Slashdot Mirror
MS Chief Security Officer to work for White House
NerveGas writes "An Interesting People message reports that Howard Schmidt, Microsoft's Chief Security Advisor, will be leaving MS to work as a security adviser for the White House. With the track record that Microsoft has in the area of computer security, this strikes me as a very bad move." CD: you'd think people would examine the job someone did at thier previous job before offering them a new one. Isn't this is like putting Capt. Hazelwood in charge of an oil tanker?
you'd think people would examine the job someone did at thier previous job before offering them a new one.
What you mean like the job GW did in Texas? This guy should fit right in.
Cat, the other, tastier white meat.
It'll b interesting to see what he does.
-- @rjamestaylor on Ello
"Howard Schmidt, Microsoft's Chief Security Advisor"
oxymoron?
we're in trouble if he's helping at the while house.
than one of the people involved in allowing the very exploits you want to exploit to exist in the first place?
;)
Boffoonery - downloadable Comedy Benefit for Bletchley Park
Was he responsible for all the holes in Microsoft code over the years? No? But you're going to hold him to that because... Or was that just another random MS flame? How do you figure you know anything about what this guy can or cannot do?
"If he thinks he can hide and run from the United States and our allies, he's sorely mistaken." Bush on bin Laden
I'm a dirty karma whore for posting it, but, here's a web interview with Harold Schmidt I recall from the Washington Post.
I'll spare you reading it for the best quote:
"Howard Schmidt: The security threat I most often see is failing to install security patches on a timely basis. Weak passwords is next inline ".
I wonder if he meant hotfixes or just Service Packs.
"Know your enemy"
"There is a terrorist behind every bush"
I think it's about time I move to Canada.
Honest George! It's ALL their fault!
I can just see it happening.
I know how we all love to flame Microsoft, but if the guy was the head of MS Security, odds are he was an executive who never wrote a line of code.
He's guaranteed not to have anything to do with holes in MS products.
A better thing to look at would be how often was Microsoft's network hacked.
No one would think a kligon would make a good ship's counseler, and I don't think that an android would make a very good captain.
--Nuintari
slashdot : where an opinion can be wrong.
Here's a guy who was working for the largest software monopoly in history and now works as security honcho for the most powerful government in history, with people like Ashcroft in it. Makes my nose bleed just thinking about it. The more I see what's happening in Micro$oft's giant sphere of influence, the more I'm glad to be a Linux user, that's for damn sure.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
That idea: To have all people with AIDS give blood to help 9/11 victims...
"Not my manner of thinking but the manner of thinking of others has been the source of my unhappiness." - M
Perhaps Schmidt sees this as an opportunity to have leadership role assigned to him, and obtain actual results.
Can you blame one person for the security holes in an entire company (well, maybe you can...)? Maybe he wasn't getting cooperation at M$, and thinks the public sector is where the real thrills are.
Then again, maybe he is an idiot.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
So it's easy to flame this guy because of working for the Evil Empire and have been related to things like Code Red and Nimda. But what is his real function going to be? Sure, the article mentions he will be on the cyber-security team for Pentagon global network security, but that is a really broad statement. Is he going to be in charge of firewalls, access lists, high-level network security checks, or making sure that each government employee's Outlook doesn't flood the Pentagon's network (sorry, had to insert a flame...)? I think it would be interesting to find what his specific function is, then allow the flames to burn.
It will be the cracker community's first real chance to affect government policy in years.
Mike Hoye
Hacked? (a little)
... some of our deeper mineshafts. The radioactivity would
Ransacked?
Attacked? (yes im sure it has)
Blown up?? No????
I've read many of hackers pages that m$.com is the Ultimate challenge. Although some sub sites have been hacked, they've never really managed to kill the front page.
Same thing goes with the campus itself. Bill Gates office was built with 6 foot concrete walls to double as a bomb shelter. It is fully equipped with enough food, water, and electricity to keep it fully self contained for 100 years.
STRANGELOVE
Mr. President, I would not rule out the chance to preserve a nucleus of human
specimens. It would be quite easy... heh heh...
(rolls forward into the light)
at the bottom of ah
never penetrate a mine some thousands of feet deep. And in a matter of
weeks, sufficient improvements in dwelling space could easily be provided.
MUFFLEY
How long would you have to stay down there?
STRANGELOVE
Well let's see now ah,
(searches within his lapel)
cobalt thorium G.
(notices circular slide rule in his gloved hand)
aa...nn... Radioactive halflife of uh,... hmm.. I would think that uh...
possibly uh... one hundred years.
On finishing his calculations, he pulls the slide rule roughly from his gloved
hand, and returns it to within his jacket.
MUFFLEY
You mean, people could actually stay down there for a hundred years?
STRANGELOVE
It would not be difficult mein Fuhrer! Nuclear reactors could, heh... I'm
sorry. Mr. President. Nuclear reactors could provide power almost
indefinitely. Greenhouses could maintain plantlife. Animals could be bred
and slaughtered. A quick survey would have to be made of all the available
mine sites in the country. But I would guess... that ah, dwelling space
for several hundred thousands of our people could easily be provided.
MUFFLEY
Well I... I would hate to have to decide.. who stays up and.. who goes down.
STRANGELOVE
Well, that would not be necessary Mr. President. It could easily be
accomplished with a computer. And a computer could be set and programmed to
accept factors from youth, health, sexual fertility, intelligence, and a cross
section of necessary skills. Of course it would be absolutely vital that our
top government and military men be included to foster and impart the required
principles of leadership and tradition.
Slams down left fist. Right arm rises in stiff Nazi salute.
STRANGELOVE
Arrrrr!
(restrains right arm with left)
Naturally, they would breed prodigiously, eh? There would bemuch time, and
little to do. But ah with the proper breeding techniques and a ratio of
say, ten females to each male, I would guess that they could then work their
way back to the present gross national product within say, twenty years.
MUFFLEY
But look here doctor, wouldn't this nucleus of survivors be so grief stricken
and anguished that they'd, well, envy the dead and not want to go on
living?
STRANGELOVE
No sir...
Um, your capitalist overlords are not interested in which product has the better security. They are interested in forming strategic partnerships with other evil organizations. Like, when the ID card implementation comes, do you really want some wacko cryptome-reading Linux hacker running the show? No, you want the Borg.
bjord.org
news from the revolution
...and one that I'll probably get bitch-slapped for making:
"It's like asking the terrorists where they want to go today."
Here is some info on Schmidt at microsoft.com. Looks like he has an admin-level job rather than a software engineering job. So I wouldn't blame him for how poorly coded Microsoft products are. He's involved with best practices on setting things up securely, not watching over programers making sure there's no buffer overruns in the code. Although administration and programming must overlap when it comes to real security there's only so much you can do if you're not deeply involved with the code.
No, Thursday's out. How about never - is never good for you?
Chris, you're a fucking idiot. Welcome to my killfile (where you'll be joining Michael, Katz and Jamie). Seriously, sir: get a motherfucking life.
I think the guy was not in charge of MS security in terms of software development, but IT infrastructure. And in that case it was a really good find. This guy managed fort Microsoft and MS knew how to keep its internal network in pretty good shape... Even with all of the gadgets and VPN's that they have.
"You can't make a race horse of a pig"
"No," said Samuel, "but you can make very fast pig"
Given how badly the government did on its last security evaluation they are hiring the company with about the worse security track record ever to help them? Isn't this like the blind leading the blind? Well I guess this gives a good indication as to what kind of "penalty" MS will get from the trial since it looks like they have managed to buy off the current administration.
;)
This just seems like one of the most phenomenolly stupid ideas the government could make with respect to computers though given the current adminstration I am sure they could figure out some way to outdo themselves. Though I really don't want to see what they do to outdo themselves.
Hmm I heard Mars is nice this time of year
Computer modeling for biotech drug manufacturing is HARD!
This is fairly reminiscient of other stupid crossover attempts by "artists" speaking outside their medium.
If the latter is the case, there is a good chance that this guy will follow the easy and obvious (to laymen) path and push Windows. After all, NT was created by someone with decades of experience and it is 'C4' certified (or whatever). It has zillions of security features, even more so than VMS, so how could it not be secure? And it is used by some of the most security conscious companies in the world. And what's good for Microsoft is good for America anyway. At least those will be the arguments that will likely be heard around the White House when issues about what software infrastructure the armed services and US government should use.
This will be followed by calls for keeping source code for criticial infrastructure under wraps, "like Microsoft is already doing", because "we don't want to give the terrorists the blueprints to our advanced technology". He'll probably preach the Microsoft mantra that open source is dangerous, unsafe, and un-American. And he'll likely conflate "security" RIAA style (fair use hijacking) with national security and point to how badly the RIAA and MPAA has been "hurt" by "security problems" resulting from "open source hackers" and how Microsoft, in contrast, keeps content "secure" and protects copyright holder's rights.
Altogether, this appointment is likely going to hurt open source efforts, as well as national information security.
Why is he leaving? Who knows what he might of wanted to be done, only to be over ruled by some higher authority or senior department.
If the security at the White House goes to hell we'd know why probably.
Matt
interestingly enough, back in the days when the DDOS attacks were taking yahoo and amazon down, MS managed to stay up. Then again there was that escapade where it was discovered their four DNS servers were on the same class C network segment. Its a big company. They undoubtedly have both people who know what they are doing and others who need a cluestick application.
No, Thursday's out. How about never - is never good for you?
"He holds a Bachelors Degree in Business Administration, (BSBA) and a Master of Arts in Organizational Management (MAOM). He also has a Technician class Ham Radio License, and a Single Engine Land pilots license." quoted from this site on Mr. Schmidt.
How exactly does someone with college education like that get to become a cyber security advisor? He was a police officer too. Maybe I'm reading to much into stereotypes but this sure dosn't sound like the kind of guy I'd want protecting me from a nerdy kid who lives in his basement with a cafinee IV making root kits.
Jartan
Notice in the 1998 interview that he denies that viruses in mail attachments are a problem.
He was a security ADVISOR...
He could have given Microsoft all the advice in the world and if they were too lazy to implement the appropriate security measures it's not his fault.
Maybe the position at the government was his oppourtunity to get to a better place that would actually listen to him.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
he can't do any worse in the area of computer security than our president and his administration are doing for national security.
xavii aka bob
Maybe now we can have an OPEN Government :)
Maybe finally he'll stop the defacing of whitehouse.com with pornographic images.
As security advisor at Microsoft, his job presumably was to define policies that keep those holes from getting into the software and/or to keep Microsoft's sites secure. Microsoft's products are full of holes and their services have suffered major security compromises, so he can't have been very effective.
Since his new role will be similar in nature, it seems reasonable to suspect that he will be equally ineffective at defining national policies to protect our national security infrastructure.
Actually, no. Captain Hazelwood was drunk at the wheel before the accident. Apparently he was a fine captain when sober. Microsoft has bad security whether or not you consider them to be drunk.
In the future, I wonder if people will need to authenticate themselves using .net when passing through custom. :-)
Serious, I do not really think Schimdt's appointment is that bad. Esp in the past, it is not at all difficult to find CEO/senior managers etc with a military background. Many of them can still do a good job without turning the companies to a barrack... For people as higher up, personal character may be more important...
Oh, and for those that claim that this guy isn't responsible for the holes in Microsoft software, and that thus this guy is actually pretty good at his job of protecting MS's network: You're half right. He DOESN'T have anything to do with the Microsoft software security holes. However, he was the one in charge of protecting Microsoft's network during the incident six months to a year ago when a hacker group hacked into Microsoft's network, completely 0wning the whole thing, and Microsoft didn't find out about it until the group had already been making regular visits to the network for three months, downloading the majority of the network (possibly the entire thing, I don't think anyone's really sure) during that time. And while some may wave that off as "one intrusion in X amount of time", remember that these guys got in and then kept making REGULAR VISITS to the Microsoft network without anyone noticing for three months. So while only one group managed to do it, it sounds like they managed to keep doing it on an almost daily basis. That makes for a pretty bad security record, and it would've been a huge fucking disaster if this had been done during the upcoming era of widespread .NET and Passport services, or only a "somewhat large fucking disaster" during the current era of consumer and business consumer information being regularly logged through XP's activation madness.
I guess this proves that from now on, the government will be too busy looking at our computers to even take a passing glance at the situation of their own.
You will soon need a Passport account to contact your senator's office. You will also need a Pentium 4 with 256MB of RAM and WinXP so that, once you do connect to your senator's office, you will be able to run Microsoft Government Simulator 2002 without locking up ;)
Just fucking great. Put all of my hatred for M$ on the ethical side away, and they definitely suck with security. You know, this is the kind of shit that makes me wanna go fuck a hentai chick.
I haven't done any digging yet, but it is my assumption that as head of security he will be in charge of physical security policy at Microsoft installations: who has access to which rooms, and at what times of day. How many cameras to put in the bathroom stalls. How many parabolic surveilance microphones to hide in the trees. How many pits full of punji stakes, vipers and bear traps to place around the Redmond campus.
In other words, Big Brother stuff. Spook stuff.
That is what a chief security officer does in the traditional corporate environment. He will have an underling (or several) who handle electronic security for him. If he knows what's good for him he'll realize that he shouldn't try and play a game he knows nothing about, and he'll let his underlings have free reign.
Not that it will do any good, of course. As long as Microsoft uses its own software, it will always be vulnerable to the same exploits with which it burdens the rest of the world.
Among other things, the EULA at passport.com/Consumer/PrivacyPolicy.asp?lc=1033.NE T says: Passport will disclose personal information if required to do so by law or in the good-faith belief that such action is necessary to... Act under exigent circumstances to protect the personal safety of users of Microsoft, the .NET Passport Web Site, or the public.
.Net servers could be sifted and profiled in many fascinating ways by the intelligence community.
How interestingly broad, given that in light of recent terrorist activities any "exigent circumstances" could be said to be met as a matter of course. And there is no doubt that all the information that's bound to be stored on
Kinda makes you wonder how it all fits together, given the walk Microsoft got on the anti-trust case.
First off, being the white house I'm sure they throughly examined everything about him.. I had a friend apply for a fairly low position with the DoD and they interviewed his friends and family as well as giving him a lie detector test.
Secondly, this is hardly compareable to the Exxon Valdez thing..
Third who are you to say he did a bad job at MS?
Other then just taking at cheap shot as MS, you have no info about his job performance or even what he specifically did while working at "The Great Evil"
Maybe its just me, or maybe theres a reason you dont see chrisd listed in the hof anywhere..
Isn't it funny that he uses "anything called" instead of "anything like" or "anything such as what echelon is supposed to do"?
Wax-Museum Fire Results In Hundreds Of New Danny DeVito Statues
Microsoft and the Administration both seem to think they're each about the best things that have ever happened to eachother, and now they may be even better friends.
MS security, of all things...
We could moderate topics. Yet another random Anti-MS flame. What does have a person in charge of internal IT infrastructure have to do with security holes in IIS and Outlook?
I wonder if the whole topic would be marked offtopic. It's too silly to qualify as Troll.
"CD: You'd think people would examine what someone did at his previous job before offering him a new one." [Corrections to grammar and spelling added.]
It's all part of the same kind of thinking. Bomb Afghanistan to save it. (I'm talking about the first bombing by the U.S. government [1983], not the second and third.)
Hire someone from a company known for its inability to make secure software, and put him in charge of what his company always did poorly.
But, of course, maybe he is not really leaving Microsoft, but just working with a government that doesn't believe in privacy to assure that Microsoft software will always be compromised by the government.
Look on the bright side. With Microsoft in the White House, no one who truly wants software security will be running Microsoft products.
--
Links to respected news sources show how U.S. government policy contributed to terrorism: What should be the Response to Violence?
Bush's education improvements were
Any Takers! (all Linux moles please apply!)
Newt-dog
My Doctor prescribed daily nasal saline irrigation, hehe
hahahahahhahahahahaha!!!
Seriously though, this is rather ominous.
Take MS's awesome track record and keep it in mind, this isn't going to be a MS flame on their fucked security though. He was an advisor, which meant people didn't necessairly listen to him.
Now, we all know that the new guy will be completely impartial? Right?
Bullshit, not only does the DOJ let MS go damn near scott free, but now the white house appoints a former employee to tell them how to work security.
Great, name him "Director of Computer Honesty" too, rename the DOJ to "The Ministry of Peace" to keep with the theme (or was it truth, it's been a while since I read the book).
You know, this might not be that bad - if sysadmins can't patch their servers because the government doesn't allow publication of exploits, it will make hackers / skript kiddies jobs easier. It will escalate to a point where there will be so much bullshit, that sysadmins will all just post their shit anyways, consequences be damned - or just host exploits in Rwanda, Iraq, or some other nation.
This is not to say that his experience will be a total fuckup - he does have a few interesting ideas, and I think that he realizes that what is under his control can never be broken into, which is nice (a realist, instead of some bitch from marketing).
His administration will be a mix of good and bad things, though his support of ammending the freedom of information act certainly makes my worried.
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
You're giving them good marks for not having their front page defaced? I'd much rather have a web page defaced than have an intruder on my network downloading my company's code.
Holy Lord, Slashdot... give the dude a break. He's the security advisor for their stuff, he doesn't write the code... and on top of it, he was in charge of security for some of the highest traffic sites ever! TOUGH!
I suppose we can hope for the best. We know this guy wasn't responsible for the code itself, but rather M$'s IT infrastructure. And Microsoft's has been pretty good at not being hacked, (or at least having their websites defaced) Although one intrusion did take place (and it was major)
Aside from that, though, what bothers me is the security ideology espoused by Microsoft (and as others mentioned, this guy), the whole 'security-through-obscurity' thing. These people seem to think that building software is like building a house, it can't really be secure, just tight enough so that you don't have to worry, but we know that isn't the case. I mean, Microsoft is a successful company, but they're security is just crap. And when they're called on it they blame others. This is not the kind of attitude that we need to manage a secure government system. I mean we can't just send the FBI in to confiscate the computers of 'suspected' hackers if they're funded by another country.
Bleh, this government sucks. 9/11 has just made them more paranoid and retarded.
autopr0n is like, down and stuff.
That's the funniest, most subversive post I've ever read. You're beautiful, man.
Well, as a classical conspiry freak, I reckon:
1. All the real influence and decisions that this guy has in the white house will not be made public, so we won't really ever know what he is doing.
2. He will still be loyal to MS, afterall, most government people don't stay in government forever. What better way to climb the MS corporate ladder than to leave, get lots of power in the government, and then go back to MS. Not to mention the great signing bonus that is actually a payoff for how much he helped get MS into lucrative government software contracts.
3. What better way to kill open source, than send in an MS general onto a government security council?
Unfortunately, we will probably all never know the real effects, due to statement one.
Real men don't need signitures!!!
What does Gore's (supposed) affinity for potted plants have to do with 9/11?
Gore had a hell of a lot more experience then Bush Jr before the election, which was the point of the above poster.
autopr0n is like, down and stuff.
/. will no longer be regarded as an major anti-MS. Now they will also call us anti-Government!
Wait a minute...
I heard he's going to be in charge of the MS Supreme Court 2002 installation. And there are also rumors of a switch to MS Advanced Senate. Unfortunately, the upgrade to MS President Express has been postponed because it kept dying.
Need Free Juniper/NetScreen Support? JuniperForum
neighborhood...err... nation state.
security positions in governments and corporations alike are always political, never involving an ounce of technical clue. he'll fit right in.
Perhaps he simply got tired dealing with windows security and sees this as a way to broaden his horizens without appearing negative about windows.
Or, being charitable, perhaps he has made a bundle, and wants to make a public contribution.
Best wishes,
Bob
Likewise, it is not a security advisor's job to fix security issues. It is his job to advise people on ways of preventing security problems. Just like a QA tester, he has no control over whether people actually heed his advice.
that we won't have to go on tours to see the whitehouse anymore?
... the backdoor's open
... it is a secure facility
... ok
tourist> yay
tourist> common guys lets go
security officer> um sir please don't tell too many people about this
tourist> er
*walks inside*
**AA: a bunch of mindless jerks who'll be the first against the wall when the revolution comes
To the best of my knowledge, NT got a C2 certification umpteen years ago. But (and I'm not making this up), It only achieved C2 when the disk drive was removed and the machine was not attached to any network
I don't think Microsoft attempted to brag about orange book certification since then.
ich bin der musikant
mit taschenrechner in der hand
kraftwerk
While this may seem a strange move, it is a case of Security Through Obscurity ;)
Any technology distinguishable from magic, is insufficiently advanced.
I think you're missing the point. Microsoft consistently releases buggy software and they publicly admit that yes, the UI experience comes before security. Sorry, but that's not for me. In addition, you've forgotten to list OpenBSD. Four years without remote hole in default install.
I wish i could fire that $2 million missile into that $10 tent you live in, and hit you in the butt.
yes, it's the typical /. behaviour when it comes comes down to jobs/functions/code/etc from/by/at microsoft.
This kind of bashing is definitely not ok. You know NOTHING about this guy, I'm sure he is VERY high qualified and he is not to blame for the philosophy of a company.
Hey chrisd, do you have any idea which education you must have to become a Chief Security Advisor at Microsoft? Do you?
Demonizing Microsoft, that is what the script kiddies, crackers, etc do. It should not be commited by a sane, open minded community.
For example I know a guy who teaches ppl how to pass the mcse certificates. I once asked him why he is doing this microsoft stuff. He told me that he no fan of Microsoft itself as a company, but it's good money, a nice job.
In his free time he is a sun/java developer and truly fan of linux.
Maybe we shouldn't categorize people because of their jobs. And believe me, Mr. Schmidt knows more OS than win98...
Saying "w1nd0wz sux0rZ, h4X0r1ng m$ r00lez" is just embarassing...
This imply's to me the White House think security is something that is corporate and so they understand it more than anyone else.
Dangerous line of thinking.
think about it, if the government gets owned and rooted on a regular basis, we wont have to worry about what the government is up to. We can just go to our favorite script kiddie/warez/black hat web site and read all those top secret CIA documents we've so dearly wanted to see. Heck in 6 months, we can just go to something like astalavista.box.sk and search for anything we want :)
Or if we're really lucky, the feds will be too busy fixing exploits in their systems to foist laws like the DMCA on us.
Lawyers, MBA's, RIAA? A jedi fears not these things!
1. unauthorized user can autheticate.
2. denial-of-service attack
3. unauthorized user can read files
4. Inject HTML tags into the generated reports.
5. gain root access.
6. denial-of-service attack
7. execute arbitrary code when accessing RPM from untrustworthy source.
8. denial-of-service attack
9. gain root access
Every one of 1 through 9 above are stories about people who made mistakes.
The security problems in Microsoft products, are, in my opinion, not mistakes. They are the result of policies: 1) Only money matters. If you can make more money by being sloppy, then do it. 2) Release software with lots of known shortcomings so that people will want to pay for upgrades later. 3) Relate to your employees by pushing them.
Items 2, 3, 4, 6, and 8, more than half of those you mentioned, do not allow destruction to the system itself. One or more Microsoft security bugs that allow destruction to the system are announced on the average of every month, if I recall correctly.
I am not anti-Microsoft. I am more pro-Microsoft than Bill Gates. Microsoft is a company that has $30,000,000,000 dollars in the bank, instead of being used to clear up the problems in their products.
Today I spent about an hour of my Sunday helping a woman in Brazil clear her computer of the Badtrans worm. Billions of dollars are being wasted by very serious Microsoft bugs. The company is not worrying enough about the quality of its products, in my opinion.
I installed a security bug fix supplied by Microsoft to Internet Explorer on someone's computer last week, and the security bug fix put all the network settings back to least security. This has been going on for years. Microsoft knows this happens. It is a result of policy, not mistake. Why they do that, I don't know. Maybe it has been dictated by the U.S. government that Microsoft will make their systems insecure.
We have a problem on Slashdot that many people who read Slashdot don't work with Microsoft products enough to know how bad things really are.
Bush's education improvements were
This is George "C Average" Bush making the decisions. Maybe now instead of a missile defense system we can have a blue screen of death system that crashes the guidence systems of incoming missles.
Henchman: "Missile fired, sir."
Evil Leader: "Good work. Keep me inform-"
H: "Wait! WTF? The missile crashed - I mean it froze up. Some sort of 'protection fault.'"
EL: "Well, reboot then!"
H: "I can't find the delete key. Damn these curvey MS keyboards!"
[missile falls harmlessly to the ground]
Howard Schmidt, GWB: "That's great - who wants ice cream?!"
hey if this guy kept all them Micorserf bees busy making service packs for other service packs for security patches for other security patches to patch the latest buggy update of the last bug, just imagine how much he can solidify the Bush-Dick-Colon trinity's hold on power. he he he ;)
One of the first and most important recommendations will be to outlar open source software, everyone in America must use Microsoft supported products for security reasons. Microsoft will impliment backdoors so every computer can be viewed easily by Askkkroft and his group. No computer can be left untouched, they need to know who you are and what you are foing every minute of the day. Open Source can be hacked to easily and users could remove back doors- this is no good, it is unpatriotic to not allow the governement to snoop around your computers at will.
>>>please remove "nospam" from email address
Will Windows Security get better or worse out of this is the question....
Now i dont really know if this person was good in his job or not, but i read some article about him from 1998 and it didnt look to good....
So probably this is a good step for Windows, which would be bad from my perspective...
Anyways i have quit using MS products anyways, so i dont really care, except for my Goverment who is using MS products i hope they switch to a secure system like OpenBSD or MS gets wise and secures its SHIT......
Quazion.
Aide: Mr Schmidt, our 30 top-secret servers have been 0wn3d by a 3 year-old russian toddler!
Howard Schmidt: Quick, upgrade them to NetBSD!
that he's not so much leaving microsoft as merely changing departments. it's all the same company isn't it?
dave
You might be interested to know that Microsoft has an active directory with over 2 million objects in it. Microsoft might have been caught off guard by the internet, but reducing their network expertise to a remark about netbios is shockingly ignorant, even for slashdot. More over the US government is probably the biggest target for those cracking into computers, Microsoft is probably number two. No one else faces problems on the scale microsoft does. IBM likes to pretend, they'll even send you a free book about "What Hackers Don't Want You To Know", and they certainly have experience, but not like microsoft. It's a matter of scale.
You think so little of Microsoft's accumen. I invite you to take a look around. Microsoft, as you rightly point out, was nearly last on the internet bandwagon, a scant decade later where are they? For better or for worse they have beat down, out competed, and embarised their competition. The free market made its decision. Obviously marketing had something to do with it, but if their products weren't at least good enough Adam Smith would be proved wrong and we'd eating Borsht.
Don't even pretend to whine about anti-competitive tactics. My tax dollars helped pay for Mosaic, Microsoft got access to the source for free.... And don't get me started on ticketmaster.
--Jimmy has fancy plans; and pants to match.
It's interesting to read the 1998 interview:
Interesting because of course, new laws make it illegal to tell anyone about the security flaws in software products.
The Government versus The Taliban.
The Government has a tendency to want to break up things they don't have a liason to/for.
When Clinton was in office, was anyone working for Microsoft offered a spot to work there? I doubt it. What did Clinton do? He whipped out his 800 pound Gorilla Janet Reno.
Now look what happens? As soon as there's a liason, everything's friendly again, and all the "Arms Trading" can commence again.
I bet all our Passport passwords are being handed over as we speak...
Thoughts?
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i
... but he was their security officer, not a product designer. What difference does it make that he worked for MS? Other than that consequentially he worked for a huge, high-profile MS shop that everyone wants to crack and not many have managed.
The job'll be easier, I'd imagine, since the White House is a smaller and less ambitious (but equally high profile) MS shop and while he now isn't down the hall from the developers (which is not all it's cracked up to be) he is down the hall from the NSA.
I mean really. If you've got to secure an important *MS* shop, who do you think would be better?
~~~~~ BigLig2? You mean there's another one of me?
First, I'd like to comment that I'm posting this using AT&T Broadband... They didn't pay me to say this, but I expected to be net-less for a week, so I'm happy.
Second, MS's infmaous security record doesn't stem from "mishaps." It stems from their insistance on a very flawed set of models. "Drivers at Ring-0" and all that. Among the more popular flaws is in their VBA/VBS integration. Bad enough that These languages have access to the whole machine indescriminantly, but docments from untrusted sources now have access to your whole machine? How many times has this happened? It's not something that requires a patch, it requires a rewrite or complete removal as a feature.
Javascripting? Why are so many MSIE flaws handled best by disabling client-side scripting? Think about it -- same problem.
How about their insistance on installing "everything, even if you don't need it?" How many "Nimda" hosts are out there on machines where the owner didn't even know IIS was there? My brother said it best when he said that it was the equivalant of shipping a loaded pistol. It's not dangerous if you know how to use it and if you knew it was loaded, but then again anyone with a finger thinks they can handle a gun... ring true enough?
It's not that the company's popularity makes a common problem seem worse, it's the company's problem of prioritizing "cool stuff" over "secure stuff."
Your president and government realise how dependent their economy is on M$ products. Of course, they can't just ask Microsoft what the terrorist-exploitable holes in the code are, because the company is big enough to hang on to their corp. secrets from even the US government.
So they employ the guy and put him in a safehouse where they can have a long chat, Dubwya gets a clearer picture of what he's up against.
"If you create user accounts, by default, they will have an account type of Administrator with no password." KB Q293834
I'd say this was closer to putting bin Laden in charge of American Home Security.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Microsoft's product line evolved from a single user application. Programmers on their product line are still in the mentality that if you're sitting at the console, their programs have sole access to the full resources of the computer. How many Windows application installs demand that you close down all other programs and reboot the system when you're done? How many of them actually need you to do that? How many times has some Windows program opened a modal dialog (Which in the historical past prevents the program from being minimized until you acknowledge the dialog) or worse, a system dialog? When was the last time you saw one on Linux? Completely different programmer mentality.
Sure Microsoft's been kludgeing user support into Windows for a while now, but they don't enforce its use. It'd take too long for them to explain to every user out there why they should have to log out and log in as the administrator in order to install that new game or those scanner drivers. Most Windows users are perpetually stuck in the running as root mode, despite years of sysadmin experience that dictates that you should never run as root. And Microsoft will never force them to create a user and use it because that would make them a little less user friendly and a little more like UNIX and that's not the direction they've taken.
BTW: Most Linux dists don't force you to create and use a user ID either, and it's a very common thing to see newbies running as root. They usually stop after the first or second time they manage to trash their entire damn filesystem. And you can never just tell them "Don't run as root -- 30 years of UNIX sysadmin experience can't be wrong!" They seem to have to learn by hard experience.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
That didn't even make sense. Do you know what DEFCON is? It doesn't even go to 10 anyway.
I didn't need that functionality anyway -- there are other ways to move files around. But what about a server that I really need? Well I don't trust bind farther than I can spit a rat but I run the damn thing. I compiled it statically and run it chrooted as a user other than root. Although a previous release of the kernel would still have allowed a compromise of my system, I'm not running that kernel and so I'm willing to trust bind nominally in that configuration. I was able to secure it although I don't trust it.
Windows evolved from a single user operating system and those roots are still very much evident in every application for it that I've ever seen. It is highly in need of clueful administrative staff in order to keep a user base secure, but the lack of a need for a really clueful administrative staff is one of the selling points of Windows -- we were supposed to be able to install NT on all our servers, 95/98 on all our desktops and fire all those high paid UNIX sysadmins, replacing them with chimpanzees. And somehow the CIO doesn't take any flak for this when the company spends a billion dollars trying to clear code red out of the network. The attitudes are more flawed than anything else and that is why I don't trust Windows.
For the record I don't trust Linux or BSD either, but I trust them a lot more. I'd be much happier if the various servers I used were coded in some language where it was harder to make such fatal mistakes, such as Java, Haskell or LISP, but I expect we'll get there eventually.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Helevius
Looks like Microsoft may have gotten more than just a break on the anti-trust suit.
Microsoft never listens to the government.
:)
So, in a brilliant move, the White House has usurped their security chief.
How is this brilliant? Won't the government be annihilated by l33+ h@x0rZ?!
No - you see, this man will be stuck in the basement near the boiler room, unable to harm anyone.
So why'd they do it?
Simple - now Microsoft needs a new head of security, and there's a good chance they'll get someone with a clue this time. If they do - look out, running Windows may no longer be equatable to pulling down your pants and bending over in a shower room in a prison.
GWB: what's this computer security stuff?
Ashcroft: that's computer survellience.
GWB: well this Texan don't know the difference so why doncha tell me.
Ashkroft: we need to spy on people to make sure they're not terrorists or having abortions or being queer.
GWB: so this guy from MS can help us with that
Ashkroft: yeah he can get MS to put whatever backdoors in so we can spy on whomever we want.
GWB: backdoors? sounds kinda queer.
Ashkroft: those nerds are all kinda queer anyway - so here's the deal. we hire this guy and then tell him what to tell Gates to do.
GWB: why should Gates do what we say - that nerds's got more money than a whorehouse with an oilwell?
Ashkroft: cause Gates has money but we wants access and prestige like everyone else
GWB: ok I'll go with it - how we commin with rounding up the ragheads
Ashkroft: fine, project TexAryan is right on target - all non Christians are being targetted as we speak.
GWB: well shit howdy, get me a drink then.
Depends on what you expect from "security," I guess.
Smart move as I see it. Both guys are very capable, so it is nice to see this office start staffing with real professionals rather than just pay lip service.
Mr. Schmidt is fairly well known in the office where I used to work, and in my professional circles. Although I have never met the guy personally, I am familiar with his reputation -- which is not one of being a very knowledgeable individual. I would hope that if his reputation (as I am aware of it) is correct, the White House would not put him in charge of anything mission critical -- especially since "mission critical" at the White House is in many cases somewhat more important than, say, whether some router is down on MSN.
You are ripping on a man for leaving Microsoft. Do you really think he was responsible for all of Microsoft's security flaws? Do you really think that one man, no matter what level he is at, is capable of turning a corporate culture around? Do you think that one man, whom isn't the CEO, is capable of changing a company's philosophy?
If you do, you've never worked for a large company.
Whether you like them or not, Microsoft has a lot of smart people working for them. Grow up everybody...I'm sure he is very qualified.
It won't be long before they enable scripting in every existing government service. It would be pretty cool to use the scripting "features" to order a drivers license with Micky Mouse's picture! :)
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
I work as a security manager, and am a part time linux geek. I think what is being overlooked here is that this guy appeard to be incharge of all MS security, computers being a small part of it. And if he was running MS's security operation he is a guy worth haveing in the white house. His information may not be the best on computer security because he knows what he is told by MS's security goonz. Now i dislike MS as much as any penguin loveing american but if your the head of security for a company the size of MS you know your stuff. In the security world computer threats are a concern but very small when compared to all other possable threats.
Does this mean that they'll start dropping packages of Windows XP in Afganistan now? ;)
That will be a bad idea because if you drop the OS, you should drop the security patches too.
And I don't think you can drop stuff for another 5 years...
42 + 1 = 42
The issue being examined here shouldn't be what bugs Microsoft has. All large software projects have bugs. Windows has bugs, Linux has bugs, games have bugs, I'm willing to bet the backend code /. runs on has bugs.
What we should look at instead is how MS deals with the security bugs and what their consultants do to help clients avoid security holes. In that regard, MS has a pretty good track record fixing most security holes within a week of confirmation.
Isn't this is like putting Capt. Hazelwood in charge of an oil tanker?
Similarly, putting the Gov. of New Jersey in charge of the Environmental Protection Agency was like putting some Amish guy in charge of the Dept. of Transportation.
I think we're missing the point here. It's not that the White House is hiring someone from inside a company that has a track record of releasing buggy software, it's that one of the most powerful and malicious companies in the world now has a tangible foothold inside the White House. Remember how Juliani came on stage and thanked Bill Gates for his wonderful contributions to society during the XP launch, how the world was in his debt? Personally I don't doubt that Microsoft's influence is strong enough that Bush might decide to run in 2004 with Bill Gates as his Vice President. It seems far fetched, I know, but then again so did the idea that Microsoft could control the outcome of the court decision against itself through sheer politics.
Plutocracy, here we come!
Remember "Bring 'em on"? *sigh
SuSE has a (german) press release here.
ALeX
Who would know all the potential MS backdoors better?
The more I learn of the policies of this executive administration regarding its lack of concern for personal freedoms, the more concerned I become.
Remember that all of Enron's execs are friends and associates of GW. I hear that company liked to innovate too.
Let's get drunk and delete production data!
The truth is that I have met Howard Schmidt, and before he worked for Microsoft, we worked for several gov't agencies and is a wel respected member of the Information Systems Security Assosciation (President In fact). Howard is a very good security admin, and really does know what he is talking about. He would be the first to tell you that he is not the biggest fan of Windows security.
Wherever you go, there I am...
You forgot to mention that, under the right conditions, Windows 98 and ME should get C2 certification, also: When there is no power to the computer.
More like:
"Howard Schmidt, Microsoft's Chief Security Advisor"
Sure, he gives advise. But nowhere did it say that they actually listen.
You can accomplish anything you set your mind to. The impossible just takes a little longer.
That's write, we've taken what matters into our owned hands. You can go ahead & copy all the media on the www, but in order to paste IT anywhere, you'll need to make arrangements with us. Talk about solving the ip problem? We've decided not to enforce our writes on household glue yet, but if you feel uncomfortable using our word (paste), you could just use the g word instead.
Last few days to stake your claim to this descriptive web address. Includes a year's free hosting, in case you need somewhere to hang your hack, whilst the GNU millennium kicks .asp.
If they'd put him in charge of the IRS network security, maybe we could avoid paying any more taxes
It's not really like letting Hazelwood drive an oil tanker, itt's more like letting him fly Air Force One, while there's an open bar and it's bikini day for the stewardesses.
"So on one hand, honey is an amazingly sophisticated and efficient food source. On the other hand it's bee backwash."
Clearly a move to put in place someone who can make our networks safe for all operating systems - W2K and XP, all over the world, from California to New York.
Guess that little thing with the DoJ about monopolistic business practices is all water under the bridge now.
The point of hiring him away from Microsoft was to make the nation's computers more secure as a whole. He'll sit in a small office somewhere and harass interns while Microsoft goes to the junior colleges to find a more capable replacement.
The day is coming soon that it will be a federal felony to run, write or possess any software, firmware or hardware that is not government certified. Linux will be the first to be outlawed.
In my post above, I was making the point that Microsoft is much worse than people realize. Here is a link to a Microsoft Knowledgebase article that eloquently makes that point: User Accounts That You Create During Setup Are Administrator Account Types (Q293834)
This is not Windows 95 the article is discussing. It is Windows XP. Here is a cut-and-paste quote from that article:
"After you install Windows XP, you have the option to create user accounts. If you create user accounts, by default, they will have an account type of Administrator with no password."
Even someone who knows how bad Microsoft can be would likely not guess that Windows XP would be designed to be completely and utterly not secure by default. So, we will see a lot of stories about compromised Windows XP systems like this: Some poor guy was testing XP and set up an account to begin using it, and was rooted while he was still looking around.
--
Links to respected news sources show how U.S. government policy contributed to terrorism: What should be the Response to Violence?
Bush's education improvements were
C4 is an explosive and windows blows up all the time, so I think he's right. "C4" is the more appropriate term.
...did you fix the cable, or what?
Typical of Slashdot to make such witty comments involving Microsoft. You lose, Slashdot.
So far the U.S. Government isn't doing so good with Linux and Apache. Here's an article about some recent hacks on US Gov sites using this software. hack
If you look at the posts here you will see alot critisizm and jokes but no real ideas, solutions, or answers. It's easy to sit in the backseat and knock everyone and everything but if anyone here thinks they can do a better job then why don't you all send in your resumes or volunteer time.
the old "build a better mou$etrap" phlame. fauxking shills.
There's a fair amount of stuff by him on the web, mostly the usual Microsoft line of "it's all your fault, not ours".
He's spot-on correct here. If you're such a dumbass to be using Microsoft stuff in the first place, then you get what you deserve. The security problem *is* your fault for making such a negligent decision for what software to run.
Yeah - and who do you blame for all the security issues in unix, linux, etc, over the years? With linux, being open, and with so much, by so many people, you can't even point a single finger...so, in a way, I guess distributed development = distributed blame for all security buges found in linux, eh? Sheesh. Shit happens people, it always has, it always will, and everyone piece of software will always have some way of breaking it.
It is interesting what you said.
The presumption has been, however, that Unix/Linux would be used by very knowledgeable people. The presumption of Windows is that people with no experience with it will be using it.
Even if Microsoft doesn't change the way Windows XP operates, it would be sensible to explain the issues carefully on-screen. Recent versions of Mandrake and RedHat do this during install, if I recall correctly.
Bush's education improvements were
We have a problem on Slashdot that many people who read Slashdot don't work with Microsoft products enough to know how bad things really are.
Hopefully, most of us have a small thing called a job, usually at a corporation running on a Microsoft-based foundation. I think we do know, and that's why we use something else at home (except for those of us who still need to keep a windows box around for games..).
Stop the BS. MS is infiltrating into our government. That's it, the world is completely f... Bad enough as it is, with all the crap that already goes on. Now completely obvious crap is allowed, and no one is doing anything about it.
Question everything.
I hope he gives better advice to the white house, ...
looking at the bugs with multiplication factor 4 in Microsoft products
--- I am known for the ones who want to find me on the net. Is that a privacy risk or a privilege? One might wonder..
From one poster:Notice in the 1998 interview that he denies that viruses in mail attachments are a problem.
And from another:He was a security ADVISOR...
He could have given Microsoft all the advice in the world and if they were too lazy to implement the appropriate security measures it's not his fault.
To me this begs the question:
"When he emailed his resume, I assume it was a Wurd Document with the subject 'I send you this file in order to have your advice' "
Have you read the moderator guidelines? Well, have you, PUNK? (and I want a Karma: Gnarly option)
Here's a starting point for you to consider: "The Orange Book C2 specification is for standalone, nondistributed computing environments and non-networked devices."
There's no security without physical security and a floppy/CD attached to a computer giving you a workaround from the single pathflow of username/password login to an ACL-controlled environment fails the C2 spec by default. No one brags about Orange Book certifications because no one enforces it because it's freaking useless in every conceivable work environment. No network + no disk drives == no sneakernet == why bother?
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
"I bet the guy will be working actively on methods to snoop on Windows "
Did you forget to wear your aluminum foil beanie today?
:begin conspiracy theory
.NET). This protocol will be part of its .NET secure architecture, which means no unsupported media types allowed (bye bye Quicktime and Real. Also, bye bye MP3 as Windows Media Player doesn't support that).
1 6. html
.NET, which needs Microsoft transport protocols of course (more secure).
A report on Cringely claims that the use of raw sockets in XP is just to make network security so bad that Microsoft needs to replace TCP/IP with its own, more secure protocol (part of
http://www.pbs.org/cringely/pulpit/pulpit200108
Having a security guy in the White House means that the government will hear exactly why the problem is with TCP/IP and the only way to improve on the virus problem is to switch to the secure environment of
:end conspiracy theory
In all the years Microsoft has been around, and given the size of the company... We're only aware of one break-in to their corporate network.
Yet even with that one break-in, no secrets were stolen, no source code, no pre-announcements of products, etc. At least not that we've been told, but then you'd think if thise l33t hacker got this stuff it'd have been released, right?
That's what a Security Officer is there to protect. The security and privacy of the internal infrastructure.
On the other hand we have a bunch of kiddies whining about how Microsoft doesn't understand security. Some of these kiddies work for a company(VA Linux) who last year was hacked. Not by sneaking in, but because some moron used the root password in clear text in a telnet account. This resulting in a l33t hacker not just sniffing around but actually 0wning you. Modifying the websites at sourceforge, etc. to show this fact.
Even then, they had no idea what damage had been done.
"The company is not worrying enough about the quality of its products, in my opinion. "
Did this woman have the latest version of Outlook installed?
If not, then what the fuck are you talking about?
Microsoft *DOES* worry about the quality of its products, and it has *FIXED* many of those products. But we have whiners like you in the world who can't be bothered to take the time to learn about this, to install new versions, etc.
What is it that you want?
Do you want Microsoft to fix their products? They have.
What else do you want? Maybe a new crack pipe for whatever it is you've been smoking?
MS tools may not be the best, but once that's what the White House has got, then choosing this guy to advise on security seems to me to be a sound decision, no question about that. But I don't think this move has much to do with White House security at all.
Now, call me paranoid if you wish, but when I read this piece of news I can't help but ask myself what is this individual really up to within the government structure. He's supposed to know MS security like very few people in the world. Wouldn't he be of great help for the Bureau in their desire to do funny stuff with everyone's machine? Or something along those lines? Reading the article we see that he's not going to do things like helping beef up thw WH website security, he will be working with a taskforce that has many ramifications, chaired by Richard Clarke.
From the article:
Clarke was named last month to head a new White House Office of Cyberspace Security that is to focus on developing a plan for protecting the nation's critical infrastructure.
That could mean a lot of things.
You have to suck. And suck big time. For example:
Fredrico Pena, former [Mayor, Governer?] of Colorado became Transportation Secretary of the US. How? Two bullets for his res:
Once ran out of money to plow the roads, so he broke out pavement rollers... to "pack it down". Denver shut down for a couple of days while they tried to break up the 3 ft thick ice sheets.
Second bullet: Stapleton International Airport. Need I say more?
Ctimes2
My cube. My friend. My solace. My prison.
Just wondering. Anyway, I bet he'll go back to work for Microsoft after the exploit.
I actually shrieked out loud in terror when I read this headline. Good lord, I feel like I'm trapped in a bad Dilbert cartoon.
A job? Isn't that a place where you are expected to work? Ugh. I hate work.
Her only fault was not to install one of the many security updates. I've told her to be more careful next time.
You seem to be confusing the two of us. She is an acquaintance who does not understand computers.
If Microsoft cared sufficiently, this would not be a tough problem to solve. Just don't give Outlook Express so much power in the default install.
Bush's education improvements were
>> Hire someone from a company known for its inability to make secure software, and put him in charge of what his company
>> always did poorly.
>
> Or, even better, people could check what in the hell they are talking about! But then again, this is Slashdot, no fact checking
> [go2vanguard.com] required:
[posts resume]
Yet for many seasoned sysadmins concerned for security, having Microsoft on your resume is what a character in ``Dilbert" once called an indelible stain on your resume: it is going to work against you, rather than for you. And you better be able to do some persuasive talking to explain why under your tenure MS failed implement its own software in a secure manner.
Geoff
I think I see a trend here. Maybe for them it really would be easier to muzzle the entire internet than to produce p
Everybody's been hacking... hacking USA!
No, seriously, I just come here for the articles.
Uhm...free software has as many security problems as Windows. The difference is that Windows has 95% of the users, and so is a much bigger target.
No, it would be like making Capt. Hazelwood the Secretary of Transportation.
(Uh, he was in charge of an oil tanker.)
I can explanate how to administrate your network. You must configurate and segmentate it, so it can computate.
And MS campus security is half-way decent. Cameras everywhere, little radio-card-readers for everybody and it's all hooked up in one hardened, redundant (and isolated) network. They can pretty much catch anybody slipping in unauthorized and zero in on any MS employee.
Thank goodness I don't work there any more, [shudder]. Though it was the management rather than the work environment that bothered me.
Well, if you look at the security problems - most :)
of them are from Microsoft so actually he may be usefull. It is like hiring one of Taliban leaders to
have better contact with Taliban.
WOW!
This says it all, doesn't it?
Here we have Microsoft being treated with kid gloves after a successful DOJ prosecution and now Howard Schmidt, Microsoft's Chief Security Advisor, is leaving MS to work as a security adviser for the White House.
Microsoft has cut a deal with the Feds in exchange for backdoor access to domestic and foreign networks running the Microsoft Windows operating system.
Imagine, every file and graphic being scrutinized by CIA analysts on nearly every desktop connected to the Internet. Even machines that only connect via conventional telephone lines could easily send text data without causing too much additional traffic.
And if the system is cracked, all Microsoft has to do is wrap themselves in the flag and point to September 11!
What an intellegence coup for law enforcement and US espionage agencies.
You have to hand it to Chairman Bill and the Beast of Redmond, crime does pay!
Just one guy's opinion.
CD
..reset the admin password. Now you know how stupid script kiddies get hundreds of thousands of CC#s.
The Christian religion has been and still is the principal enemy of moral progress in the world. -- Bertrand Russell
I think there is a world market for maybe five personal web logs.
Nevertheless: My interpretation of the assessment was: As long as you don't touch it, it's C2.
I didn't intend to spread fud, it was an honest (possibly Freudian ?) error.
ich bin der musikant
mit taschenrechner in der hand
kraftwerk
I think the NT kernel was designed by very competent people (Dave Cutler et al). It probably was a good OS until M$ marketing laid their clutches upon it.
ich bin der musikant
mit taschenrechner in der hand
kraftwerk
~REZ~ #43301. Who'd fake being me anyway?
At first, I thought, "eh". But then I remembered this post.
-Puk
Stop flaming Howard Schmidt, Microsoft's Chief Security Advisor. I think Microsoft and not Mr. Schmidt is the cause of security problems with Microsoft's software. And at least now he has lots of experience for his new job.
;-)
As for Capt Hazelwood? Look to big oil companies in their wishes to save money. We still send oil-filled ships out into one the world's most rough and storm-ridden seas of the world. We build single hull supertankers only to save money, these days many tankers are being built double-hulled for added safety. The oil companies have authority over the Anchorage Port Authority to send oil tankers out into storms. The Exxon Valdex left the port despite objections from the port authority. The oil companies have permission to employ 2nd, no 3rd, no less than 3rd mates to captain a supertanker. Steering a large vessel is difficult, it may take miles to slow down, look at the case of the ship that crashed into the dockside mall in New Orleans. The less experienced person who was steering, not Capt Hazelwood, steered the Exxon Valdez sideways to avoid the reef which was the worse thing to do. It was too late to do this manouver and the tanker hit the reef on it's side, doing the most damage. A more experienced captain might have kept her on course and possibly avoided the reef all together. And what was this oil tanker doing amongst reefs? Apparently, it was advised by the Coast Guard, due to the intense weather conditions, to move to the oncoming shipping lane. By means of navigation possible at the time the tanker was thought to be in the oncoming shipping lane. It was not actually in the shipping lane, it was in an area of reefs in between. Things do improve, today GPS works very well and ships carry more sophisticated onboard navigation equipment with redundancy and at an expense to the shipping company to acquire, maintain and properly use this equipment -- I hope they're not running Windows!
As for Capt Hazelwood, he was down below at the time before the visible sighting of the reef and wasn't called upon until it was too late. Later, the press reached him in an Anchorage bar, he was off duty and drinking which might account for the stories of his drunkeness. This, however, would well suit the PR for a certain oil company.
And yes, I am an anonymous coward. I learn a lot from making mistakes. We are safe. We are not invulnerable.
I know for a fact that the United States CIA, NSA, (most)DOD and SSA all use Lotus Notes and I believe that the White House does as well. This is why they weren't hit by LoveBug or several other bad little email virus events when the rest of the online world (eg: Britain's Parliament) was.
It would be interesting to see if they move from the security of Notes to something like Outlook now that a minion of the evil empire is in there.
"Whoever would overthrow the liberty of a nation must begin by subduing the freeness of speech."--Benjamin Franklin
In my opinion, you are missing the point. They could meet their own needs and the needs of the world at large at the same time, but seem unable to do so.
Bush's education improvements were
this is nothing more or less than politics.
congratulations guys, thanks to the DOJ's retarted anti-trust case against microsuck, the company now has lobbying offices in Washington. Whereas before, they didn't.
Let me repeat this just in case no one got it the first time:
THEY DID NOT HAVE ANY LOBBYING OFFICES IN WASHINGTON UNTIL THE DOJ ANTI-TRUST CRAP.
get it? Now thanks to our idiocy, they will be paying off anyone with a hand out to help them push their crap on us. And to make it harder to promote linux ( like that security update thing I've been hearing about ), and they'll be working hand in hand with our new friends in office (both dems and repubs - Fritz Hollings was one of the bastards sponsering the fascist new laws against free speach).
Lest you folk regard this as paranoia, let me point out that after several major commision - based software companies donated money to the Honorable Sen. Patrick Moynahan, it became practically illegal to work as a freelance programmer. The rational being that freelance programmers will write off personal expenses as business expenses. And yes, a bunch of guys have in fact gotten reamed in some IRS witchhunts.
A lot of us warned everyone else about this - don't get the @#$#@ing government involved. But no, we had to be stupid, and now we will forever pay the price. Here's a tip - once the politicians get their grubby little hands into something, they NEVER let go. Expect to see a lot more government "help" and "regulations" designed to save us all from ourselves.
What did you people think? Did you really believe that turning micro$oft into baby bells would make even the slightest bit of difference? Did it not occur to anyone that once congress has a precedent for screwing around with the biggest fish, that they'll then decide that the little fish (every other company in existence) is fair game?
And please don't kid yourselves that this is about an evil republican administration. Every administration, especially the party-that-loves-to-regulate, will be holding out there hands, or pushing us down.
Great going guys.
The White House NEEDS a Micro$oft security expert in order to accomplish one specific goal:
Absolve corporate responsibility for the failures of network security and instead install Government Thugs to enforce network security. The idea here is NOT to develop technology that thwarts miscreants, but instead rely on Society's Thugs to enforce fair play! Hey, the Government always NEEDS new growth and what could be better than to accomplish this by following Micro$oft's lead on security issues and rely on the CyberCops to clean up the mess.
oh....my!
drops a nuclear bomb on the US. Will the government pretend it didn't happen or accuse everybody who knew about it beforehand of trying to destabilize the country?
Maybe he figured out that he would never work in the security industry again if he didn't get out of there quick.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
Sometimes I love off-topic posts.
Bush's education improvements were
Some pieces of software have more ways of being broken than others.
Ahmen
Serves him right for using telnet. Now bugger off and go back to playing with yourself.
Twit
whoops... messy...
Yeah, everyone has their flaws. I agree.
But Outlook still sucks, they should still be sued for not making people aware of it's vulnerabilities.
But you're still right.
lf.o
Not knowing much about his role at microsoft, or USAF, but he is the current president of the Information Systems Security Association (www.issa.org).
The ISSA seems to be an interesting and informative organisation. Their monthly magazine has some good articles, but the advertising seems to be mainly interested in selling you products to secure your phone lines and phone systems, than your network, border routers, etc...
Their meetings and presentations are definately worth the yearly charge.
Although I must say that his editorial is mostly waffle than real content.
$0.02
I think /.'s criticism misses the point of what a corporate security officer does. This guy's job had nothing to do with bugs in Windows. Security officiers are generally not programmers or techies. They don't know anything about elliptic curve encryption or SYN cookies.
.exe email attachments, and that everyone's PC runs a daily virus scan.
Most large companies have security officers. They usually come from a law enforcement or military background. When you see the title "security officer", think Lieutenant Worf, not Wesley Crusher. The security officer is usually in charge of physical plant security, of running background checks on incoming employees, making sure the guards at the parking lot entrance check the right ID's, etc. Their involvement with computers may reach as far as directing that the company firewall filter out incoming
As far as I know, Microsoft didn't have serious problems of that nature, and that guy did perfectly well at his job. The pinhead marketroids who put all the vulnerabilities into Outlook were in a completely different jurisdiction, so to speak. So I don't have a problem with his going to work for the white house.
Here are his Job Qualifications:2 297,140000-140700,00.html
i on al/schmidt080598.htm
a ck ers/interviews/schmidt
"It's the kind of high-level role Mr Schmidt knows well. Prior to joining Microsoft four years ago, he was director of the US Air Force office investigating computer crime and information warfare, and set up the government's first dedicated computer forensic lab. Before that he was with the FBI's National Drug Intelligence Center, heading its computer forensic team. In his younger days he even served in the elite SWAT team. Currently, he is the international president of the Information Systems Security Association, which has 54 chapters around the world, and sits on several security-related national and international committees."
Source: http://business-times.asia1.com.sg/subcategory/0,
Other related links:
http://dev.issa.org/howardschmidt.htm
http://www.washingtonpost.com/wp-srv/zforum/nat
http://www.pbs.org/wgbh/pages/frontline/shows/h
"Windows XP will not authenticate network access attempts by accounts with blank passwords."
The issue is whether an attacker from outside, who gains access to a computer because of some security hole, would have control over that computer. My understanding is that an attacker would have complete control if there were no password.
Bush's education improvements were