Slashdot Mirror
Slashback: Snapshots, Amends, Bazaarity
Microsoft is just as secure as the competition, says Microsoft. Jon_E writes: "According to this article Microsoft is responding to the Gartner Report which recommends that enterprises drop IIS by claiming unfair targeting due to their popularity."
Whether because of better-trained or more vigilant administrators, or some other factors, the Apache servers running many web sites certainly haven't seen the devastating outages in the past month (Code Red, Nimda) as certain large IIS installations have.
If animated, this might make a really good Saturday cartoon. cconnell writes "Last September, slashdot published my critique of Eric Raymond's essay The Cathedral and the Bazaar. There was a lively (and sometimes scorching) discussion that followed. Here is Eric's reply to my critique, which Slashdot readers might enjoy. And here is my reply to Eric."
This was not faked in the same studio as the "lunar landings." mrsmalkav writes "Deep Space 1 has passed by Comet Borrelly within 1400 miles and took some very pretty pictures of the comet's core, all while collecting lots of data about said comet. NASA's press release discusses some of the details and findings of the flyby.
This is actually really impressive given that there was very little hope for this mission. From the Mission Logs on DS1's site, '[T]o be honest, DS1's visit with the comet simply is unlikely to work as well as we hope. Many mission logs have described the difficulty of keeping this aged and wounded bird aloft, and the encounter with Borrelly will present Deep Space 1 with the greatest challenge yet in its historic trek through the solar system.'"
Saint Aardvark writes "Space.com has an article about the images taken by DS-1, and they're stunning." And eldurbarn points to the NASA Images of comet Borrelly online at JPL.
How to satisfy customers with license objections, Part II brtb writes: "Soon after Slashdot posted my DiscZerver-GPL writeup last week, xStore added a link in their Download section for information about the use of GPL software in their products. Below is the e-mail I received in response (address changed to protect the spamless). Congratulations to xStore for supporting Free Software and bringing the DiscZervers into compliance with the GPL.
From: "Support" [support@xstoreonline.com]
To: "brtb" [slashdot@brtb.org]
Subject: "RE: GPL SOURCE CODE"xStore is committed to complying to the full letter and spirit of the GPL. We are currently investigating the allegations of non-GPL compliance and communicating with the GNU.ORG and Free Software Foundation on this issue. We will produce a response to your request that is mutually acceptable to the copyright holders of the programs we have used that fall under the GPL and xStore itself. Due to the recent acquisition of this product, we are still in the process of preparing the required source code for distribution. xStore is commited to bring the DiscZerver product into GPL compliance, if it is indeed found to be not in compliance.
In the meantime, please provide xStore with information so that we can send you, the user of this product, the package that you are entitled to. Please provide the serial number of your DiscZerver product and the 'system page' with your response. The 'system page' is located at [http://your_Zerver_name_or_IP_address/admin-cgi/s ystem]. In addition, please send us a self addressed stamped envelope suitable for mailing a CD-ROM along with $14.95 to:
xStore, Inc.
Federal Highway Center
1200 North Federal Highway
Suite 200
Boca Raton, FL 33432After we receive your written request along with the above items, we will process it and promptly send you the disc when it becomes available.
This thanks to the mostly behind-the-scenes work of people at the FSF. Congratulations to xStore for respecting the intent of the programmers whose work they're consolidating and packaging.
Just out of curiousity...how does this engine work...what principles of physics does this satellite use and what would it's benefits be?..first time I heard of one is when I found that's what powers TIE fighters
: ) - It's true...TIE = Twin Ion Engine
----------
ah honey, we're all resplendent - Bill Mallonee
There's another article in the NYT about the encryption restrictions being brought up for debate and it includes a nice jab at the Washington Post for misquoting Zimmermann on his PGP interview. Check it out here:
D E.html
http://www.nytimes.com/2001/09/25/technology/25CO
+1 Insightful, -1 Troll. What can I say, I'm an Insightful Troll.
From the IIS article:
I couldn't agree more. Apache just can't compete with the speed of Microsoft's PR department in spinning every horrendous hole as "innovation".
That's "Mr. Soulless Automaton" to you, Bub.
I hate the .95 thing. It's everywhere you look. Oh wow that's only fourteen dollars! Oh wait...
I could almost understand it on standard retail stuff, but in this case... Does it not seem a little frivolous?
Not the best solution, but as the article says, there aren't a lot of virsuses for the mac for this reason. So one thing that can make your servers more secure is to use a more obscure OS and know it really well.
One other note: I thought a majority of web servers run a varient of linux. So because they have the market share, wouldn't hackers attack them more? I just think it's harder to attack something that is open source because so many bugs can can be found by the community and fixed by the community, while bugs for IIS can rarely be fixed by the community.
Plus a lot of people just hate microsoft in general.
F-bacher
James Tiberius Kirk: "Spock, the women on your planet are logical. No other planet in the galaxy can make that claim."
Before you flame: yes, I know that was meant as a joke, and yes, this post is more than slightly off topic (but Slashback threads often are), but this is probably going to be discussed here sooner or later anyhow so I might as well take some preventative measures.
The lunar landings were not fake. The "evidence" is poor at best, and just blatantly stupid otherwise. I won't reiterate all arguments against this silly conspiracy theorys validity, as you can read all about it, for example, here or here.
There are lots of nice conspiracy theories that really have some nice arguments that actually speak for them, but this is not one of those. This one should really die. Seriously, I'd go for Illuminati or Elvis any day of the week if this was my only alternative.
"If you think education is expensive, try ignorance" - Derek Bok
They're targeted because they're the most vulnerable target. That's all.
Unlimited growth == Cancer.
This is simple physics, boys and girls.
First things first, you need a spacecraft as light as possible. Anything not needed goes away. Basically, you're left with the instrumentation, the navigation, the cameras, solar panels, batteries, and a couple of sizeable tanks of xenon.
Yes. Xenon. The heaviest non-radioactive noble gas.
Now, xenon is normally inert like other noble gases. I mean, there are no natural compounds containing any noble gas because they have no natural need to enhance their electron shell configuration.
However, xenon is pretty large (as atoms go) and, given enough juice (courtesy our light and ability to live, the sun, hence the solar panels), you can ionize xenon. You can strip off an electron or two and it's useful (For example, the compound XeF6, xenon hexafloride. What it's good for? Dunno. Still doesn't change the fact it exists.) More importantly, it's charged and can be directed.
Then, it's a simple matter of a small aperture (which can be directed), a positively-charged grid, and the xenon leaves in the direction opposite the spacecraft goes.
Don't expect this to power any spacefighters, however. At full power, the force this produces will barely move a piece of paper in front of it. The beauty of ion engine, though, is that because in space, inertia isn't hampered except by collision or a gravity field, this little bit gets larger as time increases. It's not much force, but given time it gets zooming.
I used to be someone else. Now I'm someone better.
Real life is underrated.
Sorry, couldn't resist. But seriously:
The attempt to rank vendors according to their security success rate is a risky business. The aim of most virus writers is usually for their worm to achieve its biggest impact, and so will target platforms that are widely used. "Microsoft is targetted as it is so popular, rather than the system being the least secure," said Cluley.
You have to love how they pull the "everyone is jealous so they pick on us" stuff everytime they screw up. Suprise, shitstreak, Microsoft does not make the world's most popular Web server. That's Apache. "Hackers", as you call these jerks, do not target Microsoft because they're the most popular. They target Microsoft because Microsoft has made itself an easy target by making it really easy to hack their products. If popularity made you a target, we'd see scores of Apache worms.
How many security holes so far discovered in XP?
How many security holes so far discovered in Linux?
0 for XP.
Hundreds for Linux.
Therefore, XP is better. Currently, XP is the more secure OS ever. That record will last about a week, so get it while it's hot.
How many beneficial software projects simply wouldn't exist without this sans-management stucture?
Here are NASA engineers, squeezing every last drop of science and knowledge out of projects which had justified themselves and their cost before the end of the Cold War- the possibilities presented by a modern project would now be so exponentially greater, due to increased technology, that it's ludicrous Congress doesn't invest in such more heavily. Perhaps one could add this to the list of things /. could become a million-strong lobby for.
Acutally, it is Cluely, someone from a firm called Sophos, who claims IIS is being targetted because it is widespread. The only Microsoft quote is from some Peon saying "IIS is as secure as our competitors' products, and what differentiates Microsoft is our industry-leading response process" Now, as to the first point, as some earlier poster pointed out Apache is still a leading webserver as hasn't had nearly the compromise. Sure, crackers will go after widespread targets. But they'll also go after the easier ones. As to Microsoft being distinguished by its response process, I couldn't agree more. Few other companies respond with as much hot air (This flaw would be very technically difficult to exploit...) and as cruddy patches. Just read through SecurityFocus.
Since an Ion engine ionizes its supply of onboard gas (so it gets an electrical charge), then electrically accrelerates it out the back, that's why TIE fighters make that wooshing noise. All the gas they expel makes for enough of an atmosphere for sound to carry to the nearby cameras :)
A.
According to The Register, their reaction also includes the following:
Timeo idiotikOS et dona ferentes
subject says it all.
http://www.msnbc.com/news/206711.asp
Am I the only one that sees half of a face in the released picture of Comet Borely?
This is the biggest image of it:
http://nmp.jpl.nasa.gov/ds1/img/borrelly_1.jpg
Then I must conclude that there are twice as many worms developed for Apache, than IIS. I feel sorry for all you poor Apache users. Your worm problems haven't received nearly as much publicity and sympathy. It must be a conspiracy.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Worms dont happen to Mac web servers running WebStar.
.exe because macintoshes do not have file suffixes. The mac OS (9,x and older) uses a four byte file type designator that the user never sees and cannot be set carelessly.
EVER.
Thats why no reports of ANY exploit has ever been published regarding the secure Mac OS. !
consult bugtraq if you doubt this.
This Gartner report is a sham unless it really discusses techical issues regarding the macs securuity as a web server.
C Language alone is not the sole reason but the types of STRINGs used in ANSI C libraries certainly adds risk.
Worms dont happen to Macs because Mac programmers rarely have buffer overrun problems because mac apps typically NEVER use null terminated strings and intead use "pascal" style strings that have a bounds of 255 and a marker in the front.
Additionally mac programmers tend to know that there is no false sense of security because all code is running at supervisor level so programs, like Webstar, are careful not to do foolish things.
Mac programs and executables NEVER can run merely from a data file named with a suffix such as
A further reason macs are more secure than unix (hundreds of documented exploits) and Win NT (almost as many exploits documented over the years), is because the mac does not have a command line shell and has no path to hijack. No command line and a modern type of interprogram communication prevent the silly weaknesses in other OSs.
Yet another reason the Mac is secure is vecause a mac program (either 68k or PowerPC) needs TWO files to execute and not one file. The second file is called the resource fork and it is genreally an invisible file kept tightly associated with a file. classic internet apps do not create or allow creation of these resource forks as side effects of merely storing data files. Macs are very secure from infiltration by dynamic creation of apps by rouge products on a server
Another reason macs have NEVER been broken into running the WebStar server is because the mighty Mac OS Webstar server, (which typically costs over 400 dollars unfortunately), avoids ever executing cgi code files from directories where they ought not to be. A clever set of directory and folder control prevent the webserver from being hijacked unlike earlier versions of apache.
The US army switched to Webstar webservers on macs when MS NT webservers kept getting hacked.
There are thousands of major webstar servers out there. I think many are colocated at reprahduce.com cages.
And mac NEVER get hacked. EVER. and NEVER have, even with public challenges and reward money.
Sure, there may be some defects that might get discoverred one day, and surely any mac not runnning mac os such as ppcLinux, or MAc OS X (freeBSD derivitive) are hackable.
But face it. Macs have NEVER been hacked and that is because of modern and sound design principles.
Myself and other mac programmers I know have NEVER shipped a product containing a single null terminated C string, and do lots of paranoid error checking as well.
Unix is hackable not because of open source, not because of popularity (both of which help) but because of all the things I mentioned here.
But I agree about the other OS's sucking. parts of the older Mac OS itself is written using pascal strings, in fact the original ROMs were written using only pascal compilers and some assembly, and no C. But string overruns alone are not the ONLY reasons mac servers have never been hacked, (command line, dual fork, no extensions, etc etc).
Wake up and quite being bigoted. "Never" is a good enough abosolute ajective for most logical people to draw up reasoned conclusions from.
MS had its roots in BASIC on small hobby computers. Much of what they have done since is summed up by their home-grown product: GeeWhizz Basic.
The network that they have now is based on IBM OS/2 Lan Server, which they got in code sharing arangements with IBM. I mean, the OS/2 1.3 help file still serves me well under NT4.
Their main contribution has to lay all sorts of flash in fanciful languages, purpose designed to ensure upgrades. Excel, for example, has had three entirely different languages in five years. Most people could not be bothered to learn the new language. A lot less macro writing happens now then in the days of Lotus 123 for DOS. Mind you, it does not stop the script kiddies, who are learning the latest exploits.
Most MS products ship badly configured. Like, who would put a spell checker on a function key (F7), if spell checking is done live anyway. I mean, you either do it live because you have the juice, or you do it from the tools menu because you don't have the resources to run it all the time. Putting it on a function key is silly. Except to bring it up on sales promotions. "Yes, we have spell checker [press F7]".
So their network stuff is full of flashing chrome designed to sell the thing to executives, and the scripts that run this chrome is by this set up, already in a form ready for remote exploits. Yes, you can configure it, if you want to stuff around in the registry and hidden settings. But most people dont have the knowledge or time to do something that should be a default or available choice.
MS is a small system maker that is attempting to do big time: all they do is big time damage.
OS/2 - because choice is a terrible thing to waste.
Microsoft products are rarely considered to be secure. Outlook is a laughing stock, and IIS is a running joke in the industry I'm in (managed services). So much so that we've been wondering whether or not to charge customers who insist on using IIS an extra fee for all the time we spend monitoring and patching their boxes. History has shown that if we get a new customer who demands to use IIS, then we can be reasonably assured that we'll have multiple headaches dealing with it so we might as well charge them. We (thankfully) never even considered supporting Exchange. We're going to ban IE from all NOC machines as well. Weaning people off Outlook may be harder, though. (Mirapoints help us mitigate that threat.)
The "competition"? That would be Apache, Opera, Eudora (or Pine for some of us), qmail, etc. The "competition" is not half as secure. It is far more secure, everything else being equal (i.e., everything is installed properly, configured correctly, etc). That's my opinion, to be sure, but a colo full of servers running about everything you can think of formed it for me and I stand by it.
You are the target, and you will be breached...
That statement is specious at best. The only way to be completely secure is to have a standalone box. Which isn't an option, and therefore silly to say.
MS software will never be completely secure. Yes, things like wu-ftp and such can be insecure as well. Anything can be. But at least most free/OS packages try to be secure. MS software isn't even trying to be secure. Hell, they apparently aren't even trying to be half-assed.
When will they get that through their thick skulls???
I'm wondering when people will stop drinking the MS koolaid and realize that there are many better, cheaper, more stable and more secure options available to them.
-B
Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.
Could we, in fact, turn a Disney DVD into a terrorist tool? Has it already been done? Should we be encouraging Congress to ban the CSS encryption scheme because it could have been used in such a way? Interesting questions, no?
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I thought a majority of web servers run a varient of linux
Here's the key to it. The majority of servers run some variant of Linux. Most buffer overflow bugs require a specific offset and known layouts in memory. If you look at the specific versions out there IIS is probably the most common single version of any product out there (can you get this info from Netcraft?)
On the other hand, it could just be stupid admins - check out http://www.netcraft.com/Survey/vuln.gif. I'm sorry, but those numbers make me puke when I think any of those people seriously call themselves admins...
Fear: When you see B8 00 4C CD 21 and know what it means
Here is a sneak peek at the documentation for the new IIS rewrite. Of course there are a lot of bugs in this version of the document and it'll have to be edited quite heavily before the final release...
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
In quite a number of the responses I've seen there has been discussion about whether IIS is simply more targetted, or really insecure.
Some have discounted the more targetted point of view because Apache is reportedly far more popular. Ok, granted. But now for my sad analogy... Single family homes are far more popular in the United States than skyscrapers, but when terrorists want to make a point, what types of buildings do they attack?
People who write viruses may not be "terrorists" as they aren't trying to kill people. Sometimes they don't even have a point to make, but they most certainly want to cause financial damage, so who better to target?
Hmm... where do I remember him from?
Always nice to have a few staunch supporters ready to jump to your defense
I/O Error G-17: Aborting Installation
Umm... about 6.5 years ago many university Mac labs were completely overrun -- shut down -- because of fast spreading viruses that moved like wildfire. I remember watching a lab shut down within 15 minutes (25 machines). Cleaned by the next day and then shut down again in another 15 minutes.
The Mac is not invulnerable. Far from it. Webstar hasn't been hacked yet -- congratulations! That's good news and the developers deserve thanks.
Of course if the Mac were in any way a significant platform for web serving it might make more of an impact. Right now it isn't nor does it look like it will be in the near future. As a matter of fact it is an extremely tiny server platform.
The reasons that the Mac is a marginal platform for servers are many but center around a few significant facts. In the past they have not been built as true servers that can compete on a price/performance module -- not the cpu but the entire system. The development platforms for open source (Linux, etc.) and NT (IIS/ASP/etc.) implementations are easy, powerful and productive -- the Mac is not really superior and in some areas doesn't come close to the base functionality of either Linux or NT/2000.
Frankly the Mac is a marginal system. Always has been. May always be. To move away from marginality it needs to present a compelling technical ability (i.e.: price/performance must soundly trounce the competition), an ability to deliver solutions swiftly and/or an ability to deliver web solutions that no other platform can do.
Doesn't look good for the Mac.
Thus, using Internet-exposed IIS Web servers securely has a high cost of ownership. Enterprises using Microsoft's IIS Web server software have to update every IIS server with every Microsoft security patch that comes out ? almost weekly.
This is the biggest problem with maintaining Microsoft networks. Exploits in IIS or Windows are far too frequent, and almost all patches require reboots. You can imagine the response I get when I call management every other week and say "I need emergency downtime to patch 65 of our servers...".
Microsoft loves to talk about how their software has a lower TCO than other operating systems. Perhaps they don't count the cost of man-hours spent applying patches, or the downtime involved?
This is also true of the GPL:
At some point, of course, it was decided that distributing source in a 650MB CD-ROM image was OK under these terms (!?), but that's another argument for another day. ;)
I have been thinking about this as well as one of the places I do contract work for is getting pounded daily with Nimda and Code Red I/II attacks as well. Since the box is running Linux, the attacks don't matter but I have been wondering if there is some way that a sysadmin could take advantage of these requests to stop the attacking system.
Various people have mentioned writing a white hat virus that would shut down the attacker and all that - but in reality that just puts you in the same boat as someone attacking their system - and its therefore illegal.But if someone's computer makes an http request for a file from my server, am I responsible if what they get is not what they might expect to get?
What if I was to create a file consisting of nothing but the letter X that was, say, 1Gb in size, and leave it on my linux webserver with a name like "root.exe"? It wouldn't take all that many requests for the attacking system to run out of HD space. Granted service on my server might suck for a bit, but eventually if enough linux admins did this the target systems would simply shutdown for lack of swap space or HD space or whathaveyou.
Or perhaps I tell Apache to treat .exe files as PHP files and process them accordingly. Then I create a PHP script that sends prints nothing but Xs or random numbers in a long string back to the requesting server (with the execution time limit for PHP turned off). It would be like 5 lines of code total.
After all, its my server, so presumeably I put the file there for my own purposes, indicated in robots.txt that I dont want it indexed etc. If some other system makes a request for that file which I have in no way indicated is present on my system, isn't there fault/problem if the file is too big, or causes problems at their end?
I am sure the clever folks at /. could think of other things that could be done in this manner.
Just food for thought, and I would love to see some suggestions...
"The first time I got drunk, I got married. The second time I bought a chimpanzee, after that I stayed sober" Arian Seid
One mail server - Unix scales.
One web server - Unix scales.
One print server - Unix scales.
One file server - Unix scales.
One Oracle database server - Unix scales.
One middleware hub - Unix scales.
Three DNS servers - On different networks.
And one system to manage them all.
I have no second level admins. For a similar number of users - about 800.
It's just me and "It all just works". You feel free to go on running yourself ragged with crap systems. Eventually you'll get fired or burnt out and someone who knows what they're doing will fix it.
Deleted
The windows platform is very popular. Most common desktop by far; sheer numbers makes it a target. Add in that the average user has little IT experience and (either because of design or end user maintenance... or both) that a lot of these machines will be full of holes... great target.
Lets say its not IIS that's under scrutiny but Apache. Very popular. Lots of holes. And a large percentage of the user base tends not to patch holes as they're announced. Great target.
Just because Apache tends to be ran on non-Windows hosts does not mean we can't put them togeather. sadmind did just that. It spread on Solaris systems to attack and deface IIS servers. No reason we can't launch a new Nimda-a-like that propogates amoung windows machines and attackes Apache (on whaterver OS its sitting on) hosts.
But, of course, that's not what is going on. IIS is being attacked because of the virtues of IIS, not because its usually sitting on Windows hosts.
So, I guess use of Apache must not be too widespread, eh? Now I'm not going to try to make the uneducated claim that Apache is really more secure than IIS, but for some reason there are far fewer security breaches on Apache. Maybe it's because virus writers are more supportive of Apache. Who knows? Unless something has changed in the last year, Apache still has the largest install base out there, and based on Microsoft's reasoning it should have the largest number of exploits.
I read the entire Gartner release, and I thought it was very insightful. They didn't say, "Take down your IIS servers." Instead, they carefully qualified it, suggesting that "...enterprises hit by both Code Red and Nimda immediately investigate alternatives to IIS, including moving Web applications to Web server software from other vendors, such as iPlanet and Apache." Note the key word investigate. Also note that they only suggest this for people hit by both viruses.
Microsoft's rebuttal also fails to properly address a serious issue: "cost of ownership." They make the wonderous claim about how fast they release patches to fix these security holes. What they missed entirely was the fact that a company can't be paying for the resources and downtime to apply a patch WEEKLY, not to mention the need for somebody to constantly watch for a security update so that it can be installed before somebody exploits it.
What Microsoft *should* have done (IMHO) is kept their mouths shut and swing some resources into either rewriting IIS or truly removing security holes, and then have a surprise release to counter Gartner's arguments.
GreyPoopon
--
Why is it I can write insightful comments but can't come up with a clever signature?
Yep. If popularity was the source of all worms, Apache would be 3 times the can-of-worms that IIS is....
The problems is pretty simple-- IIS trusts itself to police itself, and this trust is misplaced. The default installation of Apache does not do this. That being said, I have serious reservations about many other proprietary and open source web servers including Tux and Websphere for this reason.
Does IIS remind one of Sendmail, anyone?
LedgerSMB: Open source Accounting/ERP
The "live" checking does not autofix it, but if you right click on it, it does give suggestions that will be put in if you select it. That's what makes the F7 key so stupid. Autofix actually is a hazard if you regularly use double caps eg "JSmith said ...". Tab is bound to something that most people find absolutely irritating. I know I have to fix their docs up.
Most of my typing is done straight in markup. That is, when I type this in bold, I go {control-B}this{control-B} or {b}this{/b}. Amipro had a clever idea of putting styles onto the function keys: so if I want a header, I press F7, and if I want a body, this is F2. The table is stored in the template.
With control-c, v, and x, the easy way to remember these is that x is sissors (cut), v is glue pen tip, and c is copy. That might help.
Spell checking a document, like printing it, is a separate activity, and not something you want activated on a wrong key stroke. Going Alt-T-S, especially if you watch the menus as you do it, is not a big ask, especially if the machine does a lot of paging as it does it.
As far as your data files go, I have found a way around this is to store them in one tree, and then create an icon with the command line "explorer.exe /n,/e,/root=d:\path,folder" does wonders for file management. You can change the icon view to "List", and arange by date to get the latest to the end. Whichever way, it's better than "Large icon". Also, the back space backs up the tree. Also counter intuitive, but consistant.
OS/2 - because choice is a terrible thing to waste.