter with Borrelly will present Deep Space 1 with the greatest challenge yet in its historic trek through the solar system.'"
Saint Aardvark writes "Space.com has an article about the images taken by DS-1, and they're stunning." And eldurbarn points to the NASA Images of comet Borrelly online at JPL.
How to satisfy customers with license objections, Part II brtb writes: "Soon after Slashdot posted my DiscZerver-GPL writeup last week, xStore added a link in their Download section for information about the use of GPL software in their products. Below is the e-mail I received in response (address changed to protect the spamless). Congratulations to xStore for supporting Free Software and bringing the DiscZervers into compliance with the GPL.
From: "Support" [support@xstoreonline.com]
To: "brtb" [slashdot@brtb.org]
Subject: "RE: GPL SOURCE CODE"xStore is committed to complying to the full letter and spirit of the GPL. We are currently investigating the allegations of non-GPL compliance and communicating with the GNU.ORG and Free Software Foundation on this issue. We will produce a response to your request that is mutually acceptable to the copyright holders of the programs we have used that fall under the GPL and xStore itself. Due to the recent acquisition of this product, we are still in the process of preparing the required source code for distribution. xStore is commited to bring the DiscZerver product into GPL compliance, if it is indeed found to be not in compliance.
In the meantime, please provide xStore with information so that we can send you, the user of this product, the package that you are entitled to. Please provide the serial number of your DiscZerver product and the 'system page' with your response. The 'system page' is located at [http://your_Zerver_name_or_IP_address/admin-cgi/s ystem]. In addition, please send us a self addressed stamped envelope suitable for mailing a CD-ROM along with $14.95 to:
xStore, Inc.
Federal Highway Center
1200 North Federal Highway
Suite 200
Boca Raton, FL 33432After we receive your written request along with the above items, we will process it and promptly send you the disc when it becomes available.
This thanks to the mostly behind-the-scenes work of people at the FSF. Congratulations to xStore for respecting the intent of the programmers whose work they're consolidating and packaging.
Just out of curiousity...how does this engine work...what principles of physics does this satellite use and what would it's benefits be?..first time I heard of one is when I found that's what powers TIE fighters
: ) - It's true...TIE = Twin Ion Engine
----------
ah honey, we're all resplendent - Bill Mallonee
There's another article in the NYT about the encryption restrictions being brought up for debate and it includes a nice jab at the Washington Post for misquoting Zimmermann on his PGP interview. Check it out here:
D E.html
http://www.nytimes.com/2001/09/25/technology/25CO
+1 Insightful, -1 Troll. What can I say, I'm an Insightful Troll.
From the IIS article:
I couldn't agree more. Apache just can't compete with the speed of Microsoft's PR department in spinning every horrendous hole as "innovation".
That's "Mr. Soulless Automaton" to you, Bub.
I hate the .95 thing. It's everywhere you look. Oh wow that's only fourteen dollars! Oh wait...
I could almost understand it on standard retail stuff, but in this case... Does it not seem a little frivolous?
Not the best solution, but as the article says, there aren't a lot of virsuses for the mac for this reason. So one thing that can make your servers more secure is to use a more obscure OS and know it really well.
One other note: I thought a majority of web servers run a varient of linux. So because they have the market share, wouldn't hackers attack them more? I just think it's harder to attack something that is open source because so many bugs can can be found by the community and fixed by the community, while bugs for IIS can rarely be fixed by the community.
Plus a lot of people just hate microsoft in general.
F-bacher
James Tiberius Kirk: "Spock, the women on your planet are logical. No other planet in the galaxy can make that claim."
Before you flame: yes, I know that was meant as a joke, and yes, this post is more than slightly off topic (but Slashback threads often are), but this is probably going to be discussed here sooner or later anyhow so I might as well take some preventative measures.
The lunar landings were not fake. The "evidence" is poor at best, and just blatantly stupid otherwise. I won't reiterate all arguments against this silly conspiracy theorys validity, as you can read all about it, for example, here or here.
There are lots of nice conspiracy theories that really have some nice arguments that actually speak for them, but this is not one of those. This one should really die. Seriously, I'd go for Illuminati or Elvis any day of the week if this was my only alternative.
"If you think education is expensive, try ignorance" - Derek Bok
Hmm... That reminds me... I read somewhere that Macintosh viruses are WAY DOWN!!! Perhaps some of those a**holes that are wreeking havoc on the Windows platform, could concentrate on the MACs... We don't want to have them feel left out now do we?
---
Programming is like sex... Make one mistake and support it the rest of your life.
http://directory.google.com/Top/Science/Technology /Mechanical_Engineering/Propulsion/Aerospace/Space /Electric/
They're targeted because they're the most vulnerable target. That's all.
Unlimited growth == Cancer.
This is simple physics, boys and girls.
First things first, you need a spacecraft as light as possible. Anything not needed goes away. Basically, you're left with the instrumentation, the navigation, the cameras, solar panels, batteries, and a couple of sizeable tanks of xenon.
Yes. Xenon. The heaviest non-radioactive noble gas.
Now, xenon is normally inert like other noble gases. I mean, there are no natural compounds containing any noble gas because they have no natural need to enhance their electron shell configuration.
However, xenon is pretty large (as atoms go) and, given enough juice (courtesy our light and ability to live, the sun, hence the solar panels), you can ionize xenon. You can strip off an electron or two and it's useful (For example, the compound XeF6, xenon hexafloride. What it's good for? Dunno. Still doesn't change the fact it exists.) More importantly, it's charged and can be directed.
Then, it's a simple matter of a small aperture (which can be directed), a positively-charged grid, and the xenon leaves in the direction opposite the spacecraft goes.
Don't expect this to power any spacefighters, however. At full power, the force this produces will barely move a piece of paper in front of it. The beauty of ion engine, though, is that because in space, inertia isn't hampered except by collision or a gravity field, this little bit gets larger as time increases. It's not much force, but given time it gets zooming.
I used to be someone else. Now I'm someone better.
Real life is underrated.
Sorry, couldn't resist. But seriously:
The attempt to rank vendors according to their security success rate is a risky business. The aim of most virus writers is usually for their worm to achieve its biggest impact, and so will target platforms that are widely used. "Microsoft is targetted as it is so popular, rather than the system being the least secure," said Cluley.
You have to love how they pull the "everyone is jealous so they pick on us" stuff everytime they screw up. Suprise, shitstreak, Microsoft does not make the world's most popular Web server. That's Apache. "Hackers", as you call these jerks, do not target Microsoft because they're the most popular. They target Microsoft because Microsoft has made itself an easy target by making it really easy to hack their products. If popularity made you a target, we'd see scores of Apache worms.
How many security holes so far discovered in XP?
How many security holes so far discovered in Linux?
0 for XP.
Hundreds for Linux.
Therefore, XP is better. Currently, XP is the more secure OS ever. That record will last about a week, so get it while it's hot.
How many beneficial software projects simply wouldn't exist without this sans-management stucture?
Here are NASA engineers, squeezing every last drop of science and knowledge out of projects which had justified themselves and their cost before the end of the Cold War- the possibilities presented by a modern project would now be so exponentially greater, due to increased technology, that it's ludicrous Congress doesn't invest in such more heavily. Perhaps one could add this to the list of things /. could become a million-strong lobby for.
Acutally, it is Cluely, someone from a firm called Sophos, who claims IIS is being targetted because it is widespread. The only Microsoft quote is from some Peon saying "IIS is as secure as our competitors' products, and what differentiates Microsoft is our industry-leading response process" Now, as to the first point, as some earlier poster pointed out Apache is still a leading webserver as hasn't had nearly the compromise. Sure, crackers will go after widespread targets. But they'll also go after the easier ones. As to Microsoft being distinguished by its response process, I couldn't agree more. Few other companies respond with as much hot air (This flaw would be very technically difficult to exploit...) and as cruddy patches. Just read through SecurityFocus.
Since an Ion engine ionizes its supply of onboard gas (so it gets an electrical charge), then electrically accrelerates it out the back, that's why TIE fighters make that wooshing noise. All the gas they expel makes for enough of an atmosphere for sound to carry to the nearby cameras :)
A.
According to The Register, their reaction also includes the following:
Timeo idiotikOS et dona ferentes
subject says it all.
http://www.msnbc.com/news/206711.asp
pw: testtest
'Nuff said.
"If you think education is expensive, try ignorance" - Derek Bok
Am I the only one that sees half of a face in the released picture of Comet Borely?
This is the biggest image of it:
http://nmp.jpl.nasa.gov/ds1/img/borrelly_1.jpg
Then I must conclude that there are twice as many worms developed for Apache, than IIS. I feel sorry for all you poor Apache users. Your worm problems haven't received nearly as much publicity and sympathy. It must be a conspiracy.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Worms dont happen to Mac web servers running WebStar.
.exe because macintoshes do not have file suffixes. The mac OS (9,x and older) uses a four byte file type designator that the user never sees and cannot be set carelessly.
EVER.
Thats why no reports of ANY exploit has ever been published regarding the secure Mac OS. !
consult bugtraq if you doubt this.
This Gartner report is a sham unless it really discusses techical issues regarding the macs securuity as a web server.
C Language alone is not the sole reason but the types of STRINGs used in ANSI C libraries certainly adds risk.
Worms dont happen to Macs because Mac programmers rarely have buffer overrun problems because mac apps typically NEVER use null terminated strings and intead use "pascal" style strings that have a bounds of 255 and a marker in the front.
Additionally mac programmers tend to know that there is no false sense of security because all code is running at supervisor level so programs, like Webstar, are careful not to do foolish things.
Mac programs and executables NEVER can run merely from a data file named with a suffix such as
A further reason macs are more secure than unix (hundreds of documented exploits) and Win NT (almost as many exploits documented over the years), is because the mac does not have a command line shell and has no path to hijack. No command line and a modern type of interprogram communication prevent the silly weaknesses in other OSs.
Yet another reason the Mac is secure is vecause a mac program (either 68k or PowerPC) needs TWO files to execute and not one file. The second file is called the resource fork and it is genreally an invisible file kept tightly associated with a file. classic internet apps do not create or allow creation of these resource forks as side effects of merely storing data files. Macs are very secure from infiltration by dynamic creation of apps by rouge products on a server
Another reason macs have NEVER been broken into running the WebStar server is because the mighty Mac OS Webstar server, (which typically costs over 400 dollars unfortunately), avoids ever executing cgi code files from directories where they ought not to be. A clever set of directory and folder control prevent the webserver from being hijacked unlike earlier versions of apache.
The US army switched to Webstar webservers on macs when MS NT webservers kept getting hacked.
There are thousands of major webstar servers out there. I think many are colocated at reprahduce.com cages.
And mac NEVER get hacked. EVER. and NEVER have, even with public challenges and reward money.
Sure, there may be some defects that might get discoverred one day, and surely any mac not runnning mac os such as ppcLinux, or MAc OS X (freeBSD derivitive) are hackable.
But face it. Macs have NEVER been hacked and that is because of modern and sound design principles.
Myself and other mac programmers I know have NEVER shipped a product containing a single null terminated C string, and do lots of paranoid error checking as well.
Unix is hackable not because of open source, not because of popularity (both of which help) but because of all the things I mentioned here.
But I agree about the other OS's sucking. parts of the older Mac OS itself is written using pascal strings, in fact the original ROMs were written using only pascal compilers and some assembly, and no C. But string overruns alone are not the ONLY reasons mac servers have never been hacked, (command line, dual fork, no extensions, etc etc).
Wake up and quite being bigoted. "Never" is a good enough abosolute ajective for most logical people to draw up reasoned conclusions from.
MS had its roots in BASIC on small hobby computers. Much of what they have done since is summed up by their home-grown product: GeeWhizz Basic.
The network that they have now is based on IBM OS/2 Lan Server, which they got in code sharing arangements with IBM. I mean, the OS/2 1.3 help file still serves me well under NT4.
Their main contribution has to lay all sorts of flash in fanciful languages, purpose designed to ensure upgrades. Excel, for example, has had three entirely different languages in five years. Most people could not be bothered to learn the new language. A lot less macro writing happens now then in the days of Lotus 123 for DOS. Mind you, it does not stop the script kiddies, who are learning the latest exploits.
Most MS products ship badly configured. Like, who would put a spell checker on a function key (F7), if spell checking is done live anyway. I mean, you either do it live because you have the juice, or you do it from the tools menu because you don't have the resources to run it all the time. Putting it on a function key is silly. Except to bring it up on sales promotions. "Yes, we have spell checker [press F7]".
So their network stuff is full of flashing chrome designed to sell the thing to executives, and the scripts that run this chrome is by this set up, already in a form ready for remote exploits. Yes, you can configure it, if you want to stuff around in the registry and hidden settings. But most people dont have the knowledge or time to do something that should be a default or available choice.
MS is a small system maker that is attempting to do big time: all they do is big time damage.
OS/2 - because choice is a terrible thing to waste.
Microsoft products are rarely considered to be secure. Outlook is a laughing stock, and IIS is a running joke in the industry I'm in (managed services). So much so that we've been wondering whether or not to charge customers who insist on using IIS an extra fee for all the time we spend monitoring and patching their boxes. History has shown that if we get a new customer who demands to use IIS, then we can be reasonably assured that we'll have multiple headaches dealing with it so we might as well charge them. We (thankfully) never even considered supporting Exchange. We're going to ban IE from all NOC machines as well. Weaning people off Outlook may be harder, though. (Mirapoints help us mitigate that threat.)
The "competition"? That would be Apache, Opera, Eudora (or Pine for some of us), qmail, etc. The "competition" is not half as secure. It is far more secure, everything else being equal (i.e., everything is installed properly, configured correctly, etc). That's my opinion, to be sure, but a colo full of servers running about everything you can think of formed it for me and I stand by it.
You are the target, and you will be breached...
That statement is specious at best. The only way to be completely secure is to have a standalone box. Which isn't an option, and therefore silly to say.
MS software will never be completely secure. Yes, things like wu-ftp and such can be insecure as well. Anything can be. But at least most free/OS packages try to be secure. MS software isn't even trying to be secure. Hell, they apparently aren't even trying to be half-assed.
When will they get that through their thick skulls???
I'm wondering when people will stop drinking the MS koolaid and realize that there are many better, cheaper, more stable and more secure options available to them.
-B
Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.
Just kidding, but tell me one thing. I don't really care WHY the platform has more viruses, if its because its insecure or just more popular. There is clear account of HAVING more viruses and thus BEING more insecure and thus HAVING bigger
TCO. In other words, reasons enough for replacing
this unreliable service.
If programs would be read like poetry, most programmers would be Vogons.
Could we, in fact, turn a Disney DVD into a terrorist tool? Has it already been done? Should we be encouraging Congress to ban the CSS encryption scheme because it could have been used in such a way? Interesting questions, no?
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I thought a majority of web servers run a varient of linux
Here's the key to it. The majority of servers run some variant of Linux. Most buffer overflow bugs require a specific offset and known layouts in memory. If you look at the specific versions out there IIS is probably the most common single version of any product out there (can you get this info from Netcraft?)
On the other hand, it could just be stupid admins - check out http://www.netcraft.com/Survey/vuln.gif. I'm sorry, but those numbers make me puke when I think any of those people seriously call themselves admins...
Fear: When you see B8 00 4C CD 21 and know what it means
Here is a sneak peek at the documentation for the new IIS rewrite. Of course there are a lot of bugs in this version of the document and it'll have to be edited quite heavily before the final release...
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
In quite a number of the responses I've seen there has been discussion about whether IIS is simply more targetted, or really insecure.
Some have discounted the more targetted point of view because Apache is reportedly far more popular. Ok, granted. But now for my sad analogy... Single family homes are far more popular in the United States than skyscrapers, but when terrorists want to make a point, what types of buildings do they attack?
People who write viruses may not be "terrorists" as they aren't trying to kill people. Sometimes they don't even have a point to make, but they most certainly want to cause financial damage, so who better to target?
After we receive your written request along with the above items ($14.95 & A S.A.S.E), we will process it and promptly send you the disc when it becomes available.
Seems like they want to not make it as easy as possible for people to get the code...
So, brtb, when you receive the disk, could you set up a sourceforge project and upload the files..? so otehrs can have a peak without the $ and snail-mail bother...
Every day I get about 10,000 attempts by various people to execute CMD.EXE on my server (a FreeBSD box!) and so compromise it. I consider each of these attempts to be an attack. Can I sue these attackers? If not can they be tried in a criminal court? If not can I sue the morons who are negligent enough to run a server with known and well publicised bugs without patching. Surely someone can be sued here. Anyone out there a lawyer?
-- SIGFPE
So Microsoft is claiming "unfair targeting due to their popularity"?
:)
Do they mean popularity as a target of Internet worm/virus/trojan attacks?
...I once received an email that read something to this effect:
Hi! This email virus works on the honor system. Delete some random files and then forward this email to everybody in your address book.
Hmmm... I wonder if sending this email to a bunch of random people constitutes setting off a virus?
Ok, I'm tired of seeing people always throw out that since Apache has more market share than IIS there are more Apache servers sitting on the Internet. This is simply not true, IIRC, from the numbers we saw for code red.
.. it worked because of the tens of thousands of IIS servers running by people who didn't know they were there.
.. and probably never knew they had it.
There are thousands of people running IIS on Win2k server, many of which are 31337 warez puppies on cable modems who installed win2k server because it was the biggest Win2k download and hence had the most stuff. These people are not included in the "market share" of IIS webservers.
The exploits for IIS worked not because of the relatively small number of sysadmins who did not update their IIS servers eventually
No competent sysadmin had their system compromised by Code Red, and if they did, they had it patched quickly. The people who got Code Red 2 were not part of the "market share"
--
Hmm... where do I remember him from?
Always nice to have a few staunch supporters ready to jump to your defense
I/O Error G-17: Aborting Installation
Umm... about 6.5 years ago many university Mac labs were completely overrun -- shut down -- because of fast spreading viruses that moved like wildfire. I remember watching a lab shut down within 15 minutes (25 machines). Cleaned by the next day and then shut down again in another 15 minutes.
The Mac is not invulnerable. Far from it. Webstar hasn't been hacked yet -- congratulations! That's good news and the developers deserve thanks.
Of course if the Mac were in any way a significant platform for web serving it might make more of an impact. Right now it isn't nor does it look like it will be in the near future. As a matter of fact it is an extremely tiny server platform.
The reasons that the Mac is a marginal platform for servers are many but center around a few significant facts. In the past they have not been built as true servers that can compete on a price/performance module -- not the cpu but the entire system. The development platforms for open source (Linux, etc.) and NT (IIS/ASP/etc.) implementations are easy, powerful and productive -- the Mac is not really superior and in some areas doesn't come close to the base functionality of either Linux or NT/2000.
Frankly the Mac is a marginal system. Always has been. May always be. To move away from marginality it needs to present a compelling technical ability (i.e.: price/performance must soundly trounce the competition), an ability to deliver solutions swiftly and/or an ability to deliver web solutions that no other platform can do.
Doesn't look good for the Mac.
Hrm, interesting; I had not thought about that when I read it the first time. When I send in a request for the code (sans serial number, now), I'll ask them about it.
The problem with surveys like Netcraft is that they only take into account web servers. But because IIS is an integral part of the operating system (tm), it gets installed on all sorts of things which aren't web servers, making it thus more popular than Apache, and a better target for worms.
Of course, you can't really blame these people for not keeping the web server they didn't know about (but probably paid for) up to date, and you may wonder why the server has to include features that MS can't make secure the first time when it does not, in fact, have to include any features at all.
Correct me if I'm wrong, but I didn't think IIS (or Personal Web Services) was installed by default on Win2k Pro? This is all supposition because I can't remember whether I deliberately turned it on when I installed my machine or not (it's set to only accept on 127.0.0.1 though).
Fear: When you see B8 00 4C CD 21 and know what it means
Excerpted from Netcraft's Web Server Survey http://www.netcraft.com/survey/
Take that, marketroid!
Snickersnee3: Build your own 3-watt Luxeon Star headlamp from scratch
There must be intelligent alien life on the comet.
Quick, alert the editors at that fine scientific magazine " Weekly World News."
KFG
Thus, using Internet-exposed IIS Web servers securely has a high cost of ownership. Enterprises using Microsoft's IIS Web server software have to update every IIS server with every Microsoft security patch that comes out ? almost weekly.
This is the biggest problem with maintaining Microsoft networks. Exploits in IIS or Windows are far too frequent, and almost all patches require reboots. You can imagine the response I get when I call management every other week and say "I need emergency downtime to patch 65 of our servers...".
Microsoft loves to talk about how their software has a lower TCO than other operating systems. Perhaps they don't count the cost of man-hours spent applying patches, or the downtime involved?
On a G3, MacOSX has proven to be slowish (Dog slow, in my not so humble opinion...) compared to Linux. If you don't have apps that are OSX only and have a NewWorld Mac, you will run about as well or better with YDL or one of the other distributions. I'd not say many are moving. The Linux users seem to be staying where they are in my area.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
This is also true of the GPL:
At some point, of course, it was decided that distributing source in a 650MB CD-ROM image was OK under these terms (!?), but that's another argument for another day. ;)
I have been thinking about this as well as one of the places I do contract work for is getting pounded daily with Nimda and Code Red I/II attacks as well. Since the box is running Linux, the attacks don't matter but I have been wondering if there is some way that a sysadmin could take advantage of these requests to stop the attacking system.
Various people have mentioned writing a white hat virus that would shut down the attacker and all that - but in reality that just puts you in the same boat as someone attacking their system - and its therefore illegal.But if someone's computer makes an http request for a file from my server, am I responsible if what they get is not what they might expect to get?
What if I was to create a file consisting of nothing but the letter X that was, say, 1Gb in size, and leave it on my linux webserver with a name like "root.exe"? It wouldn't take all that many requests for the attacking system to run out of HD space. Granted service on my server might suck for a bit, but eventually if enough linux admins did this the target systems would simply shutdown for lack of swap space or HD space or whathaveyou.
Or perhaps I tell Apache to treat .exe files as PHP files and process them accordingly. Then I create a PHP script that sends prints nothing but Xs or random numbers in a long string back to the requesting server (with the execution time limit for PHP turned off). It would be like 5 lines of code total.
After all, its my server, so presumeably I put the file there for my own purposes, indicated in robots.txt that I dont want it indexed etc. If some other system makes a request for that file which I have in no way indicated is present on my system, isn't there fault/problem if the file is too big, or causes problems at their end?
I am sure the clever folks at /. could think of other things that could be done in this manner.
Just food for thought, and I would love to see some suggestions...
"The first time I got drunk, I got married. The second time I bought a chimpanzee, after that I stayed sober" Arian Seid
If it's got the fileshare for an entire group of machines, I'll bet you money that it'd be infected almost immediately and anyone else that's hooked to the machine by nature.
All it takes is for the virus to inject itself in the CODE fork of one of several files to "properly" infect a machine and then start randomly infecting everything (Remember, some of the magic of MacOS comes from all files potentially having a CODE resource fork and MacOS acting on the same... Simply inserting a floppy into an unprotected machine can infect the machine in many cases...).
Once that's happened on the fileshare machine, all the other machines are only a matter of time before they're infected too.
Sadly, I DO believe him- it's entirely possible. Just not directly from off the Internet like it is with Windows machines.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
OTOH, virus writers do a great job of refuting people's claims of security, and making those refutations public... Go figure.
Now that Windows XP is here does that make Windows NT and Windows 2000 a legacy product?
Yeah, but this was probably before sales tax was introduced in the US.
Taxes grew grew by 1000-2000% during the 20th censtury. At least that won't happen this century...
One mail server - Unix scales.
One web server - Unix scales.
One print server - Unix scales.
One file server - Unix scales.
One Oracle database server - Unix scales.
One middleware hub - Unix scales.
Three DNS servers - On different networks.
And one system to manage them all.
I have no second level admins. For a similar number of users - about 800.
It's just me and "It all just works". You feel free to go on running yourself ragged with crap systems. Eventually you'll get fired or burnt out and someone who knows what they're doing will fix it.
Deleted
The windows platform is very popular. Most common desktop by far; sheer numbers makes it a target. Add in that the average user has little IT experience and (either because of design or end user maintenance... or both) that a lot of these machines will be full of holes... great target.
Lets say its not IIS that's under scrutiny but Apache. Very popular. Lots of holes. And a large percentage of the user base tends not to patch holes as they're announced. Great target.
Just because Apache tends to be ran on non-Windows hosts does not mean we can't put them togeather. sadmind did just that. It spread on Solaris systems to attack and deface IIS servers. No reason we can't launch a new Nimda-a-like that propogates amoung windows machines and attackes Apache (on whaterver OS its sitting on) hosts.
But, of course, that's not what is going on. IIS is being attacked because of the virtues of IIS, not because its usually sitting on Windows hosts.
So, I guess use of Apache must not be too widespread, eh? Now I'm not going to try to make the uneducated claim that Apache is really more secure than IIS, but for some reason there are far fewer security breaches on Apache. Maybe it's because virus writers are more supportive of Apache. Who knows? Unless something has changed in the last year, Apache still has the largest install base out there, and based on Microsoft's reasoning it should have the largest number of exploits.
I read the entire Gartner release, and I thought it was very insightful. They didn't say, "Take down your IIS servers." Instead, they carefully qualified it, suggesting that "...enterprises hit by both Code Red and Nimda immediately investigate alternatives to IIS, including moving Web applications to Web server software from other vendors, such as iPlanet and Apache." Note the key word investigate. Also note that they only suggest this for people hit by both viruses.
Microsoft's rebuttal also fails to properly address a serious issue: "cost of ownership." They make the wonderous claim about how fast they release patches to fix these security holes. What they missed entirely was the fact that a company can't be paying for the resources and downtime to apply a patch WEEKLY, not to mention the need for somebody to constantly watch for a security update so that it can be installed before somebody exploits it.
What Microsoft *should* have done (IMHO) is kept their mouths shut and swing some resources into either rewriting IIS or truly removing security holes, and then have a surprise release to counter Gartner's arguments.
GreyPoopon
--
Why is it I can write insightful comments but can't come up with a clever signature?
Here's a pdf article from The Industrial Physicist that talks not only about ion engines, but also other future engine concepts.
That's because no one really cares about the three machines that are running it.
What an obvious troll.
The Anti-Blog
As I went from desk to desk here applying patches to our various IE versions, I began to fantasize about what this job would be like if the clients had a different operating system, one which I could start a remote shell on. It would be great if I could use one of the several scripting languages I know to write a script which would run from my machine and patch all of the clients. It would be great if I could trust the patch to run from a logon script. Maybe I will learn Visual Basic some day. I still don't think that will get me there, though, because I have no idea what many of the patches I apply are actually doing. I keep seeing security advisories on Microsoft's support site that say you can: a. Change the following three registry entries or b. Apply this 3 meg patch.
HTF can those be equivalent actions? What exactly am I turning on or off with these cryptic registry keys?
But life with Microsoft is not so easy, is it? They keep sending you patches that require you to physically sit at each machine and click your way through dialog boxes, and you don't have time for that.
Where your Apache admin, who has fewer machines to patch and fewer patches to apply, can write a PERL script to do the job for him, you have to sit at each IIS box, open the control panel for each site, and click your way through the changes. Wouldn't it be great if you could SSH in and apply patches or make configuration changes from home while you watch the ball game? Of course it would.
I feel your pain, because I am dealing with it every day. The hardest decision I ever made here was to sit down with my boss, put my reputation (and job) on the line, and get permission to bring in some free technology on a trial basis. After some testing and configuration, I have replaced three NT boxes with Linux. Samba and the smb_auth libraries have made it possible to replace many NT services completely transparently. The main difference is I no longer have to come in on the weekends for "maintenance reboots" or just to make sure everything is working. My current hurdle is figuring out how to replace Exchange in a way that won't irritate my users and/or bosses. Every NT box I pull the plug on reduces my workload. What are you doing about yours?
I am not trying to be combative, but you did mention that your boss has asked you for things that used to be easy to get from his old VAX cluster. Have you explained to him the limitations imposed by the decision to move from VMS or Unix (free or otherwise) to NT? What is NT giving you guys that other systems do not? Make sure your evalutation of NT includes an accurate picture of the increased administration effort it requires.
You sound like you are pretty high in the food chain over there-- politely ask for the tools you need to make your job easier. The push for better technology has got to come from our end-- management will not do it for us. As Linux and FreeBSD gain more market share, it forces Microsoft to evolve. Believe me, they have the resources. They aren't writing cheesy hacks because they can't do any better. They are writing chessy hacks because it pays a lot more than sweating the details does. Show them you won't settle for that and we can all go back to the good old days of sysadmins who had time for the occasional game of DOOM.
MS may *say* they own 95% of the server market, but they are *lying*.
They may very well be correct. Economists define "market share" along the lines of "fraction of the total amount of money spent by consumers in return for products," excluding software available for no charge such as AOLserver and Apache HTTP Server. Microsoft's IIS is the most popular HTTP (etc.) server software that's not at least free as in beer, and it may very well have over 90 percent of that market.
Will I retire or break 10K?
The 'reply' to ESR's reply was nothing more that a warbling last-ditch attempt at saving face. Relax, get involved and see what it's really like or don't. In the meantime, making a name for yourself by nipping at the heels of those who have worked harder and longer than you is not the way to go, IMHO.
**>>BELCH
Yep. If popularity was the source of all worms, Apache would be 3 times the can-of-worms that IIS is....
The problems is pretty simple-- IIS trusts itself to police itself, and this trust is misplaced. The default installation of Apache does not do this. That being said, I have serious reservations about many other proprietary and open source web servers including Tux and Websphere for this reason.
Does IIS remind one of Sendmail, anyone?
LedgerSMB: Open source Accounting/ERP
Precisely. This "response" is Microsoft obscurantism -- it doesn't even make sense in light of IIS' rather limited popularity; it seems like a marketing play.
/Brian
I think they're worth reading for a different reason: learning, through positive and negative examples, how one can put forward a claim that the ideas in someone's essay are not well supported (either by reality or by the arguments made in that essay), without making the (necessary) references to the essay's author sufficiently colorful and witty that it becomes imperative to add an aside of the form "I don't actually think the author is an idiot, just wrong-headed" to prevent readers from drawing the wrong conclusion. (The matter of whether either side in this instance is in fact correct, I found actually to be of less interest than this intriguing, if subtle, contrast in tone.)
"The Crystal Wind is the Storm, and the Storm is Data, and the Data is Life"
I believe that the only people that you are obliged to provide the source to are those that already have a legitimate copy of the binary. What you can't do is limit their right to redistribute. This generally leads to folk distributing the source freely, but there is no such obligation.
I think we've pushed this "anyone can grow up to be president" thing too far.
The "live" checking does not autofix it, but if you right click on it, it does give suggestions that will be put in if you select it. That's what makes the F7 key so stupid. Autofix actually is a hazard if you regularly use double caps eg "JSmith said ...". Tab is bound to something that most people find absolutely irritating. I know I have to fix their docs up.
Most of my typing is done straight in markup. That is, when I type this in bold, I go {control-B}this{control-B} or {b}this{/b}. Amipro had a clever idea of putting styles onto the function keys: so if I want a header, I press F7, and if I want a body, this is F2. The table is stored in the template.
With control-c, v, and x, the easy way to remember these is that x is sissors (cut), v is glue pen tip, and c is copy. That might help.
Spell checking a document, like printing it, is a separate activity, and not something you want activated on a wrong key stroke. Going Alt-T-S, especially if you watch the menus as you do it, is not a big ask, especially if the machine does a lot of paging as it does it.
As far as your data files go, I have found a way around this is to store them in one tree, and then create an icon with the command line "explorer.exe /n,/e,/root=d:\path,folder" does wonders for file management. You can change the icon view to "List", and arange by date to get the latest to the end. Whichever way, it's better than "Large icon". Also, the back space backs up the tree. Also counter intuitive, but consistant.
OS/2 - because choice is a terrible thing to waste.
Yes, there are uses for Apache on Windows -- all I said was there wouldn't be many people doing that.
Star Office follows the Word menu, because it is intended to be bug compatable with Word. I would not be supprised if other programs do the same either. I mean, Word has a WP switch kit, and many people followed the Lotus menu system for spreadsheets. Still does not get around my earlier point that a separate task activity should be on the primary key.
The Windows and Menu key are so badly placed that they often pull focus away from the current program, yet people make out they're so wonderful.
As for file navigation. You can see even in this conversation, that different people have found different secrets for getting around the system. This is more to do with the buggy interface design, which makes this all less than obvious. With a little forethought, the Win95 interface can be made to do wonders, and be easily edited at one point only (ie you are not trashing it unintentionally).
Computer savvy people navigate in these ways because they don't know better, or it's too much trouble to set up, or for a host of reasons that all point to MS thinking everyone's a dummy who has no idea on file structure. Oh for the days of 3.1, when they did not do such stupid things.
Like, if you turn on the toolbar, you can change to higher directories in a drop and click action, or otherwise navigate with the mouse. But there's no "parent" icon in a folder. This is not obvious. You have to poke around in the properties to see this.
It can't all be blamed on the user, the interface sucks. Badly
OS/2 - because choice is a terrible thing to waste.
An alternative is to look at PDF formats. Adobe Acrobat installs itself as a print driver, and you can then lay the document out as a single PDF, with all the necessary cross platform support, especially if you stick to version 3 output.
TeX is a lot of hard work, from what I recall, but the results are spectular. It's sort of like Word => Word Perfect for DOS => TeX. [Increasing power and decreasing friendlyness].
You would be better going for LaTeX. This is a wrapper around TeX, but more intended for authors, rather than fiddly page layout.
Spell checking, editing and other luxuries are done externally. So you have to hunt around. I found that the CTAN archives are good to start at, or a 4CD-ROM TeX cd, which has all the required goodies on it at a fraction of the download costs.
Anyway, Best of Luck with your endeavours, and it has been nice talking to you. I even learnt things :)
OS/2 - because choice is a terrible thing to waste.