Slashdot Mirror
Holes in PowerPoint and Excel
jeffy124 writes: "Looks like it's time for IIS and Outlook to make room on the pedestal of security holes. Just about every recent version of PowerPoint and Excel are vulnerable to being taken over to control the system remotely. The hole is a macro-related, as it's possible to bypass asking the user if they'd like a macro to run. Microsoft's advisory can be found here."
Funny. I always thought that PowerPoint was already at least as destructive as macro viruses to corporate productivity. You ever watch a suit fiddle with his presentation?
This vuln. works on Mac Office 2001 (and 98) too.
It does work.
it's in my head
I would expect nothing less from Microsoft. A secure program never gets released because you might never need to upgrade, and you won't need patches. In fact, I wonder if they maybe don't actually make sure that stuff isn't totally secure and bug free.
Customers using Microsoft® Excel or PowerPoint for Windows® or Macintosh® I guess Mac uses can stop complaining that they don't get all the features of the Windows version.
Is this really a surprise? I was under the impression, that all macro-enabled applications under windows (office suite) shared such vulnerabilities, because they most probably use the same scripting engine.
;)
One exploit serves all
-- The plural of 'anecdote' is not 'data'.
How can the free software community ask Microsoft to open up their file formats, when they don't even know them well enough themselves to properly scan for macros?
Well, I hope that with this problem more guys think about switching to KOffice or StarOffice ;)
Renegades for ever and the funk never dies...
well it looks like yet another round of updates and constant examination of network logs where i work at RIT
Now I can try to finally convince people that, although it may not be quite as userfriendly or have as good of features, star office in most cases wont compromise their systems.
Mindwarp
I've not seen a suit fiddle with a presentation. I have, however, seen five hours (yes, 5) wasted by several teachers at my school in putting together a few crappy slides for an assembly. They could have made a better job of them by hand in a tenth of the time.
But now... I could, erm, improve the content. Say, replace the word 'Ethos' with something less buzzwords, and add a few more interesting graphics...
*must*... resist... urge... to put in goatse comment...
Hasn't anyone at Microsoft noticed yet that macros and scripting are a very dangerous features? They are executable code! They should be avoided if possible. When implemented they should have restricted functionality (why the hell does a macro need to be able to delete files?!?), and they need to be scrutinized for bugs and holes more closely than almost any other piece of code.
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
At my job, the IT tech gave instructions to all users to disable macros on all incoming attachments in Excel and Word, or not to even open them at all if they're not sure.
It's not foolproof but it does make the people at my job aware of one of the many ways that viruses are spread.
I like fire ants. They are very spicy!
I wonder how many Corportate IT Dept's have deployed Microsoft products precisely BECAUSE they are so full of vulnerabilities. It offers ongoing access to CEO, CFO, and BOD computers! Hard to keep a secret about future corporate plans. In addition, its a way of doing constant ongoing survielance of employees.
Tested Versions:
Microsoft tested the following products to assess whether they are affected by these vulnerabilities. Previous versions are no longer supported, and may or may not be affected by these vulnerabilities.
Office 98 for Macintosh
Office 2001 for Macintosh
Office 2000 for Windows
Office 2002 for Windows
Do note - just because older versions aren't supported Microsoft won't check if the whole is there!
it's in my head
Is the hole exploitable in Mac OS X? Does the unix architecture and security prevent this from being a problem?
If a story about a vulnerability in Microsoft created software is considered news.:)
My other sig is extremely clever...
These things first appeared in 1996 or so. Word.Concept or what was it called. Microsoft responded by disabling the AutoLoad macro (or whatever it's called). Now somebody found a new way to make Excel/etc. execute stuff when loading a file. Big deal.
I wonder why virus writes bother at all. They can just put a button labeled "Click here" on the page, and 95% of the lusers will click it. The only defense against that is just disabling all macro support. And everybody knows that isn't going to happen.
Care to explain?
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
http://office.microsoft.com/ProductUpdates/
.EXE Patches are also available. They can be distributed to client machines using sign-on scripts and some custom coding. They're not nearly as automated as I'd like, but they're getting better.
I didn't see any proof of concept. Can anyone point me in the right direction?
" Funny. I always thought that PowerPoint was already at least as destructive as macro viruses to corporate productivity. You ever watch a suit fiddle with his presentation?"
Funny
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
This does not seem to be a problem unique to Miscrosoft Office. Wouldn't this type of security hole be possible in any office suite with scripting/macro capabilities? Do KOffice or StarOffice not support macros (I've never used them, so I don't know)?
Kudos to MSFT for making a patch immediately available, but I must say that MSFT's constantly having to play catch-up with secuirty holes does not make me real confident in .NET's data safeguard capabilities.
I was attending a presentation by some state officials last week. The presenter's Powerpoint presentation was set to autoadvance every 30 seconds or so and apparently they couldn't make it stop, so she had an assistant sit at the computer and backup the slide everytime it jumped ahead prematurely.
So who else has watched someone by victimized by powerpoint? Add your anectdote as a reply.
Outlook/IIS have many holes; it is very rare that someone has bothered to write a worm that uses them. I personally won't be holding my breath for these exploits to be used in one. You aren't a reporter or AV person are you?
That Microsoft advisory states that Macintosh versions are affected, yes. I doubt the OS matters much with viruses that rely on a macro language within an application rather than using the OS itself or its services to propagate.
Powerpoint is about the only part of Microsoft Office worth keeping around. It used to be a mac app made by a third party, and for making up posters on Windows with a shoestring budget, you can't top it.
More than Word or Excel, Powerpoint is the killer app for office. Once Linux makes up something as tidy, fast and easy to use, corporate acceptance will go through the roof, just BECAUSE suits like to spend time playing with their slides.
"Look at me, I invented the stove!" -- Ben Franklin
If you have Office 97 or 95, their should be no Powerpoint hole because powerpoint does not have macros until Office 2000 and then Office XP. Just checked the help file cuz I happen to have Office 95 (it does what I want and is not as bloated as the new stuff....it's still bloated, just not as bloated as the latest stuff....).
Gork
Gorkman
couldn't resist ;)
Others have said it in the past, and I'm starting to believe it more myself. I really think that many at large companies use default installs of Office as job security. No one can blame them entirely if there's a problem - after all, the IT guys themselves didn't write the viruses. Failing to keep up with patches released months earlier can be cause for problems, but if a virus just came out recently, or there's just no patch for it, then "It's not my fault!" is a very valid point.
The 'job security' aspect comes in because *someone* has to go around and patch every machine. *Someone* has to go round and install/test new virus software. I think it's past being 'common knowledge' that *by default* most MS products install themselves pretty insecurely. So someone has to learn about how to lock down those products - then actually do it. It's job security, choosing products which you KNOW will require you to always be updating them.
Yeah, I'm a bit overly cynical about this. I've met some people who really just think this is how computers are supposed to be - you're always playing 'catch up' to virus writers. The concept of prevention to them is installing the latest 'Norton' utility. Proactively analyzing the systems they have for potential vulnerabilities (turn off scripting on machines that don't need it, etc) just doesn't occur to them.
I'll be the first to admit that StarOffice/OpenOffice have not been up to snuff in the past, and even the current versions may not be up to snuff for everyone, but they're getting better. SO6 and the next OO may in fact be solid enough to let *many* in an organization use those as their primary or only Office applications, and let the few people that need the MS-specific features keep using MS Office. Yes, there'd be some relearning costs - figure that gets covered by the savings in upgrade licensing for those people.
creation science book
cat? less? banner?
Come on, Powerpoint is the de facto standard.. Don't expect millions of business users to jump through hoops just because 'M$ sux0rs'
Time to use the "bad news" powerpoint presentations wizard. heh :-)
powerpoint does not have macros until Office 2000 and then Office XP
I was writing powerpoint macros in Office 97 (possibly 95; not sure about that one).
Sun needs to get StarOffice 6.0 out the door NOW. Do it while Microsoft keeps getting bad press. I'm a Network Admin at a company with 200 employees and the guys before me never kept licensing info. So, I'm doing a license audit right now. We're either going to be buying a lot of Microsoft Office licenses, or looking for an alternative. I sure wouldn't mind bringing up StarOffice, if a real usable and supported version was out there.
With the recent change in MS licensing policy NOW is the time for Sun to act and get their product in the door..
I am SHOCKED! SHOCKED I tell you! Microsoft products have holes? How can this be, when Microsoft has always only hired the most intelligent programmers, and the most talented engineers!?!? Clearly someone has made a mistake somewhere here, and it is clearly not Microsoft, as they are the most innovative (ie: best) corporation to ever exist. This slashdot place should be ashamed of itself for propogating these lies and mistruths clearly funded by the likes of Sun and IBM, those terrosist corporations.
I know it's popular to bash Powerpoint, but I have to say that's one product without any acceptable replacements on the linux side. ("Impress" does not.
Now I have an excuse for my mistakes..."The baddies took over my computer and messed with the data!" I can't wait!
Denver Isuzu Suzuki
There's a fairly serious new exploit against Solaris machines. Read about it at SecurityFocus.Com (been there since Oct 4). Why do these never get reported here?
You know, I think that if the former versions aren't vulnerable, they're not gonna tell you. They just can't take the risk to have people want to revert to older versions on the basis that they "work better", not when their business relies so much on people upgrading over and over...
-- B.
This sig does in fact not have the property it claims not to have.
I know I've read it somewhere, I believe in an interview in Linux Journal from a few years back. Linus stated at the time that PowerPoint was one of the Microsoft products that he liked using.
Not that it matters to me, but go ahead and knot up your undies in angst.
I always thought that PowerPoint was already at least as destructive as macro viruses to corporate productivity. You ever watch a suit fiddle with his presentation?
How does that hurt productivity? You seem to be implying that the suit would be doing something productive if he weren't using PowerPoint.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
All of us DO know that Micro$oft's programs are full of bugs and security holes, but I don't think we should post every security hole on slashdot. Everyone know that M$ sucks, but please: don't post more stuff like this and concentrate on improving whatever is your open source operating system (Linux, FreeBSD, NetBSD, OpenBSD, etc.) because they have security holes too.
The opinions in this comment are subject to GPL, you can copy, modify and redistribute freely (as in speech).
Maybe something like recording keystrokes, but I was pretty sure there was no VBA in PowerPoint 95 and 97. The macro languages in Word and Excel were also incompatabile because of minor differences in each. At least for the 95 version. In the 95 version, there was WordBasic for Word (subset of VB) and VBA in Excel (Visual Basic for Applications...another subset of VB). In Office 2000 (it could be 97, but I thought it was 2000) everything got a compatible macro language. Thus the recent blossoming of macro virii. Personally, I have PowerPoint installed, but don't use it much. Only people I have ever seen use this are suits and sales monkey's.
Gorkman
mouses?
I could rant on and on, but I'm not going to because, in fact, there just are no words to say how braindead this is.
This sig under construction. Please check back later.
You have been looking at too much porn if you see a woman's butt in those two mice! How do you know it wasn't a man's butt?
geez!
Eduard III: "Honi soit qui mal y pense"
Have a group of people proof-read the code before compiling it.
enough said.
Then, instead of having all this text, and forcing people to pretty much choose between writing it down, or listening to you, you can just say, "This is all on the web, at this address, so you don't need to write it down." I had a couple of profs do that, and it was sooo much better than all this powerpoint nonsense.
Plus, with a browser, you can scroll back half a page, and let the slow writer in the room get that last figure, while you go on with the talk. With ppt, it's back the whole page, and wait for the one slow guy, or the hell with the slow guy and go ahead with the talk
The most amazing thing of all these virii it that they all exist only due to one (and no more than one) function in the whole VBA language:
- CopyMacro
Maybe it has another name today, but it means exactly the same, copy a macro from a document to another. THAT'S AMAZING!!! Erradicating all these dam virii is much more easy to erradicate malaria from a non-tropical country, kill all the vectors.That's wright we don't even need to kill the vector, all we need is to avoid the vectors to infect the host. This dam macro must not exist anymore!!!
Simple as that, and M$ doesn't seems to want to solve the problem.
-=-=-=-=
I know life isn't fair, but why can't it ever be un-fair in MY favor!?
what makes a macro hidden? is it a malformed tag?
"The Most Fun Possible on 4 wheels" is at SunBuggy in Las Vegas
Be forwarned, though, that even WindowsUpdate doesn't list ALL of the patches that are out.
The rackspace ad. Blatant group sex, guy inserting a dildo into a woman's mouth, nothing less.
...and students, engineers, IT management, teachers, , researchers, training staff, etc.
Just because you haven't seen people use PowerPoint doesn't mean that it doesn't get used. I can't help that your job/experiences don't include presenting/being presented information to/from others.
Good presentation software is invaluable to business and education. Just because some people waste hours with screen swipes, cheesy clip-art, and other useless crap doesn't mean that it's not useful. Once I have my content finalized, I can whip up a decent looking presentation in PowerPoint in about 1/2 hour... faster than I could ever do it by hand.
Keeping
Does OpenOffice support a scripting similar to the macros in MSOffice ? If so would it be possible to see similar issues with OpenOffice as well ?
It may not be as bad on Linux/Unix because of the user processes not getting access privilages to do anything nsty, but OpenOffice has a windows version as well.
If there is a sizable installed base of OpenOffice , then maybe you can imagine OpenOffice script worms doing annoying stuff with user files/mails.
And if your friendly Mozilla/Kmail/Evolution/PINE mail tool has the MIME type set to open with OpenOffice then it can spread the worm around.
Really I mean, Bin Laden is jealous of the U.S. because it's a successfull and powerfull country that made a few mistakes (which he keeps on talking about) yet doesn't do much to help his people. Same goes for Slashdot, they're afraid of MS because it's a successfull and powerfull company who happened to make a few mistakes (they keep on talking about them) and do very little in order to help with Linux issues. If you look closely you'll see that very few of their articles talk about Linux.
I work for a BIG company, (fortune 500) that runs MS Exchange server for mail. We recently upgraded from 95 to 2000 just a few months ago. (support for our working Win95 system having been discontinued by MS) The overhead created by all the security stuff running on the network has created lots of problems. Email is no longer 'realtimeish' meaning it may take 1/2 hour to recieve a message sent across our network. When right clicking in my browser window, it takes about 5 seconds for a menu to open (pentium III 500 128meg ram). My home pc runs Linux, and outperfoms my work computer at about half the hardware (PII 266)
IT has been trying to figure out how to fix the mail delays for a few months now with no progress, and I don't think they even care that it takes me so long to perform functions in the browser, but most of my work is done in web-based tools. MS has the world by the nuts, and they're milking us all!!! at least in my home I still have a choice.
"The Most Fun Possible on 4 wheels" is at SunBuggy in Las Vegas
Emacs does include some features that are equivalent to these sort of macros. They are disabled by default
And they used to be enabled by default - which was a big vulnerability if you used them as a mail reader or netnews reader. A simple string embedded in the letter or posting could do anything YOU could do in emacs - which means anything you could do from a shell, too.
Fortunately the first well-known public exploit was a netnews posting demoing the bug by popping up a window and telling you how to turn it off. The default was changed in the next release.
The days of the MIT AI lab were a more innocent time. To keep the students from crashing the machine they made it trivial - with a well-documented command to do it. The idea being that if there were no reputation points to be earned by "finding a way to crash the machine" but lots of negative ones to be had by annoying the other students, everybody would get bored with it quickly. Stallman continued the tradition later by having no root password on his personal machine for quite a while.
Unfortunately, about one person in a hundred (one in 50 to one in 200) is a psychopath - a person with a brain problem analogous to color blindness that amounts to "no concience". Some fraction of these don't compensate by learning that hurting others is bad for number one and becoming "good" by deliberate effort.
So when you have hundreds of millions of people on the internet, you end up with a few "black hat" hackers and a host of script kiddies. So the days of innocence (and Stallman's open root account) are long over.
Now internet-connected computers hold information of value that can be stolen and run mission-critical functions for businesses with cutthroat competitors. So a management order to install mass-market stoftware with a history of well-known major security holes has graduated from administrative cluelessness to a severe breach of fiduciary duty.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
For the moment, I'm choosing to believe this is some freaky coincidence, but here's what happened.
I shut down extraneous programs, installed the new patches and several others from office.microsoft.com. After installing the patches it tells me I need to reboot, so I click on the happy little button. In the process of rebooting stuff starts to misbehave and hang. After killing several "not responding" processes, the computer does manage to shut itself down.
When it comes back on, I find that my keyboard is dead! Not only will the computer not accept keyboard input, but it appears like it has no power at all. The little Caps Lock, Num Lock, etc indicator lights are off and won't respond. Mouse and everything else appears to work fine. So now I shut down my computer entirely, unplug and replug the keyboard, and power it all back up. This time everything works with no problems.
Little freaky I must say. Never had anything quite like this happen before.
Well geez.. these guys are there own worst enemies, with all the virii going around taking down IIS servers and people advicating to go to apache for your server. They've now hit apon the common users desktop. I wonder what the new desktop they will suggest ;). Go microsoft!
Most people aren't thought about after they're gone. "I wonder where Rob got the plutonium" is better than most get.
NASCAR forums!!
I have done infosec in both a large funding-limited US government agency, and a well-funded network-savvy corporation. I'd like to suggest different reason lax security exists: funding.
In both cases, I saw that the IT support infrastructure (sysadmins, architects, desktop support, etc) were underfunded compared to the amount of new tasks and upkeep they were presented. These folks worked tirelessly just to keep their heads above the workflow. Security often added additional effort / steps / work to their already overwhelming load.
In the Gov't environment, this meant security practices were often ignored. Security was considered an additional effort, and the IT groups were not funded for it. Furthermore, there were few security experts (again - they were not funded for and rarely sought out). Often IT workers were oblivious to security practices to begin with.
In the well-funded corporate environment, implementing security practices involves a great deal of fighting and compromise. There was a well-funded infosec group who championed good security practices. However, the actual admin groups (who were otherwise excellent admins) were rarely knowledgable (or focused) on security issues. Their focus was simply to get things working. Thus, sometimes good security practices went in to place... sometimes security practices were compromised away... sometimes security practices were completely ignored.
It might be worth making another observation. I used to believe good security practices are just a part of being a good admin. I've changed my mind. It is a sign of an exceptional admin. A good unserstanding of infosec issues requires additional training and understanding that goes beyond the usual realm of administration. Infosec is a specialized skill. As such, those with knowledgeable admins should count themselves lucky. Most organizations will need to hire (or contract) infosec specialists who's focus is on secure (and workable - that's sometimes a tough tradeoff) implementations.
Who the hells cares if there is some security flaw in powerpoint and excel? Who cares about 90% of the microsoft stories that get posted here? They aren't getting posted so that people are informed and can go patch their system, that is for sure. Near as I can tell the only reason any of this ever gets posted is so that the Linux community can point and laugh. Are we so insecure about our operating system that we have to point out every single problem with the competition. Microsoft hasn't fallen that low yet, and the sad truth is that linux has its share of flaws as well. Now before I go I am going to fill all of you in on a little secret. Microsoft has written more code then any other company on earth, its only logical that thus they would have the most bugs. Now go back and post actual news for nerds instead of every Microsoft entry on BugTraq. I am tired of this crap.
Microsoft publishes free viewers for PowerPoint and Excel files. There's no mention in the advisory of whether these are vulnerable or not. Are the viewers safe?
SO 6.0 beta is released and I am impressed. Previous Excel and Word documents that SO 5.2 could not handle are no longer a problem. Speed improvements too, since individual applications start independently. I am converting my company (70 users) over to Star Office in the very near future.
Great job, Sun.
- Students, maybe, especially if they are marketing students...
- Engineers? Maybe, the same kind of engineers that build schools out of cardboard.
- IT Management? Yes, that's IT management, i.e. suits. I doubt that the developers, system engineers, designers etc would use that piece of shite.
- Researchers? Nope, those use latex or slitex.
- Training staff? Suits too.
I can't help that your job/experiences don't include presenting/being presented information to/from others.Just because you need to do a presentation does not mean that you have to do it using crappy software.
Good presentation software is invaluable to business and education.
Yes, good presentation software is invaluable.
Ever think that this article might be useful for those readers on /. who use windows that don't have the time to sift through microsoft press releases, or other news sites. Sure, lots of MS bashing results from articles like this, but some people will actually get informed and will download the necessary patches because of it.
As for the lack of linux articles, i think i disagree.
Got Freedom?
Thinking?
Once again we have MS telling its "customers" that older versions are no longer supported. IOW, Bill says: Fuck You
They refuse to address the problems associated with older versions of PowerPoint and Excel. They are saying: "If you don't pay us money to upgrade then it's your fault if you get burned."
At some point someone should investigate whether this is a pre-meditated strategy on Bill's part. They know there are security holes - they may actually put them in there on purpose - and they refuse to fix them unless they are paid. Unacceptable.
Most researchers don't use LaTeX for presentations. I would venture to guess that most Physics and Math professors don't even use LaTeX for presentations. I've seen some LaTeX presentations and I've even made one. It is my opinion that WYSIWYG is much more important for creating slides than it is for creating a document.
Keeping
Somehow I suspect that line came from a Microsoft PR guy and not Symantec. After all, they know that any script kiddie will be able to easily exploit the hole once a single expert writes the script/program to generate or modify a XLS or PPT file that skirts the security checks. Even Microsoft should know this, but a PR guy's job is to gloss over how serious the problem really is.
My second favorite quote, immediately after it, reads:
TWO MONTHS!. I suppose Microsoft had their hands full with all these other worms/virii. Two months to respond to a major hole and write the patch is a great indication of how seriously (not!) Microsoft takes the security of their customers.
PJRC: Electronic Projects, 8051 Microcontroller Tools
From the story:
"The vulnerablity was first brought to Microsoft's notice about two months ago by Symantec."
Microsoft has known about this vulnerability and has taken two full months to warn users? Disturbing, if not surprising.
Yes it does!
Yes you can!
He-Man and the Web Masters of the Universe go to battle ObviousVore -- who will win?!?!?
Usually, a "Microsoft _______ has holes" story would have 400 to 700 comments by now.
Is it possible that the Slashdot community is actually more interested in today's attack on the Taliban/Osama bin Laden than a security vulnerability in a Microsoft application?
Do you like German cars?
I stand corrected.
Keeping
LOL! Great idea, I *hate* those stupid puppets...
- project overviews
- design reviews
- status updates
- presentation of findings to other engineers, mgmt, users
As an engineering student, I used Powerpoint for the same tasks. I would suspect that a great many engineers use presentation software like Powerpoint for the same things I do.Access is fairly braindead, Word auto-mangles my documents, and Outlook is just dreadful IMO in terms of efficient correspondence, but I'm quite productive in Powerpoint and Excel as long as I keep the paperclip at bay (this is the '97 suite -- keep 2000 far, far away except for Outlook).
You seem to have a very narrow view of the responsibilities given to an engineer, researcher, trainer, etc. In today's world, engineers (and the rest of the people you listed) are asked to 'do it all' and that includes communicate with others.
Regards,
Stephen
P.S. On-topic content: IT should turn off macro capabilities as a matter of course. The functionality should not even exist in Word/Ppt/Excel installations. It's probably necessary in Access given the limitations of BillGSQL.
OperaShow ....
I have to choose a way to make several presentations, using material that's now in TeX, HTML, jpg. Any qualified recommendation (somebody
who actually tried some of the above would be highly appreciated.
will this affect staroffice users?
my blog
Microsoft, as a software company, has been on the forefront of trying to make adaptive, intuitive software for many years. Unfortunately they have failed, miserably.
From menus where unused items 'go away', to modal paperclips that take over your screen, they really haven't come up with a good idea for UI.
Of course this just proves how tough it is to make software that is truly nice to use. While MS has its faults, it would be naive to say that they don't spend the most money and time on researching software that is easier to use.
many /. readers are in tech support, maintaining M$ machines at work. these articles are useful: they serve a practical purpose.
however, maybe a new category for tech-support issues would be good.
my old sig used to be funny, but then slashcode ate it and now it's not funny anymore
Once I have my content finalized, I can whip up a decent looking presentation in PowerPoint in about 1/2 hour... faster than I could ever do it by hand.
Once I have my content finalized, I can whip up a decent stylesheet using the CSS features of IE 6 or Mozilla and then put your slides in one HTML page with a 10 inch BR between slides and an A NAME on each slide for navigation. HTML+CSS is by nature a WYSIWYM system (wyat you say is what you mean), but tabbing from emacs/vi/notepad to mozilla and then clicking refresh gives you instant WYSIWYG feedback. No proprietary crap (w3c's proposed policy will NOT turn core elements such as html and css into RAND patented standards), no viruses, less disk footprint, network transparency (view your presentation from anywhere), and easy conversion to handouts (just change stylesheets).
Will I retire or break 10K?
That's... that's... beautiful!
Thank you.
Has it been 72 hours yet?
jgoebbels@propaganda.gov.3r
Comment removed based on user account deletion
How is it advantageous to Microsoft to get people to download free patches? Why would they willfully leave security holes in their software to force people to download free patches? They like incurring extra development expense, extra load on their servers, and paying for extra bandwidth?
Once you have your content finalized, all you can do is subtract value by imposing one linear graphical rendering over what could have been a useful document.
I can't speak for other fields but powerpoint is becoming very popular in the physics community, and I have seen some damn good presentations done on it. Most of them done by people who have forgotten more about *nix than you'll ever know.
I would love to hear about alternatives, but right now powerpoint is the best presentation software I've seen and I have a win2000 partition especially for it.
:wq
Well geez.. these guys
Well gee, these guys
or
Well, gee. These guys
there
their
virii
viruses
advicating
advocating
apache
Apache
apon
upon (but it's superfluous in that sentence)
users
user's or users'
what the new desktop they
which new desktop they
Go microsoft!
Begone, Crimo$oft!
icedcool (jchurch@linuxmail.org)
troglodyte (is not allowed to use textual media)
It hurts when I see a language abused like in the parent message, and English isn't even my native language.
Many people may have held off upgrading because Office 97 does everything they need. MS states in their bulleting that Office 97 is an unsupported product. So to get "support" for any fixes to this bug, they must buy Office XP now. (and then download the patch.)
...but you have to learn how to spell "Wessel".
Has it been 72 hours yet?
jgoebbels@propaganda.gov.3r
Microsoft design choice not to include restrictive mode execution enviroments ( also known as "sandboxing" ) simliar to Javascript or Java's applets for Microsoft's embedded scripting puts users at risk when veiwing almost any disributed Microsoft document format.
. pn s.heretic@localhost.localdomain
I posted the following in various usenet groups last year. Given the recent events it is well worth the read...
Subject: Microsoft Applications Security
Date: 2000/05/28
http://groups.google.com/groups?selm=slrn8j2cen
"This continued virus threat is not ONLY an email or Outlook problem it extends to all Microsoft Office products, Microsofts internet explorer as well as a lot of third party software for the Microsoft OS platforms."
Even with all the patches, anti-virus scanners and proxy firewall, it will not stop the average user clicking on an embedded https:// URL link in an email and downloading and opening a Microsoft format document with an embedded script containing a new "unknown" virus/malware.
Office users share documents over the net all the time, the inclusion of executable blocking, "run script" dialogs and digital script "signing" is a big improvement, but it all can be circumvented by a little social engineering.
Sun should be shipping this puppy AOL-style - Glue it in the back of every computer magazine out there. Load up the Windows version and the Linux version on the CD and pump them out into the hands of the public. For now, even the latest betas - they seem rock solid - plus, I'm sure people wouldn't mind updating in a few months, if they need.
Why exactly isn't this on the CDs of every distro, too? This should be there, as well as Mozilla.
Those two programs probably make Linux more desktop-worthy than any others, at least for people coming from a Windows environment.
If you're not really familiar with them, I wrote some pages on the subject - click my sig.
Cheers,
Jim in Tokyo
-- My Weblog.
One of the sources of insecurity is the fact that many of these programs run at the same security level. The security model in Windows NT is a pretty good one, but how useful is the system if you run as a normal user? How many of us run with Administrative priviledges on the system? How much work is it to set up a new application to work as its own user and then communicate with other applications running as services, authenticated as other users? It's not simple, because many applications seem to assume that they have the right to run as Administrator.
It's a good idea to run things as Least Priviledge, where a process only has enough rights on the system to do what it needs to, and nothing more. The downside to this is that you have to understand everything the application does. That takes a lot of time and effort, and how often in your average-sized business is there a computer geek on staff who has the time to devote to figuring out how to install the app with just enough priviledges so it will run, but not so many that it is a security risk? Seriously, how much time does something like this take?
I know it took me years of thinking about it to understand the guts of Windows 9x, and understand and appreciate how it worked so I could get it to do what I wanted it to. Not because I'm not smart enough to figure it out, but just because there was so much other stuff going on that was urgently needed that I didn't have the time to sit down and figure it out. Gradually, bit by bit, I did figure it out. Not just what the software does, but how it works, why it does what it does, what the implications are for configuring it in a certain way and then deciding how to implement it. A similar scenario was encountered with Windows NT and 2000. Just in time for the Windows XP system to come along, with a new set of rules.
There is a hideous amount of complexity involved with these operating systems, each with their own quirks and behaviors, and understanding everything well enough to be able to dig around in the guts and know what's going on and know how to lock it down is way more than one person can comfortably do if they are doing anything else on the job.
I don't believe there is any magic bullet solution to this, either. There are common practices and techniques that help with securing your network, but there is no lock-n-load solution. We have found tools that help us along the way, but they only help to implement the strategy - they are not the strategy themselves.
It's easy to blame Microsoft, because everyone is running their software. That's their own fault - they've monopolized the marketplace such that everyone uses the same platform. Consequently pretty much everyone is vulnerable to the exact same set of vulnerabilities. Any other common platform will likely have vulnerabilities that can be exploited. I'm not convinced that there isn't a code-red like vulnerability out there for Apache, but Microsoft has been targetted. (On the other hand, it's clear that there are significant problems inside IIS, and as a manager I wonder if they shouldn't dump the source code and start from scratch with better coding practices.) I can recall that Apache *did* have a number of exploits a number of years ago, but many of these have been dealt with in the intervening years.
In any case, I don't think it's either carelessness or incompetence, but marketing. Software under Windows tends to be devastatingly easy to install (compared to Linux, Unix, NetWare and other environments). Mac may be easier. But, just because the software installs easily, does not mean it installs securely. Currently, ease-of-use, ease-to-install and security are at odds with each other.
The argument has been made to get applications to install with least priviledge by default. It's a good design goal, but I wonder if application developers will ever have that as a fundamental design goal for their software. Usually it's a major accomplishment when the silly thing compiles!
I'll admit that I haven't used Windows in a while, but I can't imagine that Office 97 is really unsupported.
People put up with that crap?
OK... Here goes...
<LOUD> Listen here! Open Office is FREE. It probably does what you need. You don't need to break the law to use it at home. It does not currently have any of the virus problems that Office does. </LOUD>
Office 97 seemed like a pretty good product, once you installed it on a machine a couple generations later that a current PC at the time of release.
Personally, I'd be happy with Word 6. That was a good release, still-compatable file formats, nearly universal readability.
Open Office is a nice package that exceeds my modest needs. After having used it a bit, there is no way I'd even consider installing Office XP or whatever it is.
Sometimes, I just don't *get* people...
Cheers,
Jim in Tokyo
-- My Weblog.
I've been running as non-admin on NT/2000 for many years now. I just don't install software everyday and use SU.exe/Run As when appropriate.
Of course in this day-and-age, the real value is the user data and not the easily replacable OS configuration. That's why both Unix's and NT's security model is deficient and we need to move to a Java/NET-like capabilities system where all code is sandboxed (except when absolutely necessary for speed or whatever).
When the students want the notes for a given class, they come into the lab, find the relevant files and print them. The problem is that MS defaults to printing "Slides" and this means that it will print one PowerPoint slide per page... many of the PowerPoint files have between 30-60 slides in them. The printer gets spammed. Of course, if things were actually set up properly, there would be a limit on how many pages people could print--but there isn't. Of course, if the lusers were a little more clueful, they wouldn't send 40-60 page print jobs--but their not.
MS is really only one large part in the general web of stupidity that makes daily computing suck.
Furry cows moo and decompress.
How, where are you getting that from? Where exactly was I implying that all the professionals I named would only have one narrow task? Or do you mean my comment about bad engineers building schools out of cardboard? Hey, that comment was tongue in cheek. I was not implying that engineers only build schools... this was just an example of one kind of activity among zillions.
In today's world, engineers (and the rest of the people you listed) are asked to 'do it all' and that includes communicate with others.
Yeah. The old "Unix users don't get well along with people" canard. Hey Softie, I'll tell you something: people "communicated" with each other since humanity exists. They didn't need to wait for Uncle Bill to do so. And guess what: even today, they still don't need Uncle Bill to do so. There are zillions of ways to make presentation, including Latex, Slitex, Dia (which you mentioned yourself), Star Office, HTML, or even plain old markers on transparencies.
I suggest you take a look at Dia, Star Office, LaTex, Slitex, etc.
Oops, confused this with another reply. It was actually grammar nazi who mentioned prefering dia. Sorry.
In a past job, I was also forced to use Powerpoint, Word, Excel, etc. I guess that's why it is a past job...
It is my opinion that WYSIWYG is much more important for creating slides than it is for creating a document.
It is my opinion that actually having something to say, and expressing it clearly if much more important for creating slides than what software you use. Hey, if you need, you may even use transparency pens, I've seen some very good presentations done that way.
I don't think it was planned.   I think they rush to market on every release.   I believe it to be the company's modus operandi - get it out the door, fix the problems in a Service Pack.
Service Pack.   There's an awesome piece of marketing.   Microsoft calls 'patches' 'Service Packs' and averts contaminating the perception of The Product.   A patch is something you apply to something that's broken.   A 'Service Pack' is like getting something extra.   Genius.
It all seems so obvious.   Microsoft wanted to offer complete connectivity between products.   And they did.   And they rushed it to market without realizing how all this inter-process functionality could be exploited.   I'm sure it was the furthest thing from their minds - "Why would anyone want to use The Product to do anything bad?   We're just trying to provide solutions.  Why the hell are people using our 'Solutions' to cause problems?"
Spoing!
MjM
XKCD:Xeric Knowledge Comically Dispen
The patches total ~10mb, downloadable as 2 seperate files, one for excel and one for powerpoint. I can imagine those on 56k modems will be complaining about this.
When you're on the road a lot and your only access is 28.8k modem via a crappy phone line, you could kill those fscking morons; literally.
ich bin der musikant
mit taschenrechner in der hand
kraftwerk
I wish there were a way to contact you directly instead of making an off topic post, but your sig is pretty weak. Where are you getting that number?? Somalia was obviously a fiasco, but I've NEVER heard the claim that the US killed 7000 Somalians. See for example the Frontline website for reference. If you are going to say something so controversial, you should point to a link with some info.
You get no email for half the day sometimes because a high-up sent a base-wide email with a PowerPoint attachment that he thought everyone could need when he should have just given to the folks in his office. This makes it difficult when part of your job is to email reports to supported agencies and reimbursement vouchers to customers.
It doesn't help that when someone makes a PowerPoint project, they go all out and put lots of pictures and animations on every page.
Last time i checked, most worms were also executed manually by dimwit users...
+++ath0
switch that one occurence of the string "presentable.css" to "printable.css" in your presentation
As unapersson pointed out, you can do this automatically. However, some browsers do not support CSS2 paged media; for them, you can write a short Perl script that recognizes the special style you used for slide breaks and breaks the slides into separate HTML pages for printing. Only one person has to do this; the rest can just download the presentation tools off OSDN Freshmeat.
Will I retire or break 10K?
"Customers using affected versions of Excel and/or PowerPoint should apply the patch immediately."
"Patch availability"
"Download locations for this patch "
"Additional information about this patch"
... I'm not how your attack is relevant, or even accurate. You're claiming that they use the term "Service Pack" instead of "Patch", when it's plain as day that they use the term "Patch" all the time. The only point where they mention "Service Pack" in this advisory is: "The fix for this issue will be included in Office XP Service Pack 1."
from the website this wonderful nugget of microsloth support advising an upgrade (spend $$$) to a more secure (ha!) version:
I'm running Excel 97 and/or PowerPoint 97, does this issue affect me?
First, it's important to understand that Excel and PowerPoint 97 do not have the same macro security framework as Excel and PowerPoint 2000 and 2002. The Excel and PowerPoint 97 macro security framework lacks many key features that the 2000 and 2002 macro security framework has, including a digital signature trust model that allows trusted, signed macros to be differentiated from untrusted, unsigned macros. Under this older framework, it is difficult for a user to make an informed decision regarding the trustworthiness of macros.
In addition, as noted under "Tested Versions", Excel and PowerPoint 97 are no longer supported products.
Because of these two issues, customers who are concerned about macro security are urged to upgrade to a support version with a more robust macro security model.
Unfortunately I see many (not the majority) mathematicians, physicists, and scientists in general using PowerPoint. While this is nothing bad in itself, PowerPoint allows them to make a presentation worse than if they just used transparencies.
Without font AA on, the equations look bad in Windows.
PowerPoint lets people put text and equations on colored background so they are hard to see.
Equation fonts don't ever seem to use the correct size or weight font and are always more difficult to read than LaTeX slides.
People seem to have a difficult time going back and forth through slides.
In fact the only thing of value that I have ever seen are animations and media type things, but nothing that can't be done with HTML.
Sigh. I support over 300 systems. Most of them have Office 97, since the organization I support has not (and I have not) discerned any benefit for moving to Office 2000 to justify the horrendous expense.
If I had my way, I would move everyone to Corel/WordPerfect Office or StarOffice, but I know that I would not survive the howls of dismay if I seperated people from their beloved Excel and PowerPoint (I suspect that I could wean them off of Word - it might take time, but it could be done).
Me? I use WP. I have Office on my machine, because I have to be able to support the people who can't live without it. My attempts to plead, cajole, and bully people into other options have not worked, and, I suspect will not work. Needless to say, I also have a fair amount of my time taken up with fixing the damage caused by people opening MacroViruses, too. At least (mercifully!), we don't use IIS, Exchange, and most of us don't use Outlook (and the ones who do have been told by those who control the purse-strings that they are on their own!)!
The sad fact is the most people in environments like mine will not leave what they perceive as a comfortable place (despite their cursing everytime I have to fix the M$ problems or patch their system) until something drastic (I mean costing them serious money or losing valuable research) happens. So far, the ones that have lost their research have been deemed "unimportant" and "dumb". I can only bide my time for the "important" folk to do the same (the two most important are high on my list of virus-openers - they just haven't opened the right ones - yet)
Meanwhile, I tweak my linux boxes, so that I can show them an alternative when the ask for it...
Have you ever noticed how awkwardly some writers alter their writing to use "she" or "he/she" instead of "he", to seem cool and PC-savvy and inclusive, to the point of making their writing unreadable? Go re-read M$'s vulnerability report. The user is always referred to as "he", and the attacker is always referred to as "she". How subvertive! What are they trying to tell us?
/sbin/init is always Job 1.
Unix: Where
Unix: Where
You bring up a good point that is sorely neglected by people advocating the Unix security model. In ye olde Unix days, many people shared the same system. A major vulerability of the system was users who could touch or manipulate system resources.
As a result of this legacy, just about the only thing that can be easily and immediately destroyed by a user logged onto a Unix system is all the important data in the User's home directory. As you mention, that's precisely the ONLY important information on the system (you sysadmin types please just shut up. go change that toner cartridge up on the third floor you've been neglecting all morning, kay?). Anything else can be ghosted onto a well designed system in a matter of minutes.
Clearly a coarse grained security model that almost entirely ignores the vulnerability of the data in the user's home directory is a deficient one.
This isn't the '70's anymore, people. I like listening to my Jefferson Airplane albums, too, but I don't pretend Nine Inch Nails doesn't exist.
...or more accurately, you could say that while people's eyes are well opened to the fact that MS puts out buggy software, their eyes haven't been opened to a better alternative to what they've currently got, because there is none.
Until one of these holes actually affects their bottom line or someone puts out a product that can actually compare in terms of ease of use, they won't be losing any sleep (or money) over their latest hole.
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
These macros were written for Visual Basic for Applications (VBA), which I think was introduced in the 1997 versions of the products. If you could dig up an earlier version, they used a macro language that was almost entirely incompatible with current scripts. (I know because this caused me enormous pain in trying to make a macro package compatible with both versions - it was all but impossible).
So if you have that ancient version lying around, you may want to use it. Or use programs with Word or Excel import filters instead of the real thing.
Anyone know if StarOffice is affected? When I checked it a few years back, it looked like it had a pretty complete emulation of VBA.
D
I got off track.
What I was trying to express was that Microsoft came up with this great "spin" on regular patches, - Service Packs - but that the unending stream of emergency fixes they've been forced to provide has them reverting to using "patch" lest they lose the perceptive effect of that brilliant marketing move.
Or something to that effect...
MjM
XKCD:Xeric Knowledge Comically Dispen
I don't think he was saying that you shouldn't do presentations, just that PowerPoint is lame software.
I have never used PowerPoint, but I can certainly say it is responsible for incredible numbers of terrifyingly bad presentations, so I think there are ample good reasons behind the prejudice.
I used Macromedia Flash for my last presentation - as cross-platform as it gets, and I was amazed at how flexible it was and how (comparatively) gentle the learning curve. It's well worth checking out in my view.
D
I have used for 8 years software called Scala. http;//www.scala.com It is so far above what Powerpoint can do it is silly. the only reason that Powerpoint would be used is that it comes in the Office suite. Scala has scripting and transistions that Powerpoint doesn't even come close too. I started using it on the Amiga and then it was ported to the Windows platform. Its biggest software package IC200 runs cable networks. For really professional presentations Scala is the only choice out there.
Keeping a suit tied up tweeking his (gender intended) presentation prevents him from sticking his nose into real decisions and mucking them up.
Just for the benefit of anyone who went rushing to get the patch like I did, the patch was released in May of 2000, which means it is over a year old, and they have released SP2 since then which apparently incorporates this fix.
I sent the network admin for my company a link to the Computer World article...just got an e-mail back saying it was irrelevant...
Denver Isuzu Suzuki
What bug in PowerPoint changed the "we should stop thinking that Linux servers will sell themselves" slide to a "we should get out of the hardware business" slide in a certain somewhat recent VA Linux presentation?
AC's cheerfully ignored
It took me months to find my first crashing bug in Mozilla (and that bugfix was obsolete by the time I got the patch to the developers).
The coolest thing about having the source is that when you disagree with the developers, you can Just Hack It. This doesn't buy you much if you then rely on your hacked copy (and have to maintain your hack), but it gives a much more level playing field if you want to discuss why making such a change would be a good thing, because you can show them how your proposal would behave.
In the case of MS Office, first thing I would have done years ago if I had the source is instrument the binary just to find out who is using macros and what for. I hate being told by users that they need dangerous feature X, only to learn later that they don't know how to use it if their lives depended on it.
Bert Driehuis -- All I asked was a friggin' rotatin' chair. Throw me a bone here, people.
Of course I can. There used to be a time when a virus checker only had to care about accesses to .EXE, .COM and .DLL. If you disable the "scan all file types" feature nowadays, you're vulnerable to macro attacks, and of course to the brilliant feature that allows files with the .CMD and a slew of other extensions to have an MZ magic header and be treated as a binary.
Those are design problems, that a virus checker has no speedy workaround for. It has to treat every file as hostile.
I don't want to know how many of our virus infections have a user who "optimized" his virus checker as the root cause.
Bert Driehuis -- All I asked was a friggin' rotatin' chair. Throw me a bone here, people.
>Do note - just because older versions aren't >supported Microsoft won't check if the whole is
>there!
Isnt that the definition of "not supported" ?
Excuse me if my post is complete bollocks.
:-( but....
:-)
Not thinking straight because of a bad headcold..
Wouldn't it be great if the W3C had the ability to enforce some kind of ownership/copyright of HTTP?
Just in the way that MS can force software vendors to submit their code in order to get that 'Windows Compatible' sticker on the box, the W3C would have had the ability to audit (inc. security checks) any commerically released code using the protocol (which would include servers and browsers) before granting a license to the vendor. Any unlicensed releases by a company triggering legal action for copyright infringement....
This might have stopped vendors polluting the net with substandard releases?
It's too late now I suppose, and I almost certainly haven't thought it through, so flame away...
Who holds the copyright for HTTP anyway?
Is it Tim Berners-Lee himself, CERN, the W3C...?